Behavior event detection method and device and electronic equipment

Abstract

The invention discloses a behavior event detection method and device and electronic equipment, and relates to the technical field of information security, and the method comprises the steps: determining a plurality of target events, the plurality of target events comprise behavior events which are matched by the first type of single event rules and belong to the alarm event and behavior events which are matched by the second type of single event rules and do not belong to the alarm event, and then according to rule identifiers of the single event rules met by the plurality of target events respectively, determining the alarm event according to the rule identifiers. A target association rule is determined in the multiple association rules, multiple preset identifications of the target association rule comprise rule identifications of single event rules met by multiple target events, then association detection is conducted on the multiple target events according to the target association rule, a detection result is obtained, and finally the detection result is obtained. And determining whether an attack behavior exists according to a detection result. According to the method and the device, the technical problem of low accuracy of safety detection on the behavior event caused by single-event detection only on the behavior event in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a behavior event detection method, device and electronic device. Background Art

[0002] In the prior art, when performing security detection on behavioral events in system logs, single event detection is often performed on multiple behavioral events in the system logs based on pre-established security detection rules, that is, each behavioral event in the multiple behavioral events is detected one by one, so as to achieve the purpose of determining whether each behavioral event contains attack behavior. However, since the prior art only performs single event detection on behavioral events based on security detection rules, there is a lack of correlation detection between multiple behavioral events. In addition, when a single behavioral event does not match the pre-established security detection rules, the prior art solution determines the behavioral event that does not match the security detection rules as a normal event that will not affect the security of the system, thereby causing the problem of missed detection of attack behaviors caused by only performing single event detection on behavioral events, and further causing the problem of low accuracy in security detection of behavioral events in the prior art.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The present application provides a behavior event detection method, device and electronic device to at least solve the technical problem of low accuracy in security detection of behavior events caused by only performing single event detection on behavior events in the prior art.

[0005] According to one aspect of the present application, a behavior event detection method is provided, including: determining multiple target events, wherein the multiple target events include: behavior events that are matched by a first type of single event rule and are alarm events, and behavior events that are matched by a second type of single event rule and are not alarm events; determining a target association rule from multiple association rules based on rule identifiers of single event rules that are respectively satisfied by the multiple target events, wherein the target association rule has multiple preset identifiers that include rule identifiers of single event rules that are respectively satisfied by the multiple target events; performing association detection on the multiple target events based on the target association rule to obtain a detection result; and determining whether there is an attack behavior based on the detection result.

[0006] Optionally, when the detection result indicates the presence of an attack behavior, the behavior event detection method also includes: determining a behavior event that is not an alarm event and is matched by the second type of single event rule as an alarm event; and / or adjusting the alarm level corresponding to each target event in multiple target events to a preset alarm level.

[0007] Optionally, in the process of performing association detection on multiple target events according to the target association rule to obtain the detection result, the behavior event detection method also includes: when the target association rule has a preset event logical relationship, detecting whether multiple target events satisfy the preset event logical relationship to obtain the logical relationship detection result.

[0008] Optionally, in the process of determining whether there is an attack behavior according to the detection result, the behavior event detection method further includes: determining whether there is an attack behavior according to the logical relationship detection result.

[0009] Optionally, in the process of performing association detection on multiple target events according to the target association rule to obtain the detection result, the behavior event detection method also includes: when the target association rule has a preset event association relationship, detecting whether multiple target events satisfy the preset event association relationship to obtain the association relationship detection result.

[0010] Optionally, in a case where the target association rule has a preset event logical relationship, in the process of detecting whether multiple target events satisfy the preset event logical relationship and obtaining a logical relationship detection result, the behavioral event detection method also includes: in a case where the association relationship detection result indicates that there are at least two target events among the multiple target events that satisfy the preset event association relationship, detecting whether the multiple target events satisfy the preset event logical relationship and obtaining a logical relationship detection result.

[0011] Optionally, the preset event association relationship includes at least one of an equivalence relationship, an inequality relationship, an inclusion relationship, a numerical value relationship, and a parent-child process chain relationship between attribute values ​​of different events that satisfy the target association rule.

[0012] Optionally, the preset event logical relationship includes at least one of the following: a first logical relationship, a second logical relationship, a third logical relationship, a fourth logical relationship and a fifth logical relationship, wherein the first logical relationship is used to characterize that different events occur at the same time; the second logical relationship is used to characterize that different events are prohibited from occurring at the same time; the third logical relationship is used to characterize that different events belong to the same preset event set; the fourth logical relationship is used to characterize that there is a preset sequence between the generation times of different events; and the fifth logical relationship is used to characterize that within a preset period after the occurrence of the first of the two events, the second event is prohibited from occurring.

