Endpoint behavior recognition method and system based on low code

Abstract

The present application discloses a low-code-based endpoint behavior recognition method and system, which mainly relates to the field of endpoint behavior recognition technology, and is used to solve the problem that the existing solutions increase the coverage of behavior detection by adding detection codes in order to effectively detect the operation behaviors of each user, which leads to a surge in the amount of code for developers to adapt to the behaviors of different users. It includes: loading preset information configuration rules; capturing a single system call information and processing it into preset format data; based on the specific content of the preset format data, determining the preset information configuration rules corresponding to the current preset format data, and then placing the preset format data in the rule queue of the corresponding preset information configuration rules; when the rule queue is not empty, sequentially determining the matching of the preset format data in the rule queue with several sub-rule conditions in the preset information configuration rules to determine whether the preset behavior is satisfied.

Description

Technical Field

[0001] The present application relates to the field of endpoint behavior recognition technology, and in particular to a low-code-based endpoint behavior recognition method and system. Background Art

[0002] Endpoint behavior recognition is a network security technology that monitors and analyzes the activities of network terminal devices to identify abnormal behaviors and take corresponding measures to protect network security. The "endpoint" here usually refers to computing devices in the network, such as laptops, desktops, servers, tablets and smartphones.

[0003] The existing system terminal behavior recognition is judged by system call information, such as common system calls open, creat, rename, etc. By analyzing the system call information of related processes, we can preliminarily determine what behaviors the process has. However, some user operations such as copy, cut, compress, decompress, etc. cannot be judged by a single system call information, but a collection of multiple system call information. When we judge the behavior of these compound operations, we will merge the compound behaviors. Generally, we merge them in the code. In the system, such as compression and decompression, each software version, system version, and file system version will have different behavior combinations. For compatibility, developers need to constantly adapt to different behaviors.

[0004] Since users' systems and software versions are constantly upgraded and each person's usage behavior is different, in order to effectively detect each user's operation behavior, the coverage of behavior detection is mainly improved by adding detection code. Therefore, there is a problem of developers increasing the amount of code in order to adapt to different user behaviors. Summary of the invention

[0005] In response to the above-mentioned deficiencies in the prior art, the present application provides a low-code-based endpoint behavior recognition method and system to solve the problem that the existing solutions mainly increase the coverage of behavior detection by increasing the detection code in order to effectively detect the operation behavior of each user. Therefore, there is a problem that the amount of code increases sharply in order for developers to adapt to the behavior of different users.

[0006] In the first aspect, the present application provides an endpoint behavior identification method based on low code, the method comprising: obtaining a number of preset information configuration rules, loading the preset information configuration rules; capturing system call information, and processing a single system call information into preset format data; wherein the preset format data includes a single behavior of the system call information, a process name, time information, the pid of the current process, the first parameter data in the system call, and the second parameter data in the system call; based on the specific content of the preset format data, determining the preset information configuration rule corresponding to the current preset format data, and then placing the preset format data in the rule queue of the corresponding preset information configuration rule; real-time detection of whether the rule queue corresponding to the current preset information configuration rule is non-empty, and when it is not empty, determining in turn the matching of the preset format data in the rule queue with several sub-rule conditions in the preset information configuration rule, and determining whether the preset behavior is met based on the matching of all preset format data in the rule queue.

[0007] Furthermore, the system call information is captured, and a single piece of system call information is processed into preset format data, specifically including: capturing the system call information, extracting a single behavior, process name, time information, the pid of the current process, the first parameter data in the system call, and the second parameter data in the system call from the single piece of system call information; when the second parameter data does not exist, the second parameter data is a null value or a preset value.

[0008] Furthermore, before placing the preset format data in the rule queue of the corresponding preset information configuration rule, the method also includes: when the preset format data triggers the preset intermediate event rule MIDEVENT, through: MIDEVENT+detection item, detecting whether there is data of the detection item in the preset format data, and if so, revising the single behavior corresponding to the preset format data to the preset defined behavior.

[0009] Furthermore, MIDEVENT+ detection items specifically include: MIDEVENT&single behavior=preset first string matching item&process name=preset second string matching item&first parameter data in system call=preset third string matching item&second parameter data in system call=preset fourth string matching item, REPORT&preset defined behavior, determines whether the single behavior meets the preset first string matching item, whether the process name meets the preset second string matching item, whether the first parameter data in the system call meets the preset third string matching item, whether the second parameter data in the system call meets the preset fourth string matching item, and when all meet, updates the single behavior to the preset defined behavior.

