Abnormal behavior detection method and device, electronic device, and storage medium

Abstract

The application discloses a kind of detection method and device of abnormal behavior, electronic equipment and storage medium, it is related to network security technical field, wherein, the detection method includes: the log data of terminal equipment is collected, and log data is added to log queue, log data in log queue is handled, single-point event is obtained, based on single-point event rule base, single-point event is matched, in the case where single-point event and any event rule match successfully, single-point event is determined as suspicious event, and suspicious event is added to event queue, based on association event rule base, suspicious event in event queue is detected, and in the case where multiple suspicious events hit target association event rule is detected, the event behavior of all suspicious events triggered by target association event rule that hits is determined as abnormal behavior on terminal equipment.The application solves the technical problem that the accuracy of detecting abnormal behavior in the related art is low.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an abnormal behavior detection method and device, an electronic device and a storage medium. BACKGROUND

[0002] In the field of computer security, antivirus software is the main terminal protection method. These software mainly detects and removes viruses by scanning and matching known malware signatures. However, these software can only prevent known malware and cannot defend against new or variant malware.

[0003] Therefore, with the complexity of network threats, a more comprehensive terminal protection method is adopted, which not only includes antivirus functions, but also integrates firewall, intrusion prevention and application control functions to prevent various types of malware and attacks (such as zero-day attacks and social engineering attacks).

[0004] For example, an intrusion detection method based on multi-host log association in the related art collects different operating system logs in a virtual machine cluster, abstracts them into a unified format, and stores them centrally. Then, a log matching algorithm is used to analyze the intrusion behavior characteristics, extract feature data, and form matching rules. Then, the centralized log data is analyzed using a model detection-based approach to analyze the correlation, thereby effectively tracking and identifying the intrusion path.

[0005] However, the above method only implements the basic log collection-feature extraction-rule update process, and does not perform further detection and scanning after detecting malicious behavior, which may result in the omission of malicious behavior. In addition, directly analyzing the logs can generate a large number of redundant event logs, reducing the efficiency and performance of rule matching.

[0006] In view of the above problems, no effective solution has been proposed so far. SUMMARY

[0007] The embodiments of the present application provide an abnormal behavior detection method and device, an electronic device and a storage medium to at least solve the technical problem of low accuracy in detecting abnormal behavior in the related art.

[0008] According to an aspect of the embodiments of the present application, a method for detecting abnormal behavior is provided, including: collecting log data of a terminal device and adding the log data into a log queue; processing the log data in the log queue to obtain single-point events; matching the single-point events based on a single-point event rule library, and determining the single-point events as suspicious events in a case that the single-point events match any event rule successfully, and adding the suspicious events into an event queue, wherein the single-point event rule library includes a plurality of event rules; detecting the suspicious events in the event queue based on an association event rule library, and determining event behaviors triggered by all the suspicious events hitting a target association event rule as abnormal behavior on the terminal device in a case that a plurality of the suspicious events hit the target association event rule, wherein the association event rule library includes a plurality of association event rules.

[0009] Further, the association event rule is used to record a plurality of preset single-point events associated with each other, and the step of detecting the suspicious events in the event queue based on the association event rule library includes: reading the suspicious events in the event queue in sequence according to a queue order of the suspicious events, and detecting whether the read suspicious events match the preset single-point events associated with each other in any association event rule; in a case that the suspicious events matching a start single-point event associated with each other in the target association event rule are detected, detecting whether there are other suspicious events matching remaining single-point events associated with each other in the target association event rule respectively within a preset time period, wherein the start single-point event is the preset single-point event associated with each other in the target association event rule and starting to occur, and the remaining single-point events are all the remaining preset single-point events associated with each other in the target association event rule except the start single-point event; in a case that the other suspicious events are detected within the preset time period, it is determined that the suspicious events and the other suspicious events hit the target association event rule.

[0010] Further, in the process of detecting the suspicious events in the event queue based on the association event rule library, it further includes: in a case that a plurality of the suspicious events read in sequence from the event queue hit the target association event rule, characterizing the plurality of the suspicious events as association events, and adding the association events as suspicious events into the event queue in a case that the target association event rule is an event in other association event rules, wherein the other association event rules are the association event rules except the target association event rule; detecting the suspicious events in the event queue until the event queue is empty.

[0011] Further, after determining all the suspicious event triggered event behaviors that hit the target associated event rule as abnormal behaviors on the terminal device, the method further comprises: matching the abnormal behaviors with a response handling rule library, wherein the response handling rule library comprises a plurality of response handling strategies; in the case of matching a target response handling strategy associated with the abnormal behaviors, processing the abnormal behaviors using the target response handling strategy and sending the target response handling strategy to a detection center.

[0012] Further, after determining all the suspicious event triggered event behaviors that hit the target associated event rule as abnormal behaviors on the terminal device, the method further comprises: determining an alarm type based on all the suspicious events triggering the abnormal behaviors; in the case of the alarm type being a preset alarm type, sending a scanning request to a scanning engine, wherein the scanning engine responds to the scanning request and returns scanned abnormal codes; and sending all the suspicious events triggering the abnormal behaviors and the abnormal codes to the detection center for determination of a handling strategy.

[0013] Further, the step of processing the log data in the log queue to obtain a single-point event comprises: filtering the log data based on a log analysis rule library, wherein the log analysis rule library comprises a plurality of keywords; deleting the log data not containing any of the keywords in the log analysis rule library from the log queue; and performing data format unification processing on all the remaining log data in the log queue to obtain the single-point event of the log data.

[0014] Further, the step of matching the single-point event based on a single-point event rule library comprises: analyzing the single-point event to determine a single-point event behavior of the single-point event; and in the case of the single-point event behavior matching any event behavior indicated by the event rule successfully, determining the single-point event as the suspicious event.

[0015] According to another aspect of the embodiments of the present application, there is also provided an abnormal behavior detection apparatus, comprising: a collection unit configured to collect log data of a terminal device and add the log data to a log queue; a first processing unit configured to process the log data in the log queue to obtain a single-point event; a first matching unit configured to match the single-point event based on a single-point event rule library, and determine the single-point event as a suspicious event if the single-point event matches any event rule; a first adding unit configured to add the suspicious event to an event queue; and a first detection unit configured to detect the suspicious event in the event queue based on an association event rule library, and determine an event behavior triggered by all suspicious events that hit a target association event rule as an abnormal behavior on the terminal device if a plurality of suspicious events hit the target association event rule, wherein the association event rule library comprises a plurality of association event rules.

