Server behavior anomaly detection methods, devices, electronic equipment, and storage media

Abstract

This application relates to a method, apparatus, electronic device, and storage medium for detecting abnormal server behavior, applied in the field of network security technology. The method includes: real-time acquisition of system call sequences during server process execution; dividing the system call sequence into N runtime phase subsequences, and further dividing the runtime phase subsequences corresponding to the target process's runtime phases into process activity subsequences; segmenting the system call sequence into multiple unidentified subsequences; inputting each unidentified subsequence into a process semantic abstraction model to obtain the named entity recognition result corresponding to each system call in the unidentified subsequence; aggregating and overwriting the named entity recognition results of multiple unidentified subsequences to obtain the named entity recognition result corresponding to each system call in the system call sequence; if unidentified named entities are included, determining that the system call sequence is abnormal, and sending an alarm message. This application can extract process behavior, facilitating expert analysis of abnormal events.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting abnormal server behavior. Background Technology

[0002] An APT (Advanced Persistent Threat) attack is a persistent and effective computer attack campaign launched by an attacker against a specified target. Detection of APT attacks is crucial.

[0003] In related technologies, data sources on the system (such as system logs or application logs) can be analyzed to determine whether a host is engaging in malicious activity. For example, LSTM (Long Short-Term Memory) networks can be used to model system logs as natural language sequences and learn log patterns corresponding to normal behavior, allowing for real-time detection of abnormal entries in the logs in a streaming manner. While this research can model logs as natural language, it does not extract the semantics of processes, preventing security experts from understanding the high-level behavior of processes. Summary of the Invention

[0004] To address the aforementioned technical problems, this application provides a method, apparatus, electronic device, and storage medium for detecting abnormal server behavior.

[0005] According to a first aspect of this application, a method for detecting abnormal server behavior is provided, comprising:

[0006] Real-time acquisition of system call sequences during server process execution;

[0007] According to a pre-set automatic annotation algorithm, each system call in the system call sequence is divided into N process execution stages, resulting in N execution stage sub-sequences. Then, according to the request execution process, the execution stage sub-sequences corresponding to the target process execution stage in the N process execution stages are divided into one or more process activity sub-sequences; N is an integer greater than 1.

[0008] The system call sequence is divided into multiple sub-sequences to be identified based on the sliding window length and the sliding window step size; wherein the sliding window length is greater than or equal to the maximum value of the lengths of all process activity sub-sequences.

[0009] For each subsequence to be identified, the subsequence to be identified is input into a pre-trained process semantic abstraction model to obtain the named entity recognition result that represents the process behavior corresponding to each system call in the subsequence to be identified;

[0010] The named entity recognition results corresponding to system calls in multiple sub-sequences to be identified are aggregated and overwritten to obtain the named entity recognition results corresponding to each system call in the system call sequence.

[0011] If the named entity identification results for each system call in the system call sequence contain unidentified named entities, it is determined that the system call sequence is abnormal, and an alarm message is sent.

[0012] Optionally, the training method for the process semantic abstraction model includes:

[0013] Collect multiple system call sequences of the server process during normal operation, and use a single system call sequence as a single sample system call sequence;

[0014] According to the automatic annotation algorithm, each sample system call sequence is divided into N sample execution phase subsequences; and according to the request execution process, the sample execution phase subsequence corresponding to the target process execution phase is divided into one or more sample process activity subsequences.

[0015] The maximum value is selected from the lengths of all sample process activity subsequences, and the sliding window length and sliding window step size are determined based on the selected maximum value; wherein the sliding window length is greater than or equal to the selected maximum value;

[0016] Based on the sliding window length and the sliding window step size, each sample system call sequence is divided into multiple sample training subsequences;

[0017] Based on the N sample execution phase subsequences and one or more sample process activity subsequences in each sample system call sequence, named entity annotation is performed on each system call in the sample system call sequence to obtain the entity annotation result corresponding to each system call;

[0018] The entity annotation results of the sample training subsequence are determined based on the entity annotation results of the system calls contained in each sample training subsequence.

[0019] The sample training subsequences are used as input data, and the entity annotation results corresponding to the sample training subsequences are used as label data to train the semantic abstraction model of the generation process.

[0020] Optionally, the N process execution phases include: an initialization phase, an event loop phase, and an exit phase;

[0021] The system call sequence is divided into N process execution stages according to a pre-set automatic annotation algorithm, resulting in N execution stage sub-sequences, including:

[0022] Find the first system call in the system call sequence that uses input / output I / O multiplexing, and divide the system calls before the first system call that uses I / O multiplexing into the initialization phase to obtain the initialization phase subsequence;

[0023] Find the system call that last exhibited I / O multiplexing from the system call sequence, and divide the system calls between the first and last I / O multiplexing system call into the event loop phase to obtain the event loop phase subsequence;

[0024] System calls following the last I / O multiplexing system call are assigned to the exit phase, resulting in an exit phase subsequence.

[0025] Optionally, the target process execution phase is the event loop phase;

[0026] The step of dividing the target process execution phase subsequence among the N process execution phases into one or more process activity subsequences according to the request execution process includes:

[0027] The system calls between the system calls that involve I / O multiplexing and the system calls that involve I / O multiplexing again in the event loop phase subsequence are considered as a process activity subsequence.

[0028] Optionally, the step of performing named entity annotation on each system call in the sample system call sequence based on N sample execution phase subsequences and one or more sample process activity subsequences in each sample system call sequence to obtain the entity annotation result corresponding to each system call includes:

[0029] For each sample system call sequence, the sample execution phase subsequence corresponding to the execution phases of other processes besides the target process execution phase is marked as a phase entity triplet corresponding to the sample execution phase subsequence; wherein, the first element of the phase entity triplet represents the start of the execution phase of other processes, the second element of the phase entity triplet represents the intermediate process of the execution phase of other processes, and the third element of the phase entity triplet represents the end of the execution phase of other processes.

[0030] The first system call in the sample running phase subsequence is marked as the first element in the phase entity triplet, the last system call in the sample running phase subsequence is marked as the third element in the phase entity triplet, and the other system calls in the sample running phase subsequence are marked as the second element in the phase entity triplet.

[0031] For each sample system call sequence, the sample execution phase subsequence corresponding to the target process execution phase is marked as an activity entity triplet corresponding to the sample process activity subsequence; wherein, the first element of the activity entity triplet represents the start of the process activity, the second element of the activity entity triplet represents the intermediate process of the process activity, and the third element of the activity entity triplet represents the end of the process activity.