[0010] Further, the preset information configuration rule includes a preset compound event rule; the preset compound event rule is: the preset compound event rule is MERGE_ORDER_ADD+detection item.

[0011] Further, MERGE_ORDER_ADD+ detection item, specifically includes: MERGE_ORDER_ADD&single behavior=fifth string matching item&process name=sixth string matching item&first parameter data in system call=seventh string matching item&second parameter data in system call=eighth string matching item; determine the matching situation of preset format data in the rule queue and several sub-rule conditions in the preset information configuration rule, and determine whether the preset behavior is satisfied based on the matching situation of all preset format data in the rule queue, specifically including: when the preset format data is in the rule queue corresponding to the preset compound event rule, call: MERGE_ORDER_ADD&single behavior=fifth string matching item&process name = the sixth string match item & the first parameter data in the system call = the seventh string match item & the second parameter data in the system call = the eighth string match item; determine whether a single behavior of the current preset format data meets the fifth string match item, whether the process name meets the sixth string match item, whether the first parameter data in the system call meets the seventh string match item, and whether the second parameter data in the system call meets the eighth string match item. When all of them meet, determine that the preset format data matches the preset compound event rule; obtain the matching situation of all preset format data in the rule queue and the preset compound event rule. When the matching order corresponding to the matching situation meets the preset matching order corresponding to the preset behavior, determine that the terminal corresponding to the preset format data has the preset behavior.

[0012] Furthermore, the preset information configuration rules include preset conditional event rules; the preset compound event rules include association relationship rule conditions between preset format data and preset behaviors; the association relationship rule conditions specifically include: a first relationship rule condition: detecting whether the first parameter data of the current preset format data is consistent with the second parameter data of the previous preset format data in the rule queue, and if they are consistent, the first relationship rule condition is met; a second relationship rule condition: detecting whether a single behavior of the current preset format data is consistent with a single behavior of the previous preset format data in the rule queue, and if they are consistent, the second relationship rule condition is met; a third relationship rule condition: detecting whether the pid of the current process of the current preset format data is consistent with the pid of the current process of the previous preset format data in the rule queue, and if they are consistent, the third relationship rule condition is met.

[0013] Further, determine the matching situation of the preset format data in the rule queue and several sub-rule conditions in the preset information configuration rule, and determine whether the preset behavior is satisfied based on the matching situation of all the preset format data in the rule queue, specifically including: detecting whether the first parameter data of the current preset format data is consistent with the second parameter data of the previous preset format data in the rule queue, and satisfying the first relationship rule condition when they are consistent; detecting whether a single behavior of the current preset format data is consistent with a single behavior of the previous preset format data in the rule queue, and satisfying the second relationship rule condition when they are consistent; detecting whether the pid of the current process of the current preset format data is consistent with the pid of the current process of the previous preset format data in the rule queue, and satisfying the third relationship rule condition when they are consistent; obtaining the sequence of the preset format data in the rule queue that meets the first relationship rule condition, the second relationship rule condition, and the third relationship rule condition; when the sequence is consistent with the sequence of the preset behaviors, determine that the terminal corresponding to the preset format data has the preset behavior.

[0014] On the second aspect, the present application provides an endpoint behavior identification system based on low code, and the system includes: a loading module, which is used to obtain a number of preset information configuration rules and load the preset information configuration rules; a processing module, which is used to capture system call information and process a single system call information into preset format data; wherein the preset format data includes a single behavior of the system call information, a process name, time information, the pid of the current process, the first parameter data in the system call, and the second parameter data in the system call; a placement module, which is used to determine the preset information configuration rule corresponding to the current preset format data based on the specific content of the preset format data, and then place the preset format data in the rule queue of the corresponding preset information configuration rule; a determination module, which is used to detect in real time whether the rule queue corresponding to the current preset information configuration rule is not empty. When it is not empty, the matching status of the preset format data in the rule queue and the several sub-rule conditions in the preset information configuration rule are determined in turn, and based on the matching status of all preset format data in the rule queue, it is determined whether the preset behavior is met.

[0015] Those skilled in the art can understand that the present application has at least the following beneficial effects:

[0016] The existing solution is to obtain system call information and then import it into a large number of behavior identification codes, and then compare it with a large number of behavior identification codes in sequence to determine the specific user endpoint behavior.

