Anomaly detection method, apparatus, device, storage medium, and program product

Abstract

The application relates to an abnormality detection method and device, equipment, a storage medium and a program product, and belongs to the technical field of information security. For host data in each dimension sent by a to-be-detected device, all data frequent items, same-process-group frequent items and same-session frequent items are calculated. Historical command in the host data is input into a prediction model to obtain predicted command type information output by the prediction model. The predicted command type information is compared with type information of real commands in the host data to obtain an abnormality comparison result. The abnormality comparison result, all data frequent items, same-process-group frequent items and same-session frequent items are input into a classification model to obtain a target abnormal event type. An abnormality detection result is generated based on the target abnormal event type. Through the application, the detection accuracy of abnormality detection on a behavior sequence of a host can be improved, the security of the host is improved, and the probability of a business collapse caused by a hacker attack on the host is reduced.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and particularly relates to an anomaly detection method and device, equipment, a storage medium and a program product. BACKGROUND

[0002] At present, the phenomenon of hacker attacks on hosts often occurs, and for this, it is necessary to detect such potential malicious behaviors existing on the host.

[0003] In practice, it is found that the current anomaly detection method for the behavior sequence of the host is usually to determine whether the host behavior sequence is abnormal according to whether a single event is abnormal. However, in fact, a single event cannot comprehensively reflect the overall abnormal state. In particular, for the detection of abnormal events with a small probability, the host behavior sequence anomaly detection method based on a single event is likely to fail to detect anomalies, thereby causing host security risks and further possibly leading to the collapse of related businesses attacked in the host. It can be seen that the current anomaly detection method for the behavior sequence of the host has the problem of poor detection accuracy. SUMMARY

[0004] Therefore, the present application provides an anomaly detection method, device, equipment, storage medium and program product, which helps to improve the detection accuracy of anomaly detection for the behavior sequence of the host, thereby improving the security of the host and further reducing the probability of the collapse of the business caused by the attack of the host by hackers.

[0005] To achieve the above object, the present application adopts the following technical solutions:

[0006] In a first aspect, the present application provides an anomaly detection method, which is applied to an analysis server, and the method comprises:

[0007] receiving host data in each dimension sent by a to-be-detected device; wherein the each dimension comprises at least one of a process creation dimension, a network connection dimension and a file creation dimension, and the host data comprises at least one of process creation data in the process creation dimension, network connection data in the network connection dimension and file creation data in the file creation dimension;

[0008] For the host data, all data frequent items, same process group frequent items and same session frequent items are calculated; wherein the all data frequent items comprise at least one of process frequent data of the process creation data, network frequent data of the network connection data and file frequent data of the file creation data;

[0009] inputting historical command in the host data into a prediction model to obtain prediction command type information output by the prediction model;

[0010] comparing the predicted command type information with type information of real commands in the host data to obtain an abnormal comparison result;

[0011] inputting the abnormal comparison result, the all-data frequent item, the same-process-group frequent item and the same-session frequent item into a classification model to obtain a target abnormal event type;

[0012] generating an abnormal detection result based on the target abnormal event type.

[0013] Further, the prediction model is a probability suffix tree model; and

[0014] inputting historical commands in the host data into a prediction model to obtain predicted command type information output by the prediction model, including:

[0015] inputting historical commands in the host data into the probability suffix tree model to obtain the predicted command type information output by the probability suffix tree model. The method further includes:

[0016] generating a predicted command from historical commands in the host data by using a probability suffix tree model;

[0017] comparing the predicted command with real commands in the host data to obtain an abnormal comparison result.

[0018] Further, comparing the predicted command type information with type information of real commands in the host data to obtain an abnormal comparison result includes:

[0019] determining an execution probability corresponding to each predicted command type based on the predicted command type information;

[0020] determining a target predicted command type with the highest execution probability from the predicted command types;

[0021] comparing the target predicted command type with type information of real commands in the host data to obtain the abnormal comparison result;

[0022] The abnormal comparison result includes that the target predicted command type matches a real command type or that the target predicted command type does not match a real command type.

[0023] Further, the classification model is a score card decision tree model; and

[0024] inputting the abnormal comparison result, the all-data frequent item, the same-process-group frequent item and the same-session frequent item into a classification model to obtain a target abnormal event type, including:

[0025] The abnormal comparison result, the all data frequent item, the same process group frequent item, the same session frequent item, and the pre-stored service metadata are input into the scoring card decision tree model to obtain the target abnormal event type.

[0026] Further, the method further comprises:

[0027] An abnormal event type for each abnormal event is pre-established;

[0028] The target abnormal event type is an abnormal event type corresponding to the host data in each abnormal event type.

[0029] Further, the receiving of the host data under each dimension sent by the to-be-detected device comprises:

[0030] The initial data under each dimension sent by the to-be-detected device is received according to a preset data calculation duration;

[0031] The initial data is subjected to data processing to obtain the host data; the data processing comprises data cleaning processing and data extraction processing.