[0032] The first system call in the sample process activity subsequence is marked as the first element of the activity entity triple, the last system call in the sample process activity subsequence is marked as the third element of the activity entity triple, and the other system calls in the sample process activity subsequence are marked as the second element of the activity entity triple.

[0033] Optionally, the method further includes:

[0034] Based on the establishment and disconnection of user connections, the running phase subsequence corresponding to the target process running phase in the N process running phases is divided into one or more user connection subsequences, and the process activity subsequence contained in each user connection subsequence is determined.

[0035] The alarm information sent includes:

[0036] Send the system call corresponding to the unidentified named entity, the process execution stage to which the system call to the unidentified named entity belongs, and the system calls near the system call to the unidentified named entity that correspond to the identified named entities; and,

[0037] If the process execution phase to which the system call corresponding to the unidentified named entity belongs is the execution phase of the target process, then send the network information and request content of the request sender corresponding to the user connection subsequence to which the system call corresponding to the unidentified named entity belongs.

[0038] Optionally, the process semantic abstraction model includes: an embedding layer, a feature extraction layer, and a labeling prediction layer;

[0039] The embedding layer is a RoBERTa model, the feature extraction layer is a Bidirectional Long Short-Term Memory (BiLSTM) network model, and the annotation prediction layer is a Conditional Random Field (CRF) model.

[0040] According to a second aspect of this application, a server behavior anomaly detection device is provided, comprising:

[0041] The system call acquisition module is used to collect the system call sequence of the server process in real time.

[0042] An automatic annotation module is used to divide each system call in the system call sequence into N process execution stages according to a pre-set automatic annotation algorithm, resulting in N execution stage sub-sequences. Then, according to the request execution process, the execution stage sub-sequences corresponding to the target process execution stage in the N process execution stages are divided into one or more process activity sub-sequences; N is an integer greater than 1.

[0043] The sequence segmentation module is used to segment the system call sequence into multiple sub-sequences to be identified based on the sliding window length and the sliding window step size; wherein the sliding window length is greater than or equal to the maximum value of the lengths of all process activity sub-sequences;

[0044] The named entity recognition module is used to input the subsequence to be recognized into a pre-trained process semantic abstraction model for each subsequence to be recognized, and obtain the named entity recognition result that represents the process behavior corresponding to each system call in the subsequence to be recognized;

[0045] The named entity recognition result processing module is used to aggregate and overwrite the named entity recognition results corresponding to system calls in multiple sub-sequences to be recognized, so as to obtain the named entity recognition results corresponding to each system call in the system call sequence.

[0046] An anomaly determination module is used to determine that an anomaly has occurred in the system call sequence if the named entity identification results corresponding to each system call in the system call sequence contain unidentified named entities.

[0047] The alarm information sending module is used to send alarm information when an anomaly occurs in the system call sequence.

[0048] Optionally, the server behavior anomaly detection device further includes:

[0049] The process semantic abstraction model training module is used to collect multiple system call sequences of a server process during normal operation, treating each system call sequence as a single sample system call sequence; according to the automatic annotation algorithm, each sample system call sequence is divided into N sample execution stage sub-sequences; and according to the request execution process, the sample execution stage sub-sequences corresponding to the target process execution stage are divided into one or more sample process activity sub-sequences; and,

[0050] The maximum value is selected from the lengths of all sample process activity subsequences, and the sliding window length and sliding window step size are determined based on the selected maximum value; wherein the sliding window length is greater than or equal to the selected maximum value; each sample system call sequence is divided into multiple sample training subsequences based on the sliding window length and the sliding window step size; and,

[0051] Based on N sample execution phase subsequences and one or more sample process activity subsequences in each sample system call sequence, named entity annotation is performed on each system call in the sample system call sequence to obtain the entity annotation result corresponding to each system call; based on the entity annotation results of the system calls contained in each sample training subsequence, the entity annotation result of the sample training subsequence is determined; using the sample training subsequence as input data and the entity annotation result corresponding to the sample training subsequence as label data, a process semantic abstraction model is trained and generated.

[0052] Optionally, the N process execution phases include: an initialization phase, an event loop phase, and an exit phase;

[0053] The automatic annotation module is specifically used to divide each system call in the system call sequence into N process execution stages according to a pre-set automatic annotation algorithm, thereby obtaining N execution stage sub-sequences:

[0054] Find the first system call in the system call sequence that uses input / output I / O multiplexing, and divide the system calls before the first system call that uses I / O multiplexing into the initialization phase to obtain the initialization phase subsequence;

[0055] Find the system call that last exhibited I / O multiplexing from the system call sequence, and divide the system calls between the first and last I / O multiplexing system call into the event loop phase to obtain the event loop phase subsequence;

[0056] System calls following the last I / O multiplexing system call are assigned to the exit phase, resulting in an exit phase subsequence.

[0057] Optionally, the target process execution phase is the event loop phase;

[0058] The automatic labeling module is specifically used to divide the running phase subsequence corresponding to the target process running phase among the N process running phases into one or more process activity subsequences according to the request execution process, based on the following steps:

[0059] The system calls between the system calls that involve I / O multiplexing and the system calls that involve I / O multiplexing again in the event loop phase subsequence are considered as a process activity subsequence.

[0060] Optionally, the process semantic abstraction model training module performs named entity annotation on each system call in the sample system call sequence based on N sample runtime phase subsequences and one or more sample process activity subsequences in each sample system call sequence, thereby obtaining the entity annotation result corresponding to each system call:

[0061] For each sample system call sequence, the sample execution phase subsequence corresponding to the execution phases of other processes besides the target process execution phase is marked as a phase entity triplet corresponding to the sample execution phase subsequence; wherein, the first element of the phase entity triplet represents the start of the execution phase of other processes, the second element of the phase entity triplet represents the intermediate process of the execution phase of other processes, and the third element of the phase entity triplet represents the end of the execution phase of other processes.

[0062] The first system call in the sample running phase subsequence is marked as the first element in the phase entity triplet, the last system call in the sample running phase subsequence is marked as the third element in the phase entity triplet, and the other system calls in the sample running phase subsequence are marked as the second element in the phase entity triplet.

[0063] For each sample system call sequence, the sample execution phase subsequence corresponding to the target process execution phase is marked as an activity entity triplet corresponding to the sample process activity subsequence; wherein, the first element of the activity entity triplet represents the start of the process activity, the second element of the activity entity triplet represents the intermediate process of the process activity, and the third element of the activity entity triplet represents the end of the process activity.

