A multi-stage cascaded edge threat detection system, edge computing node, central computing node, method, apparatus, storage medium and program product

Abstract

The application provides a multi-stage cascaded edge threat detection system, an edge computing node, a center computing node, a method, a device, a storage medium and a program product. The lower access node in the cascaded architecture is set as an edge computing node with computing capability, so that the edge computing node can only transmit the result of log detection, and the bandwidth usage between the cascaded nodes is greatly reduced. Moreover, the center computing node can dynamically adjust the detection content of the edge node, and the simple stateless streaming calculation is distributed to the edge computing node, so that hierarchical threat detection is realized. Moreover, the log data related to abnormal threats can be calculated nearby, so that the efficiency of threat discovery is higher.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a multi-level cascaded edge threat detection system, an edge computing node, a center computing node, a method, an apparatus, a storage medium and a program product. BACKGROUND

[0002] Large enterprises increasingly use the mode of "central console combined with multiple distributed access points" to realize the deployment of terminal security solutions. It can realize terminal access nearby, and then manage through the central console.

[0003] However, in the Endpoint Detection and Response (EDR) scene, a large number of logs need to be collected from each terminal and transmitted to the central console for analysis and storage.

[0004] In the prior art, when threat detection is performed in the EDR scene, a large amount of bandwidth resources is occupied between access points due to the need to transmit logs in the system, thereby increasing the delay of threat discovery. SUMMARY

[0005] The purpose of the present application is to provide a multi-level cascaded edge threat detection system, an edge computing node, a center computing node, a method, an apparatus, a storage medium and a program product, which is used to reduce the bandwidth usage of detection and improve the efficiency of threat discovery.

[0006] In order to achieve the above purpose, the technical solutions adopted by the embodiments of the present application are as follows:

[0007] In a first aspect, the embodiments of the present application provide an edge threat detection system, comprising: a center computing node, at least one edge computing node and at least one terminal; wherein the center computing node is in communication connection with at least one edge computing node; the terminal is in communication connection with the corresponding edge computing node;

[0008] The edge computing node is configured to obtain logs of all first lower-level terminals; perform threat detection according to all logs to obtain all first alarm messages, and report all first alarm messages to the center computing node; the first lower-level terminal is a terminal in communication connection with the edge computing node.

[0009] The center computing node is configured to calculate security event messages according to event rules on alarm messages in the center alarm message queue; the alarm messages include the first alarm messages.

[0010] Optionally, the central computing node is further configured to: obtain logs of all second subordinate terminals; perform threat detection according to all the logs to obtain second-type alarm messages; and store the second-type alarm messages in the central alarm message queue, so that the alarm messages further include second-type alarm messages, and the second subordinate terminals are terminals in communication connection with the central computing node.

[0011] Optionally, the central computing node includes: a central collection service, a central log message queue, a central computing engine, and a central security event message queue.

[0012] The central computing node is specifically configured to:

[0013] The central collection service is configured to obtain logs of all the second subordinate terminals and store all the logs in the central log message queue.

[0014] The central computing engine is configured to perform attack behavior index IOA calculation or compromise index IOC calculation on the logs in the central log message queue according to an abnormal behavior rule to obtain all the second-type alarm messages and store the second-type alarm messages in the central alarm message queue.

[0015] The central computing engine is configured to perform security event detection on the alarm messages in the central alarm message queue according to an event rule to obtain security event messages and store the security event messages in the central security event message queue.

[0016] Optionally, the central computing node is specifically configured to:

[0017] The central collection service is configured to obtain the first-type alarm messages reported by all the edge computing nodes and store the first-type alarm messages in the central alarm message queue.

[0018] Optionally, the central computing node further includes: a central intelligence monitoring service, a central computing task generation service, and a central registration and discovery service; and the abnormal behavior rule includes an IOA rule and IOC intelligence data.

[0019] The central computing node is further configured to:

[0020] During initialization, the central computing task generation service receives the IOA rule and the event rule sent by a management console, and updates the IOA rule and the event rule to the central computing engine.

[0021] The IOC intelligence data is obtained through the central information monitoring service; a node list of all the edge computing nodes is obtained through the central registration and discovery service, and the IOA rule is sent to all the edge computing nodes according to the node list through the central computing task generation service.

[0022] Optionally, the central computing node is specifically configured to:

[0023] The central computing engine generates computing tasks according to the IOA rule and the IOC intelligence data as follows: the IOA computing or the IOC computing, and the security event detection through the central computing task generation service.

[0024] The IOA computing or the IOC computing is performed on the logs in the central log message queue and the IOC intelligence data to obtain all the second-type alarm messages.

[0025] Optionally, the edge computing node comprises an edge collection service, an edge log message queue, an edge computing engine and an edge alarm message queue.

[0026] The edge computing node is specifically configured to:

[0027] The edge collection service obtains logs of all first subordinate terminals, and stores all the logs in the edge log message queue.

[0028] The edge computing engine performs IOA computing or IOC computing on the logs in the edge log message queue according to the abnormal behavior rule to obtain all the first-type alarm messages.

[0029] The first-type alarm messages are stored in the edge alarm message queue.

[0030] The first-type alarm messages in the edge alarm message queue are reported to the central computing node.

[0031] In a second aspect, the embodiments of the present application provide an edge computing node, which is in communication connection with a superior node, wherein the superior node is another edge computing node or a central computing node; and the edge computing node is in communication connection with at least one terminal.

[0032] The edge computing node is configured to obtain logs of all first subordinate terminals; perform threat detection according to all the logs to obtain all first-type alarm messages, and report all the first-type alarm messages to the central computing node, so that the central computing node performs computing on alarm messages in a central alarm message queue according to event rules to obtain security event messages; and the first subordinate terminals are terminals in communication connection with the edge computing node.

[0033] In a third aspect, an embodiment of the present application provides a center computing node, which is in communication connection with at least one edge computing node; and a terminal is in communication connection with a corresponding edge computing node;

[0034] The center computing node is configured to:

[0035] receive all the edge computing nodes respectively reported type one alarm messages; the type one alarm messages are obtained by the corresponding edge computing node through threat detection on logs of a corresponding first subordinate terminal; and the first subordinate terminal is a terminal in communication connection with the corresponding edge computing node;

[0036] obtain a security event message by performing calculation on alarm messages in a center alarm message queue according to an event rule; and the alarm messages include the type one alarm messages.