[0032] Further, the method further comprises:

[0033] The abnormal event type of each abnormal event is data cached according to a preset time period; the preset time period comprises a minute period, an hour period, or a day period.

[0034] Further, the receiving of the host data under each dimension sent by the to-be-detected device comprises:

[0035] The initial data under each dimension sent by the to-be-detected device is received according to a preset data calculation duration;

[0036] The initial data is subjected to data processing to obtain the host data; the data processing comprises data cleaning processing and data extraction processing.

[0037] In a second aspect, the application provides an abnormality detection device, which is applied to an analysis server and comprises:

[0038] A data acquisition unit is configured to receive host data under each dimension sent by a to-be-detected device; the each dimension comprises at least one of a process creation dimension, a network connection dimension, and a file creation dimension, and the host data comprises at least one of process creation data in the process creation dimension, network connection data in the network connection dimension, and file creation data in the file creation dimension.

[0039] a frequent item calculation unit, configured to calculate all data frequent items, same process group frequent items and same session frequent items for the host data, wherein the all data frequent items include at least one of process frequent data of process creation data, network frequent data of network connection data and file frequent data of file creation data;

[0040] an anomaly detection unit, configured to input historical command in the host data into a prediction model to obtain predicted command type information output by the prediction model, compare the predicted command type information with type information of real commands in the host data to obtain an anomaly comparison result, input the anomaly comparison result, the all data frequent items, the same process group frequent items and the same session frequent items into a classification model to obtain a target anomaly event type, and generate an anomaly detection result based on the target anomaly event type.

[0041] Further, the prediction model is a probability suffix tree model; and

[0042] The anomaly detection unit is specifically configured to:

[0043] input the historical command in the host data into the probability suffix tree model to obtain the predicted command type information output by the probability suffix tree model. The method further includes:

[0044] generating a predicted command from the historical command in the host data by using the probability suffix tree model;

[0045] comparing the predicted command with the real command in the host data to obtain an anomaly comparison result.

[0046] Further, the anomaly detection unit is specifically configured to:

[0047] determine an execution probability corresponding to each predicted command type based on the predicted command type information;

[0048] determine a target predicted command type with the highest execution probability from the predicted command types;

[0049] compare the target predicted command type with type information of the real command in the host data to obtain the anomaly comparison result;

[0050] The anomaly comparison result includes that the target predicted command type matches the real command type or the target predicted command type does not match the real command type.

[0051] Further, the classification model is a score card decision tree model; and

[0052] The anomaly detection unit is specifically configured to:

[0053] inputting the abnormality comparison result, the all-data frequent item, the same-process-group frequent item, the same-session frequent item, and the pre-stored service metadata into the scoring card decision tree model to obtain the target abnormal event type.

[0054] Further, the apparatus further comprises:

[0055] a type establishing unit, configured to pre-establish an abnormal event type for each abnormal event;

[0056] The target abnormal event type is an abnormal event type corresponding to the host data in each abnormal event type.

[0057] Further, the data obtaining unit is specifically configured to:

[0058] receive initial data under each dimension sent by the to-be-detected device according to a preset data calculation duration;

[0059] perform data processing on the initial data to obtain the host data; the data processing comprises data cleaning processing and data extraction processing.

[0060] Further, the apparatus further comprises:

[0061] a data caching unit, configured to cache the abnormal event type of each abnormal event according to a preset time period; the preset time period comprises a minute period, an hour period, or a day period.

[0062] Further, the data obtaining unit is specifically configured to:

[0063] receive initial data under each dimension sent by the to-be-detected device according to a preset data calculation duration;

[0064] perform data processing on the initial data to obtain the host data; the data processing comprises data cleaning processing and data extraction processing.

[0065] In a third aspect, the present application provides an electronic device, comprising:

[0066] at least one processor; and

[0067] a memory in communication connection with the at least one processor; wherein

[0068] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method of the first aspect.

[0069] In a fourth aspect, the present application provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to execute the method in the first aspect.

[0070] In a fifth aspect, the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the method in the first aspect.

[0071] The present application has at least the following beneficial effects:

[0072] Through the present application, the host data in each dimension sent by the to-be-detected device can be received, and all data frequent items, same process group frequent items and same session frequent items are calculated. The prediction command type information corresponding to the host data is predicted through a prediction model, and then the prediction command type information is compared with the type information of the real command in the host data to obtain an abnormal comparison result. Then, through a classification model, a target abnormal event type for the abnormal comparison result, all data frequent items, same process group frequent items and same session frequent items is generated to obtain an abnormal detection result. This process can alarm through multi-dimensional host data without relying on a single host behavior, can improve the detection accuracy of abnormal detection on the behavior sequence of the host, and can more comprehensively reflect the related behaviors of hacker attacks, thereby improving the security of the host and reducing the probability of business collapse caused by hacker attacks on the host.

