Method, device, equipment and storage medium for attack behavior detection

Abstract

According to an embodiment of the present disclosure, a method, apparatus, device and storage medium for attack behavior detection are provided. The method includes: obtaining attack behavior data and non-attack behavior data, the attack behavior data is collected from at least one honeypot host, and the non-attack behavior data is collected from at least one user host; based on the keywords in the non-attack behavior data and the keywords in the attack behavior data, filtering keywords from the attack behavior data to generate at least one attack behavior detection rule, wherein each attack behavior detection rule includes at least one keyword for characterizing the attack behavior; and performing attack behavior detection on the target user host based on at least one attack behavior detection rule. In this way, automatic and efficient detection of unknown attack behaviors can be achieved, and the detection capability and accuracy of attack behaviors are improved.

Description

Technical Field

[0001] Example embodiments of the present disclosure generally relate to the field of network security, and more particularly to methods, devices, apparatuses, and computer-readable storage media for attack behavior detection. Background Art

[0002] Honeypots, such as Secure Shell (SSH) high-interaction honeypots, are network security tools used to trap intruders (e.g., hackers) to attack. Honeypots can simulate a real server or computer that uses the SSH protocol for remote login to attract intruders to try to log in and perform operations, thereby collecting and recording data such as the intruder's behavior activities (e.g., including the operation commands executed by the intruder). When using the behavioral data collected by honeypots, it is usually necessary to manually analyze the intruder's attack methods and rely on expert knowledge to design different security strategies, which is inefficient in defending against intrusions. Therefore, a solution is expected to detect intrusions in a timely and accurate manner. Summary of the invention

[0003] In a first aspect of the present disclosure, a method for attack behavior detection is provided, comprising: acquiring attack behavior data and non-attack behavior data, the attack behavior data being collected from at least one honeypot host, and the non-attack behavior data being collected from at least one user host; filtering keywords from the attack behavior data according to keywords in the non-attack behavior data and keywords in the attack behavior data to generate at least one attack behavior detection rule, wherein each attack behavior detection rule includes at least one keyword for characterizing the attack behavior; and performing attack behavior detection on the target user host based on the at least one attack behavior detection rule.

[0004] In a second aspect of the present disclosure, there is provided an apparatus for attack behavior detection, comprising: a data acquisition module, configured to acquire attack behavior data and non-attack behavior data, wherein the attack behavior data is collected from at least one honeypot host, and the non-attack behavior data is collected from at least one user host; a rule generation module, configured to filter keywords from the attack behavior data to generate at least one attack behavior detection rule based on keywords in the non-attack behavior data and keywords in the attack behavior data, wherein each attack behavior detection rule includes at least one keyword for characterizing the attack behavior; and a behavior detection module, configured to perform attack behavior detection on the target user host based on the at least one attack behavior detection rule.

[0005] In a third aspect of the present disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit. When the instructions are executed by the at least one processing unit, the device executes the method of the first aspect.

[0006] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and the computer program can be executed by a processor to implement the method of the first aspect.

[0007] It should be understood that the contents described in this content section are not intended to limit the key features or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0009] Figure 1 A schematic diagram showing an example network environment in which embodiments of the present disclosure can be implemented;

[0010] Figure 2 A schematic diagram of the structure of an attack behavior detection system according to some embodiments of the present disclosure is shown;

[0011] Figure 3 A schematic diagram showing processing of non-aggression behavior data by an initialization subsystem according to some embodiments of the present disclosure is shown;

[0012] Figure 4 A schematic diagram showing a user instruction sequence set generated by an instruction aggregation module according to some embodiments of the present disclosure;

[0013] Figure 5 A schematic diagram showing a keyword extraction module processing a user instruction sequence set according to some embodiments of the present disclosure;

[0014] Figure 6 A schematic diagram of an attack behavior determination subsystem according to some embodiments of the present disclosure is shown;

[0015] Figure 7 A schematic diagram showing a keyword extraction module processing a honeypot instruction sequence set according to some embodiments of the present disclosure is shown;

[0016] Figure 8A schematic diagram showing compression and merging of a keyword set by a keyword clustering compression module according to some embodiments of the present disclosure is shown;

[0017] Fig. 9 A schematic diagram of a process for generating detection rules according to some embodiments of the present disclosure is shown;

[0018] Fig.10 A schematic diagram of the process of publishing and adjusting detection rules according to some embodiments of the present disclosure is shown;

[0019] Fig.11 A flow chart of a method for attack behavior detection according to some embodiments of the present disclosure is shown;

[0020] Fig.12 A schematic structural block diagram of an apparatus for attack behavior detection according to some embodiments of the present disclosure is shown;

[0021] Fig.13 A block diagram of an electronic device is shown in which one or more embodiments of the present disclosure may be implemented. DETAILED DESCRIPTION

[0022] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0023] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0024] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0025] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0026] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0027] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0028] It should be noted that the titles of any sections / subsections provided herein are not restrictive. Various embodiments are described throughout this article, and any type of embodiment may be included under any section / subsection. In addition, the embodiments described in any section / subsection may be combined in any manner with any other embodiments described in the same section / subsection and / or different sections / subsections.

[0029] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may be included below. The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may be included below.

[0030] In the field of network security, the attack behavior data collected by honeypots (or honeypot hosts) can be used in at least the following ways:

[0031] Contribute intelligence: Collect indicators of compromise (IOCs), such as file hashes, C2 domain names, IP addresses, and file names, for use as threat intelligence.

[0032] Collect malicious samples: Collect malicious samples dropped by intruders, such as Trojans, mining, backdoors, etc.

[0033] Describe the intrusion situation: perceive the possible attack behaviors and situations in cyberspace through honeypot data.

[0034] Collect attack methods: The collected attack methods of intruders can help the security team better understand the strategies and means of intruders, and then take corresponding security measures and strengthen network security defense.

[0035] The use of these honeypot behavior data requires human intervention to analyze the intruder's attack methods, and then rely on expert knowledge to design different security strategies. However, for honeypots, especially SSH high-interaction honeypots, since the operation behaviors collected by SSH high-interaction honeypots are mainly Shell instructions executed by intruders, they are usually more complex and do not have a unified format, making it difficult to standardize and automate the collected operation behaviors.

[0036] Host-based Intrusion Detection System (HIDS) can collect various data including system operations and user behaviors, and perform intrusion detection based on pre-configured detection rules. Detection rules can generally use blacklists to alert on data that matches exactly, or pattern matching to alert on behaviors that match certain characteristic patterns, or complex detection logic can be designed to achieve a higher detection rate and a lower false alarm rate. HIDS detection rules for malicious commands are mainly manually developed by security professionals for different intrusion methods or intrusion behaviors, so that it can match and detect the Shell instructions or Shell instruction sequences corresponding to each intrusion behavior.

[0037] Since Shell instructions are different from IOCs, they are more complex and diverse, and the parameters and formats of Shell instructions have a large degree of freedom, they can be carefully designed by intruders to bypass current detection schemes, such as Network Intrusion Detection System (NIDS) and Industrial Intrusion Detection System (IIDS). Moreover, pattern matching detection schemes that have not been strictly designed and tested are prone to a large number of false positives.

[0038] Therefore, it is expected to provide an improved solution to achieve attack behavior detection.

[0039] In the embodiments of the present disclosure, an improved scheme for attack behavior detection is proposed. The scheme automatically generates and identifies attack behavior patterns from attack behavior data from honeypots and generates corresponding detection rules to perform subsequent attack behavior detection by referring to non-attack behavior data collected from user hosts (which can characterize non-attack behavior). This can improve the recognition efficiency of attack behaviors, improve the detection capability and accuracy of attack behaviors.