[0037] In a fourth aspect, an embodiment of the present application provides an edge threat detection method, which is applied to an edge threat detection system, the edge threat detection system includes a center computing node, at least one edge computing node and at least one terminal; wherein the center computing node is in communication connection with at least one edge computing node; and a terminal is in communication connection with a corresponding edge computing node; and the method includes:

[0038] The edge computing node obtains logs of all first subordinate terminals;

[0039] The edge computing node performs threat detection according to all the logs, obtains all type one alarm messages, and reports all the type one alarm messages to the center computing node; and the first subordinate terminal is a terminal in communication connection with the edge computing node;

[0040] The center computing node obtains a security event message by performing calculation on alarm messages in a center alarm message queue according to an event rule; and the alarm messages include the type one alarm messages.

[0041] In a fifth aspect, an embodiment of the present application provides an edge threat detection method, which is applied to an edge computing node, the edge computing node is in communication connection with a superior node, the superior node is another edge computing node or a center computing node; and the edge computing node is in communication connection with at least one terminal; and the method includes:

[0042] The edge computing node obtains logs of all first subordinate terminals;

[0043] The edge computing node performs threat detection according to all the logs, obtains all the first-type alarm messages, and reports all the first-type alarm messages to the center computing node, so that the center computing node performs calculation on alarm messages in a center alarm message queue according to an event rule to obtain a security event message; and the first subordinate terminal is a terminal in communication connection with the edge computing node.

[0044] In a sixth aspect, an embodiment of the present application provides an edge threat detection method, which is applied to a center computing node, the center computing node is in communication connection with at least one edge computing node, a terminal is in communication connection with a corresponding edge computing node, and the method comprises the following steps.

[0045] The center computing node receives first-type alarm messages reported by all the edge computing nodes respectively; the first-type alarm messages are obtained by corresponding edge computing nodes through threat detection on logs of corresponding first subordinate terminals; and the first subordinate terminal is a terminal in communication connection with the corresponding edge computing node.

[0046] The center computing node performs calculation on alarm messages in a center alarm message queue according to an event rule to obtain a security event message; and the alarm messages include the first-type alarm messages.

[0047] In a seventh aspect, an embodiment of the present application provides an edge threat detection device, which comprises the following components.

[0048] A memory for storing one or more programs;

[0049] A processor;

[0050] When the one or more programs are executed by the processor, the edge threat detection system in any one of the first aspect is implemented; and / or, the edge computing node in the second aspect is implemented; and / or, the center computing node in the third aspect is implemented.

[0051] In an eighth aspect, an embodiment of the present application provides a storage medium, which stores a computer program, and is characterized by that, when the computer program is executed by a processor, the edge threat detection system in any one of the first aspect is implemented; and / or, the edge computing node in the second aspect is implemented; and / or, the center computing node in the third aspect is implemented.

[0052] In a ninth aspect, an embodiment of the present application provides a program product, which stores a computer program, and is characterized by that, when the computer program is executed by a processor, the method in any one of the first aspect is implemented.

[0053] Compared with the prior art, the multi-stage cascaded edge threat detection system, the edge computing node, the center computing node, the method, the device, the storage medium and the program product provided by the embodiment of the application can greatly reduce the bandwidth usage between the cascaded nodes by setting the lower access node in the cascaded architecture as an edge computing node with computing capability, and then making the edge computing node only transmit the detection result of the log. Moreover, the center computing node can dynamically adjust the detection content of the edge node, and the simple stateless streaming calculation is distributed to the edge computing node, so that hierarchical threat detection is realized. Moreover, the log data related to abnormal threats can be calculated nearby, so that the efficiency of threat discovery is higher.

[0054] In order to make the above objectives, characteristics and advantages of the present application more apparent, the following preferred embodiments are specifically described below, and the accompanying drawings are referred to, and the detailed description is as follows. BRIEF DESCRIPTION OF DRAWINGS

[0055] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation to the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0056] Figure 1 The structure schematic diagram of the terminal security system in the prior art is shown in FIG. 1.

[0057] Figure 2 The structure schematic diagram of the edge threat detection system provided by the embodiment of the present application is shown in FIG. 2.

[0058] Figure 3 The structure schematic diagram of the node provided by the embodiment of the present application is shown in FIG. 3.

[0059] Figure 4 The cascaded architecture schematic diagram provided by the embodiment of the present application is shown in FIG. 4.

[0060] Figure 5 The structure schematic diagram of another edge threat detection system provided by the embodiment of the present application is shown in FIG. 5.

[0061] Figure 6 The structure schematic diagram of another edge threat detection system provided by the embodiment of the present application is shown in FIG. 6.

[0062] Figure 7 The structure schematic diagram of another edge threat detection system provided by the embodiment of the present application is shown in FIG. 7.

[0063] Figure 8 The structure schematic diagram of another edge threat detection system provided by the embodiment of the present application is shown in FIG. 8.

[0064] Figure 9 A structural schematic diagram of another edge threat detection system provided for an embodiment of the present application is shown in FIG. 6.

[0065] Figure 10 A structural schematic diagram of another edge threat detection system provided for an embodiment of the present application is shown in FIG. 6.

[0066] Figure 11 A flowchart of an edge threat detection method provided for an embodiment of the present application is shown in FIG. 7.

[0067] Figure 12 A flowchart of another edge threat detection method provided for an embodiment of the present application is shown in FIG. 8.

[0068] Figure 13 A flowchart of another edge threat detection method provided for an embodiment of the present application is shown in FIG. 8.

[0069] Figure 14 A signaling interaction diagram of an edge threat detection method provided for an embodiment of the present application is shown in FIG. 9.

[0070] Figure 15 A schematic structural block diagram of an edge threat detection apparatus provided for an embodiment of the present application is shown in FIG. 10. DETAILED DESCRIPTION

[0071] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. The components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations.

[0072] Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative labor are within the scope of protection of the present application.

[0073] It is to be noted that, in the present document, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the presence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0074] In the description of the present application, it is also to be noted that, unless otherwise specified or limited, the terms "set", "connected" should be understood broadly, for example, can be fixedly connected, or detachably connected, or integrally connected; can be mechanically connected, or electrically connected; can be directly connected, or indirectly connected through an intermediate medium, or the communication inside two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0075] Some embodiments of the present application will be described in detail below with reference to the accompanying drawings. The following examples and features in the examples can be combined with each other without conflict.