[0073] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0074] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0075] Figure 1 is a flow chart of an abnormal detection method according to an exemplary embodiment;

[0076] Figure 2 is a flow chart of an abnormal detection method according to another exemplary embodiment;

[0077] Figure 3 is a block diagram structure schematic diagram of an abnormal detection device according to an exemplary embodiment;

[0078] Figure 4is a block diagram structure schematic diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0079] For the purposes of the present application, the technical solutions and advantages will be more apparent, the technical solutions of the present application will be described in detail below. Obviously, the described embodiments are only a part of the embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor belong to the scope of protection of the present application.

[0080] Please refer to Figure 1 , Figure 1 is a flow chart of an anomaly detection method according to an exemplary embodiment, which comprises the following steps:

[0081] Step S101, receiving host data in each dimension sent by a to-be-detected device; wherein the each dimension comprises at least one of a process creation dimension, a network connection dimension, and a file creation dimension, and the host data comprises at least one of process creation data in the process creation dimension, network connection data in the network connection dimension, and file creation data in the file creation dimension.

[0082] In the embodiment, the execution subject can be an analysis server for performing analysis alarm, and the analysis server can establish a connection with the to-be-detected device.

[0083] Among them, the to-be-detected device can collect host data of the process creation dimension, the network connection dimension and the file creation dimension, and transmit these host data to the execution subject, so that the execution subject analyzes these host data to realize anomaly alarm.

[0084] Specifically, the process creation data corresponding to the process creation dimension can include but is not limited to process name, parent process name, process command line, process group ID and session ID. The network connection data corresponding to the network connection dimension can include but is not limited to process name, parent process name, process command line, connection IP, process group ID and session ID. The file creation data corresponding to the file creation dimension can include but is not limited to process name, parent process name, process command line, file creation path, process group ID and session ID.

[0085] Step S102, for the host data, calculating all data frequent items, same process group frequent items and same session frequent items; wherein the all data frequent items include at least one of process frequent data of the process creation data, network frequent data of the network connection data, and file frequent data of the file creation data.

[0086] In this embodiment, the obtained host data can be data within a computing period, for example, the computing period can be 10-15 minutes of machine or container startup. Alternatively, when obtaining the host data, data cleaning processing can be performed first, and then data within a computing period can be extracted from the data after data cleaning. Then, the execution subject can calculate the frequent items of the related data. It can be understood that the host data can include data of each dimension of at least one machine or container. For each machine or container, all data frequent items, process group frequent items, and session frequent items corresponding to the machine or container can be calculated.

[0087] Among them, for all data frequent items, it can include process frequent data corresponding to process creation data, network frequent data corresponding to network connection data, and file frequent data corresponding to file creation data. Among them, the process frequent data can be used to indicate the creation times of the process name, the creation times of the process name and the parent process name. Among them, the network frequent data can be used to indicate the number of times of accessing the internal network or the external network, such as accessing the internal network 2 times. Among them, the file frequent data can be used to indicate the number of times of file reading and writing by the process name.

[0088] Among them, for the same process group frequent item, it can indicate the creation times of each process running together in the same process group. Specifically, the creation times here can include the creation times of the process name, the creation times of the process name and the parent process name, the number of times of accessing the internal network or the external network, and the number of times of file reading and writing by the process name. However, the statistical dimension here is the whole process group as the granularity.

[0089] Among them, for the same session frequent item, it can indicate the creation times of each process group running together in the same session. Each process group contains at least one process. Specifically, the creation times here can include the creation times of the process name, the creation times of the process name and the parent process name, the number of times of accessing the internal network or the external network, and the number of times of file reading and writing by the process name. However, the statistical dimension here is the whole session as the granularity.

[0090] Step S103, input the historical command in the host data into the prediction model to obtain the prediction command type information output by the prediction model.

[0091] In the embodiment, the host data can include historical commands and real commands. The historical commands can be historical executed commands, and the real commands can be the next commands actually executed after the historical commands. The prediction model can be used to predict the command type to be executed after the historical commands according to the historical commands. The predicted command type information can be the command type to be executed after the historical commands.

[0092] The execution subject can pre-train the prediction model, use a large number of corresponding historical command samples and real command samples as training data of the model, and iteratively train the prediction model, so that the prediction model learns the occurrence probability between the historical commands and the real commands, and realizes the prediction of the command type.

[0093] In step S104, the predicted command type information is compared with the type information of the real command in the host data to obtain an abnormal comparison result.

[0094] In the embodiment, after obtaining the predicted command type information, the predicted command type information can be compared with the type information of the real command in the host data. It is determined whether the type indicated by the predicted command type information is consistent with the type indicated by the type information of the real command. If not, it is determined that the abnormal comparison result is comparison abnormality. If yes, it is determined that the abnormal comparison result is comparison normality.

[0095] In step S105, the abnormal comparison result, the all-data frequent item, the same-process-group frequent item, and the same-session frequent item are input into a classification model to obtain a target abnormal event type.