[0016] Further, the association event rule is configured to record a plurality of preset single-point events associated with occurrence, and the first detection unit comprises: a first detection module configured to read each suspicious event in the event queue in sequence according to a queue order of each suspicious event in the event queue, and detect whether the read suspicious event matches the preset single-point events associated with occurrence in any association event rule; a second detection module configured to, if a suspicious event that matches a start single-point event associated with occurrence in the target association event rule is detected, detect whether there is another suspicious event that respectively matches remaining single-point events associated with occurrence in the target association event rule within a preset time period, wherein the start single-point event is the preset single-point event that starts to occur in the target association event rule, and the remaining single-point event is all remaining single-point events except the start single-point event in the target association event rule; and a first determination module configured to, if the other suspicious event is detected within the preset time period, determine that the suspicious event and the other suspicious event hit the target association event rule.

[0017] Further, the detection apparatus further comprises: a second adding unit configured to, if a plurality of suspicious events read in sequence from the event queue hit the target association event rule, represent the plurality of suspicious events as an association event, and add the association event as a suspicious event to the event queue if the target association event rule is an event in another association event rule, wherein the other association event rule is the association event rule except the target association event rule; and a second detection unit configured to detect the suspicious event in the event queue until the event queue is empty.

[0018] Further, the detection apparatus further comprises a second matching unit, configured to match the abnormal behavior with a response handling rule library after determining the associated event as the abnormal behavior on the terminal device, wherein the response handling rule library comprises a plurality of response handling strategies; and a second processing unit, configured to handle the abnormal behavior by using a target response handling strategy associated with the abnormal behavior, and send the target response handling strategy to a detection center end if the target response handling strategy is matched.

[0019] Further, the detection apparatus further comprises a first determining unit, configured to determine an alarm type based on all the suspicious events triggering the abnormal behavior after determining the associated event as the abnormal behavior on the terminal device; a first sending unit, configured to send a scanning request to a scanning engine if the alarm type is a preset alarm type, wherein the scanning engine returns an abnormal code scanned in response to the scanning request; and a second sending unit, configured to send all the suspicious events triggering the abnormal behavior and the abnormal code to the detection center end for determining a handling strategy.

[0020] Further, the first processing unit comprises a first screening module, configured to screen the log data based on a log analysis rule library, wherein the log analysis rule library comprises a plurality of keywords; a first deleting module, configured to delete the log data not containing any keyword in the log analysis rule library from the log queue; and a first processing module, configured to perform data format unification processing on all the remaining log data in the log queue to obtain the single-point event of the log data.

[0021] Further, the first matching unit comprises a first analysis module, configured to analyze the single-point event to determine a single-point event behavior of the single-point event; and a second determining unit, configured to determine the single-point event as the suspicious event if the single-point event behavior matches an event behavior indicated by any event rule.

[0022] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, which comprises a stored computer program, wherein the computer program controls a device where the computer readable storage medium is located to perform the detection method of any one of the above abnormal behaviors when the computer program is running.

[0023] According to another aspect of the embodiments of the present application, an electronic device is also provided, which includes one or more processors and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the above-mentioned abnormal behavior detection methods.

[0024] In the present application, log data of a terminal device is collected and added to a log queue, the log data in the log queue is processed to obtain a single-point event, the single-point event is matched based on a single-point event rule library, in the case that the single-point event matches any event rule successfully, the single-point event is determined as a suspicious event, and the suspicious event is added to an event queue, the suspicious event in the event queue is detected based on an association event rule library, and in the case that multiple suspicious events hit a target association event rule, event behaviors triggered by all suspicious events hitting the target association event rule are determined as abnormal behaviors on the terminal device.

[0025] In the present application, log data of a terminal device is collected and summarized in real time to form an efficient log queue, the log data in the log queue is processed in a piece-by-piece manner to convert it into a single-point event, and the single-point event is matched based on a single-point event rule library to identify whether there is a suspicious event. If there is a suspicious event, the suspicious event is put into an event queue for further processing by a complex event engine. Then, the complex event engine analyzes the suspicious event in the event queue in depth according to an association event rule library to determine whether there is an abnormal behavior, which can effectively reduce the omission of abnormal behaviors and thus improve the accuracy of detection of abnormal behaviors. In addition, processing of the collected log data can reduce redundant logs, thereby improving the efficiency and performance of rule matching and enhancing the detection efficiency of abnormal behaviors.

[0026] It can be seen that the scheme provided by the present application achieves the purpose of security protection of a terminal device, thereby achieving the technical effect of improving the detection accuracy of abnormal behaviors, and further solving the technical problem of low detection accuracy of abnormal behaviors in the related art. BRIEF DESCRIPTION OF DRAWINGS

[0027] The accompanying drawings, which are included to provide a further understanding of the present application and constitute a part of this application, illustrate certain illustrative embodiments of the present application and together with the description serve to explain the present application. In the drawings:

[0028] Figure 1 is a flowchart of an optional abnormal behavior detection method according to an embodiment of the present application;

[0029] Figure 2is a schematic diagram of an optional log formatting according to an embodiment of the present application;

[0030] Figure 3 is a schematic diagram of an optional single-point event rule base according to an embodiment of the present application;

[0031] Figure 4 is a schematic diagram of an optional correlation event rule base according to an embodiment of the present application;

[0032] Figure 5 is a flowchart of an optional anomaly behavior detection method according to an embodiment of the present application;

[0033] Figure 6 is a schematic diagram of an optional anomaly behavior detection device according to an embodiment of the present application;

[0034] Figure 7 is a hardware structure block diagram of an electronic device (or mobile device) for an anomaly behavior detection method according to an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the personnel in the art better understand the present application scheme, the technical scheme in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor should belong to the scope of protection of the present application.

[0036] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0037] In order to facilitate those skilled in the art to understand the present application, the following explains some terms or names involved in each embodiment of the present application:

[0038] Endpoint Detection and Response (EDR) is a security technology designed to help organizations monitor, detect, and respond to security incidents on endpoint devices.

[0039] Complex Event Processing (CEP) is a technology and method for monitoring and analyzing real-time data streams to identify and process complex event patterns.

[0040] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) collected and related by the present application are all authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards in relevant regions, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user selection authorization or refusal. For example, the system and related users or institutions have an interface, which needs to send a request to the aforementioned user or institution through the interface before obtaining the relevant information, and obtain the relevant information after receiving the consent information feedback from the aforementioned user or institution.