[0076] Figure 1 For the structure of the terminal security system in the prior art, see Figure 1 The system comprises a central computing node, a plurality of subordinate access points (proxies), and terminals connected to each access point.

[0077] Among them, the upper node of the subordinate access point can be the central computing node or other access points.

[0078] Specifically, large enterprises generally have branch offices and headquarters with a wide geographical distribution. In order to enable the terminals of branch offices to quickly access the terminal security system, an access node is usually deployed in the branch office as a traffic proxy. As shown in Figure 1 .

[0079] Further, the terminal accesses the access point of the branch office nearby, and the access point cascades all traffic to the central computing node.

[0080] However, for the EDR scenario, a large amount of log data needs to be collected. Figure 1 As shown in the existing structure, since the access point is in a pure proxy mode, the following problems exist:

[0081] (1) The bandwidth occupation between cascaded nodes is large, and the bandwidth of many large enterprises is difficult to meet the requirements, and also affects the use of normal business.

[0082] (2) All data are calculated to the center computing node, which increases the computing pressure of the center computing node and threatens the delay of discovery.

[0083] In order to solve the technical problems of the prior art, the access point is enhanced to an edge computing node with computing capability. Specifically, Figure 2 A structural schematic diagram of an edge threat detection system provided by an embodiment of the present application is shown in Figure 2 The system comprises a center computing node 10, edge computing nodes 20A, 20B, 20C, 20D, 20E and terminals connected in communication with each edge computing node.

[0084] Referring to Figure 2 The original access node is replaced by an edge computing node with computing capability, which can utilize the power of edge computing to complete the log threat detection of EDR in the edge computing node, and report the calculation result to the upper computing node through the cascading relationship.

[0085] The edge computing node (20A, 20B, 20C, 20D and 20E) generally has small resources and is suitable for some simple calculation, so the edge computing node only needs to process the log detection task of the terminal at this level;

[0086] The center computing node 10 generally has sufficient resources, and in addition to processing the log detection of the terminal at this level, it also needs to further process the calculation result from all lower levels.

[0087] It should be noted that, in combination with Figure 2 In order to facilitate the distinction in the following examples, the terminal connected in communication with a specific edge computing node is named as the first lower level terminal of the edge computing node. Correspondingly, the terminal connected in communication with the center computing node is named as the second lower level terminal of the center computing node.

[0088] Optionally, for the edge computing node or center computing node shown in Figure 2 A possible implementation of the internal structure thereof is provided below. Specifically, Figure 3 A structural schematic diagram of a node provided by an embodiment of the present application is shown in Figure 3 The node comprises an access layer 30, a service layer 31, a computing layer 32 and a storage layer 33.

[0089] The access layer 30 is specifically an API gateway 300, which can serve as an invocation entry of the node and maintain a cascading relationship.

[0090] The service layer 31 can include a collection service 310 (Heka-Service), a computing task generation service 311 (Swift-Service), a search service 312 (Search-Servie), an intelligence monitoring service 313 (Nexus-Service), a registration and discovery service 314 (Curator-Service), and a reporting service 315 (Report-Service).

[0091] The collection service 310 is responsible for receiving logs collected by terminals and storing the logs in a corresponding message queue in real time.

[0092] The computing task generation service 311 is responsible for receiving attack behavior indicator (Indicator Of Attack, IOA) rules issued by a superior node, and generating IOA computing or compromise indicator (Indicator Of Compromise, IOC) computing, and security event detection (based on event rules) computing tasks.

[0093] The search service 312 is responsible for cascading search on logs collected by terminals.

[0094] The intelligence monitoring service 313 is responsible for updating IOC intelligence data.

[0095] The registration and discovery service 314 is responsible for registering a node to which the service belongs to a superior node, and maintaining a node list of all subordinate edge computing nodes.

[0096] The reporting service 315 is responsible for reporting computing results to a superior node, such as an edge computing node or a central computing node.

[0097] The computing layer 32 includes a computing engine 320 (Swift).

[0098] Optionally, the computing engine 320 is a distributed engine Flink designed by the inventor for the above technical problems, which is responsible for reading log data from a message queue for stream-based threat detection.

[0099] The storage layer 33 includes a message queue 330 (Kafka), a data storage management system 331 (ClickHouse), and a relational database 332 (Postgres).

[0100] It should be noted that for the message queue 330, the following embodiments are named "log message queue", "alarm message queue" and "security event message queue" based on the different storage contents. They can all be implemented based on "Kafka".

[0101] In addition, since the functions of the central computing node and the edge computing node need to be discussed in the following embodiments, in order to avoid confusion, the names of the logical concepts of the services, queues and engines inside the central computing node and the edge computing node are distinguished. For example, the concepts of the collection service, the log message queue and the computing engine belonging to the central computing node are all uniformly prefixed with "central", and the same logical concepts of the edge computing node are all uniformly prefixed with "edge".

[0102] The following provides an implementation of the cascade establishment of each node. Specifically, based on the above, Figure 2 Figure 4 A cascade architecture diagram is provided for the embodiments of the present application, as shown in Figure 4 The edge threat detection system includes a central computing node 10, an edge computing node 20A, an edge computing node 20B and an edge computing node 20C.

[0103] At this time, for the edge computing node 20A, the edge computing node 20B and the edge computing node 20C in the lower level position, their respective registration and discovery services 314 register with the registration and discovery service 314 of the central computing node 10 when starting. The registration and discovery service 314 of the corresponding central computing node 10 maintains a node list of all subordinate edge computing nodes.

[0104] Further, after successful registration, the subordinate edge computing node sends a heartbeat to the registration and discovery service 314 of the superior node through the registration and discovery service 314 to ensure the survival.

[0105] The following will be described in conjunction with the edge threat detection system shown in Figure 2 The central computing node 10 and the edge computing node 20A and the terminal connected thereto will be taken as an example to illustrate the edge threat detection provided by the application.

[0106] Referring to Figure 2 The edge computing node 20A is configured to obtain logs of all first subordinate terminals.

[0107] Specifically, the first subordinate terminal refers to a terminal connected in communication with the edge computing node.