[0013] Optionally, the target association rule also includes a preset time length. When the target association rule has a preset event association relationship, in the process of detecting whether multiple target events satisfy the preset event association relationship and obtaining the association relationship detection result, the behavior event detection method also includes: extracting the attribute value of each target event from the event data of each target event; for each target event, determining a time window with the generation time of the target event as the starting time, and obtaining multiple time windows, and the duration of each time window is equal to the preset time length; for each time window, detecting whether the target event in the time window satisfies the preset event association relationship according to the attribute value of the target event whose generation time is within the time window, and obtaining the detection result corresponding to the time window; determining the association relationship detection result according to the detection results corresponding to the multiple time windows.

[0014] Optionally, each association rule has a mapping relationship expression, and the mapping relationship expression includes multiple preset identifiers. In the process of determining the target association rule in multiple association rules according to the rule identifiers of the single event rules respectively satisfied by the multiple target events, the behavior event detection method also includes: matching the rule identifiers of the single event rules respectively satisfied by the multiple target events with the mapping relationship expressions in each association rule; and determining the association rule to which the mapping relationship expression containing the rule identifiers of the single event rules satisfied by all the target events belongs as the target association rule.

[0015] According to another aspect of the present application, a behavior event detection device is also provided, including: a first determination unit, used to determine multiple target events, wherein the multiple target events include: behavior events that are matched by a first type of single event rule and belong to alarm events, and behavior events that are matched by a second type of single event rule and do not belong to alarm events; a second determination unit, used to determine a target association rule from multiple association rules based on the rule identifiers of the single event rules that are respectively satisfied by the multiple target events, wherein the multiple preset identifiers of the target association rule include the rule identifiers of the single event rules that are respectively satisfied by the multiple target events; an association detection unit, used to perform association detection on the multiple target events according to the target association rule to obtain a detection result; and a third determination unit, used to determine whether there is an attack behavior based on the detection result.

[0016] According to another aspect of the present application, a computer program product is provided, in which a computer program is stored, wherein when the computer program is running, the computer program product is controlled to execute any one of the above-mentioned behavior event detection methods.

[0017] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the above-mentioned behavioral event detection methods.

[0018] In the present application, multiple target events are first determined, wherein the multiple target events include: behavioral events that are matched by a first type of single event rule and are alarm events, and behavioral events that are not alarm events that are matched by a second type of single event rule. Afterwards, the present application determines a target association rule from multiple association rules based on the rule identifiers of the single event rules that are respectively satisfied by the multiple target events, wherein the multiple preset identifiers of the target association rule include the rule identifiers of the single event rules that are respectively satisfied by the multiple target events. Then, the present application performs association detection on the multiple target events according to the target association rule to obtain detection results. Finally, the present application determines whether there is an attack behavior based on the detection results.

[0019] It can be seen from the above content that the technical solution of the present application first matches the behavioral events that need to be judged whether there is an attack behavior with different categories of single event rules to obtain multiple target events. Therefore, the multiple target events that subsequently participate in the association detection of the present application include not only the behavioral events that are matched by the first type of single event rules and are alarm events, but also the behavioral events that are not alarm events matched by the second type of single event rules, such as basic behavioral events such as network connection events, thereby achieving the purpose of increasing the diversity of target events that subsequently participate in the association detection and the coverage of the association detection.

[0020] In addition, the present application queries and obtains a target association rule that matches the rule identifier of a single event rule satisfied by multiple target events from among multiple pre-set association rules. Afterwards, the present application performs association detection on multiple target events based on the target association rule, and determines whether there is an attack behavior in the multiple target events based on the association detection results, thereby filling the gap in the prior art in performing association detection between multiple behavior events, and further overcoming the problem of missed detection of attack behaviors caused by only performing single event detection on behavior events in the prior art.

