A zero-trust threat detection method, device and system

Abstract

The embodiments of the present application provide a zero-trust threat detection method, device and system. The method includes: obtaining the original behavior features corresponding to the behavior data generated by the behavior of the physical device in the target zero-trust architecture; wherein the original behavior features include at least one of the original context features, the original structure features and the original key features; inputting the original behavior features into the threat detection model to obtain the encoded behavior features output by the threat detection model; matching the encoded behavior features with the encoded event features of each preset threat event to obtain the threat event of the encoded event features and the encoded behavior features as the threat event occurring in the physical device; wherein the encoded event features of each preset threat event are obtained by encoding the labels of each preset threat event respectively through the threat detection model. Improve the accuracy of behavioral threat detection of each physical device in the zero-trust network.

Images