[0108] Further, the edge computing node 20A is configured to perform threat detection based on all the logs, obtain all the first type of alarm messages, and report all the first type of alarm messages to the central computing node.​

[0109] Correspondingly, the center computing node 10 is configured to obtain the security event message by computing the alarm messages in the center alarm message queue according to the event rules. At this time, the alarm messages maintained by the center computing node 10 contain the alarm messages of the first type.

[0110] The edge threat detection system provided by the embodiment of the present application sets the lower access node in the cascade architecture as an edge computing node with computing capability, so that the edge computing node can only transmit the result of log detection, greatly reducing the bandwidth usage between the cascade nodes. Moreover, the center computing node can dynamically adjust the detection content of the edge node, and downlink simple stateless stream computing to the edge computing node, thereby realizing hierarchical threat detection. Moreover, the log data related to abnormal threats can be calculated nearby, so that the efficiency of threat discovery is higher.

[0111] Optionally, for the center computing node 10, it can not only process the alarm messages reported by the lower edge computing node. It can also perform log-based threat detection on its own lower terminal, i.e., the second lower terminal. Its processing logic is the same as that of the edge computing node. Specifically, a possible implementation is provided as follows:

[0112] Continuing to refer to Figure 2 The center computing node 10 is further configured to obtain the logs of all the second lower terminals, and perform threat detection according to all the logs to obtain all the second-type alarm messages.

[0113] Then, the center computing node 10 stores the second-type alarm messages into the center alarm message queue maintained by itself, so that the alarm messages further contain the second-type alarm messages.

[0114] Therefore, it needs to be noted that for the center computing node which has both its own lower terminal and lower edge computing node, the center alarm message queue can contain both the first-type alarm messages and the second-type alarm messages.

[0115] Optionally, before the edge threat detection system performs edge threat detection, the center computing node and the edge computing node in the system need to update the rules and IOC intelligence data required by each other, and when there is a lower node, the relevant rules also need to be downlinked to the node. The updating and maintenance schemes of the center computing node and the edge computing node are exemplarily described as follows.

[0116] First, Figure 5Another structural schematic diagram of an edge threat detection system provided by an embodiment of the present application is shown in the figure, and the edge threat detection system further comprises a management console 30; the central computing node 10 comprises a central intelligence monitoring service 105, a central computing task generation service 106, and a central registration and discovery service 107.

[0117] During initialization, the central computing node 10 receives the IOA rules and event rules sent by the management console 30 through the central computing task generation service 106.

[0118] The management console 30 can submit the full IOA rules and event rules to the central computing task generation service 106.

[0119] The central computing node 10 updates the IOA rules and event rules to the central computing engine 102 through the central computing task generation service 106.

[0120] Specifically, the central computing task generation service 106 submits the IOA rules and event rules to the central computing engine 102 to generate the computing tasks of the IOA computing or IOC computing and the security event detection. In addition, the IOA computing or IOC computing also loads the IOC intelligence data. Therefore, the abnormal behavior rules include the IOA rules and the IOC intelligence data.

[0121] Correspondingly, the central computing node 10 obtains the IOC intelligence data through the central intelligence monitoring service 105.

[0122] The central computing node 10 obtains the node list of all edge computing nodes through the central registration and discovery service 107, and sends the IOA rules to all edge computing nodes according to the node list.

[0123] Optionally, the central registration and discovery service 107 can maintain the node list of the subordinate nodes. For how each registration and discovery service obtains the node list, please refer to the above Figure 4 Corresponding example implementation.

[0124] Further, for the computing tasks generated by the central computing task generation service 106, the computing tasks can be specifically as follows:

[0125] Through the central computing task generation service 106, the computing tasks of the IOA computing or IOC computing and the security event detection are respectively generated in the central computing engine 102 according to the IOA rules and the IOC intelligence data.

[0126] The central computing engine 102 performs computing on the logs in the central log message queue and the IOC intelligence data through the IOA computing or IOC computing to obtain all the second type alarm messages.

[0127] Further, the updating and maintenance scheme of the edge computing node is exemplarily illustrated. Figure 2 On the basis of, Figure 6 Another structure diagram of the edge threat detection system provided by the embodiment of the present application is shown in Figure 6 which is only illustrated by taking the edge computing node 20A and the edge computing node 20D shown in the figure as example nodes. The edge computing node 20D is a subordinate node of the edge computing node 20A. Figure 2

[0128] The edge computing node 20A includes a first edge computing task generation service 206a and a first edge registration and discovery service 207a. The edge computing node 20D includes a second edge intelligence monitoring service 205b, a second edge computing task generation service 206b, and a second computing engine 202b.

[0129] For the edge computing node 20A, the first edge computing task generation service 206a obtains the IOA rule sent by the superior node. For example, the superior node is the center computing node 10. It can be imagined that in other system architectures, the superior node can also be other edge computing nodes. Figure 2

[0130] Further, the edge computing node 20A obtains the node list of the subordinate edge computing node from the first edge registration and discovery service 207a through the first edge computing task generation service 206a. For example, the node list contains the node information of the edge computing node 20D, and then the edge computing node 20A sends the IOA rule to the edge computing node 20D through the first edge computing task generation service 206a.

[0131] Correspondingly, for the edge computing node 20D, the second edge computing task generation service 206b obtains the IOA rule. The IOA rule is the full amount of IOA rule of the edge computing node 20A.

[0132] And the edge computing node 20D obtains the IOC intelligence data through the second edge intelligence monitoring service 205b. Further, the second edge intelligence monitoring service 205b provides the IOC intelligence data to the second computing engine 202b. The second edge computing task generation service 206b provides the IOA rule to the second computing engine 202b.

[0133] The second computing engine 202b generates IOA calculation or IOC calculation, and security event detection.

[0134] ​​It should be noted that in this example, since edge computing node 20D is a leaf node, the list of subordinate nodes maintained by its second registration and discovery service 207b is empty. Therefore, no further IOA rules will be issued.

[0135] Furthermore, to implement the various functions of the central computing node shown in the example above, a possible implementation method is provided below, specifically in... Figure 5 On this basis, Figure 7 This is a schematic diagram of another edge threat detection system provided in an embodiment of the present invention. See also... Figure 7 The central computing node 10 includes: a central data collection service 100, a central log message queue 101, a central computing engine 102, a central alarm message queue 103, and a central security event message queue 104.