[0021] It can be seen that the present application fills the gap in the prior art of only performing single event detection on behavioral events but lacking association detection between multiple behavioral events by matching behavioral events with single event rules of different categories and performing association detection on the obtained multiple target events based on target association rules. At the same time, it improves the diversity of target events involved in association detection and the coverage of association detection, thereby achieving the technical effect of improving the accuracy of security detection of behavioral events, and further solving the technical problem of low accuracy of security detection of behavioral events caused by only performing single event detection on behavioral events in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0023] Figure 1 is a flow chart of an optional behavior event detection method according to an embodiment of the present application;

[0024] Figure 2 is a schematic diagram of an optional behavior event detection device according to an embodiment of the present application;

[0025] Figure 3 is a schematic diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] It should also be noted that the relevant information (including behavioral event information) and data (including but not limited to data for display and analysis) involved in this application are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0029] In addition, the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant information and data involved in this application comply with the relevant laws, regulations and standards of the relevant regions, and necessary confidentiality measures have been taken and do not violate public order and good morals. In addition, this application provides corresponding operation entrances for users to choose to agree to authorization or refuse authorization. If the user chooses to refuse authorization, he / she will enter the corresponding expert decision-making process.

[0030] According to an embodiment of the present application, an embodiment of a behavioral event detection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] The present application provides a behavior event detection system (referred to as the detection system) for executing the behavior event detection method in the present application. The detection system can be implemented in software or a combination of software and hardware.

[0032] In an optional embodiment, Figure 1 is a flow chart of an optional behavior event detection method according to an embodiment of the present application. Figure 1 As shown, the method comprises the following steps:

[0033] Step S101, determining multiple target events.

[0034] In step S101 , the multiple target events include: behavior events that are alarm events matched by the first type of single event rule and behavior events that are not alarm events matched by the second type of single event rule.

[0035] For example, the behavior events may include, but are not limited to: memory write events recorded in the system log, process injection events, DLL (Dynamic Link Library) file loading events, and network connection events.

[0036] Here, the single event rule can be described by Sigma language or other languages. The Sigma language includes rich built-in functions, which can improve the writing efficiency of detection rules (i.e., single event rules). In addition, the detection rules written in Sigma language can also be deployed across security tools and platforms.

[0037] Optionally, the detection system can also save the detection rules written in the Sigma language in the YAML (Yet Another Markup Language, a lightweight data serialization language) format, thereby ensuring the compatibility of the detection rules when deployed across multiple security tools and platforms, thereby improving the compatibility of the detection system for security detection of behavioral events.

[0038] Here, the single event rule is used to detect a single event.

[0039] Here, single event rules can be described by a custom "rule" data structure, as shown below:

[0040] rule:

[0041] ID:109991

[0042] Detection:{XXXX}

[0043] In the above example, "ID: 109991" means that the rule ID of the single event rule is "109991", and "Detection: {XXXX}" means that the detection content of the single event rule is "XXXX".

[0044] In actual application scenarios, the detection rules described in the Sigma language can be analyzed and applied by various log management and analysis tools, thereby helping developers identify alarm events from multiple behavioral events, such as unauthorized access attempt events and system vulnerability exploitation events; in addition, the detection system can also identify basic behavioral events, such as network connection events, from multiple behavioral events based on the detection rules described in the Sigma language.

[0045] Here, the first type of single event rule is used to match the behavior events that belong to the alarm events.

[0046] Here, the second type of single event rule is used to match behavior events that are not alarm events. Exemplarily, the second type of single event rule can be used to match normal behavior events of a specified type. For example, the normal behavior event of the specified type can be a network connection event.

[0047] Optionally, the detection system uses the first type of single event rule as a filtering condition for behavior events, that is, the detection system filters multiple behavior events to obtain alarm events, thereby reducing the number of events that the detection system needs to perform subsequent associated detection, thereby improving the efficiency of associated detection.

[0048] Optionally, during the association detection process, the detection system not only performs association detection between multiple alarm events, but also performs association detection between multiple basic behavior events, and / or between at least one alarm event and at least one basic behavior event, thereby increasing the diversity of events involved in the association detection and the coverage of the detection system's association detection of events, thereby reducing the probability of the detection system missing attack behaviors present in behavioral events.

[0049] Step S102: determining a target association rule from a plurality of association rules according to rule identifiers of single event rules respectively satisfied by a plurality of target events.

[0050] In step S102, the multiple preset identifiers of the target association rule include rule identifiers of single event rules respectively satisfied by multiple target events.

[0051] Here, the single event rule satisfied by the target event is the single event rule matched by the target event.

[0052] Optionally, each association rule includes a single event rule identifier and a logical relationship expression.