[0064] The first system call in the sample process activity subsequence is marked as the first element of the activity entity triple, the last system call in the sample process activity subsequence is marked as the third element of the activity entity triple, and the other system calls in the sample process activity subsequence are marked as the second element of the activity entity triple.

[0065] Optionally, the automatic labeling module is further configured to divide the running stage subsequence corresponding to the target process running stage in the N process running stages into one or more user connection subsequences according to the establishment and disconnection of user connections, and determine the process activity subsequence contained in each user connection subsequence.

[0066] The alarm information sending module is specifically used to send the system call corresponding to the unidentified named entity, the process execution stage to which the system call to the unidentified named entity belongs, and system calls near the system call to the unidentified named entity that correspond to the identified named entity; and,

[0067] If the process execution phase to which the system call corresponding to the unidentified named entity belongs is the execution phase of the target process, then send the network information and request content of the request sender corresponding to the user connection subsequence to which the system call corresponding to the unidentified named entity belongs.

[0068] Optionally, the process semantic abstraction model includes: an embedding layer, a feature extraction layer, and a labeling prediction layer;

[0069] The embedding layer is a RoBERTa model, the feature extraction layer is a Bidirectional Long Short-Term Memory (BiLSTM) network model, and the annotation prediction layer is a Conditional Random Field (CRF) model.

[0070] According to a third aspect of this application, an electronic device is provided, comprising: a processor configured to execute a computer program stored in a memory, wherein the computer program, when executed by the processor, implements the method described in the first aspect.

[0071] According to a fourth aspect of this application, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0072] According to a fifth aspect of this application, a computer program product is provided that, when the computer program product is run on a computer, causes the computer to perform the method described in the first aspect.

[0073] The technical solution provided in this application has the following advantages compared with the prior art:

[0074] This paper utilizes an automatic annotation algorithm to label system call sequences, generating a mapping relationship between high-level process behavior and low-level system call sequences. Considering the long length of system call sequences, existing deep learning models cannot accommodate the entire sequence in a single input. Therefore, a sliding window approach is used to segment the system call sequences, and a pre-trained process semantic abstraction model is used to extract process behavior. When the process semantic abstraction model cannot identify the process activity corresponding to the system call sequence, it indicates a possible anomaly in the system call sequence, i.e., abnormal process activity. Analysis of the anomaly can provide alert information to security experts, facilitating their identification of abnormal process behavior. The process semantic abstraction model proposes an anomaly detection algorithm that can determine the abnormal stages and activities of a server process through its system call sequence and report relevant information upon detection, helping security experts discover anomalies and trace attack sources. Therefore, this application combines automatic annotation algorithms and a process semantic abstraction model to extract high-level process semantics from system call sequences, enabling security experts to understand high-level process behavior and facilitating the analysis of abnormal events. Attached Figure Description

[0075] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0076] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0077] Figure 1 This is a flowchart of a server behavior anomaly detection method in an embodiment of this application;

[0078] Figure 2 This is the server process execution framework for embodiments of this application;

[0079] Figure 3 This is a schematic diagram of the annotation results of the system call sequence using an automatic annotation algorithm in an embodiment of this application;

[0080] Figure 4 This is a flowchart of a training method for a process semantic abstraction model in an embodiment of this application;

[0081] Figure 5 This is a schematic diagram of process semantic abstraction based on named entity recognition in the embodiments of this application;

[0082] Figure 6This is a schematic diagram of a server behavior anomaly detection device in an embodiment of this application;

[0083] Figure 7 This is a schematic diagram of the structure of an electronic device in an embodiment of this application. Detailed Implementation

[0084] To better understand the above-mentioned objectives, features, and advantages of this application, the solution of this application will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0085] Many specific details are set forth in the following description in order to provide a full understanding of this application, but this application may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some embodiments of this application, and not all embodiments.

[0086] Figure 1 This is a flowchart of a server behavior anomaly detection method in an embodiment of this application, which may include the following steps:

[0087] Step S102: Real-time acquisition of system call sequences during server process execution.

[0088] In APT attacks, the targets are often processes that provide services internally or externally. Therefore, it is crucial to focus on tracking and analyzing the behavioral patterns of these processes. By combining the process system call tracing tool strace and the debugger GDB (GNU Debugger) to trace process behavior, the high-level activities of the process can be analyzed through its system call sequence. The system call sequence is a sequence of system calls.

[0089] Step S104: According to the pre-set automatic annotation algorithm, each system call in the system call sequence is divided into N process execution stages to obtain N execution stage subsequences. Then, according to the request execution process, the execution stage subsequences corresponding to the target process execution stage in the N process execution stages are divided into one or more process activity subsequences; N is an integer greater than 1.

[0090] Supervised learning in machine learning requires labeled data, and datasets in related technologies often require extensive manual labeling, which consumes significant manpower and time. The automatic labeling algorithm in this application is obtained by pre-analyzing multiple system call sequences. Specifically, a server process execution framework is constructed based on the multiple system call sequences. This framework represents the runtime mode of the server process, and based on it, the execution stage and activities of the process can be determined within the system call sequences. This framework bridges the gap between the underlying system call sequences and the higher-level behavior of the process. Based on this framework, the system call sequences collected in real-time are labeled.

[0091] Based on multiple system call sequences, the service process's operation mode can be divided into N stages, where N can be 3 or 5, etc. Optionally, the N process operation stages include: initialization stage, event loop stage, and exit stage.

[0092] Initialization Phase: During this phase, the server process needs to perform a series of initialization operations upon startup, including information reading and writing, resource requesting and allocation, environment registration and configuration, etc. The server process will make a large number of different system calls to meet its initialization needs. The sequence of these system calls usually does not have a fixed pattern and depends on the process's file operations, process management, memory management, network communication, etc.

[0093] Event Loop Phase: During the event loop phase, the server provides services externally. This process typically includes request reading, command execution, and response return. From a system call perspective, the server usually first enters a blocking state due to I / O multiplexing, and is awakened when an event arrives or times out. It then reads events from the monitored file descriptors, dispatches them to specific event handlers, and writes the response back to the file descriptor after execution. This process has a relatively fixed pattern, in which the high-level activities of the process can be extracted from the system call sequence.

[0094] Exit Phase: Upon active or passive exit, the server process needs to perform backup and resource cleanup operations. Similar to the initialization phase, the sequence of system calls in this phase also depends on the execution needs of the process itself.