[0040] In some embodiments, the deployed honeypot host will continuously collect attack behavior data. Through the above process, more unknown or new attack behaviors can be updated and identified in a timely and automatic manner, greatly improving network security.

[0041] Figure 1 A schematic diagram of an example network environment 100 in which an embodiment of the present disclosure can be implemented is shown. In the example network environment 100, a honeypot network 102 is deployed to trap attacks by intruders. For example, due to the attraction of the honeypot network 102, a hacker 112 will use a hacker host 110 to access the honeypot network 102. In this way, attack behavior data can be collected on the honeypot network 102. In addition, a HIDS 104 is also deployed in the network environment 100 to collect non-attack behavior data generated during normal user operations. In an embodiment of the present disclosure, the attack behavior data and the non-attack behavior data will be used to generate attack behavior detection rules suitable for performing attack behavior detection. The generated attack behavior detection rules can be used for user hosts on HIDS 104 or HIDS 106 to detect attack behaviors.

[0042] In the exemplary network environment 100, the honeypot network 102 may include one or more honeypot hosts 120-1, 120-2 ... 120-N (collectively referred to as honeypot hosts 120 for ease of discussion), the HIDS 104 may include one or more user hosts 130-1, 130-2 ... 130-M (collectively referred to as user hosts 130 for ease of discussion), and the HIDS 106 may include one or more target user hosts 140-1, 140-2 ... 140-K (collectively referred to as target user hosts 140 for ease of discussion). Figure 1 In the example, N, M, and K may be any values. In some embodiments, HIDS 106 and HIDS 104 may be in the same system, or may be separate systems.

[0043] The host 110, the honeypot host 120, the user host 130, and the target user host 140 may be servers or any type of device with computing capabilities, including terminal devices. The terminal device may be any type of mobile terminal, fixed terminal, or portable terminal, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication systems (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio broadcast receivers, electronic book devices, gaming devices, or any combination thereof, including accessories and peripherals of these devices or any combination thereof.

[0044] It should be understood that the structure and functionality of environment 100 are described for exemplary purposes only and does not imply any limitation on the scope of the present disclosure.

[0045] Some example embodiments of the present disclosure are described below with reference to the accompanying drawings. Figure 2 FIG. 2 shows a schematic diagram of the structure of an attack behavior detection system 200 according to some embodiments of the present disclosure. Figure 1 The attack behavior detection system 200 is described with reference to the environment 100 of FIG.

[0046] like Figure 2 As shown, the rule generation process for attack behavior detection can be divided into two stages. In the first stage, non-attack behavior data 205 from HIDS 104 is obtained, wherein the non-attack behavior data 205 can be collected from at least one user host in HIDS 104. The non-attack behavior data 205 from HIDS 104 is input into the initialization subsystem 220 for use as baseline behavior data. In the second stage, attack behavior data 210-1, 210-2...210-J (collectively referred to as attack behavior data 210) are obtained, wherein the attack behavior data can be collected from at least one honeypot host, and the attack behavior data 210 from the honeypot network 102 is provided to the attack behavior determination subsystem 230 for generating attack behavior detection rules. Different attack behavior data 210-1, 210-2...210-J may include data collected from the honeypot network 102 at different time periods.

[0047] Based on the non-offensive behavior data 205, the offensive behavior determination subsystem 230 can determine at least one offensive behavior detection rule from the offensive behavior data 210, wherein each offensive behavior detection rule can correspond to a class of offensive behavior. In some embodiments, based on the input offensive behavior data 210 and the output of the initialization subsystem 220, the offensive behavior determination subsystem 230 can output an offensive behavior detection rule. Specifically, the offensive behavior determination subsystem 230 generates at least one offensive behavior detection rule by filtering keywords from the offensive behavior data 210 according to the keywords in the non-offensive behavior data 205 and the keywords in the offensive behavior data 210, wherein each offensive behavior detection rule includes at least one keyword for characterizing offensive behavior. Here, the non-offensive behavior data 205 is considered to be able to characterize normal non-offensive behavior, and therefore can be used as benchmark data. When identifying an offensive behavior detection rule, by taking the non-offensive behavior data 205 as a benchmark, keywords that can be distinguished from non-offensive behavior data and can characterize offensive behavior can be identified from the offensive behavior data 210.

[0048] The determined attack behavior detection rule is provided to the behavior detection subsystem 240 for performing attack behavior detection on the target user host 140. The behavior detection subsystem 240 performs attack behavior detection on the target user host 140 based on at least one attack behavior detection rule.

[0049] The attack behavior data 210 may include instruction sequences (e.g., Shell instruction sequences) collected by one or more honeypot hosts 120 in the honeypot network 102, and may also be referred to as honeypot behavior data. Since the attack behavior data 210 is collected on the honeypot host, it indicates data that may contain abnormal behavior, such as data generated by malicious behavior of a malicious user (e.g., hacker 112). Table 1 below shows an example of the attack behavior data 210.

[0050] Table 1. Example attack behavior data

[0051]

[0052] The non-attack behavior data 205 may represent an instruction sequence (e.g., a Shell instruction sequence) collected by one or more user hosts 130 in the HIDS 104, and may also be referred to as normal behavior data, which represents data generated by normal user behavior, such as data generated by normal behavior (non-malicious behavior) of a normal user (non-malicious user).

[0053] In the first stage, the non-attack behavior data 205 from the HIDS 104 is input to the initialization subsystem 220, so that the initialization subsystem 220 performs data pre-processing and statistics for use by the attack behavior determination subsystem 230. Figures 3 to 5 The process of the first stage of initializing the subsystem 220 is described.

[0054] Figure 3 FIG. 2 shows the structure of the initialization subsystem 220 and the processing of the exemplary non-offensive behavior data 205 according to some embodiments of the present disclosure. Figure 3 As shown, the initialization subsystem 220 includes an instruction aggregation module 320 and a keyword extraction module 330 .

[0055] The non-attack behavior data 205 includes a user command sequence collected from at least one user host 130 of the HIDS 104. In some embodiments, multiple user command sequence sets may be collected from multiple sessions on at least one user host, for example, each session corresponds to a user command sequence set. In some embodiments, the user command sequence may include Shell commands or other commands. Figure 3As shown, the example non-attack behavior data 315 includes host ID: 1, session ID: 100, Shell command: "ls"; host ID: 1, session ID: 100, Shell command: "pwd"; host ID: 2, session ID: 200, Shell command: "history". Behavior data with consistent host IDs (also called host identifiers) can indicate that the behavior data is generated by the same user host, and behavior data with consistent session IDs (also called session identifiers) can indicate that the behavior data is generated by the same session.

[0056] The instruction aggregation module 320 is configured to perform aggregation operations on the non-attack behavior data 205. For example, the user instruction sequence in the non-attack behavior data 205 can be aggregated according to the host identifier (ID) and the session ID to obtain a user instruction sequence set 325 (in this example, it can be a Shell instruction sequence set) grouped by host ID and session ID, wherein the user instruction sequences in each user instruction sequence set have the same host ID and session ID, which can indicate that the user instructions in a user instruction sequence set are all from the same host and the same group of sessions. Figure 3 The example user instruction sequence sets shown include user instruction sequence set 1: Shell instructions "ls" and "pwd" in {"ls", "pwd", ...} both come from the same host and the same group of sessions (in this example, the host ID is 1 and the session ID is 100), and the remaining user instruction sequence sets are similar.