[0096] In the embodiment, the execution subject can input the abnormal comparison result, the all-data frequent item, the same-process-group frequent item, and the same-session frequent item into the classification model, so that the classification model determines the target abnormal event type corresponding thereto.

[0097] In step S106, an abnormal detection result is generated based on the target abnormal event type.

[0098] In the embodiment, the execution subject can output the target abnormal event type as the final abnormal detection result.

[0099] In the embodiment, the execution subject can pre-store labels of abnormal events. The labels are pre-set for historical existing abnormal events. When the abnormal detection result is generated, the target label conforming to the current situation can be determined from the labels according to the all-data frequent item, the same-process-group frequent item, and the same-session frequent item corresponding to the current host data, and the target abnormal event type corresponding to the target label is taken as the abnormal detection result of the current abnormal detection.

[0100] For example, the target abnormal event type corresponding to the target label can be a process creation exception, a file read / write exception, or a network connection exception.

[0101] If the frequent item indicates that the target process creation command has only been executed once in the history, but the host data suddenly executes twice this time, it is determined that the abnormal detection result is a process creation exception. For example, whoami has been executed once in the history, but whoami is suddenly executed twice this time, and it is determined that the process creation exception.

[0102] Or, if the frequent item indicates that a certain process has never accessed the target file in the history, but the host data suddenly accesses the target file this time, it is determined that the abnormal detection result is a file read / write exception. For example, the cat process has never accessed / etc / passwd in the history, but / etc / passwd is suddenly accessed this time, and it is determined that the file read / write exception.

[0103] Or, if the frequent item indicates that a certain process suddenly accesses the external network, it is determined that the abnormal detection result is a network connection exception. For example, curl suddenly accesses the external network, and it is determined that the network connection exception.

[0104] Through the present application, the host data under each dimension sent by the to-be-detected device can be received, and all data frequent items, process group frequent items, and session frequent items can be calculated. The prediction model is used to predict the prediction command type information corresponding to the host data, and then the prediction command type information is compared with the type information of the real command in the host data to obtain an abnormal comparison result. Through the classification model, the target abnormal event type for the abnormal comparison result, all data frequent items, process group frequent items, and session frequent items is generated to obtain an abnormal detection result. This process can alarm through multi-dimensional host data and does not depend on a single host behavior, which can improve the detection accuracy of abnormal detection of the behavior sequence of the host, and can more comprehensively reflect the related behaviors of hacker attacks, thereby improving the security of the host and reducing the probability of business collapse caused by hacker attacks on the host.

[0105] Please refer to Figure 2 , Figure 2 is a flowchart of an abnormal detection method according to another exemplary embodiment, which comprises the following steps:

[0106] Step S201, according to a preset data calculation time length, receiving initial data under each dimension sent by the to-be-detected device.

[0107] In this embodiment, the execution subject can be an analysis server for analysis and alarm, and the analysis server can establish a connection with the to-be-detected device.

[0108] The preset data calculation duration can be 10 to 15 minutes after the machine or the container is started, and the preset data calculation duration can be dynamically adjusted based on requirements, which is not limited in the embodiment.

[0109] The initial data of the process creation dimension, the network connection dimension, and the file creation dimension can be collected by the to-be-detected device, and the initial data is transmitted to the execution subject, so that the execution subject analyzes the initial data to realize abnormal alarm.

[0110] In step S202, the initial data is subjected to data processing to obtain the host data; the data processing includes data cleaning processing and data extraction processing; and the host data includes process creation data, network connection data, and file creation data.

[0111] In the embodiment, after obtaining the initial data, the execution subject can perform data cleaning processing on the initial data to obtain data after data cleaning processing. Then, valid data is extracted from the data after data cleaning processing as the host data.

[0112] Specifically, the process creation data corresponding to the process creation dimension can include but is not limited to process name, parent process name, process command line, process group ID, and session ID. The network connection data corresponding to the network connection dimension can include but is not limited to process name, parent process name, process command line, connection IP, process group ID, and session ID. The file creation data corresponding to the file creation dimension can include but is not limited to process name, parent process name, process command line, file creation path, process group ID, and session ID.

[0113] In step S203, for the host data, all data frequent items, same process group frequent items, and same session frequent items are calculated; the all data frequent items include at least one of process frequent data of the process creation data, network frequent data of the network connection data, and file frequent data of the file creation data.

[0114] In the embodiment, the obtained host data can be data in a calculation period, for example, the calculation period can be 10 to 15 minutes after the machine or the container is started. Optionally, when the host data is obtained, data cleaning processing can be performed first, and then data in a calculation period is extracted from the data after data cleaning. Then, the execution subject can calculate the frequent items of the related data. It can be understood that the host data can include data of each dimension of at least one machine or container. For each machine or container, all data frequent items, same process group frequent items, and same session frequent items corresponding to the machine or container can be calculated.