[0053] Optionally, each association rule includes a single event rule identifier, an association relationship expression, and a logical relationship expression, and may also include a preset time length; wherein each association rule uses the association rule identifier as a unique identifier, the association relationship expression is used to characterize a preset event association relationship that needs to be satisfied between multiple events, the logical relationship expression is used to characterize a preset event logical relationship that needs to be satisfied between multiple events, and the time length is used to limit the time window of the generation time of the events participating in the association rule detection.

[0054] Here, the logical relationship expression can characterize the logical relationship between at least two behavioral events. The logical relationship can be set to "and", "or", or other logical relationships such as "include", "not" and "sequence", which is not limited in this embodiment.

[0055] Step S103, performing association detection on multiple target events according to the target association rule to obtain a detection result.

[0056] In some examples, in the process of performing association detection on multiple target events based on target association rules, the detection system detects whether there are at least two target events among the multiple target events that satisfy a preset event association relationship. Based on the detection results, the detection system determines that there is an attack behavior in at least two of the current target events.

[0057] In other examples, in the process of performing association detection on multiple target events based on target association rules, the detection system not only needs to detect whether there are at least two target events among the multiple target events that satisfy the preset event association relationship, but also needs to detect whether at least two target events that satisfy the preset event association relationship further satisfy the preset event logical relationship. When the preset event logical relationship is satisfied, the detection system determines that there is an attack behavior in at least two of the current target events.

[0058] For example, when there are at least two target events among multiple target events that satisfy a preset event association relationship, and when there are at least two target events among the multiple target events that satisfy a preset event logical relationship, the detection result indicates that there is an attack behavior; for another example, when there are not at least two target events among multiple target events that satisfy the preset event association relationship, and / or when there are not at least two target events among the multiple target events that satisfy the preset event logical relationship, the detection result indicates that there is no attack behavior.

[0059] Step S104: Determine whether there is an attack behavior based on the detection result.

[0060] Optionally, for target events involving attack behavior, the detection system can adjust the alarm level of the target event. For example, after the detection system performs correlation detection on a network connection event and other target events, the detection system determines that the network connection event involves attack behavior. At this time, the detection system determines the network connection event as an alarm event and sets the alarm level of the network connection event to a preset alarm level.

[0061] It can be seen from the above content that the technical solution of the present application first matches the behavioral events that need to be judged whether there is an attack behavior with different categories of single event rules to obtain multiple target events. Therefore, the multiple target events that subsequently participate in the association detection of the present application include not only the behavioral events that are matched by the first type of single event rules and are alarm events, but also the behavioral events that are not alarm events matched by the second type of single event rules, such as basic behavioral events such as network connection events, thereby achieving the purpose of increasing the diversity of target events that subsequently participate in the association detection and the coverage of the association detection.

[0062] In addition, the present application queries and obtains a target association rule that matches the rule identifier of a single event rule satisfied by multiple target events from among multiple pre-set association rules. Afterwards, the present application performs association detection on multiple target events based on the target association rule, and determines whether there is an attack behavior in the multiple target events based on the association detection results, thereby filling the gap in the prior art in performing association detection between multiple behavior events, and further overcoming the problem of missed detection of attack behaviors caused by only performing single event detection on behavior events in the prior art.

[0063] It can be seen that the present application fills the gap in the prior art of only performing single event detection on behavioral events but lacking association detection between multiple behavioral events by matching behavioral events with single event rules of different categories and performing association detection on the obtained multiple target events based on target association rules. At the same time, it improves the diversity of target events involved in association detection and the coverage of association detection, thereby achieving the technical effect of improving the accuracy of security detection of behavioral events, and further solving the technical problem of low accuracy of security detection of behavioral events caused by only performing single event detection on behavioral events in the prior art.

[0064] In an optional embodiment, when the detection results indicate that there is an attack behavior in multiple target events, the detection system determines the behavior event that does not belong to an alarm event matched by the second type of single event rule as an alarm event; and / or, the detection system adjusts the alarm level corresponding to each target event in the multiple target events to a preset alarm level.

[0065] Optionally, the detection system can raise the alarm level corresponding to the behavior event matched by the first type of single event rule among multiple target events to a preset alarm level, and the detection system can also set the behavior event matched by the second type of single event rule among multiple target events to a preset alarm level.

[0066] For example, assuming that the target event event1 is a behavioral event that matches the first type of single event rule, and the original level of the target event event1 is the first alarm level, when the detection system determines that the target event event1 has an attack behavior, the detection system raises the alarm level of the target event event1 from the original first alarm level to the preset alarm level; the risk level corresponding to the first alarm level is lower than the risk level corresponding to the preset alarm level.