[0095] From a user behavior perspective, servers can perform many different activities, such as setting and accessing Redis key-value pairs, publishing and subscribing to pipelines, and retrieving and setting configuration directories. These activities are distinct behaviors for the user. However, from a system perspective, they all fall under normal process behavior, and therefore can be uniformly abstracted as normal activities. This helps in understanding process behavior itself and reduces the analysis burden on security personnel. For anomalous activities, attackers use specific system calls to achieve privilege escalation, environment access, or system intrusion during attacks. Therefore, such anomalous activities have a different system call sequence than normal activities. Anomaly detection methods based on this activity identification can discover anomalous behavior while extracting the high-level semantics of the process, and provide the relevant system call context to security experts for further anomaly determination.

[0096] Based on the above analysis, the server process execution framework of this application embodiment can be found in [reference needed]. Figure 2 As can be seen, the execution phase is divided into three stages: the initialization phase, the event loop phase, and the exit phase. The initialization and exit phases each consist of the beginning and end of the system call sequence, respectively, while the middle part of the sequence corresponds to the event loop phase. The event loop phase corresponds to the system call s at time t. t and s t+7 A sequence of connections. A user connection represents the beginning and end of a client session, through which the client interacts with the server. Each client connection involves multiple request execution processes, with each request execution corresponding to the activity of a server process.

[0097] System calls, as a mechanism provided by the operating system for user-space programs to access system resources, can be used to determine the resources accessed or manipulated by a process, thus serving as a way to understand process behavior. For example, a server needs to create a socket using the `socket` system call and establish a connection using `accept`. Therefore, the `accept` system call represents the establishment of a user connection, and closing the corresponding socket represents the termination of the user connection. Furthermore, the server executes requests after being woken up from I / O multiplexing; therefore, system calls such as `epoll`, `select`, and `poll` can be used to determine server activity.

[0098] Based on this, the automatic annotation algorithm can divide the system call sequence into N runtime phase sub-sequences using the following method:

[0099] The first system call in the system call sequence marks the beginning of the initialization phase. After initialization, the first event loop begins. Therefore, the first occurrence of an I / O multiplexing system call (such as epoll, poll, and select) marks the end of the initialization phase. The intermediate system calls represent the initialization actions performed by the process during the initialization phase. Therefore, by finding the first occurrence of an I / O multiplexing system call in the system call sequence, and assigning the system calls preceding this first occurrence to the initialization phase, we obtain the initialization phase subsequence.

[0100] Server process exits in two ways: signal-induced exit (e.g., terminating the process locally by sending a signal) and network-request-induced exit (e.g., a client sending a close command). Both types of exits will wake up the server process and perform subsequent cleanup and exit operations. Therefore, the system calls from the last wake-up to the end of the sequence belong to the exit phase. The system calls between the first and last instances of I / O multiplexing are identified in the system call sequence and placed in the event loop phase, resulting in an event loop phase subsequence.

[0101] The system call sequence, excluding the beginning and end sequences corresponding to the initialization and exit phases, comprises the event loop phase. This phase corresponds to the sequence between the first and last I / O multiplexing system calls. Therefore, system calls following the last I / O multiplexing system call are assigned to the exit phase, resulting in the exit phase subsequence.

[0102] The determination of a user connection can rely on the system call sequence and its parameters. After the server-side socket successfully calls `accept`, the connection for that user is successfully established, and the return value represents the socket for that user. The user connection ends when the socket is closed. Therefore, the establishment of a user connection occurs during the event loop phase, while disconnection may occur during the event loop phase or the exit phase.

[0103] Optionally, the target process execution phase is the event loop phase. Each pattern loop in the event loop of the server process represents an activity. Its system call sequence begins with an I / O multiplexing system call and ends with the next I / O multiplexing system call. The sequence between these two system calls represents this activity. Therefore, the system calls between the I / O multiplexing system call and the next I / O multiplexing system call in the event loop phase subsequence are considered as a process activity subsequence.

[0104] Optionally, the execution phase subsequence corresponding to the target process execution phase in the N process execution phases can be divided into one or more user connection subsequences according to the establishment and disconnection of user connections, and the process activity subsequence contained in each user connection subsequence can be determined.

[0105] According to the automatic annotation algorithm described above, the sub-sequences corresponding to the initialization phase, event loop phase, and exit phase, as well as the sub-sequences corresponding to user connection and process activity, can be obtained respectively. The annotation results of the automatic annotation algorithm for the system call sequence are as follows: Figure 3 As shown.

[0106] Step S106: Based on the sliding window length and sliding window step size, the system call sequence is divided into multiple sub-sequences to be identified.

[0107] Automatic labeling algorithms can label process logs, but the output of these algorithms is the sequence itself. Therefore, a process semantic abstraction model can be constructed to output the high-level behavior of a process when given a sequence of system calls.

[0108] When the system call sequence is long, it may contain tens of thousands of system calls. Natural language processing models cannot handle sentences of such length, therefore, the system call sequence cannot be directly input into the model for named entity recognition. To solve this problem, embodiments of this application can use a sliding window to segment the system call sequence. The sliding window length ensures that the length of the segmented subsequences is acceptable to the model, and the sliding window step size ensures that two adjacent subsequences can cover the system call sequence. In addition, the sliding window length is greater than or equal to the maximum length of all process activity subsequences, thus ensuring that each process activity subsequence can appear completely in the subsequence to be identified.

[0109] The sliding window length and sliding window step size can be calculated during the training of the semantic abstraction model, when the collected sample system call sequences are labeled using an automatic annotation algorithm. The methods for determining the sliding window length and sliding window step size will be introduced below and will not be detailed here.

[0110] Step S108: For each subsequence to be identified, input the subsequence to be identified into the pre-trained process semantic abstraction model to obtain the named entity recognition result that represents the process behavior corresponding to each system call in the subsequence to be identified.

[0111] Named entity recognition (NER) refers to the process of identifying and labeling specified entities within a language sentence. These entities might be names, addresses, dates, etc. In a semantic abstraction context, the entire system call sequence can be viewed as a sentence in natural language, where each word represents a system call, and the sequence of system calls representing process behavior is considered an entity. By identifying all entities within this sentence and labeling them with their corresponding behavioral tags, a mapping from system call sequences to process behavior is achieved. Process semantic abstraction models can realize this mapping, i.e., performing named entity recognition on the sub-sequence to be identified to obtain the corresponding named entity recognition results.

[0112] See Figure 4 , Figure 4 This is a flowchart of a training method for a process semantic abstraction model in this application embodiment, which may include the following steps:

[0113] Step S402: Collect multiple system call sequences of the server process during normal operation, and take a single system call sequence as a single sample system call sequence.