[0115] Among them, for all data frequent items, it can include process frequent data corresponding to process creation data, network frequent data corresponding to network connection data, and file frequent data corresponding to file creation data. Among them, the process frequent data can be used to represent the creation times of the process name, the creation times of the process name and the parent process name. Among them, the network frequent data can be used to represent the number of times the process name accesses the internal network or the external network, such as accessing the internal network 2 times. Among them, the file frequent data can be used to represent the number of times the process name reads and writes files.

[0116] Among them, for the same process group frequent item, it can indicate the creation times of each process in the same process group running together. Specifically, the creation times here can include the creation times of the process name, the creation times of the process name and the parent process name, the number of times the process name accesses the internal network or the external network, and the number of times the process name reads and writes files. However, the statistical dimension here is to count the entire process group as the granularity.

[0117] Among them, for the same session frequent item, it can indicate the creation times of each process group in the same session running together. Each process group contains at least one process. Specifically, the creation times here can include the creation times of the process name, the creation times of the process name and the parent process name, the number of times the process name accesses the internal network or the external network, and the number of times the process name reads and writes files. However, the statistical dimension here is to count the entire session as the granularity.

[0118] Step S204, input the historical command in the host data into the probability suffix tree model, and obtain the prediction command type information output by the probability suffix tree model.

[0119] In this embodiment, the prediction model is a probability suffix tree model. The execution subject can pre-train the probability suffix tree model, so that the probability suffix tree model can generate the command type corresponding to the prediction command according to the historical command, and obtain the prediction command type information.

[0120] In this embodiment, the host data can include historical commands and real commands. The historical commands can be the commands that have been executed historically, and the real commands can be the next commands that are actually executed after the historical commands. The prediction model can be used to predict the type of the command that is executed after the historical commands according to the historical commands. The predicted command type information can be the type of the command that is predicted to be executed after the historical commands. The probability suffix tree model is a commonly used model for predicting the next symbol, that is, given a symbol history, the probability suffix tree model can see the entire probability distribution of the next symbol. In this embodiment, the probability suffix tree model is introduced into the application scenario of command prediction assisting anomaly detection. The historical commands that are executed historically in the host data are input into the trained probability suffix tree model, so that the probability suffix tree model predicts the predicted command type information corresponding to the predicted command that is executed after the historical commands. The predicted command is the next command that is predicted to be executed after the historical commands.

[0121] In step S205, the execution probability corresponding to each predicted command type is determined based on the predicted command type information.

[0122] In this embodiment, after the predicted command type information is predicted by the probability suffix tree model, the execution subject can compare the predicted command with the type of the real command in the host data to obtain an abnormal comparison result. The real command refers to the command that is actually executed after the historical command, and the abnormal comparison result is used to indicate the type difference between the predicted command and the real command.

[0123] In this embodiment, the predicted command type information can include one or more predicted command types and the execution probability corresponding to each predicted command type. For example, the predicted command type information can include two types of command A and command B, and the execution probability corresponding to command A is 0, and the execution probability corresponding to command B is 0.6.

[0124] In step S206, a target predicted command type with the highest execution probability is determined from the predicted command types.

[0125] In this embodiment, the predicted command type with the highest execution probability in the multiple predicted command types can be used as the target predicted command type. For example, for the command A and the command B, the command B can be used as the target predicted command type.

[0126] In step S207, the target predicted command type is compared with the type information of the real command in the host data to obtain the abnormal comparison result.

[0127] The abnormality comparison result includes that the target predicted command type matches the real command type or the target predicted command type does not match the real command type.

[0128] For example, if the real command indicates that the command A is actually executed, it is indicated that the target predicted command type does not match the real command type, and an abnormality occurs. In this case, the abnormality comparison result can indicate that the predicted command and the real command do not match and an abnormality exists. If the real command indicates that the command B is actually executed, it is indicated that the target predicted command type matches the real command type, and no abnormality occurs. In this case, the abnormality comparison result can indicate that the predicted command and the real command match and no abnormality exists.

[0129] In step S208, the abnormality comparison result, the all-data frequent item, the same-process-group frequent item, the same-session frequent item, and the pre-stored service metadata are input into a scoring card decision tree model for abnormality detection, and the target abnormality event type is obtained.

[0130] In this embodiment, the classification model is a scoring card decision tree model. The execution subject can pre-store labels of abnormality events. The labels are pre-set for historical abnormality events. When the abnormality detection result is generated, the target label that meets the current situation can be determined from the labels according to the all-data frequent item, the same-process-group frequent item, and the same-session frequent item corresponding to the current host data, and the target abnormality event type corresponding to the target label is taken as the abnormality detection result of this time.

[0131] For example, the target abnormality event type corresponding to the target label can be a process creation abnormality, a file read-write abnormality, or a network connection abnormality.

[0132] If the frequent item indicates that the target process creation command is only executed once in history, but the host data suddenly executes twice this time, it is determined that the abnormality detection result is a process creation abnormality. For example, whoami is executed once in history, but the host data suddenly executes twice this time, and it is determined that the process creation abnormality exists.