[0057] Figure 4 An example of the aggregation process of the instruction aggregation module 320 on the example non-offensive behavior data 205 is given. Figure 4 In the example of, the example non-attack behavior data 205 in the data stream includes instruction sequences 410, 425, 420 and 425 from various sessions of various user hosts, respectively including: host ID: 1, session ID: 100, Shell instruction: "ls"; host ID: 2, session ID: 112, Shell instruction: "rm.test.sh"; host ID: 3, session ID: 1321, Shell instruction: "history"; host ID: 1, session ID: 100, Shell instruction: "pwd". The example non-attack behavior data 205 is input into the instruction aggregation module 320, and multiple user instruction sequence sets can be obtained, wherein the instructions contained in each user instruction sequence set are from the same user host and the same session. For example, in Figure 4In the example, user instruction sequence set 1 430 includes instructions "ls" and "pwd" from host ID 1 and session ID 100; user instruction sequence set 2 435 includes instruction "rm.test.sh" from host ID 2 and session ID 112; user instruction sequence set 3 440 includes instruction "history -c" from host ID 3 and session ID 1321, and so on.

[0058] In some embodiments, each user instruction sequence set can be regarded as a behavior description document, and multiple behavior description documents corresponding to all non-offensive behavior data 205 can be obtained. In some embodiments, the behavior description documents corresponding to the non-offensive behavior data 205 (i.e., user instruction sequence sets 430, 435, 440, etc.) are input into the keyword extraction module 330. Figure 5 FIG. 3 shows an example structure of a keyword extraction module 330 and processing of an example user instruction sequence set according to some embodiments of the present disclosure. Figure 5 As shown, the keyword extraction module 330 may include a word segmentation module 510 and a word frequency statistics module 530 .

[0059] The word segmentation module 510 may be configured to perform word segmentation (e.g., English word segmentation) on multiple users in the non-offensive behavior data 205. Word segmentation refers to dividing a text sequence into individual words or phrases. Figure 5 As shown, the instructions "ls" and "pwd" included in the user instruction sequence set 1 430 are segmented by the word segmentation module 510 to obtain the character string 515 "ls" and "pwd"; the instruction "rm.test.sh" included in the user instruction sequence set 2 435 is segmented by the word segmentation module 510 to obtain the character string 520 "rm", "test" and "sh"; the instruction "history-c" included in the user instruction sequence set 3 440 is segmented by the word segmentation module 510 to obtain the character string 525 "history" and "-c". After the word segmentation process, the character string obtained after the process can also be cleaned, for example, all IP addresses and pure numbers (i.e., composed entirely of numbers) are cleaned to avoid irrelevant content from interfering with the subsequent extraction of keywords. Since in some cases there may be keywords such as file names that are a combination of English and numbers, the combination of English and numbers can be retained during the cleaning process to avoid mistaken cleaning. After the word segmentation process or the cleaning process, a benchmark keyword set including multiple benchmark keywords (e.g., character strings) can be obtained.

[0060] The word frequency statistics module 530 is configured to perform statistics on the benchmark keywords. Specifically, the word frequency statistics module 530 can count the total number of behavior description documents (i.e., user instruction sequence sets) and the number of behavior description documents containing each benchmark keyword. Figure 5 In the example shown, the total number 535 of behavior description documents is, for example, 18888, the number 540 of behavior description documents containing "ls" is 3200, the number 545 of behavior description documents containing "pwd" is 1800, and the number 550 of behavior description documents containing "rm" is 2800.

[0061] Notice, Figures 3 to 5 The specific instruction sequence and statistical information thereof shown in the figure are merely examples given for the purpose of explanation and do not imply any limitation on the scope of the embodiments of the present disclosure.

[0062] Through the above steps, the initialization of the keyword extraction module in the first phase can be completed. Through the keyword extraction module, the construction of the benchmark keyword set, the number of user instruction sequence sets in the non-aggression behavior data 205, and the number of user instruction sequence sets containing each benchmark keyword are completed. The statistical information obtained from the non-aggression behavior data 205 can be used for the subsequent screening of representative keywords in the attack behavior data 210.

[0063] In the second stage, the attack behavior data 210 collected from the honeypot network 102 can be converted into rules for attack behavior detection. Figures 6 to 8 The process of executing the second phase is described below.

[0064] Figure 6 Schematic diagram showing an example structure of the attack behavior determination subsystem 230 and processing of the example attack behavior data 210 according to some embodiments of the present disclosure. The attack behavior determination subsystem 230 can convert the attack behavior data 210 into an attack behavior detection rule 655 for attack behavior detection. Figure 6 As shown, the attack behavior determination subsystem 230 includes an instruction aggregation module 620 , a keyword extraction module 630 , a keyword clustering compression module 640 , a detection rule generation module 650 , and a detection rule publishing and adjustment module 660 .

[0065] To facilitate subsequent discussion, it is assumed that the attack behavior data 210 includes host ID: 1, session ID: 365, Shell instruction: "chattr-iae / root / .ssh"; host ID: 2, session ID: 365, Shell instruction: ". / meowmeow.Selfrep.arm5", and so on.

[0066] The instruction aggregation module 620 is configured to aggregate the attack behavior data 210 according to the host ID and the session ID to obtain a honeypot instruction sequence set (e.g., honeypot instruction sequence set 625) grouped by the host ID and the session ID. The instruction aggregation module 620 here has the same function as the instruction aggregation module 320 used in the first stage. Figure 6 In the example, after the aggregation operation, the honeypot instruction sequence set 1 is obtained: {“. / meow meow.Selfrep.arm5”, Shell instruction 2, Shell instruction 3, ………}.

[0067] In some embodiments, multiple honeypot instruction sequence sets are determined from the attack behavior data 210, and the multiple honeypot instruction sequence sets can be collected respectively in multiple sessions on at least one honeypot host. For example, each honeypot instruction sequence set can include instruction sequences from sessions on the honeypot host. Multiple candidate keyword sets are extracted from the multiple honeypot instruction sequence sets of the attack behavior data 210. In some embodiments, all character strings of each honeypot instruction sequence set (for example, Shell instructions included in the set) can be used as a behavior description document, and the behavior description documents corresponding to all attack behavior data 210 can be obtained. The behavior description document corresponding to the attack behavior data 210 can be input into the keyword extraction module 630 to obtain a candidate keyword set 635. The keyword clustering compression module 640 can determine the frequency of occurrence of each keyword in the multiple candidate keyword sets in the non-attack behavior data and the non-attack behavior data by referring to the keywords in the non-attack behavior data 205, and determine at least one target keyword set 645 from the multiple candidate keyword sets based on the frequency of occurrence of each keyword. Each target keyword set 645 includes at least one keyword that can be used to characterize the attack behavior.

[0068] Figure 7 A specific example of the keyword extraction module 630 according to some embodiments is given, wherein a schematic diagram of the keyword extraction module 630 processing a honeypot instruction sequence set is shown. Figure 7 As shown, the keyword extraction module 630 may include a word segmentation module 720, a statistical update module 735, an importance calculation module 760, and a keyword determination module 775. The word segmentation module 720 is used to perform word segmentation (for example, English word segmentation) on the behavior description document corresponding to the attack behavior data 210, and the word segmentation method is similar to that of the first stage. Figure 7As shown, the instruction ". / meowmeow.Selfrep.arm5" included in the honeypot instruction sequence set 1 710 is segmented by the word segmentation module 720 to obtain the candidate keyword set 725 "meow", "Selfrep" and "arm5"; the instruction "chattr-iae / root / .ssh" included in the honeypot instruction sequence set 2 715 is segmented by the word segmentation module 720 to obtain the candidate keyword set 730 "chattr", "-iae" and "root".