[0136] The functions of the central computing node 10 are described below, including the log receiving process, alarm receiving process, and calculation process.

[0137] Regarding the "diary receiving process":

[0138] The central computing node 10 obtains all logs from the secondary lower-level terminals through the central acquisition service 100 and stores all logs in the central log message queue 101;

[0139] Regarding the "alarm reception process":

[0140] The central computing node 10 obtains a type of alarm message reported by all edge computing nodes through the central acquisition service 100, and stores the type of alarm message in the central alarm message queue 103.

[0141] For details, see Figure 7 The central computing node 10 receives alarm messages reported by edge computing nodes 20A, 20B, and 20C through the central data acquisition service 100. It should be noted that... Figure 2 Taking the system architecture shown as an example, edge computing node 20A also has subordinate edge computing nodes 20D and 20F. Edge computing node 20A will also report alarms reported by its subordinate edge computing nodes to the central computing node 10.

[0142] Regarding the "calculation process":

[0143] The central computing node 10 performs IOA or IOC calculations on the logs in the central log message queue 101 through the abnormal behavior rules of the central computing engine 102, obtains all the second-class alarm messages, and stores the second-class alarm messages in the central alarm message queue 103.

[0144] The central computing node 10 performs security event detection on the alarm messages in the central alarm message queue 103 by the event rules of the central computing engine 102, obtains security event messages, and stores the security event messages to the central security event message queue 104.

[0145] Specifically, the abnormal behavior rules include IOA rules and IOC intelligence data. The IOA rules are generally used to detect suspicious behaviors and form alarms. The IOC intelligence data is used to detect suspicious external connection behaviors and form alarms. The event rules can be Incident rules, i.e., time window-based time sequence rules that can detect security events.

[0146] Optionally, to realize the functions of the edge computing node shown in the above examples, a possible implementation is provided as follows. Specifically, on the basis of Figure 2 , Figure 8 Another structure diagram of an edge threat detection system provided by an embodiment of the present application is shown in FIG. 6. As shown in FIG. 6, Figure 8 , only one edge computing node 20 is taken as an example. The edge computing node 20 includes an edge collection service 200, an edge log message queue 201, an edge computing engine 202, and an edge alarm message queue 203.

[0147] The edge computing node 20 obtains all the logs of the first subordinate terminal through the edge collection service 200, and stores all the logs to the edge log message queue 201.

[0148] Further, the edge computing node 20 performs IOA calculation or IOC calculation on the logs in the edge log message queue through the abnormal behavior rules of the edge computing engine 202, and obtains all the first type of alarm messages.

[0149] The edge computing node 20 stores the first type of alarm messages to the edge alarm message queue 203.

[0150] Finally, the edge computing node 20 reports the first type of alarm messages in the edge alarm message queue to the central computing node.

[0151] Further, as to how the edge computing node reports the above alarm messages, a possible implementation is given as follows. Specifically, on the basis of Figure 2 , Figure 9 Another structure diagram of an edge threat detection system provided by an embodiment of the present application is shown in FIG. 6. As shown in FIG. 6, Figure 9 In the edge threat detection system, the central computing node 10 exemplarily includes a central collection service 100 and a central alarm message queue 103.

[0152] Correspondingly, for the edge computing nodes without subordinate nodes, such as edge computing node 20B, edge computing node 20C, edge computing node 20D and edge computing node 20E, each of which exemplarily comprises: edge alarm message queue 203 and edge reporting service 204.

[0153] And for the edge computing node with subordinate nodes, such as edge computing node 20A, it exemplarily comprises: edge collection service 200, edge alarm message queue 203 and edge reporting service 204.

[0154] Among them, for each subordinate edge computing node (such as edge computing node 20B to edge computing node 20E), the edge reporting service 204 thereof is used to report a type of alarm message in the edge alarm message queue 203 to the superior node. For example, for edge computing node 20B, it reports a type of alarm message to the central collection service 100 of the center computing node 10. And for edge computing node 20E, it reports a type of alarm message to the edge collection service 200 of edge computing node 20B. The edge collection service 200 stores the edge alarm message queue 203 corresponding to the type of alarm message received.

[0155] Optionally, for the edge threat detection system provided by the present application, it can also have the function of cascaded query of logs. A possible implementation is provided below. Specifically, on the basis of Figure 2 , Figure 10 Another structure diagram of an edge threat detection system provided by an embodiment of the present application is shown in FIG. 2B. In the edge threat detection system, Figure 10 , the center computing node 10 exemplarily comprises: center retrieval service 107.

[0156] The edge computing node 20A, edge computing node 20B, edge computing node 20C, edge computing node 20D and edge computing node 20E each exemplarily comprises edge retrieval service 208.

[0157] Further, this embodiment takes the center computing node 10 querying all original logs of edge computing node 20A and its subordinate nodes as an example, then correspondingly, Figure 10 In FIG. 2B, edge computing node 20A and its subordinate nodes: edge computing node 20D and edge computing node 20E are also shown, each of which is used to store the database 209 of logs. Since edge computing node 20B and edge computing node 20C are involved in the query target in the example, the corresponding databases are not shown.

[0158] Specifically, the central retrieval service 107 of the central computing node 10 receives the query request. According to the cascade information in the query request, it is determined that the current level is not the target level to be queried. Then, the query request is forwarded to all lower levels of the current level, i.e., the edge computing node 20A, the edge computing node 20B and the edge computing node 20C.

[0159] When the edge computing node 20A receives the query request, it is determined according to the cascade information that the current level and the lower level of the current level need to be queried. Then, the coroutine is started to asynchronously query the current level and request the edge computing node 20D and the edge computing node 20E.

[0160] The edge computing node 20D and the edge computing node 20E receive the request of the edge computing node 20A, and determine according to the cascade information in the request that the current level and the lower level need to be queried. However, because the edge computing node 20D and the edge computing node 20E do not have lower levels, they only query the current level and then feed back the query results to the edge computing node 20A.

[0161] The edge computing node 20A ends the query of the current level and receives the query results of all the child levels, i.e., the edge computing node 20D and the edge computing node 20E, and then returns the query results that meet the query condition according to the query condition by merging all the query results.