[0067] For example, assuming that the target event event2 is a behavioral event that matches the second type of single event rule, and the target event event2 was not originally an alarm event, after the detection system performs correlation detection on the target event event2 and other target events, and determines based on the detection results that there is an attack behavior, the detection system updates the target event event2 to an alarm event, and the detection system sets the alarm level of the target event event2 to the preset alarm level.

[0068] Optionally, the detection system can help remind users or operation and maintenance personnel to accurately assess potential threats to system security by adjusting the alarm level of target events involving attack behaviors, thereby achieving the purpose of improving the efficiency of implementing security measures to protect the system.

[0069] In an optional embodiment, when the target association rule has a preset event logical relationship, the detection system detects whether multiple target events satisfy the preset event logical relationship and obtains a logical relationship detection result. Thereafter, the detection system determines whether there is an attack behavior based on the logical relationship detection result.

[0070] Optionally, the preset event logical relationship includes at least one of the following: a first logical relationship, a second logical relationship, a third logical relationship, a fourth logical relationship and a fifth logical relationship, wherein the first logical relationship is used to characterize that different events occur at the same time; the second logical relationship is used to characterize that different events are prohibited from occurring at the same time; the third logical relationship is used to characterize that different events belong to the same preset event set; the fourth logical relationship is used to characterize that there is a preset sequence between the generation times of different events; and the fifth logical relationship is used to characterize that within a preset period after the occurrence of the first of the two events, the second event is prohibited from occurring.

[0071] In some examples, the event logic relationship that may be satisfied between two target events event1 and event2 is described as follows:

[0072] (1) event1 and event2:

[0073] The above event logical relationship is a first logical relationship, which means that the target event event1 and the target event event2 occur at the same time.

[0074] (2) event1 or event2:

[0075] The above event logical relationship is a second logical relationship, which means that the target event event1 and the target event event2 cannot occur at the same time. At the same time, the target event event1 or the target event event2 occurs.

[0076] (3)(event1 and event2):

[0077] The above event logical relationship is a third logical relationship, which means that the target event event1 and the target event event2 belong to the same preset event set.

[0078] (4)sequence(event1,event2):

[0079] The above event logic relationship is the fourth logic relationship, which means that the target event event2 can only occur after the target event event1 occurs.

[0080] (5) event1 and not event2:

[0081] The above event logical relationship is the fifth logical relationship, which means that after the target event event1 occurs, the target event event2 can occur only after a time period corresponding to the preset period has passed.

[0082] Optionally, in the detection system, the preset event logic relationship can be described by a custom "condition" data structure.

[0083] In an optional embodiment, when the target association rule has a preset event association relationship, the detection system detects whether multiple target events satisfy the preset event association relationship and obtains an association relationship detection result. Thereafter, when the association relationship detection result indicates that there are at least two target events among the multiple target events that satisfy the preset event association relationship, the detection system detects whether the multiple target events satisfy a preset event logical relationship and obtains a logical relationship detection result.

[0084] Optionally, the preset event association relationship includes at least one of an equivalence relationship, an inequality relationship, an inclusion relationship, a numerical value relationship, and a parent-child process chain relationship between attribute values ​​of different events that satisfy the target association rule.

[0085] Here, the equivalence relationship is used to characterize that the attribute values ​​of different events are equal; the inclusion relationship is used to characterize that the attribute value of one event is a subset of the attribute value of another event; the numerical size relationship is used to characterize the size relationship between the preset attribute value of one event and the attribute value of another event; the parent-child process chain relationship is used to characterize that the process that creates an event is the descendant process of the process that creates another event.

[0086] In some examples, assuming that the attribute value corresponding to the target event event1 is {event1}.{attribute}, and the attribute value corresponding to the target event event2 is {event2}.{attribute}, the preset relationship that the attribute values ​​of event1 and event2 may satisfy is described as follows:

[0087] (1) {event1}.{attribute}=={event2}.{attribute}:

[0088] The above preset relationship represents an equivalence relationship. The specific application scenarios are as follows:

[0089] Scenario 1: The process IDs of the target events event1 and event2 are the same;

[0090] Scenario 2: The process file paths for starting target event event1 and starting target event event2 are the same.