[0017] Based on the specific content of the preset format data, the present application determines the preset information configuration rules corresponding to the current preset format data, and then places the preset format data in the rule queue of the corresponding preset information configuration rules, preliminarily determines the specific behavior set (rule queue) corresponding to the system call information, and realizes the preliminary division of the behavior; in the subsequent process, by determining the matching situation of the preset format data in the rule queue and several sub-rule conditions in the preset information configuration rules, the matching situation is obtained, and then based on the corresponding relationship between the matching situation and the preset behavior, the matching situation of the user system call information is obtained, and then the preset behavior corresponding to the current user is determined through the matching situation of all the preset format data in the rule queue and the preset corresponding relationship of the preset behavior. It can be seen that the entire implementation process only involves the screening of several rules, and there is no need to perform operations of sequentially comparing with a large amount of code, and the amount of code is small.

[0018] In addition, when new behaviors appear, the prior art needs to add a large amount of code to be compatible with identifying the new behaviors. In the process of obtaining several preset information configuration rules and loading the preset information configuration rules, the present application can modify the preset information configuration rules to realize the identification of the new behaviors, further reducing the amount of code.

[0019] In summary, the present application solves the problem that the existing solutions mainly increase the coverage of behavior detection by adding detection codes in order to effectively detect the operation behaviors of each user. Therefore, there is a problem that the amount of code increases sharply in order for developers to adapt to the behaviors of different users. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Some embodiments of the present disclosure are described below with reference to the accompanying drawings, in which:

[0021] Figure 1 This is a flow chart of a low-code-based endpoint behavior identification method provided in an embodiment of the present application.

[0022] Figure 2 This is a specific implementation flowchart of a low-code-based endpoint behavior identification method provided in an embodiment of the present application.

[0023] Figure 3 This is a schematic diagram of the internal structure of a low-code-based endpoint behavior recognition system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] It should be understood by those skilled in the art that the embodiments described below are only preferred embodiments of the present disclosure, and do not mean that the present disclosure can only be implemented through the preferred embodiments. The preferred embodiments are only used to explain the technical principles of the present disclosure, and are not used to limit the protection scope of the present disclosure. Based on the preferred embodiments provided by the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work should still fall within the protection scope of the present disclosure.

[0025] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0026] The technical solution proposed in the embodiments of the present application is described in detail below with reference to the accompanying drawings.

[0027] The present application embodiment provides a low-code-based endpoint behavior recognition method, such as Figure 1 As shown, the method provided in the embodiment of the present application mainly includes the following steps:

[0028] Step 110: Obtain a number of preset information configuration rules, and load the preset information configuration rules.

[0029] It should be noted that the preset information configuration rules can be obtained through the preset acquisition interface.

[0030] In addition, in order to achieve effective matching of system call information with preset information configuration rules, and then achieve matching of user endpoint behaviors, when new behaviors appear, the prior art needs to add a large amount of code to be compatible with and identify the new behaviors. This application obtains several preset information configuration rules and loads the preset information configuration rules. In the process, the new behaviors can be identified by modifying the preset information configuration rules, thereby further reducing the amount of code.

[0031] Step 120: Capture system call information, and process a single piece of system call information into data in a preset format.

[0032] It should be noted that the preset format data includes a single behavior of the system call information, the process name, time information, the pid of the current process, the first parameter data in the system call, and the second parameter data in the system call.

[0033] As an example, the captured single system call data is processed into the following format:

[0034] {

[0035] "action" : "open",

[0036] "object_dst" : " / home / test / Desktop / cmd2.txt",

[0037] "object_src" : " / home / test / Desktop / cmd.txt",

[0038] "opera_comm" : " / usr / bin / dde-desktop",

[0039] "opera_comm_id" : "3158",

[0040] "opera_user" : "test",

[0041] "timestamp" : "XXXXX"

[0042] }

[0043] Among them, action: represents a single action; timestamp: represents time information; opera_user: represents the current user operation; opera_comm_id: represents the pid of the current process; opera_comm: represents the process name; object_src: represents the first parameter data in the system call; object_dst: represents the second parameter data in the system call, and can be set to empty if none is available.