[0114] The collected system calls contain a wealth of information. The system call sequences can be cleaned and preprocessed to extract key information. For example, information such as the system call name, the first parameter, return value, process, and thread can be extracted, while other parameters and error messages can be removed. Furthermore, only the parameters and return values ​​of system calls like `accept` and `close` can be collected, further reducing the amount of other system call information.

[0115] Step S404: According to the automatic annotation algorithm, each sample system call sequence is divided into N sample running stage subsequences; and according to the request execution process, the sample running stage subsequence corresponding to the target process running stage is divided into one or more sample process activity subsequences.

[0116] This step is similar to the process in step S104. Please refer to the description in step S104 for details, which will not be repeated here.

[0117] Step S406: Select the maximum value from the lengths of all sample process activity subsequences, and determine the sliding window length and sliding window step size based on the selected maximum value.

[0118] Each sample system call sequence can be divided into one or more sample process activity subsequences. The maximum length of each subsequence is selected, and this maximum length determines the sliding window length and step size. The sliding window length must be greater than or equal to the selected maximum value. This ensures that each sample process activity subsequence appears completely within the sample training subsequence during the following sliding segmentation stage. That is, it avoids truncating a complete sample process activity subsequence. For example, the sliding window length can be twice the maximum value, and the sliding window step size can be equal to the maximum value.

[0119] Step S408: Based on the sliding window length and sliding window step size, each sample system call sequence is divided into multiple sample training subsequences.

[0120] Step S410: Based on the N sample running stage subsequences and one or more sample process activity subsequences in each sample system call sequence, name entity annotation is performed on each system call in the sample system call sequence to obtain the entity annotation result corresponding to each system call.

[0121] In named entity recognition, the entire system call sequence is a sentence, and each system call is a word. The system call subsequence corresponding to the initialization phase can be defined as an entity, labeled using the triple {B-initial, M-initial, E-initial}. The event loop phase has many activities, each labeled using the triple {B-activity, M-activity, Eactivity}; similarly, the exit phase can be labeled using the triple {B-exit, M-exit, E-exit}. Therefore, the system call sequence can be abstracted into multiple entities in named entity recognition, and process behavior can be determined by identifying these entities.

[0122] Optionally, for each sample system call sequence, each sample running stage subsequence corresponding to the running stages of other processes besides the target process running stage is marked as a stage entity triple corresponding to the sample running stage subsequence; wherein, the first element in the stage entity triple represents the start of the running stage of other processes, the second element in the stage entity triple represents the intermediate process of the running stage of other processes, and the third element in the stage entity triple represents the end of the running stage of other processes.

[0123] The first system call in the sample execution phase subsequence is marked as the first element in the phase entity triple, the last system call in the sample execution phase subsequence is marked as the third element in the phase entity triple, and the other system calls in the sample execution phase subsequence are marked as the second element in the phase entity triple.

[0124] For each sample system call sequence, the sample execution phase subsequence corresponding to the target process execution phase is marked as an activity entity triplet. The first element of the activity entity triplet represents the start of the process activity, the second element represents the intermediate process of the process activity, and the third element represents the end of the process activity.

[0125] The first system call in the sample process activity subsequence is marked as the first element in the activity entity triplet, the last system call in the sample process activity subsequence is marked as the third element in the activity entity triplet, and the other system calls in the sample process activity subsequence are marked as the second element in the activity entity triplet.

[0126] See Figure 5 , Figure 5 This is a schematic diagram of process semantic abstraction based on named entity recognition in an embodiment of this application. The middle section shows the system call sequence of the process, the right side shows the sequence labeling results based on the process execution framework, and the left side shows the entity annotation results from named entity recognition. It can be seen that each system call has a corresponding entity annotation result.

[0127] Step S412: Determine the entity annotation results of the sample training subsequence based on the entity annotation results of the system calls contained in each sample training subsequence.

[0128] Since each sample training subsequence contains multiple system calls, the sequence consisting of the entity annotation results corresponding to the multiple system calls is used as the entity annotation result of the sample training subsequence.

[0129] Step S414: Use the sample training subsequence as input data and the entity annotation results corresponding to the sample training subsequence as label data to train the semantic abstraction model of the generation process.

[0130] Deep learning models can generally be divided into an embedding layer, a feature extraction layer, and a labeling and prediction layer. The process semantic abstraction model in this embodiment includes an embedding layer, a feature extraction layer, and a labeling and prediction layer. Optionally, the embedding layer is a RoBERTa model, the feature extraction layer is a BiLSTM (Bidirectional Long Short-Term Memory) model, and the labeling and prediction layer is a CRF (Conditional Random Field) model.

[0131] During model training, a pre-trained model (i.e., the RoBERTa model) can be generated by combining the collected system call sequences. This model can transform a single system call into a low-dimensional dense feature vector, and similar system calls will be mapped to similar positions in the feature space, which has deep language representation. This feature vector will also be used as the input of subsequent models.

[0132] The BiLSTM model takes as input the dynamic word embedding sequence output by the RoBERTa model and extracts more comprehensive contextual information and dependencies from it. The LSTM within it includes three gating units—input gate, forget gate, and output gate—to preserve and utilize long-term dependencies, avoiding the vanishing gradient problem. Furthermore, the forward and backward LSTM structures included in BiLSTM can more comprehensively combine contextual information and relationships, learning deeper features.

[0133] The CRF model combines deep sequence features extracted by the BiLSTM model with the dependencies between labels for labeling and decoding. Overall, the combined BiLSTM and CRF model can jointly model using sentence sequence features and label information, and ultimately predict the best sequence label. In the process semantic abstraction model, this combined model abstracts the high-level semantics of the process from the system call sequence of the process, that is, outputs the behavioral label corresponding to each system call.

[0134] Training data can be split into multiple batches, and each batch of data can be used for one training session. Each training session involves forward propagation of the model, where the model trains a subsequence based on the input samples in that batch of data, calculates the loss between the predicted and ground truth values, calculates the gradient based on the loss value, and performs backpropagation. For example, the Adam optimizer can be used to update the model parameters until the model converges.

[0135] After generating the process semantic abstraction model, test data (which can include normal system call sequences and abnormal system call sequences) can be used to validate the model. If the accuracy of the process semantic abstraction model is high, it can be directly used for anomaly detection. If the accuracy of the process semantic abstraction model is low, sample system call sequences can be collected to construct training data and the process semantic abstraction model can be trained until its accuracy meets the requirements.