[0041] In the present application, through the Endpoint Detection and Response system (EDR system), terminal activities can be monitored in real time, known and unknown threats can be accurately detected using multiple technical means, evidence can be deeply analyzed and retained to support detailed forensics and threat correlation analysis, and automatic triggering or guidance of efficient response and remediation measures can be achieved, as well as integration of external threat intelligence and provision of centralized management view, thereby strengthening the all-round defense capability of terminal devices, effectively resisting various complex network attacks including advanced persistent threats, significantly improving threat visibility, shortening emergency response cycle, and promoting continuous learning and optimization of security strategy.

[0042] In addition, EDR technology provides deeper endpoint visibility, enabling monitoring and analysis of detailed activities on endpoints, including process creation, file modification, registry changes, and network communications. EDR tools usually include real-time alerts, automatic responses, and endpoint management functions, which can help security analysts quickly identify and respond to threats. EDR technology also emphasizes continuous monitoring and recording of endpoint events, as well as in-depth analysis of these events to better understand the behavior and strategies of attackers. This analysis can help organizations improve their security strategies and more effectively prevent future attacks.

[0043] In the present application, the complex event processing (CEP) technology is adopted to help aggregate many different information and identify and analyze the causal relationship between events in real time. The CEP technology matches the continuously incoming events with patterns and provides insights into what is happening and allows for proactive and effective actions.

[0044] In addition, in the present application, the CEP technology is integrated into the EDR system, which can significantly improve the ability to detect and analyze complex threats. By accessing the CEP event processing, the EDR system can more effectively identify and respond to advanced persistent threats and other complex attack patterns. In the present application, the main applications of CEP technology include: (1) threat detection: CEP can help the EDR system identify complex threat patterns that may involve multiple terminals and various attack means, by analyzing these patterns, the EDR system can more accurately identify potential threats; (2) event correlation: CEP technology can correlate events from different terminals to identify attack activities across multiple terminals, which helps the EDR system understand the overall situation of the attack and respond more effectively; (3) real-time response: by processing and analyzing events in real time, CEP can help the EDR system quickly identify and respond to threats, thereby reducing the activity window of attackers.

[0045] Based on this, the present application proposes an abnormal behavior detection system to realize the abnormal behavior detection of terminal equipment. The system is constructed based on the complex event processing mechanism and is suitable for operating systems such as Windows and Linux that generate various behavior event logs during operation. The system is composed of multiple closely cooperating components, including a log collection module, a log analysis module, a rule engine, an event queue, a memory scanning engine, an EDR Controller (EDR controller, i.e. detection center end) and a disposal response engine. The goal of the system design is to identify abnormal behavior on the terminal by in-depth analysis of abnormal logs, and to identify potential associated events in the terminal by intelligent combination of single-point event rules and complex event rules. In addition, the system will automatically trigger corresponding disposal measures according to the detected results.

[0046] In the present application, the abnormal behavior detection system can improve the terminal's ability to detect attack behavior, thereby enhancing the terminal's security protection level. By implementing the system, various security threats can be more effectively prevented and responded to, ensuring the stable operation and data security of the terminal.

[0047] The present application will be described in detail below in conjunction with various embodiments.

[0048] Embodiment one

[0049] According to an embodiment of the present application, an embodiment of a method for detecting abnormal behavior is provided. It should be noted that the steps shown in the flowcharts of the drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0050] Figure 1 is a flowchart of an optional method for detecting abnormal behavior according to an embodiment of the present application, as shown in Figure 1 the method comprises the following steps:

[0051] In step S101, log data of a terminal device is collected and added to a log queue.

[0052] In step S102, the log data in the log queue is processed to obtain a single-point event.

[0053] In step S103, the single-point event is matched based on a single-point event rule library, and in the case that the single-point event matches any event rule successfully, the single-point event is determined as a suspicious event, and the suspicious event is added to an event queue, wherein the single-point event rule library includes a plurality of event rules.

[0054] In step S104, the suspicious events in the event queue are detected based on an associated event rule library, and in the case that a plurality of suspicious events hit a target associated event rule, the event behaviors triggered by all suspicious events hitting the target associated event rule are determined as abnormal behaviors on the terminal device, wherein the associated event rule library includes a plurality of associated event rules.

[0055] In some embodiments, the method for detecting abnormal behavior can be executed by a terminal device. The terminal device includes but is not limited to a mobile terminal, a computer, etc.

[0056] In the embodiment of the present application, the log data of the terminal device is collected and summarized in real time to form an efficient log queue, and then the log data in the log queue is processed in a piece to be converted into a single-point event, and then the single-point events are matched according to a single-point event rule base to identify whether there is a suspicious event. If there is a suspicious event, the suspicious event is put into an event queue, which can be further processed by a complex event engine. Then the complex event engine analyzes the suspicious event in the event queue in depth according to an associated event rule base to determine whether there is an abnormal behavior, which can effectively reduce the omission of abnormal behaviors, thereby improving the accuracy of detecting abnormal behaviors. Moreover, by processing the collected log data, the redundant log can be reduced, thereby improving the efficiency and performance of rule matching, improving the detection efficiency of abnormal behaviors, and thus solving the technical problem of low accuracy of detecting abnormal behaviors in the related art.

[0057] The embodiment of the present application will be described in detail below in combination with the above steps.

[0058] In step S101, the log data of the terminal device is collected and added to the log queue.

[0059] In step S101, the log data of the terminal device can be collected in real time by a log collection module in the abnormal behavior detection system, and the collected log data is added to the log queue to generate an efficient log queue.

[0060] In some optional embodiments, the log collection module can use a variety of advanced log collection components, such as Sysmon (a system monitoring tool), ETW (Event Tracing for Windows, a technology for monitoring and analyzing events in an operating system), and driver hook technology (driver program hook technology), etc., to comprehensively collect logs on the terminal operating system and ensure that the log data is stored in a structured format. Moreover, the collected log data can be pushed to the log queue in real time by using stream processing.

[0061] In step S102, the log data in the log queue is processed to obtain a single-point event.

[0062] In step S102, the log data in the log queue can be processed in a piece by a log analysis module in the abnormal behavior detection system to perform log screening according to the key field information in the extracted log data, and the screened log data is converted into a single-point event.

[0063] In the embodiments of the present application, the single-point event refers to an independent event occurring on a terminal device (for example, an operating system or an application of the terminal device), for example, an application a starts an application b, the application b connects a network c, and the like.