[0044] This step can be specifically as follows:

[0045] Capture system call information, extract a single behavior, process name, time information, pid of the current process, the first parameter data in the system call, and the second parameter data in the system call from a single system call information; when the second parameter data does not exist, the second parameter data is an empty value or a preset value.

[0046] In addition, it is understandable that the existing solution is to import the obtained system call information into a large number of codes, and compare the configuration of the current system call information with each code in turn, and does not involve the solution of capturing the system call information and processing a single system call information into a preset format data. This step is facilitated by processing a single system call information into a preset format data, which is conducive to the subsequent extraction of content at the preset location.

[0047] Step 130: Based on the specific content of the preset format data, determine the preset information configuration rule corresponding to the current preset format data, and then place the preset format data in a rule queue of the corresponding preset information configuration rule.

[0048] Before placing the preset format data into the rule queue of the corresponding preset information configuration rule, the method can also modify a single behavior to a preset definition behavior:

[0049] When the preset format data triggers the preset intermediate event rule MIDEVENT, MIDEVENT+detection item is used to detect whether the preset format data contains the detection item data. If so, the single behavior corresponding to the preset format data is revised to the preset defined behavior.

[0050] As an example, MIDEVENT&single behavior=preset first string matching item&process name=preset second string matching item&first parameter data in system call=preset third string matching item&second parameter data in system call=preset fourth string matching item, REPORT&preset defined behavior, determine whether the single behavior meets the preset first string matching item, whether the process name meets the preset second string matching item, whether the first parameter data in the system call meets the preset third string matching item, whether the second parameter data in the system call meets the preset fourth string matching item, and when all meet, update the single behavior to the preset defined behavior.

[0051] In addition, it can be understood that the present application determines the preset information configuration rules corresponding to the current preset format data based on the specific content of the preset format data, and then places the preset format data in the rule queue of the corresponding preset information configuration rules, thereby realizing the preliminary determination of the specific behavior set (rule queue) corresponding to the system call information, and realizing the preliminary division of the behavior, which is different from the existing scheme of importing a large amount of code after obtaining the system call information, and comparing each code in turn with the configuration of the current system call information. The present application divides information through rules, and does not need to compare a large amount of code. In addition, through the division of the queue, the length of the queue is reduced, and the queue division based on the preset information configuration rules corresponding to the current preset format data realizes the aggregation of preset format data of the same behavior, reduces interference data, and is conducive to improving the subsequent detection accuracy.

[0052] Step 140: Detect in real time whether the rule queue corresponding to the current preset information configuration rule is not empty. When it is not empty, determine in turn the matching conditions of the preset format data in the rule queue and several sub-rule conditions in the preset information configuration rule. Based on the matching conditions of all preset format data in the rule queue, determine whether the preset behavior is met.

[0053] As an example, the preset compound event rule is MERGE_ORDER_ADD+detection item.

[0054] Specifically, the preset information configuration rule may be a preset compound event rule; the preset compound event rule may be: MERGE_ORDER_ADD&single behavior=fifth string match&process name=sixth string match&first parameter data in system call=seventh string match&second parameter data in system call=eighth string match.

[0055] It should be noted that the keywords corresponding to the preset compound event rules are:

[0056] MERGE_BEGIN, MERGE_ORDER_ADD, MERGE_END. Among them, MERGE_ORDER_ADD+detection items.

[0057] As an example, the matching conditions of the preset format data in the rule queue and several sub-rule conditions in the preset information configuration rule are determined in sequence, and based on the matching conditions of all the preset format data in the rule queue, it is determined whether the preset behavior is satisfied, which may be:

[0058] When the preset format data is in the rule queue corresponding to the preset compound event rule, call: MERGE_ORDER_ADD&single behavior=fifth string match&process name=sixth string match&first parameter data in system call=seventh string match&second parameter data in system call=eighth string match; determine whether the single behavior of the current preset format data meets the fifth string match, whether the process name meets the sixth string match, whether the first parameter data in the system call meets the seventh string match, and whether the second parameter data in the system call meets the eighth string match. If all meet, determine that the preset format data matches the preset compound event rule; obtain the matching situation of all preset format data in the rule queue and the preset compound event rule. When the matching order corresponding to the matching situation meets the preset matching order corresponding to the preset behavior, determine that the terminal corresponding to the preset format data has the preset behavior.