[0091] (2) {event1}.{attribute}! ={event2}.{attribute}:

[0092] The above preset relationship represents an inequality relationship. The specific application scenarios are as follows:

[0093] Scenario 1: Target events event1 and event2 are started at the same time, but the parent process IDs of event1 and event2 are different.

[0094] (3){event1}.{attribute}contains{event2}.{attribute}:

[0095] The above preset relationship represents a containment relationship. The specific application scenarios are as follows:

[0096] Scenario 1: The command line attributes for starting the target event event1 include the file name corresponding to the target event event2 used for file creation, that is, the newly created file of the target event event2 is referenced by the command line executed by the target event event1. The detection system can achieve security detection of phishing behavior events through the inclusion relationship.

[0097] (4) {event1}.{attribute} > {event2}.{attribute},

[0098] {event1}.{attribute}<{event2}.{attribute}:

[0099] The above preset relationship represents the relationship between numerical values. The specific application scenarios are as follows:

[0100] Scenario 1: Cross-process application can execute memory event event1 and cross-process write memory event event2. The starting address of the memory application in event1 is smaller than the starting address of the memory written in event2, and the ending address of the memory application in event1 is larger than the starting address of the memory written in event2. The detection system can detect memory injection scenarios through the relationship between numerical values, that is, the relationship between numerical values ​​can be used to detect that a process has applied for executable memory from another process, and instructions have been written into the applied memory area across processes.

[0101] (5){event1}.{attribute}isOffSpring{event2}.{attribute}:

[0102] The above preset relationship represents the parent-child process chain relationship. The specific application scenarios are as follows:

[0103] Scenario 1: The attacker starts the target event event2 in the temporary directory, and the process corresponding to the target event 2 subsequently creates the target event event1.

[0104] Optionally, in the detection system, the preset event association relationship can be described by a custom "relation" data structure.

[0105] Optionally, the detection system can extract the attribute values ​​included in the target event based on the rule identifier of the single event rule matched by the target event. Thereafter, the detection system detects whether there are at least two target events among the multiple target events that satisfy a preset event association relationship based on at least part of the attribute values ​​extracted from each target event. That is, the detection system achieves the technical effect of improving the efficiency of the detection system in performing association detection on multiple target events by comparing the attribute values ​​extracted from different target events.

[0106] In an optional embodiment, the target association rule also includes a preset time length. When the target association rule has a preset event association relationship, the detection system first extracts the attribute value of each target event from the event data of each target event. Then, the detection system determines, for each target event, a time window with the generation time of the target event as the starting time, and obtains multiple time windows. The duration of each time window is equal to the preset time length. Then, for each time window, the detection system detects whether the target event in the time window satisfies the preset event association relationship based on the attribute value of the target event at the generation time in the time window, and obtains the detection result corresponding to the time window. Finally, the detection system determines the association relationship detection result based on the detection results corresponding to the multiple time windows.

[0107] Optionally, in the detection system, the time window can be described by a custom "timeframe" data structure, and the detection system defines the unit of the "timeframe" field value by abbreviations of time units such as second, minute and hour.

[0108] Optionally, the detection system sets a "timeframe" field for the target association rule to prevent the detection system from taking too long to perform association detection on multiple target events, thereby preventing the system resources of the detection system from being occupied by the association detection process for a long time, and further avoiding the problem of the detection system being unable to respond to other system services.

[0109] Optionally, since the probability of satisfying a preset event association relationship between two target events with a long interval between their generation times is small, the detection system determines the range of generation times of the target events participating in each association detection through a time window, thereby achieving the purpose of reducing the amount of data that needs to be processed in the process of association detection of target events, thereby improving the efficiency of the detection system in performing association detection on multiple target events.

[0110] In an optional embodiment, each association rule has a mapping relationship expression, which includes multiple preset identifiers. The detection system first matches the rule identifiers of the single event rules that are respectively satisfied by multiple target events with the mapping relationship expressions in each association rule. Thereafter, the detection system determines the association rule to which the mapping relationship expression containing the rule identifiers of the single event rules satisfied by all target events belongs as the target association rule.

[0111] Optionally, in the detection system, the mapping relationship expression can be described using a custom "event_mapping" data structure.

[0112] Optionally, in the process of performing association detection on multiple target events, a mapping relationship expression generated is described as follows:

[0113] event_mapping:

[0114] event1:109991

[0115] event2:109992

[0116] In the above example, "109991" and "109992" are two preset identifiers included in the mapping relationship expression, "109991" is the rule identifier of the single event rule matched by the target event event1 among multiple target events, and "109992" is the rule identifier of the single event rule matched by the target event event2 among multiple target events.