[0064] Optionally, the step of processing the log data in the log queue to obtain the single-point event comprises: filtering the log data based on a log analysis rule library, wherein the log analysis rule library comprises a plurality of keywords; deleting the log data not containing any keyword in the log analysis rule library from the log queue; and performing data format unification processing on all the remaining log data in the log queue to obtain the single-point event of the log data.

[0065] Here, the data format unification processing can be processing the log data containing one or more keywords into a unified data format.

[0066] In the embodiments of the present application, the log analysis rule library can be first constructed, and the log analysis rule library comprises a plurality of keywords, which are pre-set keywords for matching the log data useful for detecting suspicious events. Then, the log data in the log queue is processed in a piece-by-piece manner according to the keywords in the log analysis rule library, so as to realize fine filtering of the log data, that is, the log data not containing any keyword in the log analysis rule library is deleted from the log queue, thereby reducing the redundant log data, improving the efficiency and performance of subsequent rule matching, and improving the detection efficiency of abnormal behaviors. Subsequently, the unification processing of the multi-log source data field (that is, the data format unification processing is performed on all the remaining log data in the log queue to obtain the single-point event of the log data) can be further performed, so as to realize the data format unification of the log data, thereby ensuring the consistency and comparability of the subsequent event data.

[0067] Figure 2 is a schematic diagram of optional log formatting according to the embodiments of the present application, as shown in Figure 2 The data (for example, source_1_event, source_2_event, source_3_event, …, source_n_event) from different log sources is processed by formatting to unify the data format of the log data, so as to obtain the corresponding format data (for example, format_event_1, format_event_2, format_event_3, format_event_n).

[0068] Step S103, matching the single-point event based on the single-point event rule library, in the case that the single-point event matches any event rule successfully, determining the single-point event as a suspicious event, and adding the suspicious event into the event queue, wherein the single-point event rule library comprises a plurality of event rules.

[0069] In step S103, the single-point event rule engine in the abnormal behavior detection system can analyze the single-point events according to the single-point event rule library to identify whether there is a suspicious event (i.e. matching the single-point event based on the single-point event rule library, in the case that the single-point event matches any event rule successfully, determining the single-point event as a suspicious event), and if a suspicious event is found, putting the suspicious event into the event queue for further processing by the subsequent complex event rule engine (also referred to as the associated event rule engine).

[0070] In the embodiment of the present application, the single-point event rule library comprises a plurality of event rules, each of which is used to indicate a suspicious event behavior, for example, application a starts application b.

[0071] Figure 3 is a schematic diagram of an optional single-point event rule library according to an embodiment of the present application, as Figure 3 shown, a single-point rule library (i.e. single-point event rule library) example is shown, which comprises a plurality of event behaviors, for example, event_1 (event 1): office start (start) cmd; event_2 (event 2): office start (start) mshta; ……; event_n (event 1): run l l connect (connect) network.

[0072] Optionally, the step of matching the single-point event based on the single-point event rule library comprises: parsing the single-point event to determine the single-point event behavior of the single-point event; in the case that the single-point event behavior matches the event behavior indicated by any event rule successfully, determining the single-point event as a suspicious event.

[0073] In the embodiment of the present application, the single-point event rule engine can be used to preliminarily screen and match the single-point events in the log queue according to the preset single-point event rule library, and if the single-point event matches the event rule, it is determined as a suspicious single-point event.

[0074] In some optional embodiments, after the single-point event is determined as a suspicious event, the single-point event can be directly added to the event queue, or field information indicated by a hit result of the hit event rule can be extracted according to the hit result, and the extracted field information can be added to the event queue. The field information is some information related to an event behavior indicated by the hit event rule, for example, an application field, an operation field, and the like.

[0075] In step S104, suspicious events in the event queue are detected based on the associated event rule library, and in a case where multiple suspicious events hit a target associated event rule, event behaviors triggered by all suspicious events hitting the target associated event rule are determined as abnormal behaviors on the terminal device, wherein the associated event rule library includes multiple associated event rules.

[0076] For example, each suspicious event can be read from the event queue in sequence, and it is detected whether the read suspicious event matches a preset single-point event associated in any associated event rule in the associated event rule library; if there is an associated event rule matched with multiple suspicious events, the associated event rule is determined as the target associated event rule.

[0077] In step S104, a complex event rule engine can be invoked to consume suspicious events in the event queue according to the preset associated event rule library, to determine whether there is a potential abnormal behavior (i.e., to detect suspicious events in the event queue, and in a case where multiple suspicious events hit a target associated event rule, to determine event behaviors triggered by all suspicious events hitting the target associated event rule as abnormal behaviors on the terminal device). By correlating analysis of multiple suspicious single-point events, abnormal behaviors can be more accurately detected, and missed detection of abnormal behaviors can be avoided.

[0078] In the embodiments of the present application, the associated event rule library includes multiple associated event rules, and the associated event rules record multiple single-point events associated to occur. When the single-point events associated to occur, it indicates that the terminal device has abnormal behaviors, for example, an application a starts an application b, and the application b connects one or more abnormal networks.

[0079] In the embodiments of the present application, if it is detected that multiple suspicious events hit the associated event rule, the associated event behaviors triggered by the suspicious events can be determined as abnormal behaviors. In the embodiments, the associated event behaviors are composed of event behaviors triggered by multiple suspicious events, and the multiple event behaviors are associated to occur according to a certain operation order.

[0080] Optionally, the correlation event rule is used to record a plurality of preset single-point events of which correlation occurs, and the step of detecting suspicious events in the event queue based on the correlation event rule library comprises: reading suspicious events in the event queue in sequence according to the queue order of each suspicious event in the event queue, and detecting whether the read suspicious event matches any preset single-point event of which correlation occurs in the correlation event rule; in the case that a suspicious event matching the start single-point event of which correlation occurs in the target correlation event rule is detected, detecting whether there is other suspicious event matching the remaining single-point event of which correlation occurs in the target correlation event rule within a preset time period, wherein the start single-point event is the preset single-point event that starts to occur in the target correlation event rule, and the remaining single-point event is all remaining preset single-point events except the start single-point event in the target correlation event rule; in the case that other suspicious event is detected within the preset time period, it is determined that the suspicious event and the other suspicious event hit the target correlation event rule.