[0059] As an example, the preset information configuration rule can be a preset conditional event rule; the preset compound event rule includes an association relationship rule condition between the preset format data and the preset behavior; the association relationship rule condition specifically includes: a first relationship rule condition: detecting whether the first parameter data of the current preset format data is consistent with the second parameter data of the previous preset format data in the rule queue, and if they are consistent, the first relationship rule condition is met; a second relationship rule condition: detecting whether a single behavior of the current preset format data is consistent with a single behavior of the previous preset format data in the rule queue, and if they are consistent, the second relationship rule condition is met; a third relationship rule condition: detecting whether the pid of the current process of the current preset format data is consistent with the pid of the current process of the previous preset format data in the rule queue, and if they are consistent, the third relationship rule condition is met.

[0060] As a second example, the matching of the preset format data in the rule queue with several sub-rule conditions in the preset information configuration rule is determined, and based on the matching of all the preset format data in the rule queue, whether the preset behavior is satisfied may be specifically:

[0061] Detect whether the first parameter data of the current preset format data is consistent with the second parameter data of the previous preset format data in the rule queue, and if they are consistent, the first relationship rule condition is met; detect whether a single behavior of the current preset format data is consistent with a single behavior of the previous preset format data in the rule queue, and if they are consistent, the second relationship rule condition is met; detect whether the pid of the current process of the current preset format data is consistent with the pid of the current process of the previous preset format data in the rule queue, and if they are consistent, the third relationship rule condition is met; obtain the sequence in which the preset format data in the rule queue meets the first relationship rule condition, the second relationship rule condition, and the third relationship rule condition; when the sequence is consistent with the sequence of preset behaviors, determine that the terminal corresponding to the preset format data has preset behaviors.

[0062] It should be noted that the keywords corresponding to the preset conditional event rules can be added by those skilled in the art according to the actual situation. For example, the main keywords used in conjunction with the preset compound event are: MERGE_REPORT, MERGE_AUTOREPORT, and MERGE_CONDITION. Among them, MERGE_REPORT is followed by the specified interface; MERGE_AUTOREPORT is followed by the user-defined merged behavior; MERGE_CONDITION is followed by the description of the data relationship matched by the above MERGE_ORDER_ADD.

[0063] Based on the above description, it can be understood that the present application realizes the determination of the matching situation of preset format data in the rule queue and several sub-rule conditions in the preset information configuration rule through the above-mentioned rule conditions, and then can determine the corresponding endpoint behavior according to different matching situations.

[0064] In addition, after the matching conditions between the preset format data in the rule queue and the several sub-rule conditions in the preset information configuration rule are determined in sequence, the rule queue will be cleared.

[0065] Based on the above description, this application provides a low-code-based endpoint behavior identification method, as follows: Figure 2 As shown, after starting the program, the configuration rules (preset information configuration rules) are loaded, and the thread matching the preset compound event rules is used to wait for the original data to be passed in through data processing, and then the system call information is captured by using preload or ebpf or other methods. Each system call information is processed into preset format data through the preset preliminary processing program. The specific content in the preset format data is read, and the specific content is matched with the matching items (preset data) of the intermediate event rules or compound event rules to determine the preset information configuration rules (intermediate event rules or compound event rules) corresponding to the current preset format data, and then the preset format data is placed in the rule queue of the corresponding preset information configuration rules, or directly released according to the existing processing scheme without matching items. Real-time detection of whether the rule queue corresponding to the current preset information configuration rule is non-empty (specifically, the preset data rule checking thread waits for the original data to enter the rule queue). When the rule queue is empty, continue to wait for matching data input. When the rule queue is not empty, determine in turn whether the preset format data in the rule queue matches several sub-rule conditions in the preset information configuration rule (specifically, poll and check the element data in each matched preset format data in the rule queue. When there is a match between the element data and several sub-rule conditions in the preset information configuration rule, report the data according to the preset behavior data corresponding to the rule condition). After completing the data reporting (preset behavior reporting), you can clear the data in the queue. In addition, it can also detect whether the data in the rule queue has timed out. If so, you can clear the timed out data. The process ends when the exit signal is received.