[0162] Because the edge computing node 20B and the edge computing node 20C are not the target level to be queried and do not have child levels, they only need to return the query results of the edge computing node 20A to the central computing node 10, and the central computing node 10 returns the results of the original log cascade query.

[0163] Next, in order to explain the step flow executed in the above example, the application further provides a possible implementation manner of the edge threat detection method. Specifically, Figure 11 A flowchart of an edge threat detection method provided by an embodiment of the application is shown in FIG. 3. Figure 11 The method comprises the following steps.

[0164] In step 300, the edge computing node obtains the logs of all the first lower level terminals.

[0165] In step 301, the edge computing node performs threat detection according to all the logs, obtains all the first type of alarm messages, and reports all the first type of alarm messages to the central computing node.

[0166] In step 302, the central computing node calculates the alarm messages in the central alarm message queue according to the event rule to obtain a security event message.

[0167] The edge threat detection method provided by the embodiment of the present application sets the lower access node in the cascade architecture as an edge computing node with computing capability, so that the edge computing node can only transmit the detection result of the log, greatly reducing the bandwidth usage between the cascade nodes. Moreover, the central computing node can dynamically adjust the detection content of the edge node, and the simple stateless streaming calculation is distributed to the edge computing node, so as to realize the hierarchical threat detection. Moreover, the log data related to the abnormal threat can be calculated nearby, so that the efficiency of threat discovery is higher.

[0168] It should be noted that the edge threat detection system shown above can be used to perform each step of its corresponding function to achieve the corresponding technical effect, which will not be described here.

[0169] Next, in order to explain the step flow executed by the above example, the present application also provides a possible implementation manner of the edge threat detection method. Specifically, Figure 12 For another flowchart of the edge threat detection method provided by the embodiment of the present application, see Figure 12 The method is executed by the edge computing node in the above example, and the method comprises the following steps.

[0170] In step 400, the edge computing node obtains the logs of all first lower terminals.

[0171] In step 401, the edge computing node performs threat detection according to all the logs, obtains all the first type of alarm messages, and reports the all first type of alarm messages to the central computing node, so that the central computing node calculates the alarm messages in the central alarm message queue according to the event rule to obtain the security event message.

[0172] The edge threat detection method provided by the embodiment of the present application sets the lower access node in the cascade architecture as an edge computing node with computing capability, so that the edge computing node can only transmit the detection result of the log, greatly reducing the bandwidth usage between the cascade nodes. Moreover, the log data related to the abnormal threat can be calculated nearby, so that the efficiency of threat discovery is higher.

[0173] It should be noted that the edge computing node shown above can be used to perform each step of its corresponding function to achieve the corresponding technical effect, which will not be described here.

[0174] Next, in order to explain the step flow executed by the above example, the present application also provides a possible implementation manner of the edge threat detection method. Specifically, Figure 13 For another flowchart of the edge threat detection method provided by the embodiment of the present application, see Figure 13 The method is executed by the edge computing node in the above example, and the method comprises the following steps.

[0175] Step 500, the center computing node receives all the edge computing nodes respectively reported one type of alarm message.

[0176] Step 500, the center computing node calculates the alarm message in the center alarm message queue according to the event rule to obtain a security event message.

[0177] The edge threat detection method provided by the embodiment of the application sets the subordinate access node in the cascade architecture as an edge computing node with computing capability, so that the edge computing node can only transmit the result of log detection, greatly reducing the bandwidth use between the cascade nodes. Moreover, the log data related to abnormal threats can be calculated nearby, so that the efficiency of threat discovery is higher.

[0178] It should be noted that the center computing node shown above can be used to perform each step of its corresponding function to achieve the corresponding technical effect, which will not be described here.

[0179] In order to completely describe the information interaction between the management console, the center computing node and the edge computing node in the above embodiment of the application, the embodiment of the application further provides a possible implementation manner of signaling interaction. Specifically, Figure 14 The signaling interaction diagram of the edge threat detection method provided by the embodiment of the application is shown in Figure 14 , wherein the cascade relationship between the management console 30, the center computing node 10, the edge computing node 20A and the edge computing node 20D can be referred to the above Figure 2 and Figure 5 . The flow includes:

[0180] Step 600, the management console sends the IOA rule and the event rule to the center computing node.

[0181] Step 601, the center computing node generates IOA calculation or IOC calculation, and security event detection.

[0182] Specifically, the generation manner can be referred to the above example, which will not be described here.

[0183] Step 602, the center computing node sends the IOA rule to the subordinate edge computing node.

[0184] Specifically, the center computing node 30 sends the IOA rule to the edge computing node 20A, as shown in Figure 14 . It should be noted that the steps of step 601 and step 602 are not limited in sequence. The IOA rule can also be sent to the edge computing node after step 600.

[0185] Step 603, the edge computing node sends the IOA rule to the lower-level edge computing node.

[0186] Specifically, how to determine the lower-level node, please refer to the previous examples, which will not be repeated here.

[0187] Step 604, the center computing node obtains the logs of all second lower-level terminals.

[0188] Step 605, the edge computing node sends a type of alarm message to the upper-level node.

[0189] Specifically, please refer to Figure 14 Since the edge computing node 20A is the upper-level node of the edge computing node 20D, the edge computing node 20D sends a type of alarm message to the edge computing node 20A. For specific reporting methods, please refer to the previous Figure 9 For corresponding examples, this will not be repeated here.

[0190] Step 606, the edge computing node sends a type of alarm message to the center computing node.

[0191] Step 607, the center computing node performs IOA calculation or IOC calculation according to the logs of all second lower-level terminals, and obtains all second type of alarm messages.

[0192] Specifically, for the implementation of obtaining the second type of alarm message, please refer to the previous, which will not be repeated here. In addition, for the time sequence of steps 604 to 606, Figure 14 This is only an exemplary illustration, and does not limit the order of steps.

[0193] Step 608, the center computing node performs security event detection on the alarm message, and obtains a security event message.

[0194] Specifically, the alarm message can include all or part of the above-mentioned first type of alarm message and second type of alarm message, which is determined based on the alarm messages contained in the center alarm message queue of the center computing node at a specific time.

[0195] Further, for the query scenario, the possible interaction process is given as follows.

[0196] Step 609, the center computing node sends a query request to the lower-level edge computing node.

[0197] Specifically, please refer to Figure 14 The center computing node 10 sends a query request to the lower-level edge computing node 20A.