[0069] In some embodiments, the statistical update module 735 is configured to update the statistics of the total number of behavior description documents, update the statistics of the number of behavior description documents containing each word, and count the word frequency of each word in all behavior description documents. For the statistical update of the total number of behavior description documents, the total number of behavior description documents counted based on the non-attack behavior data 205 during the initialization process of the first stage can be added to the total number of description documents currently counted based on the attack behavior data 210 in the second stage, as the total number of updated behavior description documents. For the statistical update of the number of behavior description documents containing each word, the number of behavior description documents containing each word counted based on the non-attack behavior data 205 during the initialization of the first stage can be added to the number of behavior description documents containing each word currently counted based on the attack behavior data 210 in the second stage, as the number of updated behavior description documents containing each word. For the word frequency of each word in all behavior description documents, the number of times the word appears in the current behavior description document in the second stage is counted divided by the total number of words in the current behavior description document.

[0070] exist Figure 7 In the example shown, the total number of updated behavior description documents 740 is, for example, 18888+25 (where 18888 represents the total number of behavior description documents counted based on the non-offensive behavior data 205 during the initialization process of the first phase, and 25 represents the total number of description documents currently counted based on the offensive behavior data 210 in the second phase), and the updated number of behavior description documents containing "ls" 745 is 3200+? (where 3200 represents the number of behavior description documents containing each word counted based on the non-offensive behavior data 205 during the initialization of the first phase, and "?" represents the number of behavior description documents containing each word currently counted based on the offensive behavior data 210 in the second phase).

[0071] In some embodiments, the importance calculation module 760 is configured to calculate the importance score of each keyword. The importance calculation module 760 can determine the importance score of each keyword in multiple candidate keyword sets based on the frequency of occurrence of each keyword in the attack behavior data 210 and the non-attack behavior data 205, wherein the importance score of the candidate keyword indicates the degree to which the candidate keyword can characterize the attack behavior. Generally, the higher the frequency of a keyword in a candidate keyword set, and the lower the frequency of its occurrence in each keyword set in the attack behavior data 210 and the non-attack behavior data 205, the more representative the keyword is for a certain attack behavior.

[0072] In some embodiments, the importance score of a keyword can be calculated by term frequency-inverse document frequency (TF-IDF). The TF value can be determined by the term frequency of each keyword in a plurality of candidate keyword sets in the corresponding candidate keyword set, for example, by counting the number of times the current keyword appears in the current behavior description document. The IDF value can be determined by the inverse document frequency of each keyword in a plurality of candidate keyword sets in a plurality of benchmark keyword sets and a plurality of candidate keyword sets, for example, by calculating the total number of behavior description documents divided by the number of behavior description documents containing the word. Then, the importance score of each keyword is determined based on the IDF and TF of each keyword in the plurality of candidate keyword sets. The importance score of a keyword is the product of the TF value and the IDF value of the keyword. The higher the importance score of a keyword, the more representative the keyword is, indicating that the keyword appears more in the current behavior and less in all behaviors. Figure 7 In the example shown, the importance score of the keyword meow in the candidate keyword set 765 corresponding to the host identifier 1 session identifier 365 is 12.5, the importance score of Selfrep is 11.1, and the importance score of arm5 is 2.0. The scheme disclosed herein utilizes the word frequency difference between the non-attack behavior data 205 and the attack behavior data 210 to filter out representative keywords in the attack behavior data 210.

[0073] Table 2 below shows the importance scores corresponding to the keywords of the example.

[0074] Table 2. Example keywords and their importance scores

[0075] Keywords Importance score meow 12.8 Selfrep 10.8 curl 1.2 f 2.5 …… ……

[0076] In some embodiments, the keyword determination module 775 is configured to determine at least one target keyword set from multiple candidate keyword sets according to the importance score of each keyword in the multiple candidate keyword sets, wherein each target keyword set can be used to characterize attack behavior.

[0077] In some embodiments, a predetermined number (e.g., 10) of keywords with the highest importance scores are extracted from the candidate keyword set. Each keyword extracted in this way is representative to a certain extent, and a summary of the entire honeypot instruction sequence set can be formed by the predetermined number of keywords extracted in this way. Different honeypot instruction sequence sets can be distinguished by the summary including keywords. Since the keyword extraction module 630 is initialized by the non-attack behavior data 205, it is possible to ensure that the extracted honeypot behavior keywords belong to malicious behavior by giving lower importance scores to words belonging to normal behavior in the collected attack behavior data 210. Figure 7 In the example shown, the candidate keyword set 780 corresponding to the host ID 1 and the session ID 365 includes the determined keywords meow and Selfrep. The candidate keyword set 785 corresponding to the host ID 2 and the session ID 365 includes the determined keywords ls and pwd.

[0078] In order to compress and merge the candidate keyword set 635, the candidate keyword set can be input into the keyword clustering compression module 640. Multiple candidate keyword sets (e.g., all candidate keyword sets) can be clustered by a clustering algorithm to obtain at least one keyword set cluster after clustering, wherein each keyword set cluster can include at least two candidate keyword sets. In some embodiments, a SinglePass clustering algorithm can be used, and the feature can adopt a bag-of-words model suitable for text clustering, so that after adding new data, the clustering results can be directly updated on the basis of the current clustering results. Other clustering algorithms can also be selected, such as K-Means, AGNES, etc., but are not limited to this.

[0079] Each keyword set cluster includes multiple groups of candidate keyword sets, and some candidate keyword sets included in a keyword set cluster may have certain similarities, for example, they may be from the same intrusion behavior (attack behavior). For each keyword set cluster, based on the importance scores of each keyword included in the keyword set cluster, an active keyword set is selected from at least two candidate keyword sets included in the keyword set cluster. In some embodiments, for each candidate keyword set in at least two candidate keyword sets, the number of keywords in the candidate keyword set whose importance scores exceed a first predetermined threshold is determined. Based on the determined number of keywords exceeding the first predetermined threshold, an active keyword set is selected from at least two candidate keyword sets. For example, the candidate keyword set with the largest number of keywords with importance scores greater than the threshold can be used as the active keyword set in the keyword set cluster where it is located. The first predetermined threshold here can be related to the ratio of non-attack behavior data 205 and attack behavior data 210. Keywords with importance scores exceeding the first predetermined threshold indicate that they are highly likely to be keywords unique to the attack behavior data 210, and the specific value of the first predetermined threshold is not limited.

[0080] After selecting an active keyword set for each keyword set cluster, an active keyword set can be determined in each keyword set cluster, indicating the representative behavior of the keyword set cluster. In some embodiments, the target keyword set can be determined based on the selected active keyword set. In some embodiments, at least one keyword can be deleted from the active keyword set based on the comparison of the importance score of each keyword in the active keyword set with the second predetermined threshold value to obtain the target keyword set. For example, the active keyword set can be cleaned to retain only the keywords with an importance score greater than the second predetermined threshold value and remove other keywords. In some embodiments, the trigger words of the target keyword set are determined based on at least one of the importance scores of each keyword in the active keyword set and the character length of each keyword. For example, for each active keyword set, a keyword (for example, the first keyword that meets the condition, any keyword that meets the condition) with an importance score greater than the average importance score of the keywords in the active keyword set and a character length greater than a predetermined length (for example, 4) is screened, and the keyword is marked as a trigger word.