[0081] In the embodiment of the application, the complex event rule engine can detect suspicious events in the event queue according to the queue order of each suspicious event in the event queue to determine whether there is abnormal behavior on the terminal, which can include: detecting whether the suspicious event matches any preset single-point event of which correlation occurs in the correlation event rule, if a suspicious event matching the start single-point event of which correlation occurs in the target correlation event rule (i.e. the preset single-point event that starts to occur in the correlation event rule) is detected, then detecting whether there is a suspicious event matching the remaining single-point event of which correlation occurs in the target correlation event rule (i.e. all remaining preset single-point events except the start single-point event in the correlation event rule) within a preset time period (which can be adjusted according to actual conditions, for example, 3 seconds), and if a suspicious event matching the remaining single-point event of which correlation occurs in the target correlation event rule is detected within the preset time period, it is determined that a plurality of suspicious events hit the target correlation event rule.

[0082] In some optional embodiments, if it is determined that abnormal behavior occurs on the terminal device, an alarm needs to be given, for example, alarm information is displayed on the terminal device interface, which can include: alarm type (which can be determined according to event behavior information of the correlation event) and alarm information (for example, some attack behavior description, which can be obtained according to ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) matrix (i.e. a network security knowledge base) technical points).

[0083] Optionally, in the process of detecting suspicious events in the event queue based on the correlation event rule library, further comprising: in the case that the plurality of suspicious events read out from the event queue in sequence hit the target correlation event rule, characterizing the plurality of suspicious events as a correlation event, and in the case that the target correlation event rule is the event in other correlation event rules, adding the correlation event as a suspicious event to the event queue, wherein the other correlation event rules are the correlation event rules other than the target correlation event rule; detecting the suspicious events in the event queue until the event queue is empty.

[0084] In the embodiment, after the correlation event is added to the event queue as a suspicious event, the suspicious event is matched with the correlation event rule library after being read preferentially.

[0085] For example, event a obtained based on a single log A is a suspicious event, the event a matches the correlation event rule 1 in the correlation event rule library, and hits the first preset event in the correlation event rule 1; event b obtained based on a single log B is a suspicious event, the event b matches the correlation event rule 1 in the correlation event rule library, and hits the second preset event in the correlation event rule 1, then the correlation event c composed of the event a and the event b is added to the event queue as a suspicious event, if the correlation event rule 1 is the event condition of other correlation event rules, then the correlation event c is added to the event queue, and the correlation event c is matched with the correlation event rule in the correlation event rule library.

[0086] In the embodiment, in the process of detecting the suspicious events in the event queue, the plurality of suspicious events hitting the target correlation event rule can be characterized as the correlation event hitting the target correlation event rule (i.e., the correlation event is composed of the plurality of suspicious events indicated by the hit correlation event rule, and the operation order between the suspicious events is consistent with the occurrence order between the plurality of suspicious events indicated by the hit correlation event rule), and all the correlation event rules in the correlation event rule library can be loaded in advance to determine whether the correlation event output by the rule detecting the abnormal behavior is hit by other correlation event rules, if yes, the correlation event is added to the event queue as a new suspicious event, so as to facilitate the subsequent other correlation event rules to consume the new suspicious event. In this way, by detecting the suspicious events in the event queue until the event queue is empty, the omission of the abnormal behavior can be avoided, and the accuracy of detection is improved.

[0087] In some optional embodiments, in the process of loading the correlation event rules in the correlation event rule library, it can be detected whether the suspicious event matches at least two correlation event rules, if yes, the suspicious event consumed by a certain correlation event rule can be re-added to the event queue for re-consumption.

[0088] Figure 4 is a schematic diagram of an optional associated event rule library according to an embodiment of the present application, as Figure 4 shown, shows an example of an associated rule library (i.e. an associated event rule library), for example, the event queue includes: a plurality of suspicious events (such as event_A, event_B, event_D, etc.), event_C is a complex event formed after the association of event_A and event_B, if event_C occurs on the terminal, an alarm is performed. And, since event_E is a complex event formed after the association of event_C and event_D, event_C needs to be re-added to the event queue. After that, if the complex event event_E formed after the association of event_C and event_D occurs, an alarm needs to be performed.

[0089] Optionally, after determining that the event behavior triggered by all suspicious events of the hit target associated event rule is an abnormal behavior on the terminal device, further comprising: matching the abnormal behavior with a response handling rule library, wherein the response handling rule library includes: a plurality of response handling strategies; in the case of matching the target response handling strategy associated with the abnormal behavior, processing the abnormal behavior by using the target response handling strategy, and sending the target response handling strategy to the detection center end.

[0090] In an embodiment of the present application, the related information of the abnormal behavior (such as the abnormal behavior name, type, etc.) is sent to the terminal response handling engine for processing, and the terminal response handling engine can select a corresponding response handling strategy according to the response handling rule library to handle the abnormal behavior (i.e. matching the abnormal behavior with the response handling rule library, in the case of matching the target response handling strategy associated with the abnormal behavior, processing the abnormal behavior by using the target response handling strategy).

[0091] In an embodiment of the present application, the response handling rule library includes: a plurality of response handling strategies, for example, each abnormal behavior name is associated with the response handling strategy of the abnormal behavior to construct the response handling rule library.

[0092] In addition, the determined target response handling strategy can be sent to the EDR Controller (i.e. the detection center end) to facilitate the subsequent handling strategy issued by the EDR Controller.

[0093] Optionally, after determining the event behavior triggered by all suspicious events of the hit target association event rule as abnormal behavior on the terminal device, further comprising: determining an alarm type based on all suspicious events triggering the abnormal behavior; and in a case where the alarm type is a preset alarm type, sending a scanning request to a scanning engine, wherein the scanning engine responds to the scanning request and returns scanned abnormal codes; and sending all suspicious events triggering the abnormal behavior and the abnormal codes to a detection center end for determination of a disposal strategy.

[0094] In the embodiment of the application, whether to send a scanning request to a scanning engine (for example, sending a memory scanning request and a file scanning request to a memory scanning engine and a file scanning engine respectively) can be selected according to the alarm type of the abnormal behavior (which can be determined according to all suspicious events triggering the abnormal behavior). If the alarm type is a preset alarm type (that is, a type for which a scanning request needs to be sent in advance, for example, some attack behavior alarms), a scanning request is sent to the scanning engine, so that the scanning engine responds to the scanning request and returns scanned abnormal codes.

[0095] In the embodiment of the application, all suspicious events triggering the abnormal behavior and the abnormal codes can be sent to the detection center end, so that the detection center end determines a disposal strategy based on the suspicious events and the abnormal codes, so as to facilitate disposal of the terminal device using the disposal strategy subsequently.