[0198] Step 610, the edge computing node determines the need for query of the current level and the lower-level according to the cascading information.

[0199] Specifically, if yes, the edge computing node 20A sends a query request to the lower-level edge computing node 20B according to the cascading information, and step 610.

[0200] Step 610, the edge computing node sends a query request to the lower-level edge computing node.

[0201] Step 611, the edge computing node sends a query result to the upper-level node.

[0202] Specifically, referring to Figure 14 , the edge computing node 20B sends a query result to the upper-level edge computing node 20A.

[0203] Step 612, the edge computing node sends a query result to the center computing node.

[0204] Optionally, the present application also provides a possible implementation of an edge threat detection device. Specifically, Figure 15 is a schematic structural block diagram of an edge threat detection device provided by the present application. Please refer to Figure 15 , the edge threat detection device 70 includes a memory 701, a processor 702 and a communication interface 703, which are directly or indirectly electrically connected with each other to realize the transmission or interaction of data. For example, these elements can be electrically connected with each other through one or more communication buses or signal lines. The memory 701 can be used to store software programs and modules, such as the program instructions / modules corresponding to the center computing node or the edge computing node provided by the present application, and the processor 702 executes the software programs and modules stored in the memory 701 to perform various functional applications and data processing. The communication interface 703 can be used for signaling or data communication with other node devices.

[0205] Among them, the memory 701 can be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) and the like.

[0206] Processor 702 can be an integrated circuit chip with signal processing capabilities. Processor 702 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0207] Understandable. Figure 15 The structure shown is for illustrative purposes only; the edge threat detection device may also include components that are more advanced than those shown. Figure 15 The more or fewer components shown, or having the same Figure 15 The different configurations shown. Figure 1 The components shown can be implemented using hardware, software, or a combination thereof.

[0208] It should be noted that the edge threat detection system described above can be deployed on a single edge threat detection device; alternatively, different nodes can be deployed on different edge threat detection devices. For example, the central computing node belongs to one edge threat detection device, while each edge computing node is deployed on its corresponding edge threat detection device. That is, multiple edge threat detection devices constitute one edge threat detection system. This invention does not limit the configuration.

[0209] In the embodiments provided by the present application, it should be understood that the disclosed apparatus and method can also be implemented in other manners. The embodiments described above are merely exemplary embodiments of the present application. For example, the flowcharts and block diagrams in the accompanying drawings show the possible implementation architectures, functions and operation of the apparatus, method and program product according to the embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logic function. It should also be noted that, in some alternative implementations, the functions noted in the blocks can occur in a different order from that noted in the accompanying drawings. For example, two consecutive blocks can actually be executed in a substantially parallel manner, or they can be executed in a reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and the combination of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system for implementing the specified functions or actions, or by a combination of dedicated hardware and computer instructions.

[0210] In addition, each functional module in the various embodiments of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0211] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the method of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0212] After the access point is enhanced to an edge computing node with computing capability, the technical effects of the present application are:

[0213] (1) The edge computing node can only transmit the results of log detection (suspicious behavior of the terminal), greatly reducing the bandwidth usage between the cascaded nodes, and the occupancy is estimated to be only about one ten-thousandth of the original scheme.

[0214] (2) Hierarchical threat detection, the center computing node can dynamically adjust the detection content of the edge node, and the simple stateless stream computing is issued to the edge computing node (such as suspicious behavior is detected by IOA computing or IOC computing), and the center node calculates the complex state stream computing (such as security event detection).

[0215] (3) Log data is calculated nearby, and the threat discovery speed is faster.

[0216] The above only is the preferred embodiment of the application, and is not used to limit the application, and the application can have various changes and changes for the person skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the application should be included in the protection scope of the application.

[0217] It is obvious for the person skilled in the art that the application is not limited to the details of the above exemplary embodiments, and the application can be realized in other specific forms without departing from the spirit or basic characteristics of the application. Therefore, the embodiments should be regarded as exemplary and non-limiting from any point of view, the scope of the application is defined by the appended claims rather than the above description, and all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be included in the application. Any reference signs in the claims should not be regarded as limiting the claims involved.

Claims

1. An edge threat detection system, characterized in that, include: The system comprises a central computing node, at least one edge computing node, and at least one terminal; wherein the central computing node is communicatively connected to at least one of the edge computing nodes; the terminal is communicatively connected to a corresponding edge computing node; and the edge computing node includes: an edge acquisition service, an edge log message queue, an edge computing engine, and an edge alarm message queue. The edge computing node is configured to obtain all logs from the first lower-level terminals through the edge acquisition service and store all the logs in the edge log message queue; perform IOA or IOC calculations on the logs in the edge log message queue according to the abnormal behavior rules of the edge computing engine to obtain all type I alarm messages; store the type I alarm messages in the edge alarm message queue; and report the type I alarm messages in the edge alarm message queue to the central computing node; the first lower-level terminal is a terminal that is communicatively connected to the edge computing node; The central computing node is used to calculate security event messages from alarm messages in the central alarm message queue according to event rules; the alarm messages include the aforementioned type of alarm messages; The central computing node is also used to obtain logs from all second-level terminals; perform threat detection based on all the logs to obtain all type II alarm messages; and store the type II alarm messages in the central alarm message queue so that the alarm messages also include type II alarm messages; the second-level terminal is a terminal that is communicatively connected to the central computing node.

2. The system according to claim 1, characterized in that, The central computing node includes: a central data collection service, a central log message queue, a central computing engine, and a central security event message queue; The central computing node is specifically used for: All logs from the second lower-level terminal are obtained through the central acquisition service, and all logs are stored in the central log message queue. The attack behavior index IOA or the compromise index IOC is calculated on the logs in the central log message queue by the abnormal behavior rules of the central computing engine, and all the two types of alarm messages are obtained and stored in the central alarm message queue. The central computing engine uses event rules to perform security event detection on alarm messages in the central alarm message queue, obtains the security event message, and stores the security event message in the central security event message queue.

3. The system according to claim 2, characterized in that, The central computing node is specifically used for: The central acquisition service obtains all the alarm messages of the first type reported by the edge computing nodes and stores the alarm messages of the first type in the central alarm message queue.