[0117] In an optional embodiment, the complete process of the detection system detecting multiple behavior events is as follows:

[0118] (1) The detection system matches multiple behavior events with the first type of single event rule or the second type of single event rule respectively, and records the behavior events matched by the first type of single event rule and the behavior events matched by the second type of single event rule as M target events;

[0119] (2) The detection system determines a target association rule containing mapping relationship expressions corresponding to the M target events from multiple association rules based on the rule identifier of the single event rule matched by each target event in the M target events. Then, the detection system transmits the M target events to the association detection module, and the association detection module performs association detection on the M target events according to the target association rule.

[0120] (3) In the association detection module, the detection system determines the first time window according to the preset time length in the target association rule and the first target event generated earliest among the M target events, wherein the generation time of the first target event is the same as the start time of the first time window, and the first time window is used as the current detection window to execute step (4);

[0121] (4) detecting whether there is a subsequent target event that satisfies the mapping relationship expression in the current detection window through the association detection module, and if there is a subsequent target event, detecting whether the two target events satisfy the preset event association relationship;

[0122] (5) If the two target events do not satisfy the preset event association relationship, skip the subsequent target event in step (3);

[0123] (6) If the two target events satisfy the preset event association relationship, further detecting whether the two target events satisfy the preset event logical relationship;

[0124] (7) If the two target events do not completely satisfy the preset event logic relationship, for example, more target events are needed to determine whether the two target events satisfy the preset event logic relationship, the detection system caches the two target events persistently, and then the associated detection module continues to wait for the arrival of more target events;

[0125] (8) If the two target events do not satisfy the preset event logic relationship at all, for example, if the temporal relationship of the target events is known to be sequence (eventA, eventB, eventC), and it is assumed that the first event to arrive is the target event eventA, and the subsequent event to arrive is the target event eventC, then the detection system skips the target event eventC and continues to wait for the arrival of the target event eventB;

[0126] (9) If the two target events completely satisfy the preset event logic relationship, the detection process ends, and the detection system determines that the two target events contain attack behaviors;

[0127] (10) When no attack behavior is detected for at least one target event in the current detection window, a second time window is determined based on a preset time length in the target association rule and a first target event among the M target events whose generation time is later than that of the first target event, wherein the generation time of the first target event whose generation time is later than that of the first target event is the same as the start time of the second time window, and the second time window is used as the current detection window, and the process returns to step (4).

[0128] In an optional embodiment, the application scenarios of the technical solution of the present application are exemplified as follows:

[0129] Assume that process injection is implemented through DLL technology in the process injection scenario. At this time, three target events occur in sequence. The first target event eventA performs a memory write operation across processes. The second target event eventB is that a process creates a remote thread to execute functions related to loading DLL. The third target event eventC is that a process is loading a DLL file. The mapping relationship expressions corresponding to the three target events, as well as the event association relationship and event logic relationship satisfied by the three target events are described as follows:

[0130] event_mapping:

[0131] eventA:109994

[0132] eventB:109995

[0133] eventC:109996

[0134] relation:

[0135] eventA.TargetProcessId==eventB.TargetProcessId

[0136] eventA.BaseAddress<=eventB.ThreadStartAddress <eventA.BaseAddress+eventA.BytesCopied

[0137] event A.TargetProcessId==eventC.ProcessId

[0138] condition:sequence(eventA,eventB,eventC)

[0139] In the above example, the mapping relationship expression represents the following content:

[0140] (1) The rule identifier of the single event rule matched by the target event eventA is "109994";

[0141] (2) The rule identifier of the single event rule matched by the target event eventB is "109995";

[0142] (3) The rule identifier of the single event rule matched by the target event eventA is "109996".

[0143] In the above example, the content represented by the event association relationship includes:

[0144] (1) The process ID written in the target event eventA is equal to the process ID of the remote thread created in the target event eventB;

[0145] (2) The starting address (ThreadStartAddress) of the remote thread started in the target event eventB is between the starting address (BaseAddress) of the memory written in the target event eventA and the ending address (BaseAddress+BytesCopied) of the memory written in the target event eventA;

[0146] (3) The process ID written in the target event eventA is equal to the process ID that executes the DLL loading in the target event eventC.