[0066] In summary, the present application determines the preset information configuration rules corresponding to the current preset format data based on the specific content of the preset format data, and then places the preset format data in the rule queue of the corresponding preset information configuration rules, thereby realizing the preliminary determination of the specific behavior set (rule queue) corresponding to the system call information, and realizing the preliminary division of the behavior; in the subsequent process, by determining the matching situation of the preset format data in the rule queue and several sub-rule conditions in the preset information configuration rules, the matching situation is obtained, and then based on the corresponding relationship between the matching situation and the preset behavior, the matching situation of the user system call information is obtained, and then the preset behavior corresponding to the current user is determined through the matching situation of all the preset format data in the rule queue and the preset corresponding relationship of the preset behavior. It can be seen that the entire implementation process only involves the screening of several rules, and there is no need to perform operations of sequentially comparing with a large amount of code, and the amount of code is small.

[0067] In addition, when new behaviors appear, the prior art needs to add a large amount of code to be compatible with identifying the new behaviors. In the process of obtaining several preset information configuration rules and loading the preset information configuration rules, the present application can modify the preset information configuration rules to realize the identification of the new behaviors, further reducing the amount of code.

[0068] besides, Figure 3 A low-code-based endpoint behavior recognition system is provided in the embodiment of the present application. Figure 3 As shown, the system provided in the embodiment of the present application mainly includes:

[0069] The loading module 210 is used to obtain a number of preset information configuration rules and load the preset information configuration rules.

[0070] The processing module 220 is used to capture system call information and process a single system call information into preset format data; wherein the preset format data includes a single behavior of the system call information, a process name, time information, the pid of the current process, the first parameter data in the system call, and the second parameter data in the system call.

[0071] The placement module 230 is used to determine the preset information configuration rule corresponding to the current preset format data based on the specific content of the preset format data, and then place the preset format data in the rule queue of the corresponding preset information configuration rule.

[0072] The determination module 240 is used to detect in real time whether the rule queue corresponding to the current preset information configuration rule is not empty. When it is not empty, the matching conditions of the preset format data in the rule queue and several sub-rule conditions in the preset information configuration rule are determined in turn, and based on the matching conditions of all the preset format data in the rule queue, it is determined whether the preset behavior is met.

[0073] So far, the technical solutions of the present disclosure have been described in combination with the above multiple embodiments, but it is easy for those skilled in the art to understand that the protection scope of the present disclosure is not limited to these specific embodiments. Without departing from the technical principles of the present disclosure, those skilled in the art can split and combine the technical solutions in the above-mentioned various embodiments, and can also make equivalent changes or replacements to the relevant technical features. Any changes, equivalent replacements, improvements, etc. made within the technical concept and / or technical principle of the present disclosure will fall within the protection scope of the present disclosure.

Claims

1. A low-code-based endpoint behavior recognition method, characterized in that: The method comprises: Obtain several preset information configuration rules and load the preset information configuration rules; Capture system call information, and process a single piece of system call information into preset format data; wherein the preset format data includes a single behavior of the system call information, a process name, time information, a pid of the current process, the first parameter data in the system call, and the second parameter data in the system call; Based on the specific content of the preset format data, determine the preset information configuration rule corresponding to the current preset format data, and then place the preset format data in the rule queue of the corresponding preset information configuration rule; Real-time detection of whether the rule queue corresponding to the current preset information configuration rule is non-empty. When it is not empty, determine in turn the matching of the preset format data in the rule queue with several sub-rule conditions in the preset information configuration rule, and determine whether the preset behavior is met based on the matching of all preset format data in the rule queue.

2. The low-code-based endpoint behavior identification method according to claim 1 is characterized in that: Capture system call information and process a single system call information into preset format data, including: Capture system call information, extract a single behavior, process name, time information, pid of the current process, the first parameter data in the system call, and the second parameter data in the system call from a single system call information; when the second parameter data does not exist, the second parameter data is an empty value or a preset value.

3. The low-code-based endpoint behavior identification method according to claim 1 is characterized in that: Before placing the preset format data in the rule queue of the corresponding preset information configuration rule, the method further includes: When the preset format data triggers the preset intermediate event rule MIDEVENT, MIDEVENT+detection item is used to detect whether the preset format data contains the detection item data. If so, the single behavior corresponding to the preset format data is revised to the preset defined behavior.

4. The low-code-based endpoint behavior identification method according to claim 3 is characterized in that: MIDEVENT+ detection items include: MIDEVENT&single behavior=preset first string match&process name=preset second string match&first parameter data in system call=preset third string match&second parameter data in system call=preset fourth string match, REPORT&preset definition behavior, Determine whether a single behavior meets the preset first string matching item, whether the process name meets the preset second string matching item, whether the first parameter data in the system call meets the preset third string matching item, and whether the second parameter data in the system call meets the preset fourth string matching item. If all of them meet, update the single behavior to the preset defined behavior.