[0096] In addition, related information of the abnormal behavior can also be sent to an EDR Controller, so that the EDR Controller makes an association judgment by combining the alarm of the associated event of the abnormal behavior with the abnormal codes, thereby issuing a corresponding disposal strategy.

[0097] In some optional embodiments, the memory scanning engine can call an abnormal behavior rule library for scanning, and upload the scanned abnormal codes to the EDR Controller for alarm.

[0098] The following will be described in detail in combination with another optional specific embodiment.

[0099] In the embodiments of the present application, an abnormal behavior detection system is proposed, which is constructed based on a complex event processing mechanism and is suitable for an operating system that generates various behavior event logs during operation. The system is composed of multiple closely coordinated components, including a log collection module, a log analysis module, a rule engine (including a single-point event rule engine and a correlation event rule engine), an event queue, a memory scanning engine, a file scanning engine, an EDR Controller, and a terminal response handling engine, etc. The system can analyze abnormal logs in depth, identify abnormal behaviors on the terminal, and identify potential correlation events on the terminal by intelligently combining single-point event rules and complex event rules. In addition, the system can automatically trigger corresponding handling measures according to the detected results.

[0100] Therefore, the system improves the detection ability of the terminal on attack behaviors, thereby enhancing the security protection level of the terminal. By implementing the system, various security threats can be more effectively prevented and responded to, ensuring the stable operation and data security of the terminal operating system.

[0101] Figure 5 is a flow diagram of an optional abnormal behavior detection method according to the embodiments of the present application, as shown in Figure 5 The method can include the following steps:

[0102] The logs are first collected and summarized in real time to form an efficient log queue for subsequent behavior detection. Then, the log analysis module can process each log in the log queue to match the obtained key field information with the log analysis rule library, thereby screening out single-point events. The single-point event rule engine analyzes these single-point events according to the single-point event rule library to identify whether there is a suspicious event, and if there is a suspicious event, the relevant single-point events are put into the event queue for further processing by the associated event rule engine. The associated event rule engine analyzes the events in the event queue according to the preset associated event rule library to determine whether there is a potential abnormal behavior, and the obtained abnormal behavior event (i.e., the associated event) is put back into the event queue for further detection. If it is confirmed that there is an abnormal behavior, the following measures can be taken: (1) the associated event rule engine can initiate a memory scanning request to the memory scanning engine to scan the abnormal code; (2) the associated event rule engine can initiate a scanning operation of the associated file to the file scanning engine to obtain the file associated with the abnormal behavior for subsequent cleaning of the file; (3) the detected abnormal behavior characteristics are uploaded to the terminal response handling engine for automatic handling, so that the terminal response handling engine determines the response handling strategy according to the response handling rule library, and the associated event, abnormal behavior characteristics, and abnormal code information can be uploaded to the EDR Controller to obtain the corresponding handling strategy, thereby realizing effective response and handling of the abnormal behavior.

[0103] Exemplarily, the abnormal behavior detection method provided by the embodiment can be applied to the following scenarios:

[0104] In an enterprise network environment, an abnormal behavior detection system based on log behavior detection is deployed to monitor and protect Windows and Linux terminals. The terminals can include workstations of employees, servers, and key infrastructure systems. Under normal circumstances, the terminals deployed by the enterprise generate a large number of log entries, and when the terminals are subjected to external attacks, abnormal behavior logs are generated, such as unauthorized remote management tool connection attempts, irregular data transmission activities, and programs running in suspicious locations of the system.

[0105] The log collection component of the abnormal behavior detection system can collect log data in real time, the log analysis module can analyze the logs to extract key information, and the behavior feature detection module can identify normal and abnormal behavior patterns according to the preset single-point event rule engine and associated event rule engine. When an abnormal behavior is detected, the system generates a corresponding event behavior alarm and issues a corresponding strategy according to the alarm information to intercept and block the abnormal behavior.

[0106] In the embodiment, abnormal behaviors of the terminal can be identified by collecting and analyzing the log data, and associated events on the terminal can be detected by combining the single-point event rules and the complex event rules, and the corresponding handling measures can be automatically triggered according to the associated events. Therefore, the security protection level of the terminal is enhanced, and the stable operation of the terminal operating system and the data security are ensured.

[0107] In addition, for the log-feature matching-alarm-handling process in the embodiment, the associated event rule engine provides real-time or near real-time data processing capability, can quickly detect and respond to security threats, and the associated event rule engine can automatically perform certain response measures, can reduce the work burden of the security team, and speed up the response speed. The associated event rule engine in the embodiment combines single-point event rules and complex event rules, which not only reduces the work burden of log matching, but also improves the accuracy and reliability of the rules.

[0108] The following will be described in detail in combination with another embodiment.

[0109] Embodiment two

[0110] The abnormal behavior detection device provided in the embodiment includes a plurality of implementation units, each of which corresponds to each implementation step in the above embodiment one.

[0111] Figure 6 is a schematic diagram of an optional abnormal behavior detection device according to the embodiment of the present application, as shown in Figure 6 The detection device can include a collection unit 60, a first processing unit 61, a first matching unit 62, a first adding unit 63, and a first detection unit 64.

[0112] The collection unit 60 is configured to collect log data of a terminal device and add the log data to a log queue.

[0113] The first processing unit 61 is configured to process the log data in the log queue to obtain a single-point event.

[0114] The first matching unit 62 is configured to match the single-point event based on a single-point event rule library, and determine the single-point event as a suspicious event if the single-point event matches any event rule, wherein the single-point event rule library includes a plurality of event rules.

[0115] The first adding unit 63 is configured to add the suspicious event to an event queue.

[0116] The first detection unit 64 is configured to detect suspicious events in the event queue based on the correlation event rule library, and determine the correlation event as abnormal behavior on the terminal device in the case that the correlation event that hits the correlation event rule is detected, wherein the correlation event rule library comprises a plurality of correlation event rules, and the correlation event comprises a plurality of suspicious events.