[0136] By using the process semantic abstraction model, we can obtain the named entity recognition result for each system call in the subsequence to be identified, and this named entity recognition result can characterize the behavior of the process.

[0137] Step S110: Aggregate and overwrite the named entity recognition results corresponding to system calls in multiple sub-sequences to be identified, and obtain the named entity recognition results corresponding to each system call in the system call sequence.

[0138] Since each subsequence to be identified is obtained through sliding window segmentation, each subsequence to be identified contains overlapping parts. Therefore, the named entity recognition results corresponding to system calls in multiple subsequences to be identified can be aggregated and overwritten to obtain the named entity recognition results corresponding to each system call in the entire system call sequence.

[0139] Step S112: If the named entity recognition result corresponding to each system call in the system call sequence contains unrecognized named entities, it is determined that the system call sequence is abnormal, and an alarm message is sent.

[0140] The process semantic abstraction model learns the normal behavior patterns of server processes and can identify process stages and activities from the process's system call sequence. Therefore, when a process exhibits abnormal stages or activities, the model can also identify the corresponding abnormal system call sequence and issue an alert. This anomaly detection method only requires normal process behavior during training and does not need abnormal attack behavior. Therefore, it is applicable to many normally running server processes and can handle unknown attacks such as vulnerabilities without needing to mine all attack patterns from a vulnerability database.

[0141] Specifically, for running processes, their system call sequences are input into the model in real time for behavioral annotation. If the model cannot identify the initialization phase at the beginning of the sequence, it indicates abnormal behavior during server startup, such as attacks during the initialization phase. After the server enters the event loop phase, the model can identify and annotate the process's activities from its system call sequence. If unidentified activities exist, it indicates anomalies in the process's event loop. For example, an attacker might inject a vulnerability into the server and execute abnormal system calls during this phase, resulting in a different system call sequence from the server process's normal sequence. The model uses this to determine if abnormal activity exists. After the server exits, the model can annotate the end of the system call sequence to determine if it's a normal exit phase. Attackers might exploit the process exit to execute malicious actions.

[0142] After the model detects anomalies, alerts can be sent to help security experts assess the abnormal behavior of the process. For example, alerts can be sent for system calls corresponding to unidentified named entities (including the system call name, parameters, and return value), the process phase to which the unidentified named entity system call belongs, and nearby system calls corresponding to identified named entities. System calls corresponding to unidentified named entities can help security experts determine if the process behavior is abnormal. System calls near unidentified named entities and those corresponding to identified named entities can help security experts understand the attack context and trace its origin.

[0143] Furthermore, when the process execution phase of the system call corresponding to the unidentified named entity belongs to the execution phase of the target process, since the request sender is often closely related to the attacker, the network information (such as the user's IP address and port number) and request content of the request sender corresponding to the user connection subsequence to which the system call corresponding to the unidentified named entity belongs can be sent.

[0144] The server behavior anomaly detection method in this application utilizes an automatic annotation algorithm to annotate system call sequences, generating a mapping relationship between high-level process behavior and low-level system call sequences. Considering the long length of system call sequences, existing deep learning models cannot accommodate the entire sequence in a single input. Therefore, a sliding window approach can be used to segment the system call sequence, and a pre-trained process semantic abstraction model can be used to extract process behavior. When the process semantic abstraction model cannot identify the process activity corresponding to the system call sequence, it indicates that an anomaly may have occurred in the system call sequence, i.e., the process is exhibiting abnormal activity. The anomaly scenario can be analyzed, and alert information can be provided to security experts, facilitating their identification of abnormal process behavior. The process semantic abstraction model proposes an anomaly detection algorithm that can determine the abnormal stages and activities of a process through its system call sequence and report relevant information upon detection, helping security experts discover anomalies and trace attack sources. Therefore, this application, by combining an automatic annotation algorithm and a process semantic abstraction model, extracts high-level process semantics from system call sequences, enabling security experts to understand high-level process behavior and facilitating their analysis of abnormal events.

[0145] Corresponding to the above method embodiments, this application also provides a server behavior anomaly detection device, see [link to relevant documentation]. Figure 6 The server behavior anomaly detection device 600 includes:

[0146] The system call acquisition module 602 is used to collect the system call sequence during the runtime of the server process in real time.

[0147] The automatic annotation module 604 is used to divide each system call in the system call sequence into N process execution stages according to a pre-set automatic annotation algorithm, to obtain N execution stage sub-sequences, and to divide the execution stage sub-sequences corresponding to the target process execution stage in the N process execution stages into one or more process activity sub-sequences according to the request execution process; N is an integer greater than 1.

[0148] The sequence segmentation module 606 is used to segment a system call sequence into multiple subsequences to be identified based on the sliding window length and the sliding window step size; wherein the sliding window length is greater than or equal to the maximum value of the lengths of all process activity subsequences;

[0149] The named entity recognition module 608 is used to input the subsequence to be recognized into a pre-trained process semantic abstraction model for each subsequence to be recognized, and obtain the named entity recognition result that represents the process behavior corresponding to each system call in the subsequence to be recognized;

[0150] The named entity recognition result processing module 610 is used to aggregate and cover the named entity recognition results corresponding to system calls in multiple sub-sequences to be recognized, so as to obtain the named entity recognition results corresponding to each system call in the system call sequence.

[0151] The anomaly determination module 612 is used to determine that an anomaly has occurred in the system call sequence if the named entity recognition result corresponding to each system call in the system call sequence contains unrecognized named entities.

[0152] The alarm information sending module 614 is used to send alarm information when an anomaly occurs in the system call sequence.

[0153] Optionally, the server behavior anomaly detection device 600 further includes:

[0154] The process semantic abstraction model training module is used to collect multiple system call sequences of a server process during normal operation, treating each system call sequence as a single sample system call sequence; based on an automatic annotation algorithm, each sample system call sequence is divided into N sample execution stage subsequences; and according to the request execution process, the sample execution stage subsequences corresponding to the target process execution stage are divided into one or more sample process activity subsequences; and,

[0155] The maximum value is selected from the lengths of all sample process activity subsequences, and the sliding window length and sliding window step size are determined based on the selected maximum value; wherein the sliding window length is greater than or equal to the selected maximum value; each sample system call sequence is divided into multiple sample training subsequences based on the sliding window length and sliding window step size; and,

[0156] Based on N sample execution phase subsequences and one or more sample process activity subsequences in each sample system call sequence, named entity annotation is performed on each system call in the sample system call sequence to obtain the entity annotation result corresponding to each system call; based on the entity annotation results of the system calls contained in each sample training subsequence, the entity annotation result of the sample training subsequence is determined; using the sample training subsequence as input data and the entity annotation result corresponding to the sample training subsequence as label data, a process semantic abstraction model is trained and generated.