[0081] In some embodiments, when there are multiple keyword set clusters, if the trigger words of a certain active keyword set in the multiple active keyword sets selected for the multiple keyword set clusters are the same, then these active keyword sets can be merged. For example, if the trigger words of the first active keyword set and the second active keyword set are the same, the first active keyword set and the second active keyword set are merged to obtain a target keyword set. This can not only further reduce the number of target keyword sets, but also enable different target keyword sets to include different trigger words. By traversing all active keyword sets, active keyword sets with the same trigger words can be merged, and the merged active keyword sets can be processed to remove duplicate words. For example, a union of multiple active keyword sets with the same trigger words can be taken. In the example embodiment of the present disclosure, the trigger word has at least the following functions: the trigger word can be used as a pre-matched object in the generated rule to realize trigger detection (if the trigger word is not matched, no subsequent detection is required), and multiple active keyword sets can also be merged through the trigger word, further reducing the number of active keyword sets, reducing the amount of calculation, saving resources and improving efficiency.

[0082] Figure 8 The specific structure of the keyword clustering compression module 640 in the attack behavior determination subsystem 230 is given. The target keyword set 645 can be obtained through the keyword clustering compression module 640. Figure 8 FIG. 8 is a schematic diagram showing how the candidate keyword set is compressed and merged by the keyword clustering compression module 640 according to some embodiments of the present disclosure. The keyword clustering compression module 640 may include a clustering module 820 and a screening module 840, such as Figure 8 As shown, firstly, the candidate keyword set is clustered and compressed by the clustering module 820 to obtain the keyword set cluster (such as Figure 8 As shown, keyword set cluster 1 825, keyword set cluster 2 830 and keyword set cluster 3 835), wherein each keyword set cluster includes multiple sets of candidate keyword sets with similarity. The screening module 840 is configured to screen active keyword sets and trigger words in the keyword set clusters.

[0083] like Figure 8As shown, the active keyword set 845 with host ID 1 and session ID 365 includes {meow; Selfrep}, and the trigger word is meow; the active keyword set 850 with host ID 1 and session ID 277 includes {meow; watchd0g}, and the trigger word is meow; the active keyword set 855 with host ID 2 and session ID 365 includes {xmrig; minor}, and the trigger word is xmrig. Since the trigger words corresponding to the active keyword set 845 and the active keyword set 850 are the same, both are meow, the two can be merged to remove duplicates. The target keyword set 860 obtained after the merger includes {meow; Selfrep; watchd0g}. It can be seen that the merged target keyword set includes all the words in the two active keyword sets, and there are no repeated words. Here, the session ID corresponding to the target keyword set 860 is the same as the session ID corresponding to the active keyword set 845, which is only used as an example. Since the merging process is based on trigger words and is irrelevant to the host ID and session ID, the host ID and session ID corresponding to the target keyword set 860 may be the host ID and session ID corresponding to the active keyword set 845 and / or the active keyword set 850 .

[0084] The target keyword set obtained by the attack behavior determination subsystem 230 may be provided to the behavior detection subsystem 240. Each target keyword set may be considered as an attack behavior detection rule. The behavior detection subsystem 240 is configured to detect the target user host (e.g., Figure 1 The target user host 140) performs attack behavior detection.

[0085] In some embodiments, the detection subsystem 240 may determine the attack behavior detection result on the target user host based at least on the degree of match between at least one user instruction collected from the target user host and at least one target keyword set, wherein the attack behavior detection result may indicate whether the attack behavior has occurred. For example, the user instruction is matched with the target keyword set, and if the user instruction has a high degree of match with a certain target keyword set in the target keyword set (for example, the user instruction has a high degree of match with multiple keywords in a certain target keyword set), it can be considered that the user instruction indicates the occurrence of the attack behavior. The degree of match may be calculated by similarity, and may be calculated by converting a string into a vector and calculating by vector distance.

[0086] In some embodiments, when each target keyword set in at least one target keyword set includes a trigger word and at least one keyword, the degree of match between the first user instruction collected from the target user host and the trigger word in the at least one target keyword set is determined based at least on the degree of match between at least one user instruction collected from the target user host and the at least one target keyword set. Specifically, for each target keyword set, a rule for matching the trigger word is generated, for example, when it is detected that the user instruction (for example, Shell instruction) contains the trigger word, it indicates a hit. Attack behavior detection rules can also be generated for the keywords in the target keyword set, for example, when it is detected that the executed user instruction contains the keywords in the target keyword set, it indicates a hit.

[0087] In some embodiments, the attack behavior determination subsystem 230 can generate at least one attack behavior detection rule based on at least one target keyword set, and publish the attack behavior detection rule to the behavior detection subsystem 240. Specifically, in the attack behavior determination subsystem 230, the target keyword set obtained after processing by the keyword clustering compression module 640 is input to the detection rule generation module 650 for generating an attack behavior detection rule adapted to the HIDS. The detection rule generation module 650 generates at least one attack behavior detection rule from at least one target keyword set.

[0088] By automatically converting the attack behavior data 210 into HIDS detection rules, automatic perception and detection of unknown threats can be achieved, thereby improving the attack behavior detection capability of the HIDS.

[0089] Fig. 9 FIG. 6 is a flow chart showing a process of generating attack behavior detection rules 655 according to some embodiments of the present disclosure. Fig. 9 As shown, it is assumed that the target keyword set 860 and the target keyword set 865 are obtained by the keyword clustering compression module 640. From the target keyword set 860, an attack behavior detection rule 910 with the trigger word "meow" can be determined, and from the target keyword set 865, an attack behavior detection rule 915 with the trigger word "xmrig" can be determined. Rules matching keywords in the target keyword set can also be obtained, such as an attack behavior detection rule 920 matching keywords [meow; Selfrep; Watchd0g; ...], and an attack behavior detection rule 925 matching keywords [xmrig; miner; ...].

[0090] If it is determined that the first user instruction matches the first trigger word in the first target keyword set, multiple user instructions from the target user host are obtained based on the first user instruction. In some embodiments, multiple user instructions from the target user host are obtained based on the host ID and session ID of the first user instruction. Based on the degree of matching between the multiple user instructions and at least one keyword in the first target keyword set, the attack behavior detection result is determined. For example, in the case where it is detected that the user instruction contains a trigger word, the host ID and session ID within a predetermined time (for example, 30 minutes) are filtered out, and the data that are consistent with the current user instruction and have the same host ID and session ID as the current user instruction are filtered out, and the number of types of keywords in the attack behavior detection rule that are hit in these data is counted, for example, several keywords are hit, and if the number of types is greater than a preset threshold, an alarm is issued. For example, the user instruction is first matched with the trigger word rule, and if the trigger word rule is not hit, the user instruction is ignored. If the trigger word rule is hit, the keyword rule is matched. If the keyword rule is hit, an alarm is issued; if the keyword rule is not hit, the user instruction is ignored. Here, filtering out the data within a predetermined time may be to trace back the historical data within the predetermined time, or to detect the data within the predetermined time backward from the current time point, for example, the data from the current time to 30 minutes later.

[0091] According to the technical solution of the present disclosure, the generation of attack behavior detection rules includes screening out one or more target keyword sets that can characterize attack behaviors or malicious behaviors from the attack behavior data collected from the honeypot host, and each target keyword set includes keywords extracted from the instruction sequence that initiates the attack behavior. When determining the target keyword set, it also relies on the non-attack behavior data collected from the user host. By comparing the keywords of the instruction sequence of the non-attack behavior data, it is possible to screen out keywords that can accurately characterize the attack behavior. In this way, by combining the attack behavior data from the honeypot and the non-attack behavior data from the user host, the attack behavior data of the honeypot can be automatically converted into rules for behavior detection, that is, target keyword matching.