[0117] The detection device can collect log data of the terminal device through the collection unit 60, add the log data into the log queue, process the log data in the log queue through the first processing unit 61 to obtain a single-point event, match the single-point event based on the single-point event rule library through the first matching unit 62, determine the single-point event as a suspicious event in the case that the single-point event matches any event rule successfully, add the suspicious event into the event queue through the first adding unit 63, and detect the suspicious events in the event queue based on the correlation event rule library through the first detection unit 64, and determine the event behavior triggered by all suspicious events that hit the target correlation event rule as abnormal behavior on the terminal device in the case that a plurality of suspicious events hit the target correlation event rule. In the embodiment of the present application, the log data of the terminal device is collected and summarized in real time to form an efficient log queue, and then the log data in the log queue is processed piece by piece to convert it into a single-point event, and then the single-point events are matched according to the single-point event rule library to identify whether there is a suspicious event. If there is a suspicious event, the suspicious event is put into the event queue for further processing by the complex event engine. Then the complex event engine analyzes the suspicious events in the event queue in depth according to the correlation event rule library to determine whether there is abnormal behavior, which can effectively reduce the omission of abnormal behavior, thereby improving the accuracy of detecting abnormal behavior. And by processing the collected log data, the redundant log can be reduced, thereby improving the efficiency and performance of rule matching, improving the detection efficiency of abnormal behavior, and thus solving the technical problem of low accuracy of detecting abnormal behavior in related technologies.

[0118] Optionally, the correlation event rule is used to record a plurality of preset single-point events of which correlation occurs, the first detection unit comprises: a first detection module, configured to read suspicious events in the event queue in sequence according to the queue order of the suspicious events in the event queue, and detect whether the read suspicious events match the preset single-point events of which correlation occurs in any correlation event rule; a second detection module, configured to, in the case that a suspicious event matching the start single-point event of which correlation occurs in the target correlation event rule is detected, detect whether there are other suspicious events matching the remaining single-point events of which correlation occurs in the target correlation event rule within a preset time period, wherein the start single-point event is the preset single-point event that starts to occur in the target correlation event rule, and the remaining single-point events are all the remaining single-point events except the start single-point event in the target correlation event rule; and a first determination module, configured to, in the case that the other suspicious events are detected within the preset time period, determine that the suspicious event and the other suspicious events hit the target correlation event rule.

[0119] Optionally, the detection device further comprises: a second joining unit, configured to, in the case that the plurality of suspicious events read from the event queue in sequence hit the target correlation event rule, represent the plurality of suspicious events as a correlation event, and in the case that the target correlation event rule is an event in other correlation event rules, join the correlation event as a suspicious event to the event queue, wherein the other correlation event rules are the correlation event rules except the target correlation event rule; and a second detection unit, configured to detect the suspicious events in the event queue until the event queue is empty.

[0120] Optionally, the detection device further comprises: a second matching unit, configured to, after the correlation event is determined as the abnormal behavior on the terminal device, match the abnormal behavior with a response handling rule library, wherein the response handling rule library comprises a plurality of response handling strategies; and a second processing unit, configured to, in the case that a target response handling strategy associated with the abnormal behavior is matched, process the abnormal behavior by using the target response handling strategy, and send the target response handling strategy to the detection center.

[0121] Optionally, the detection device further comprises: a first determination unit, configured to, after the correlation event is determined as the abnormal behavior on the terminal device, determine an alarm type based on all suspicious events triggering the abnormal behavior; a first sending unit, configured to, in the case that the alarm type is a preset alarm type, send a scanning request to a scanning engine, wherein the scanning engine responds to the scanning request and returns scanned abnormal codes; and a second sending unit, configured to send all suspicious events triggering the abnormal behavior and the abnormal codes to the detection center to determine a handling strategy.

[0122] Optionally, the first processing unit comprises: a first screening module, configured to screen the log data based on a log analysis rule library, wherein the log analysis rule library comprises a plurality of keywords; a first deletion module, configured to delete log data not containing any keyword in the log analysis rule library from the log queue; and a first processing module, configured to perform data format unification processing on all remaining log data in the log queue to obtain a single-point event of the log data.

[0123] Optionally, the first matching unit comprises: a first analysis module, configured to analyze the single-point event to determine a single-point event behavior of the single-point event; and a second determination module, configured to determine the single-point event as a suspicious event in a case where the single-point event behavior matches an event behavior indicated by any event rule successfully.

[0124] The detection device described above can further comprise a processor and a memory, and the above-mentioned acquisition unit 60, first processing unit 61, first matching unit 62, first adding unit 63, and first detection unit 64 are all stored in the memory as program units, and the corresponding functions are realized by the processor executing the above-mentioned program units stored in the memory.

[0125] The above-mentioned processor comprises a core, and the core retrieves the corresponding program unit from the memory. The core can be set to one or more, and the core parameters are adjusted to detect suspicious events in the event queue based on the associated event rule library, and in a case where multiple suspicious events hit the target associated event rule, the event behaviors triggered by all suspicious events hitting the target associated event rule are determined as abnormal behaviors on the terminal device.

[0126] The above-mentioned memory can comprise a non-permanent memory in a computer readable medium, random access memory (RAM) and / or non-volatile memory such as read-only memory (ROM) or flash memory (flash RAM), and the memory comprises at least one memory chip.

[0127] The application further provides a computer program product adapted to execute the program of the following method steps when executed on a data processing device: acquiring log data of a terminal device and adding the log data to a log queue, processing the log data in the log queue to obtain a single-point event, matching the single-point event based on a single-point event rule library, determining the single-point event as a suspicious event in a case where the single-point event matches any event rule successfully, and adding the suspicious event to an event queue, detecting suspicious events in the event queue based on an associated event rule library, and determining event behaviors triggered by all suspicious events hitting a target associated event rule as abnormal behaviors on the terminal device in a case where multiple suspicious events hit the target associated event rule.

[0128] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, which includes a stored computer program, wherein the computer readable storage medium controls the device where the computer readable storage medium is located to perform the above-mentioned method for detecting abnormal behavior when the computer program is executed.

[0129] According to another aspect of the embodiments of the present application, an electronic device is also provided, which includes one or more processors and a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the above-mentioned method for detecting abnormal behavior.

[0130] Figure 7 is a hardware structure block diagram of an electronic device (or a mobile device) for a method for detecting abnormal behavior according to an embodiment of the present application. As shown in Figure 7 , the electronic device can include one or more processors (for example, processors 702a, 702b, …, 702n, etc. in Figure 7 , which can include but are not limited to processing devices such as microprocessors MCU or programmable logic devices FPGA, etc.), a memory 704 for storing data. In addition, it can also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply and / or a camera. Those skilled in the art can understand that Figure 7 the structure shown is only schematic, which does not limit the structure of the above-mentioned electronic device. For example, the electronic device can also include more or less components than Figure 7 shown, or have a different configuration from Figure 7 .