[0133] Or, if the frequent item indicates that a certain process has never accessed a target file in history, but the host data suddenly accesses the target file this time, it is determined that the abnormality detection result is a file read-write abnormality. For example, the cat process has never accessed / etc / passwd in history, but suddenly accesses / etc / passwd this time, and it is determined that the file read-write abnormality exists.

[0134] Or, if the frequent item indicates that a certain process suddenly accesses the external network, it is determined that the abnormality detection result is a network connection abnormality. For example, curl suddenly accesses the external network, and it is determined that the network connection abnormality exists.

[0135] In the embodiment, the abnormality comparison result, the frequent items of various types, and the pre-stored service metadata can be input into a scorecard decision tree model for abnormality detection, and the scorecard decision tree model can be used for comprehensive scoring and evaluation to obtain an abnormality detection result. The judgment branches in the scorecard decision tree model include at least whether the access times of the frequent items exceed a threshold, whether the frequent items match the pre-stored frequency of abnormal events, whether there is an abnormal frequent item in the frequent items, whether the abnormality comparison result indicates that the predicted command does not match the real command and the real command is abnormal, whether the access permission setting in the service metadata does not match the access in the frequent items, and the like. The embodiment is not limited in this regard.

[0136] In step S209, an abnormality detection result is generated based on the target abnormal event type.

[0137] In the embodiment, the execution subject can output the target abnormal event type as the final abnormality detection result.

[0138] As an optional implementation, the following step can be further performed: an abnormal event type is pre-established for each abnormal event; and the target abnormal event type is an abnormal event type corresponding to the host data among the abnormal event types.

[0139] As an optional implementation, the following step can be further performed: the abnormal event types of the abnormal events are cached in data according to a preset time period; and the preset time period includes a minute period, an hour period, or a day period.

[0140] In the embodiment, the execution subject can pre-establish an abnormal label of an abnormal event, and the abnormal label is used to describe the abnormal event type of the abnormal event, which can include but is not limited to file download, external network access, and port detection. The execution subject can cache the abnormal label of the abnormal event in a data cache layer. The data can be cached according to a preset time period, which can include a minute period at a minute level, an hour period at an hour level, and a day period at a day level. Through the label time period division caching method, the abnormal labels corresponding to the historical minutes, the historical hours, and the historical days can be read across time, the abnormalities of the current host data can be comprehensively detected, and a more accurate abnormality detection result can be obtained.

[0141] The execution subject can update the abnormal events and the abnormal event types of the abnormal events in real time. When an abnormal event that is not pre-stored is detected, the abnormal event and the abnormal event type corresponding to the abnormal event can be updated to the abnormal database, so that the abnormal database can be updated in real time.

[0142] Through the present application, the host data in each dimension sent by the to-be-detected device can be received, and all data frequent items, same-process-group frequent items, and same-session frequent items are calculated. The prediction command type information corresponding to the host data is predicted through a prediction model, and then the prediction command type information is compared with the type information of the real command in the host data to obtain an abnormal comparison result. Then, through a classification model, a target abnormal event type for the abnormal comparison result, all data frequent items, same-process-group frequent items, and same-session frequent items is generated to obtain an abnormal detection result. This process can alarm through multi-dimensional host data and without relying on a single host behavior, can improve the detection accuracy of abnormal detection on the behavior sequence of the host, and can more comprehensively reflect the related behaviors of hacker attacks, thereby improving the host security and reducing the probability of business collapse caused by hacker attacks on the host.

[0143] Please refer to Figure 3 , Figure 3 is a block diagram structure diagram of an abnormal detection device according to an exemplary embodiment. The abnormal detection device 3 is applied to an analysis server and includes:

[0144] The data acquisition unit 301 is configured to receive host data in each dimension sent by a to-be-detected device. The dimensions include at least one of a process creation dimension, a network connection dimension, and a file creation dimension. The host data includes at least one of process creation data in the process creation dimension, network connection data in the network connection dimension, and file creation data in the file creation dimension.

[0145] The frequent item calculation unit 302 is configured to calculate all data frequent items, same-process-group frequent items, and same-session frequent items for the host data. The all data frequent items include at least one of process frequent data of the process creation data, network frequent data of the network connection data, and file frequent data of the file creation data.

[0146] The abnormal detection unit 303 is configured to input historical commands in the host data into a prediction model to obtain prediction command type information output by the prediction model. The prediction command type information is compared with type information of real commands in the host data to obtain an abnormal comparison result. The abnormal comparison result, the all data frequent items, the same-process-group frequent items, and the same-session frequent items are input into a classification model to obtain a target abnormal event type. An abnormal detection result is generated based on the target abnormal event type.

[0147] As an optional implementation, the prediction model is a probability suffix tree model.

[0148] The anomaly detection unit 303 is specifically configured to:

[0149] inputting the historical commands in the host data into the probability suffix tree model to obtain the predicted command type information output by the probability suffix tree model. The method further includes:

[0150] generating predicted commands according to the historical commands in the host data by using the probability suffix tree model;

[0151] comparing the predicted commands with real commands in the host data to obtain an abnormality comparison result.