5. The low-code-based endpoint behavior identification method according to claim 1 is characterized in that: The preset information configuration rules include preset compound event rules; The default compound event rule is MERGE_ORDER_ADD+detection item.

6. The low-code-based endpoint behavior identification method according to claim 5 is characterized in that: MERGE_ORDER_ADD+ detection items, including: MERGE_ORDER_ADD&single behavior=fifth string match&process name=sixth string match&first parameter data in system call=seventh string match&second parameter data in system call=eighth string match; Determine the matching of the preset format data in the rule queue with several sub-rule conditions in the preset information configuration rule, and determine whether the preset behavior is satisfied based on the matching of all the preset format data in the rule queue, specifically including: When the preset format data is in the rule queue corresponding to the preset compound event rule, call: MERGE_ORDER_ADD&single behavior=fifth string match&process name=sixth string match&first parameter data in the system call=seventh string match&second parameter data in the system call=eighth string match; Determine whether a single behavior of the current preset format data meets the fifth string matching item, whether the process name meets the sixth string matching item, whether the first parameter data in the system call meets the seventh string matching item, and whether the second parameter data in the system call meets the eighth string matching item. If all meet, determine that the preset format data matches the preset compound event rule; The matching conditions of all preset format data in the rule queue and the preset compound event rule are obtained, and when the matching order corresponding to the matching condition satisfies the preset matching order corresponding to the preset behavior, it is determined that the terminal corresponding to the preset format data has the preset behavior.

7. The low-code-based endpoint behavior identification method according to claim 1 is characterized in that: The preset information configuration rules include preset condition event rules; The preset compound event rule includes a correlation rule condition between preset format data and preset behavior; Association relationship rule conditions, including: First relationship rule condition: detect whether the first parameter data of the current preset format data is consistent with the second parameter data of the previous preset format data in the rule queue, and if they are consistent, the first relationship rule condition is met; Second relationship rule condition: detect whether a single behavior of the current preset format data is consistent with a single behavior of the previous preset format data in the rule queue. If they are consistent, the second relationship rule condition is met; Third relationship rule condition: detect whether the pid of the current process of the current preset format data is consistent with the pid of the current process of the previous preset format data in the rule queue. If they are consistent, the third relationship rule condition is met.

8. The low-code-based endpoint behavior identification method according to claim 7 is characterized in that: Determine the matching of the preset format data in the rule queue with several sub-rule conditions in the preset information configuration rule, and determine whether the preset behavior is satisfied based on the matching of all the preset format data in the rule queue, specifically including: Detect whether the first parameter data of the current preset format data is consistent with the second parameter data of the previous preset format data in the rule queue, and if they are consistent, the first relationship rule condition is met; Detect whether a single behavior of the current preset format data is consistent with a single behavior of the previous preset format data in the rule queue, and if consistent, it meets the second relationship rule condition; Check whether the pid of the current process of the current preset format data is consistent with the pid of the current process of the previous preset format data in the rule queue, and if they are consistent, the third relationship rule condition is met; Obtaining the order in which the preset format data in the rule queue meets the first relationship rule condition, the second relationship rule condition, and the third relationship rule condition; When the sequence is consistent with the sequence of the preset behaviors, it is determined that the terminal corresponding to the preset format data has the preset behavior.

9. A low-code-based endpoint behavior recognition system, characterized in that: The system comprises: A loading module is used to obtain a number of preset information configuration rules and load the preset information configuration rules; A processing module is used to capture system call information and process a single piece of system call information into data in a preset format; wherein the data in the preset format includes a single behavior of the system call information, a process name, time information, a pid of the current process, the first parameter data in the system call, and the second parameter data in the system call; A placement module, used to determine the preset information configuration rule corresponding to the current preset format data based on the specific content of the preset format data, and then place the preset format data in a rule queue of the corresponding preset information configuration rule; The determination module is used to detect in real time whether the rule queue corresponding to the current preset information configuration rule is not empty. When it is not empty, the matching conditions of the preset format data in the rule queue and several sub-rule conditions in the preset information configuration rule are determined in turn, and based on the matching conditions of all preset format data in the rule queue, it is determined whether the preset behavior is met.

Images