[0092] Fig.10 A specific example of the rule publishing process according to some embodiments of the present disclosure is given. Fig.10 As shown, after the detection rule publishing and adjustment module 660 determines the attack behavior detection rule 1 and the attack behavior detection rule 2, it can publish the rules (for example, publish a specific detection rule, or publish a target keyword set). The published attack behavior detection rules can be applied to HIDS (for example, Figure 1 In the case where the HIDS detects an attack behavior according to the rule, an alarm result is provided.

[0093] In some embodiments, the generated attack behavior detection rules can be pushed to the HIDS through the detection rule publishing and adjustment module 660 for incremental updates. In some embodiments, additional attack behavior data is collected from at least one honeypot host, and the attack behavior determination subsystem 230 updates the currently existing attack behavior detection rules based on the additional attack behavior data, such as the determined at least one target keyword set for attack behavior detection. The additional attack behavior data can be collected regularly, periodically, or in real time, and the target keyword set can also be updated regularly, periodically, or in real time, so that the attack behavior detection rules can be continuously produced, for example, the attack behavior detection rules are iteratively updated every hour or every day, so that the HIDS can apply the latest attack behavior detection rules in a timely manner. Figure 2 As shown, for different attack behavior data 210-1...210-J, the determined target keyword set can be further updated based on the above-described embodiments. The update of the target keyword set includes adding one or more new target keyword sets, adding, deleting and modifying keywords or trigger words in the existing target keyword set, deleting the existing target keyword set, and so on. The updated behavior detection rules can continue to be published and used to perform attack behavior detection on the target user host. In this way, by continuously collecting attack behavior data through the honeypot host to update the attack behavior detection rules, it is possible to track new attack patterns and continuously ensure the security of the user host.

[0094] In the scheme disclosed in the present invention, since normal behavior data is used for initialization, the false alarm rate of the generated rules is low. At the same time, the attack behavior detection rules generated have generalization capabilities and can detect variant behaviors of some malicious samples. The generated overall detection rules have the logic of detecting trigger words first and then keywords, which can effectively improve the efficiency in user instruction sequence detection.

[0095] It should be understood that the exemplary instruction sequences and rule codes are given in the drawings and descriptions for the purpose of explanation only, but this does not impose any limitation on the scope of the present disclosure. The embodiments of the present disclosure can be similarly applied to any other types of instruction sequences and codes.

[0096] Example Process

[0097] Fig.11 1 shows a flow chart of a method 1100 for attack behavior detection according to some embodiments of the present disclosure. Exemplarily, the method 1100 may be implemented by an electronic device, which may include, for example, Figure 2 Attack behavior detection system 200.

[0098] like Fig.11As shown, in box 1110, the electronic device obtains attack behavior data and non-attack behavior data, the attack behavior data is collected from at least one honeypot host, and the non-attack behavior data is collected from at least one user host.

[0099] In box 1120, the electronic device generates at least one offensive behavior detection rule by filtering keywords from the offensive behavior data according to the keywords in the non-offensive behavior data and the keywords in the offensive behavior data, wherein each offensive behavior detection rule includes at least one keyword for characterizing the offensive behavior.

[0100] In block 1130 , the electronic device performs attack behavior detection on the target user host based on at least one attack behavior detection rule.

[0101] In some embodiments, filtering keywords from attack behavior data to generate at least one attack behavior detection rule includes: determining multiple honeypot instruction sequence sets from the attack behavior data, each honeypot instruction sequence set including an instruction sequence from a session on a honeypot host; based on the frequency of occurrence of each keyword in multiple candidate keyword sets in the attack behavior data and non-attack behavior data, determining at least one target keyword set from the multiple candidate keyword sets, each target keyword set including at least one keyword for characterizing the attack behavior; and generating at least one attack behavior detection rule from the at least one target keyword set.

[0102] In some embodiments, determining at least one target keyword set from multiple candidate keyword sets includes: determining an importance score for each keyword in the multiple candidate keyword sets based on the frequency of occurrence of each keyword in the multiple candidate keyword sets in the keywords in the attack behavior data and the keywords in the non-attack behavior data, the importance score of the candidate keyword indicating the extent to which the candidate keyword can characterize the attack behavior; and determining at least one target keyword set from the multiple candidate keyword sets based on the importance score of each keyword in the multiple candidate keyword sets.

[0103] In some embodiments, the non-offensive behavior data includes multiple user instruction sequence sets collected from at least one user host, and multiple benchmark keyword sets are respectively extracted from the multiple user instruction sequence sets; and determining the importance score of each keyword in the multiple candidate keyword sets includes: determining the inverse document frequency IDF of each keyword in the multiple candidate keyword sets in the multiple benchmark keyword sets and the multiple candidate keyword sets; determining the word frequency TF of each keyword in the multiple candidate keyword sets in the corresponding candidate keyword sets; and determining the importance score of each keyword based on the IDF and TF of each keyword in the multiple candidate keyword sets.

[0104] In some embodiments, based on the importance scores of each keyword in multiple candidate keyword sets, determining at least one target keyword set from multiple candidate keyword sets includes: clustering the multiple candidate keyword sets to obtain at least one keyword set cluster, each keyword set cluster including at least two candidate keyword sets; and for each keyword set cluster, based on the importance scores of each keyword included in the keyword set cluster, selecting an active keyword set from the at least two candidate keyword sets included in the keyword set cluster, and determining the target keyword set based on the selected active keyword set.

[0105] In some embodiments, for each keyword set cluster, selecting an active candidate keyword set from at least two candidate keyword sets included in the keyword set cluster includes: for each candidate keyword set in the at least two candidate keyword sets, determining the number of keywords in the candidate keyword set whose importance scores exceed a first predetermined threshold; and based on the determined number of keywords that exceed the first predetermined threshold, selecting an active keyword set from the at least two candidate keyword sets.

[0106] In some embodiments, determining the target keyword set based on the selected active keyword set includes: deleting at least one keyword from the active keyword set based on comparison of importance scores of each keyword in the active keyword set with a second predetermined threshold to obtain the target keyword set.

[0107] In some embodiments, based on the importance scores of each keyword in multiple candidate keyword sets, determining at least one target keyword set from multiple candidate keyword sets includes: determining the trigger words of the target keyword set based on at least one of the importance scores of each keyword in the active keyword set and the character length of each keyword.

[0108] In some embodiments, at least one keyword set cluster includes multiple keyword set clusters, and determining at least one target keyword set further includes: if the trigger words of a first active keyword set and a second active keyword set in multiple active keyword sets selected for the multiple keyword set clusters are the same, merging the first active keyword set and the second active keyword set to obtain a target keyword set, and the target keyword set at least includes the same trigger words.

[0109] In some embodiments, performing attack behavior detection on a target user host includes: determining whether at least one user instruction collected from the target user host satisfies at least one attack behavior detection rule; and determining an attack behavior detection result on the target user host based on the determination of whether at least one user instruction satisfies at least one attack behavior detection rule, the attack behavior detection result indicating whether an attack behavior has occurred. In some embodiments, each of the at least one attack behavior detection rule includes a trigger word and at least one keyword, and wherein determining whether at least one user instruction collected from the target user host satisfies at least one attack behavior detection rule includes: determining a degree of match between a first user instruction collected from the target user host and a trigger word in at least one target attack behavior detection rule; if it is determined that the first user instruction matches the first trigger word in the first attack behavior detection rule, obtaining multiple user instructions from the target user host based on the first user instruction; and determining whether the first attack behavior detection rule is satisfied based on a degree of match between the multiple user instructions and at least one keyword in the first attack behavior detection rule.

[0110] In some embodiments, acquiring multiple user instructions from the target user host based on the first user instruction includes: acquiring multiple user instructions from the target user host based on a host identifier and a session identifier of the first user instruction.