[0152] As an optional implementation, the anomaly detection unit 303 is specifically configured to:

[0153] determining an execution probability corresponding to each predicted command type based on the predicted command type information;

[0154] determining a target predicted command type with the highest execution probability from the predicted command types;

[0155] comparing the target predicted command type with type information of real commands in the host data to obtain the abnormality comparison result;

[0156] The abnormality comparison result includes that the target predicted command type matches the real command type or the target predicted command type does not match the real command type.

[0157] As an optional implementation, the classification model is a scorecard decision tree model; and

[0158] The anomaly detection unit 303 is specifically configured to:

[0159] inputting the abnormality comparison result, the all-data frequent item, the same-process-group frequent item, the same-session frequent item, and pre-stored service metadata into the scorecard decision tree model to obtain the target abnormal event type.

[0160] As an optional implementation, the apparatus further includes:

[0161] a type establishing unit configured to pre-establish an abnormal event type for each abnormal event;

[0162] The target abnormal event type is an abnormal event type corresponding to the host data in each abnormal event type.

[0163] As an optional implementation, the data acquisition unit 301 is specifically configured to:

[0164] According to a preset data calculation duration, initial data in each dimension sent by the to-be-detected device is received.

[0165] The initial data is subjected to data processing to obtain the host data, wherein the data processing includes data cleaning processing and data extraction processing.

[0166] As an optional implementation, the apparatus further includes:

[0167] The data caching unit is configured to cache the abnormal event types of each abnormal event according to a preset time period, wherein the preset time period includes a minute period, an hour period or a day period.

[0168] As an optional implementation, the data acquisition unit 301 is specifically configured to:

[0169] According to a preset data calculation duration, initial data in each dimension sent by the to-be-detected device is received.

[0170] The initial data is subjected to data processing to obtain the host data, wherein the data processing includes data cleaning processing and data extraction processing.

[0171] According to the present application, host data in each dimension sent by the to-be-detected device can be received, and all data frequent items, same process group frequent items and same session frequent items are calculated. The prediction command type information corresponding to the host data is predicted through a prediction model, and the prediction command type information is compared with the type information of the real command in the host data to obtain an abnormal comparison result. Through a classification model, the target abnormal event type for the abnormal comparison result, all data frequent items, same process group frequent items and same session frequent items is generated to obtain an abnormal detection result. This process can perform alarm through multi-dimensional host data and without relying on a single host behavior, can improve the detection accuracy of the abnormal detection of the behavior sequence of the host, and can more comprehensively reflect the related behaviors of the hacker attack, thereby improving the host security and reducing the probability of the business collapse caused by the host attacked by the hacker.

[0172] As to the abnormal detection apparatus 3 in the above embodiments, the specific manner in which each module performs operations has been described in detail in the above embodiments of the related method, and will not be described in detail here.

[0173] Please refer to Figure 4 , Figure 4 is a block diagram structure schematic diagram of an electronic device according to an exemplary embodiment, and the electronic device 4 includes:

[0174] at least one processor 41; and

[0175] a memory 42 in communication with the at least one processor 41; wherein

[0176] The memory 42 stores instructions executable by the at least one processor 41, and the instructions are executed by the at least one processor 41 to enable the at least one processor 41 to perform the above-mentioned related anomaly detection method.

[0177] In practical applications, the electronic device 4 can be a server, and it should be noted that the electronic device 4 is not limited to be embodied in the form of a server. As for the electronic device 4 in the above-mentioned embodiments, the specific manner in which the processor 41 executes the program in the memory 42 has been described in detail in the embodiments related to the method, and will not be described in detail here.

[0178] In addition, the present application also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to perform the above-mentioned related anomaly detection method.

[0179] The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc. The storage medium can also include a combination of the above-mentioned types of memories.

[0180] In addition, the present application also provides a computer program product comprising a computer program, which, when executed by a processor, implements the above-mentioned related anomaly detection method.

[0181] It can be understood that the same or similar parts in the above-mentioned embodiments can be mutually referred to, and the content not described in detail in some embodiments can be referred to the same or similar content in other embodiments.

[0182] It should be noted that in the description of the present application, the terms "first", "second", etc. are only used for descriptive purposes and should not be understood as indicating or implying relative importance. In addition, in the description of the present application, unless otherwise specified, the meaning of "a plurality of" or "multiple" is at least two.

[0183] It should be understood that when an element is referred to as being "on" or "connected to" another element, it can be directly on or connected to the other element or intervening elements can be present. In addition, the term "connected" as used herein can include wirelessly connected. Also, the term "on" as used herein can include "directly on" and "indirectly on" when used in the context of interlayers.

[0184] Any process or method described in flow chart form or otherwise described herein can be understood as a representation of executable instructions, code, or a module, segment, or portion of code for execution, including one or more steps for accomplishing a particular logic function or process, and the preferred embodiments of the present application encompasses additional implementations that can not be precisely shown or described herein, including implementations involving the performance of functions in a different order, including substantially concurrently or in reverse order, and according to variations of the described embodiments, as would be understood by persons skilled in the art of the present embodiments.

