Server behavior anomaly detection methods, devices, electronic equipment, and storage media

By automatically labeling and recognizing system call sequences of server processes, the problem of not being able to detect abnormal server behavior in existing technologies is solved, and effective detection and alerting of APT attacks are achieved.

CN118551321BActive Publication Date: 2026-05-26TSINGHUA UNIVERSITY
2 Cites 0 Cited by

Patent Information

Application Number
CN202410633860.2
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2024-05-21
Publication Date
2026-05-26
Estimated Expiration
2044-05-21

AI Technical Summary

Technical Problem

Existing technologies cannot effectively extract process semantics from system logs, making it difficult to detect abnormal server behavior, especially in APT attacks.

Method used

By collecting the system call sequence of server processes in real time, the system calls are divided into multiple process execution stages using an automatic annotation algorithm. Then, a sliding window and a pre-trained process semantic abstraction model are used for named entity recognition to identify abnormal behavior and send alarm information.

Benefits of technology

It enables the extraction of high-level semantics of processes from system call sequences, effectively detects abnormal server behavior, and provides detailed alarm information to facilitate the analysis of abnormal events by security experts.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

This application relates to a method, apparatus, electronic device, and storage medium for detecting abnormal server behavior, applied in the field of network security technology. The method includes: real-time acquisition of system call sequences during server process execution; dividing the system call sequence into N runtime phase subsequences, and further dividing the runtime phase subsequences corresponding to the target process's runtime phases into process activity subsequences; segmenting the system call sequence into multiple unidentified subsequences; inputting each unidentified subsequence into a process semantic abstraction model to obtain the named entity recognition result corresponding to each system call in the unidentified subsequence; aggregating and overwriting the named entity recognition results of multiple unidentified subsequences to obtain the named entity recognition result corresponding to each system call in the system call sequence; if unidentified named entities are included, determining that the system call sequence is abnormal, and sending an alarm message. This application can extract process behavior, facilitating expert analysis of abnormal events.
Need to check novelty before this filing date? Find Prior Art