4. The system according to claim 2, characterized in that, The central computing node also includes: a central intelligence monitoring service, a central computing task generation service, and a central registration and discovery service; the abnormal behavior rules include IOA rules and IOC intelligence data. The central computing node is also used for: During initialization, the central computing task generation service receives the IOA rules and event rules sent by the management console and updates the IOA rules and event rules to the central computing engine. The IOC intelligence data is obtained through the central intelligence monitoring service. The central registration and discovery service obtains a list of all edge computing nodes, and the central computing task generation service sends the IOA rules to all edge computing nodes according to the list of nodes.

5. The system according to claim 4, characterized in that, The central computing node is specifically used for: Based on the IOA rules and the IOC intelligence data, the central computing task generation service generates the following computing tasks in the central computing engine: the IOA calculation or the IOC calculation, and the security event detection. The logs in the central log message queue and the IOC intelligence data are calculated using the IOA calculation or the IOC calculation to obtain all the two types of alarm messages.

6. An edge computing node, characterized in that, The edge computing node is communicatively connected to a superior node, which is another edge computing node or a central computing node. The edge computing node is communicatively connected to at least one terminal; The edge computing node includes: an edge acquisition service, an edge log message queue, an edge computing engine, and an edge alarm message queue. The edge computing node is used to obtain all logs from the first lower-level terminals through the edge acquisition service and store all the logs in the edge log message queue; perform IOA or IOC calculations on the logs in the edge log message queue using the abnormal behavior rules of the edge computing engine to obtain all type-one alarm messages; store the type-one alarm messages in the edge alarm message queue; and report the type-one alarm messages in the edge alarm message queue to the central computing node, so that the central computing node can calculate security event messages from the alarm messages in the central alarm message queue according to event rules; the first lower-level terminal is a terminal that is communicatively connected to the edge computing node.

7. A central computing node, characterized in that, The central computing node is communicatively connected to at least one edge computing node; the terminal is communicatively connected to the corresponding edge computing node. The central computing node is used for: Receive a type of alarm message reported by each of the edge computing nodes; the type of alarm message is obtained by the corresponding edge computing node through threat detection of the logs of the corresponding second lower-level terminal; the second lower-level terminal is a terminal that is communicatively connected to the corresponding edge computing node; Security event messages are obtained by calculating alarm messages in the central alarm message queue according to event rules; the alarm messages include the aforementioned type of alarm messages; Obtain all logs from the second-level terminals; perform threat detection based on all the logs to obtain all type II alarm messages; and store the type II alarm messages in the central alarm message queue so that the alarm messages also include type II alarm messages; the second-level terminals are terminals that are communicatively connected to the central computing node.

8. A method for detecting edge threats, characterized in that, The edge threat detection method is applied to the edge threat detection system, which includes: a central computing node, at least one edge computing node, and at least one terminal; wherein the central computing node is communicatively connected to at least one of the edge computing nodes; the terminal is communicatively connected to a corresponding edge computing node; the edge computing node includes: an edge acquisition service, an edge log message queue, an edge computing engine, and an edge alarm message queue; the method includes: The edge computing node obtains all logs from the first lower-level terminals through the edge acquisition service and stores all the logs in the edge log message queue; the first lower-level terminal is a terminal that is communicatively connected to the edge computing node. The edge computing node performs IOA or IOC calculations on the logs in the edge log message queue using the abnormal behavior rules of the edge computing engine to obtain all Class I alarm messages. The edge computing node stores one type of alarm message in the edge alarm message queue; and reports one type of alarm message in the edge alarm message queue to the central computing node; The central computing node calculates security event messages from the alarm messages in the central alarm message queue according to event rules; the alarm messages include the aforementioned type of alarm messages; The central computing node obtains logs from all second-level terminals; The central computing node performs threat detection based on all the logs to obtain all the two types of alarm messages; and stores the two types of alarm messages in the central alarm message queue so that the alarm messages also include the two types of alarm messages; the second lower-level terminal is a terminal that is communicatively connected to the central computing node.

9. A method for detecting edge threats, characterized in that, The edge threat detection method is applied to an edge computing node, which is communicatively connected to a superior node, which is another edge computing node or a central computing node. The edge computing node is communicatively connected to at least one terminal; The edge computing node includes: an edge acquisition service, an edge log message queue, an edge computing engine, and an edge alarm message queue; the method includes: The edge computing node obtains all logs from the first lower-level terminals through the edge acquisition service and stores all the logs in the edge log message queue; the first lower-level terminal is a terminal that is communicatively connected to the edge computing node. The edge computing node performs IOA or IOC calculations on the logs in the edge log message queue using the abnormal behavior rules of the edge computing engine to obtain all Class I alarm messages. The edge computing node stores the first type of alarm message in the edge alarm message queue; The edge computing node reports one type of alarm message from the edge alarm message queue to the central computing node.

10. A method for detecting edge threats, characterized in that, The edge threat detection method is applied to a central computing node, which is communicatively connected to at least one edge computing node; a terminal is communicatively connected to a corresponding edge computing node; the method includes: The central computing node receives a type of alarm message reported by each of the edge computing nodes; the type of alarm message is obtained by the corresponding edge computing node through threat detection of the logs of the corresponding first lower-level terminal; the first lower-level terminal is a terminal that is communicatively connected to the corresponding edge computing node. The central computing node calculates security event messages from the alarm messages in the central alarm message queue according to event rules; the alarm messages include the aforementioned type of alarm messages; The central computing node obtains logs from all second-level terminals; The central computing node performs threat detection based on all the logs to obtain all the two types of alarm messages; and stores the two types of alarm messages in the central alarm message queue so that the alarm messages also include the two types of alarm messages; the second lower-level terminal is a terminal that is communicatively connected to the central computing node.

11. An edge threat detection device, characterized in that, include: Memory, used to store one or more programs; processor; When the processor executes the one or more programs, it implements the edge threat detection system as described in any one of claims 1-5; and / or, the edge computing node as described in claim 6; and / or, the central computing node as described in claim 7.

12. A storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the edge threat detection system as described in any one of claims 1-5; and / or, the edge computing node as described in claim 6; and / or, the central computing node as described in claim 7.

13. A program product, characterized in that, When the program product is executed by the processor, it implements the edge threat detection system as described in any one of claims 1-5; and / or, the edge computing node as described in claim 6; and / or, the central computing node as described in claim 7.

Images