[0111] In some embodiments, the electronic device may also: collect additional attack behavior data from at least one honeypot host; update at least one attack behavior detection rule based on the additional attack behavior data; and perform attack behavior detection on the target user host based on the updated at least one attack behavior detection rule.

[0112] Fig.12 FIG. 1 is a schematic structural block diagram of an apparatus 1200 for attack behavior detection according to some embodiments of the present disclosure. The apparatus 1200 may be implemented in an electronic device, for example, Figure 2 The attack behavior detection system 200 or one or more subsystems thereof. Each module / component in the device 1200 can be implemented by hardware, software, firmware or any combination thereof.

[0113] like Fig.12As shown, the device 1200 includes a data acquisition module 1210, which is configured to acquire attack behavior data and non-attack behavior data, the attack behavior data is collected from at least one honeypot host, and the non-attack behavior data is collected from at least one user host. The device 1200 also includes a rule generation module 1220, which is configured to filter keywords from the attack behavior data to generate at least one attack behavior detection rule based on keywords in the non-attack behavior data and keywords in the attack behavior data, wherein each attack behavior detection rule includes at least one keyword for characterizing the attack behavior. The device 1200 further includes a behavior detection module 1230, which is configured to perform attack behavior detection on the target user host based on at least one attack behavior detection rule.

[0114] In some embodiments, the rule generation module 1220 is configured to determine multiple honeypot instruction sequence sets from the attack behavior data, each honeypot instruction sequence set including an instruction sequence from a session on a honeypot host; extract multiple candidate keyword sets from the multiple honeypot instruction sequence sets of the attack behavior data; determine at least one target keyword set from the multiple candidate keyword sets based on the frequency of occurrence of each keyword in the multiple candidate keyword sets in the keywords in the attack behavior data and the keywords in the non-attack behavior data, each target keyword set including at least one keyword for characterizing the attack behavior; and generate at least one attack behavior detection rule from the at least one target keyword set.

[0115] In some embodiments, the rule generation module 1220 is configured to determine the importance score of each keyword in multiple candidate keyword sets based on the frequency of occurrence of each keyword in the multiple candidate keyword sets in the keywords in the attack behavior data and the keywords in the non-attack behavior data, the importance score of the candidate keyword indicating the extent to which the candidate keyword can characterize the attack behavior; and determine at least one target keyword set from the multiple candidate keyword sets based on the importance score of each keyword in the multiple candidate keyword sets.

[0116] In some embodiments, the non-offensive behavior data includes multiple user instruction sequence sets collected from at least one user host, and multiple benchmark keyword sets are respectively extracted from the multiple user instruction sequence sets; and the score determination module 1220 is also configured to determine the inverse document frequency IDF of each keyword in the multiple candidate keyword sets in the multiple benchmark keyword sets and the multiple candidate keyword sets; determine the word frequency TF of each keyword in the multiple candidate keyword sets in the corresponding candidate keyword sets; and determine the importance score of each keyword based on the IDF and TF of each keyword in the multiple candidate keyword sets.

[0117] In some embodiments, the rule generation module 1220 is configured to cluster multiple candidate keyword sets to obtain at least one keyword set cluster, each keyword set cluster including at least two candidate keyword sets; and for each keyword set cluster, based on the importance scores of each keyword included in the keyword set cluster, select an active keyword set from the at least two candidate keyword sets included in the keyword set cluster, and determine the target keyword set based on the selected active keyword set.

[0118] In some embodiments, for each keyword set cluster, the rule generation module 1220 is also configured to determine, for each candidate keyword set in at least two candidate keyword sets, the number of keywords in the candidate keyword set whose importance scores exceed a first predetermined threshold; and based on the determined number of keywords that exceed the first predetermined threshold, select an active keyword set from the at least two candidate keyword sets.

[0119] In some embodiments, the rule generation module 1220 is configured to delete at least one keyword from the active keyword set based on a comparison between the importance scores of the keywords in the active keyword set and a second predetermined threshold to obtain a target keyword set.

[0120] In some embodiments, the rule generation module 1220 is configured to determine the trigger words of the target keyword set based on at least one of the importance score of each keyword in the active keyword set and the character length of each keyword.

[0121] In some embodiments, at least one keyword set cluster includes multiple keyword set clusters, and the rule generation module 1220 is also configured to merge the first active keyword set and the second active keyword set in the multiple active keyword sets selected for the multiple keyword set clusters to obtain a target keyword set if the trigger words of the first active keyword set and the second active keyword set are the same, and the target keyword set includes at least the same trigger words.

[0122] In some embodiments, the behavior detection module 1230 is configured to determine whether at least one user instruction collected from the target user host satisfies at least one attack behavior detection rule; and based on the determination of whether at least one user instruction satisfies at least one attack behavior detection rule, determine the attack behavior detection result on the target user host, and the attack behavior detection result indicates whether the attack behavior occurs.

[0123] In some embodiments, each of the at least one attack behavior detection rule includes a trigger word and at least one keyword, and the behavior detection module 1230 is further configured to determine the degree of match between a first user instruction collected from the target user host and the trigger word in at least one target attack behavior detection rule; if it is determined that the first user instruction matches the first trigger word in the first attack behavior detection rule, obtain multiple user instructions from the target user host based on the first user instruction; and determine whether the first attack behavior detection rule is satisfied based on the degree of match between the multiple user instructions and at least one keyword in the first attack behavior detection rule.

[0124] In some embodiments, the behavior detection module 1230 is further configured to obtain multiple user instructions from the target user host based on the host identifier and the session identifier of the first user instruction.

[0125] In some embodiments, the rule generation module 1220 is further configured to collect additional attack behavior data from at least one honeypot host; and update at least one attack behavior detection rule based on the additional attack behavior data. The behavior detection module 1230 is further configured to perform attack behavior detection on the target user host based on the updated at least one attack behavior detection rule.

[0126] Fig.13 1 shows a block diagram of an electronic device 1300 in which one or more embodiments of the present disclosure may be implemented. It should be understood that Fig.13 The electronic device 1300 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein. Fig.13 The electronic device 1300 shown can be used to implement Figure 1 electronic device 130.

[0127] like Fig.13 As shown, the electronic device 1300 is in the form of a general electronic device. The components of the electronic device 1300 may include, but are not limited to, one or more processors or processing units 1205, a memory 1320, a storage device 1330, one or more communication units 1340, one or more input devices 1350, and one or more output devices 1360. The processing unit 1205 may be an actual or virtual processor and is capable of performing various processes according to a program stored in the memory 1320. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to improve the parallel processing capability of the electronic device 1300.

[0128] The electronic device 1300 typically includes a plurality of computer storage media. Such media may be any accessible media accessible to the electronic device 1300, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 1320 may be a volatile memory (e.g., registers, caches, random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 1330 may be a removable or non-removable medium, and may include a machine-readable medium, such as a flash drive, a disk, or any other medium, which may be capable of being used to store information and / or data and may be accessed within the electronic device 1300.

[0129] The electronic device 1300 may further include additional removable / non-removable, volatile / non-volatile storage media. Fig.13 As shown in , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to the bus (not shown) by one or more data media interfaces. Memory 1320 may include a computer program product 1325 having one or more program modules that are configured to perform various methods or actions of various embodiments of the present disclosure.