[0157] Optionally, the N process execution phases include: an initialization phase, an event loop phase, and an exit phase;

[0158] Automatic annotation module 604 is specifically used to divide each system call in the system call sequence into N process execution stages according to a pre-set automatic annotation algorithm, thereby obtaining N execution stage sub-sequences:

[0159] Find the first system call in the system call sequence that uses I / O multiplexing, and divide the system calls before the first system call that uses I / O multiplexing into the initialization phase to obtain the initialization phase subsequence;

[0160] Find the last system call in the system call sequence that involves I / O multiplexing, and divide the system calls between the first and last system calls that involve I / O multiplexing into the event loop phase to obtain the event loop phase subsequence;

[0161] System calls following the last I / O multiplexing system call are assigned to the exit phase, resulting in an exit phase subsequence.

[0162] Optionally, the target process execution phase is the event loop phase;

[0163] Automatic labeling module 604 is specifically used to divide the execution phase subsequence corresponding to the target process execution phase among N process execution phases into one or more process activity subsequences according to the following steps:

[0164] System calls that involve I / O multiplexing within a subsequence of the event loop phase are considered as a process activity subsequence.

[0165] Optionally, the process semantic abstraction model training module performs named entity annotation on each system call in the sample system call sequence based on N sample runtime phase subsequences and one or more sample process activity subsequences in each sample system call sequence, thereby obtaining the entity annotation result corresponding to each system call:

[0166] For each sample system call sequence, the sample execution phase subsequence corresponding to the execution phase of other processes besides the target process execution phase is marked as a phase entity triplet corresponding to the sample execution phase subsequence; where the first element in the phase entity triplet represents the start of the execution phase of other processes, the second element in the phase entity triplet represents the intermediate process of the execution phase of other processes, and the third element in the phase entity triplet represents the end of the execution phase of other processes.

[0167] The first system call in the sample execution phase subsequence is marked as the first element in the phase entity triple, the last system call in the sample execution phase subsequence is marked as the third element in the phase entity triple, and the other system calls in the sample execution phase subsequence are marked as the second element in the phase entity triple.

[0168] For each sample system call sequence, the sample execution phase subsequence corresponding to the target process execution phase is marked as an activity entity triplet corresponding to the sample process activity subsequence. The first element of the activity entity triplet represents the start of the process activity, the second element represents the intermediate process of the process activity, and the third element represents the end of the process activity.

[0169] The first system call in the sample process activity subsequence is marked as the first element in the activity entity triplet, the last system call in the sample process activity subsequence is marked as the third element in the activity entity triplet, and the other system calls in the sample process activity subsequence are marked as the second element in the activity entity triplet.

[0170] Optionally, the automatic labeling module 604 is further configured to divide the running stage subsequence corresponding to the target process running stage in N process running stages into one or more user connection subsequences according to the establishment and disconnection of user connections, and determine the process activity subsequence contained in each user connection subsequence.

[0171] Alarm information sending module 614 is specifically used to send the system call corresponding to the unidentified named entity, the process execution stage to which the system call to the unidentified named entity belongs, and system calls near the unidentified named entity that correspond to the identified named entity; and

[0172] If the process execution phase to which the system call corresponding to the unidentified named entity belongs is within the execution phase of the target process, send the network information and request content of the request sender corresponding to the user connection subsequence to which the system call corresponding to the unidentified named entity belongs.

[0173] Optionally, the process semantic abstraction model includes: an embedding layer, a feature extraction layer, and a labeling prediction layer;

[0174] The embedding layer is a RoBERTa model, the feature extraction layer is a Bi-directional Long Short-Term Memory (BiLSTM) model, and the labeling and prediction layer is a Conditional Random Field (CRF) model.

[0175] The specific details of each module or unit in the above-mentioned device have been described in detail in the corresponding methods, so they will not be repeated here.

[0176] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0177] This application also provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the server behavior anomaly detection method in this application.

[0178] Reference Figure 7 , Figure 7 This is a schematic diagram of the structure of an electronic device in an embodiment of this application. The specific embodiments of this application do not limit the specific implementation of the electronic device.

[0179] like Figure 7 As shown, the electronic device may include: a processor 702, a communication interface 704, a memory 706, and a communication bus 708.

[0180] The processor 702, communication interface 704, and memory 706 communicate with each other via communication bus 708.

[0181] Communication interface 704 is used to communicate with other electronic devices or servers.

[0182] The processor 702 is used to execute program 710, specifically the relevant steps in the above method embodiments.

[0183] Specifically, program 710 may include program code that includes computer operation instructions.

[0184] The processor 702 may be a central processing unit, a specific integrated circuit, or one or more integrated circuits configured to implement the embodiments of this application. The electronic device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0185] Memory 706 is used to store program 710. Memory 706 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0186] Specifically, program 710 can be used to cause processor 702 to execute the steps in the above-described server behavior anomaly detection method embodiment.

[0187] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the devices and modules described above can be referred to the corresponding process descriptions in the foregoing method embodiments, and will not be repeated here.

[0188] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described server behavior anomaly detection method.

[0189] It should be noted that the computer-readable storage medium shown in this application can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable storage medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, radio frequency, etc., or any suitable combination thereof.

[0190] In this embodiment of the application, a computer program product is also provided, which, when running on a computer, causes the computer to execute the above-described server behavior anomaly detection method.

[0191] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0192] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting abnormal server behavior, characterized in that, include: Real-time acquisition of system call sequences during server process execution; According to a pre-set automatic annotation algorithm, each system call in the system call sequence is divided into N process execution stages, resulting in N execution stage sub-sequences. Then, according to the request execution process, the execution stage sub-sequences corresponding to the target process execution stage in the N process execution stages are divided into one or more process activity sub-sequences; N is an integer greater than 1. The system call sequence is divided into multiple sub-sequences to be identified based on the sliding window length and the sliding window step size; wherein the sliding window length is greater than or equal to the maximum value of the lengths of all process activity sub-sequences. For each subsequence to be identified, the subsequence to be identified is input into a pre-trained process semantic abstraction model to obtain the named entity recognition result that represents the process behavior corresponding to each system call in the subsequence to be identified; The named entity recognition results corresponding to system calls in multiple sub-sequences to be identified are aggregated and overwritten to obtain the named entity recognition results corresponding to each system call in the system call sequence. If the named entity identification results for each system call in the system call sequence contain unidentified named entities, it is determined that the system call sequence is abnormal, and an alarm message is sent.