[0131] The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0132] The embodiments or examples of the present disclosure are not exhaustive, and are only a part of the embodiments or examples, and are not specific limitations on the protection scope of the present disclosure. Each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily, for example, a scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be exchanged arbitrarily, in addition, the optional ways or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the embodiments or examples can be combined arbitrarily, for example, part or all steps of different embodiments or examples can be combined arbitrarily, a certain embodiment or example can be combined with optional ways or optional examples of other embodiments or examples.

[0133] In the above-described embodiments of the present disclosure, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0134] In the several embodiments of the present disclosure, it should be understood that the disclosed technology can be implemented in other ways. Of course, the embodiment described above is only a schematic, for example, the division of the units can be a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, unit or module, and can be electrical or other forms.

[0135] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the present embodiment scheme.

[0136] In addition, each functional unit in each embodiment of the present disclosure can be integrated in a first processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0137] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in other words, the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a number of instructions to make a computer device (which can be a personal computer, a server or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0138] The above description is only the preferred embodiment of the present application, and it should be pointed out that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A method of detecting abnormal behavior, characterized by, The method comprises the following steps: Collecting log data of a terminal device and adding the log data into a log queue; Processing the log data in the log queue to obtain a single-point event; Matching the single-point event based on a single-point event rule library, determining the single-point event as a suspicious event if the single-point event matches any event rule, and adding the suspicious event into an event queue, wherein the single-point event rule library comprises a plurality of event rules; Detecting the suspicious event in the event queue based on an association event rule library, and determining an event behavior triggered by all suspicious events hitting a target association event rule as abnormal behavior on the terminal device if a plurality of suspicious events hit the target association event rule, wherein the association event rule library comprises a plurality of association event rules; The association event rule is used to record a plurality of preset single-point events associated with each other, and the step of detecting the suspicious event in the event queue based on the association event rule library comprises: Reading each suspicious event in the event queue in sequence according to a queue order of each suspicious event in the event queue, and detecting whether the read suspicious event matches the preset single-point event associated with each other in any association event rule; If the suspicious event matching the start single-point event associated with each other in the target association event rule is detected, detecting whether there is other suspicious event matching the remaining single-point event associated with each other in the target association event rule within a preset time period, wherein the start single-point event is the preset single-point event associated with each other in the target association event rule, and the remaining single-point event is all remaining preset single-point events except the start single-point event in the target association event rule; If the other suspicious event is detected within the preset time period, it is determined that the suspicious event and the other suspicious event hit the target association event rule.

2. The detection method according to claim 1, characterized in that, In the process of detecting the suspicious event in the event queue based on the association event rule library, the process further comprises: If a plurality of suspicious events read in sequence from the event queue hit the target association event rule, the plurality of suspicious events are characterized as an association event, and the association event is added to the event queue as a suspicious event on the condition that the target association event rule is an event in other association event rules, wherein the other association event rules are the association event rules except the target association event rule; Detecting the suspicious event in the event queue until the event queue is empty.

3. The method of claim 1, wherein After determining the event behavior triggered by all suspicious events hitting the target association event rule as abnormal behavior on the terminal device, the process further comprises: Matching the abnormal behavior with a response handling rule library, wherein the response handling rule library comprises a plurality of response handling strategies; In a case of matching to a target response handling policy associated with the abnormal behavior, the abnormal behavior is handled by using the target response handling policy, and the target response handling policy is sent to a detection center end.

4. The method of claim 1, wherein After determining the event behaviors triggered by all the suspicious events hitting the target associated event rule as the abnormal behavior on the terminal device, the method further includes: determining an alarm type based on all the suspicious events triggering the abnormal behavior; in a case where the alarm type is a preset alarm type, sending a scanning request to a scanning engine, wherein the scanning engine responds to the scanning request and returns an abnormal code scanned; sending all the suspicious events triggering the abnormal behavior and the abnormal code to the detection center end for determination of a handling policy.

5. The method of claim 1, wherein The step of processing the log data in the log queue to obtain a single-point event includes: filtering the log data based on a log analysis rule library, wherein the log analysis rule library includes a plurality of keywords; deleting the log data not containing any keyword in the log analysis rule library from the log queue; performing data format unification processing on all the remaining log data in the log queue to obtain the single-point event of the log data.

6. The method of claim 1, wherein The step of matching the single-point event based on a single-point event rule library includes: analyzing the single-point event to determine a single-point event behavior of the single-point event; in a case where the single-point event behavior matches an event behavior indicated by any event rule successfully, determining the single-point event as the suspicious event.

7. An abnormal behavior detection apparatus characterized by comprising: The method includes: a collection unit configured to collect log data of a terminal device and add the log data to a log queue; a first processing unit configured to process the log data in the log queue to obtain a single-point event; a first matching unit configured to match the single-point event based on a single-point event rule library, and determine the single-point event as a suspicious event in a case where the single-point event matches any event rule successfully, wherein the single-point event rule library includes a plurality of event rules; a first adding unit configured to add the suspicious event to an event queue; a first detection unit configured to detect the suspicious event in the event queue based on an associated event rule library, and determine event behaviors triggered by all the suspicious events hitting a target associated event rule as an abnormal behavior on the terminal device in a case where the target associated event rule is detected, wherein the associated event rule library includes a plurality of associated event rules; The association event rule is used for recording a plurality of preset single-point events of which association occurs, the first detection unit comprises: a first detection module, configured to read suspicious events in sequence according to the queue order of the suspicious events in the event queue, and detect whether the read suspicious event matches any preset single-point event of which association occurs in the association event rule; a second detection module, configured to, in the case that a suspicious event matching the start single-point event of which association occurs in the target association event rule is detected, detect whether there is other suspicious event matching the remaining single-point event of which association occurs in the target association event rule within a preset time length, wherein the start single-point event is the preset single-point event of which association occurs first in the target association event rule, and the remaining single-point event is all remaining single-point events except the start single-point event in the target association event rule; and a first determination module, configured to, in the case that other suspicious event is detected within the preset time length, determine that the suspicious event and the other suspicious event hit the target association event rule.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored computer program, wherein the computer program controls a device in which the computer readable storage medium is located to perform the method for detecting abnormal behavior according to any one of claims 1 to 6 when the computer program is running.

9. An electronic device, comprising: The device comprises one or more processors and a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method for detecting abnormal behavior according to any one of claims 1 to 6.

Images