[0130] The communication unit 1340 implements communication with other electronic devices through a communication medium. Additionally, the functions of the components of the electronic device 1300 can be implemented in a single computing cluster or multiple computing machines that can communicate through a communication connection. Therefore, the electronic device 1300 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

[0131] The input device 1350 may be one or more input devices, such as a mouse, a keyboard, a tracking ball, etc. The output device 1360 may be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 1300 may also communicate with one or more external devices (not shown) through the communication unit 1340 as needed, such as a storage device, a display device, etc., communicate with one or more devices that allow a user to interact with the electronic device 1300, or communicate with any device that allows the electronic device 1300 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0132] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above.

[0133] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices, equipment, and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0134] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0135] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable data processing apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0136] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple implementations of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some implementations as replacements, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0137] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

Claims

1. A method for attack behavior detection, comprising: Determining the behavior data collected from at least one honeypot host as attack behavior data, and determining the behavior data collected from at least one user host as non-attack behavior data; According to the keywords in the non-offensive behavior data and the keywords in the offensive behavior data, the keywords are filtered out from the offensive behavior data to generate at least one offensive behavior detection rule, wherein each offensive behavior detection rule includes at least one keyword for characterizing the offensive behavior, wherein filtering the keywords from the offensive behavior data to generate the at least one offensive behavior detection rule includes: Determine a plurality of honeypot instruction sequence sets from the attack behavior data, each honeypot instruction sequence set comprising an instruction sequence from a session on a honeypot host; Extracting a plurality of candidate keyword sets from the plurality of honeypot instruction sequence sets respectively; Determining the importance score of each keyword in the plurality of candidate keyword sets based on the frequency of occurrence of each keyword in the offensive behavior data and the keyword in the non-offensive behavior data; Based on the importance scores of the respective keywords in the plurality of candidate keyword sets, determining at least one target keyword set from the plurality of candidate keyword sets, each target keyword set including at least one keyword for characterizing an attack behavior, the importance scores of the candidate keywords indicating the extent to which the candidate keywords can characterize the attack behavior; and Generating the at least one attack behavior detection rule from the at least one target keyword set respectively; and Based on the at least one attack behavior detection rule, attack behavior detection is performed on the target user host.

2. The method according to claim 1, wherein the non-offensive behavior data comprises a plurality of user instruction sequence sets collected from at least one user host, and a plurality of benchmark keyword sets are respectively extracted from the plurality of user instruction sequence sets; and Determining the importance score of each keyword in the plurality of candidate keyword sets includes: Determine the inverse document frequency (IDF) of each keyword in the plurality of candidate keyword sets in the plurality of benchmark keyword sets and the plurality of candidate keyword sets; Determine the word frequency TF of each keyword in the plurality of candidate keyword sets in the corresponding candidate keyword set; and The importance score of each keyword is determined based on the IDF and TF of each keyword in the plurality of candidate keyword sets.

3. The method according to claim 1, wherein determining the at least one target keyword set from the plurality of candidate keyword sets based on the importance score of each keyword in the plurality of candidate keyword sets comprises: Clustering the multiple candidate keyword sets to obtain at least one keyword set cluster, each keyword set cluster including at least two candidate keyword sets; as well as For each keyword set cluster, Based on the importance score of each keyword included in the keyword set cluster, selecting an active keyword set from at least two candidate keyword sets included in the keyword set cluster, and A target keyword set is determined based on the selected active keyword set.

4. The method according to claim 3, wherein for each keyword set cluster, selecting an active candidate keyword set from at least two candidate keyword sets included in the keyword set cluster comprises: For each candidate keyword set in the at least two candidate keyword sets, determining the number of keywords in the candidate keyword set whose importance scores exceed a first predetermined threshold; as well as An active keyword set is selected from the at least two candidate keyword sets based on the determined number of keywords exceeding the first predetermined threshold.

5. The method of claim 3, wherein determining the target keyword set based on the selected active keyword set comprises: Based on the comparison between the importance score of each keyword in the active keyword set and a second predetermined threshold, at least one keyword is deleted from the active keyword set to obtain the target keyword set.

6. The method according to claim 3, wherein determining the at least one target keyword set from the plurality of candidate keyword sets based on the importance score of each keyword in the plurality of candidate keyword sets comprises: The trigger words of the target keyword set are determined based on at least one of the importance score of each keyword in the active keyword set and the character length of each keyword.

7. The method of claim 6, wherein the at least one keyword set cluster comprises a plurality of keyword set clusters, and wherein determining the at least one target keyword set further comprises: If the trigger words of the first active keyword set and the second active keyword set in the multiple active keyword sets selected for clustering the multiple keyword sets are the same, the first active keyword set and the second active keyword set are merged to obtain a target keyword set, and the target keyword set at least includes the same trigger words.

8. The method according to claim 1, wherein performing attack behavior detection on the target user host comprises: Determining whether at least one user instruction collected from the target user host satisfies at least one attack behavior detection rule; as well as Based on determining whether the at least one user indication satisfies the at least one attack behavior detection rule, an attack behavior detection result on the target user host is determined, the attack behavior detection result indicating whether an attack behavior occurs.

9. The method according to claim 8, wherein each of the at least one attack behavior detection rule comprises a trigger word and at least one keyword, and wherein determining whether at least one user instruction collected from the target user host satisfies the at least one attack behavior detection rule comprises: Determining a degree of match between a first user instruction collected from the target user host and a trigger word in the at least one target attack behavior detection rule; If it is determined that the first user instruction matches the first trigger word in the first attack behavior detection rule, obtaining multiple user instructions from the target user host based on the first user instruction; as well as Whether the first attack behavior detection rule is satisfied is determined based on the matching degree between the multiple user instructions and at least one keyword in the first attack behavior detection rule.

10. The method according to claim 9, wherein acquiring a plurality of user instructions from the target user host based on the first user instruction comprises: Based on the host identifier and the session identifier of the first user instruction, the plurality of user instructions from the target user host are acquired.

11. The method according to claim 1, further comprising: collecting additional attack behavior data from the at least one honeypot host; updating the at least one offensive behavior detection rule based on the additional offensive behavior data; as well as Attack behavior detection is performed on the target user host based on the updated at least one attack behavior detection rule.

12. A device for attack behavior detection, comprising: A data acquisition module configured to determine the behavior data collected from at least one honeypot host as attack behavior data, and to determine the behavior data collected from at least one user host as non-attack behavior data; A rule generation module is configured to filter keywords from the offensive behavior data to generate at least one offensive behavior detection rule based on keywords in the non-offensive behavior data and keywords in the offensive behavior data, wherein each offensive behavior detection rule includes at least one keyword for characterizing the offensive behavior, wherein the rule generation module is further configured to: Determine a plurality of honeypot instruction sequence sets from the attack behavior data, each honeypot instruction sequence set comprising an instruction sequence from a session on a honeypot host; Extracting a plurality of candidate keyword sets from the plurality of honeypot instruction sequence sets respectively; Determining the importance score of each keyword in the plurality of candidate keyword sets based on the frequency of occurrence of each keyword in the offensive behavior data and the keyword in the non-offensive behavior data; Based on the importance scores of the respective keywords in the plurality of candidate keyword sets, determining at least one target keyword set from the plurality of candidate keyword sets, each target keyword set including at least one keyword for characterizing an attack behavior, the importance scores of the candidate keywords indicating the extent to which the candidate keywords can characterize the attack behavior; and Generating the at least one attack behavior detection rule from the at least one target keyword set respectively; and The behavior detection module is configured to perform attack behavior detection on the target user host based on the at least one attack behavior detection rule.

13. An electronic device comprising: at least one processing unit; as well as At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 11 when executed by the at least one processing unit.

14. A computer-readable storage medium having a computer program stored thereon, wherein the computer program can be executed by a processor to implement the method according to any one of claims 1 to 11.

Images