2. The method according to claim 1, characterized in that, The training method for the process semantic abstraction model includes: Collect multiple system call sequences of the server process during normal operation, and use a single system call sequence as a single sample system call sequence; According to the automatic annotation algorithm, each sample system call sequence is divided into N sample execution phase subsequences; and according to the request execution process, the sample execution phase subsequence corresponding to the target process execution phase is divided into one or more sample process activity subsequences. The maximum value is selected from the lengths of all sample process activity subsequences, and the sliding window length and sliding window step size are determined based on the selected maximum value; wherein the sliding window length is greater than or equal to the selected maximum value; Based on the sliding window length and the sliding window step size, each sample system call sequence is divided into multiple sample training subsequences; Based on the N sample execution phase subsequences and one or more sample process activity subsequences in each sample system call sequence, named entity annotation is performed on each system call in the sample system call sequence to obtain the entity annotation result corresponding to each system call; The entity annotation results of the sample training subsequence are determined based on the entity annotation results of the system calls contained in each sample training subsequence. The sample training subsequences are used as input data, and the entity annotation results corresponding to the sample training subsequences are used as label data to train the semantic abstraction model of the generation process.

3. The method according to claim 1, characterized in that, The N process execution phases include: initialization phase, event loop phase, and exit phase; The system call sequence is divided into N process execution stages according to a pre-set automatic annotation algorithm, resulting in N execution stage sub-sequences, including: Find the first system call in the system call sequence that uses input / output I / O multiplexing, and divide the system calls before the first system call that uses I / O multiplexing into the initialization phase to obtain the initialization phase subsequence; Find the system call that last exhibited I / O multiplexing from the system call sequence, and divide the system calls between the first and last I / O multiplexing system call into the event loop phase to obtain the event loop phase subsequence; System calls following the last I / O multiplexing system call are assigned to the exit phase, resulting in an exit phase subsequence.

4. The method according to claim 3, characterized in that, The target process execution phase is the event loop phase; The step of dividing the target process execution phase subsequence among the N process execution phases into one or more process activity subsequences according to the request execution process includes: The system calls between the system calls that involve I / O multiplexing and the system calls that involve I / O multiplexing again in the event loop phase subsequence are considered as a process activity subsequence.

5. The method according to claim 2, characterized in that, The step involves performing named entity annotation on each system call in the sample system call sequence based on N sample execution phase subsequences and one or more sample process activity subsequences in each sample system call sequence, to obtain the entity annotation result corresponding to each system call, including: For each sample system call sequence, the sample execution phase subsequence corresponding to the execution phases of other processes besides the target process execution phase is marked as a phase entity triplet corresponding to the sample execution phase subsequence; wherein, the first element of the phase entity triplet represents the start of the execution phase of other processes, the second element of the phase entity triplet represents the intermediate process of the execution phase of other processes, and the third element of the phase entity triplet represents the end of the execution phase of other processes. The first system call in the sample running phase subsequence is marked as the first element in the phase entity triplet, the last system call in the sample running phase subsequence is marked as the third element in the phase entity triplet, and the other system calls in the sample running phase subsequence are marked as the second element in the phase entity triplet. For each sample system call sequence, the sample execution phase subsequence corresponding to the target process execution phase is marked as an activity entity triplet corresponding to the sample process activity subsequence; wherein, the first element of the activity entity triplet represents the start of the process activity, the second element of the activity entity triplet represents the intermediate process of the process activity, and the third element of the activity entity triplet represents the end of the process activity. The first system call in the sample process activity subsequence is marked as the first element of the activity entity triple, the last system call in the sample process activity subsequence is marked as the third element of the activity entity triple, and the other system calls in the sample process activity subsequence are marked as the second element of the activity entity triple.

6. The method according to claim 1, characterized in that, The method further includes: Based on the establishment and disconnection of user connections, the running phase subsequence corresponding to the target process running phase in the N process running phases is divided into one or more user connection subsequences, and the process activity subsequence contained in each user connection subsequence is determined. The alarm information sent includes: Send the system call corresponding to the unidentified named entity, the process execution stage to which the system call to the unidentified named entity belongs, and the system calls near the system call to the unidentified named entity that correspond to the identified named entities; and, If the process execution phase to which the system call corresponding to the unidentified named entity belongs is the execution phase of the target process, then send the network information and request content of the request sender corresponding to the user connection subsequence to which the system call corresponding to the unidentified named entity belongs.

7. The method according to claim 1, characterized in that, The process semantic abstraction model includes: an embedding layer, a feature extraction layer, and a labeling and prediction layer; The embedding layer is a RoBERTa model, the feature extraction layer is a Bidirectional Long Short-Term Memory (BiLSTM) network model, and the annotation prediction layer is a Conditional Random Field (CRF) model.

8. A server behavior anomaly detection device, characterized in that, The device includes: The system call acquisition module is used to collect the system call sequence of the server process in real time. An automatic annotation module is used to divide each system call in the system call sequence into N process execution stages according to a pre-set automatic annotation algorithm, resulting in N execution stage sub-sequences. Then, according to the request execution process, the execution stage sub-sequences corresponding to the target process execution stage in the N process execution stages are divided into one or more process activity sub-sequences; N is an integer greater than 1. The sequence segmentation module is used to segment the system call sequence into multiple sub-sequences to be identified based on the sliding window length and the sliding window step size; wherein the sliding window length is greater than or equal to the maximum value of the lengths of all process activity sub-sequences; The named entity recognition module is used to input the subsequence to be recognized into a pre-trained process semantic abstraction model for each subsequence to be recognized, and obtain the named entity recognition result that represents the process behavior corresponding to each system call in the subsequence to be recognized; The named entity recognition result processing module is used to aggregate and overwrite the named entity recognition results corresponding to system calls in multiple sub-sequences to be recognized, so as to obtain the named entity recognition results corresponding to each system call in the system call sequence. An anomaly determination module is used to determine that an anomaly has occurred in the system call sequence if the named entity identification results corresponding to each system call in the system call sequence contain unidentified named entities. The alarm information sending module is used to send alarm information when an anomaly occurs in the system call sequence.

9. An electronic device, characterized in that, include: A processor for executing a computer program stored in a memory, wherein the computer program, when executed by the processor, implements the method of any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-7.

Images