[0185] It should be understood that various parts of the present application can be implemented in hardware, software, firmware or a combination thereof. In the above embodiments, various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any of the following technologies, known in the art, or their combinations, can be used: discrete logic circuitry having logic gates for implementing logic functions on data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), etc.

[0186] Those skilled in the art of the present technology can understand that all or part of the steps carried out by the above-mentioned embodiments can be completed by programs instructing related hardware, and the programs can be stored in a computer readable storage medium, which, when executed, includes one or a combination of steps of the method embodiments.

[0187] In addition, each functional unit in each embodiment of the present application can be integrated into one processing module, or each unit can be physically present separately, or two or more units can be integrated into one module. The above-mentioned integrated module can be realized in the form of hardware or in the form of a software functional module. The integrated module, if realized in the form of a software functional module and sold or used as an independent product, can also be stored in a computer readable storage medium.

[0188] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0189] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are contained in at least one embodiment or example of the present application. In the specification, the illustrative description of the above terms does not necessarily mean the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0190] Although the embodiments of the present application have been shown and described above, it is understood that the above-described embodiments are exemplary, and cannot be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above-described embodiments within the scope of the present application.

Claims

1. An anomaly detection method, characterized in that, The method is applied to an analysis server, and the method includes: Receive host data from the device under test in various dimensions; wherein, the various dimensions include process creation dimension, network connection dimension, and file creation dimension, and the host data includes process creation data in the process creation dimension, network connection data in the network connection dimension, and file creation data in the file creation dimension; For the host data, calculate all frequent data items, frequent items in the same process group, and frequent items in the same session; wherein, all frequent data items include frequent process data of process creation data, frequent network data of network connection data, and frequent file data of file creation data; Input the historical commands from the host data into the prediction model to obtain the prediction command type information output by the prediction model; The predicted command type information is compared with the actual command type information in the host data to obtain the anomaly comparison result; The anomaly comparison results, all frequent data items, frequent items in the same process group, and frequent items in the same session are input into the classification model to obtain the target anomaly event type. Anomaly detection results are generated based on the target anomaly event type.

2. The method according to claim 1, characterized in that, The prediction model is a probability suffix tree model; as well as The historical commands from the host data are input into the prediction model to obtain the prediction command type information output by the prediction model, including: The historical commands in the host data are input into the probability suffix tree model to obtain the predicted command type information output by the probability suffix tree model.

3. The method according to claim 1, characterized in that, The predicted command type information is compared with the actual command type information in the host data to obtain anomaly comparison results, including: Based on the predicted command type information, the execution probability corresponding to each predicted command type is determined; From the various prediction command types, determine the target prediction command type with the highest execution probability; The target predicted command type is compared with the type information of the real command in the host data to obtain the anomaly comparison result; The anomaly comparison results include either the target predicted command type matching the real command type, or the target predicted command type not matching the real command type.

4. The method according to claim 1, characterized in that, The classification model is a scorecard decision tree model; and The anomaly comparison results, all frequent data items, frequent items from the same process group, and frequent items from the same session are input into the classification model to obtain the target anomaly event type, including: The anomaly comparison results, all frequent data items, frequent items in the same process group, frequent items in the same session, and pre-stored business metadata are input into the scorecard decision tree model to obtain the target anomaly event type.

5. The method according to claim 1, characterized in that, The method further includes: Pre-define the exception types for each exception event; The target abnormal event type is the abnormal event type that corresponds to the host data among all abnormal event types.

6. The method according to claim 1, characterized in that, The received host data in various dimensions sent by the device under test includes: According to the preset data calculation time, the system receives the initial data in each dimension sent by the device under test; The initial data is processed to obtain the host data; wherein the data processing includes data cleaning and data extraction.

7. An anomaly detection device, characterized in that, The device is used in an analysis server, and the device includes: The data acquisition unit is used to receive host data under various dimensions sent by the device under test; wherein, the various dimensions include process creation dimension, network connection dimension, and file creation dimension, and the host data includes process creation data under the process creation dimension, network connection data under the network connection dimension, and file creation data under the file creation dimension; The frequent item calculation unit is used to calculate all frequent data items, frequent items in the same process group, and frequent items in the same session for the host data; wherein, all frequent data items include frequent process data of the process creation data, frequent network data of the network connection data, and frequent file data of the file creation data. An anomaly detection unit is used to input historical commands from the host data into a prediction model to obtain predicted command type information output by the prediction model; compare the predicted command type information with the type information of real commands in the host data to obtain an anomaly comparison result; input the anomaly comparison result, all frequent data items, frequent items in the same process group, and frequent items in the same session into a classification model to obtain a target anomaly event type; and generate an anomaly detection result based on the target anomaly event type.

8. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-6.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-6.

Images