[0147] In the above example, the content represented by the event logical relationship includes: the result of sorting the target event eventA, the target event eventB, and the target event eventC based on the generation time of each target event is "eventA, eventB, eventC".

[0148] To summarize, the present application first performs single event detection on multiple behavioral events in the system log based on different types of single event rules to obtain multiple target events. Then, the present application performs association detection on the multiple target events. On the one hand, the present application ensures that the multiple target events participating in the association detection describe the same event stream based on the mapping relationship expression, thereby reducing the probability of false detection. On the other hand, the present application fills the gap in the prior art for performing association detection on multiple events by performing association detection on multiple target events.

[0149] Optionally, in the present application, the basic behavior events of the system (i.e., target events that satisfy the second-type single-event rules) can also participate in association detection. For example, assuming that a target event eventA is a network connection event, and the target event has no corresponding filtering conditions (i.e., the network connection event does not match the first-type single-event rules), the network connection event will not be determined as an alarm event according to the single-event detection method in the prior art. However, the technical solution of the present application can match the network connection event through the second-type single-event rules, thereby achieving the purpose of subsequent association detection of eventA in combination with other target events.

[0150] For example, suppose that the process of the target event eventA is created as a remote thread by the process of other target events, so that the network connection operation can be realized (corresponding to the attack scenario of connecting to the server through process injection). Before this, the process of the target event eventA has never performed a network connection operation. At this time, by performing correlation detection on the target event eventA and other target events, the attack scenario of connecting to the server through process injection can be identified, and then it is determined that the target event eventA has an attack behavior, thereby achieving the purpose of reducing the probability of missed detection of attack behavior and improving the accuracy of the detection system in security detection of behavioral events.

[0151] It can be seen from the above content that the technical solution of the present application first matches the behavioral events that need to be judged whether there is an attack behavior with different categories of single event rules to obtain multiple target events. Therefore, the multiple target events that subsequently participate in the association detection of the present application include not only the behavioral events that are matched by the first type of single event rules and are alarm events, but also the behavioral events that are not alarm events matched by the second type of single event rules, such as basic behavioral events such as network connection events, thereby achieving the purpose of increasing the diversity of target events that subsequently participate in the association detection and the coverage of the association detection.

[0152] In addition, the present application queries and obtains a target association rule that matches the rule identifier of a single event rule satisfied by multiple target events from among multiple pre-set association rules. Afterwards, the present application performs association detection on multiple target events based on the target association rule, and determines whether there is an attack behavior in the multiple target events based on the association detection results, thereby filling the gap in the prior art in performing association detection between multiple behavior events, and further overcoming the problem of missed detection of attack behaviors caused by only performing single event detection on behavior events in the prior art.

[0153] It can be seen that the present application fills the gap in the prior art of only performing single event detection on behavioral events but lacking association detection between multiple behavioral events by matching behavioral events with single event rules of different categories and performing association detection on the obtained multiple target events based on target association rules. At the same time, it improves the diversity of target events involved in association detection and the coverage of association detection, thereby achieving the technical effect of improving the accuracy of security detection of behavioral events, and further solving the technical problem of low accuracy of security detection of behavioral events caused by only performing single event detection on behavioral events in the prior art.

[0154] According to another aspect of the embodiment of the present application, a behavior event detection device is also provided. Figure 2 is a schematic diagram of an optional behavior event detection device according to an embodiment of the present application, such as Figure 2As shown, the behavior event detection device includes: a first determination unit 201 , a second determination unit 202 , an association detection unit 203 and a third determination unit 204 .

[0155] Optionally, a first determination unit is used to determine multiple target events, wherein the multiple target events include: behavioral events that are alarm events matched by a first type of single event rule and behavioral events that are not alarm events matched by a second type of single event rule; a second determination unit is used to determine a target association rule from multiple association rules based on rule identifiers of the single event rules that are respectively satisfied by the multiple target events, wherein the multiple preset identifiers of the target association rule include rule identifiers of the single event rules that are respectively satisfied by the multiple target events; an association detection unit is used to perform association detection on the multiple target events according to the target association rule to obtain a detection result; and a third determination unit is used to determine whether there is an attack behavior based on the detection result.

[0156] In an optional embodiment, the behavior event detection device further includes: a fourth determination unit and / or adjustment unit.

[0157] Optionally, the fourth determination unit is used to determine the behavior event that is not an alarm event and is matched by the second type single event rule as an alarm event; the adjustment unit is used to adjust the alarm level corresponding to each target event in the multiple target events to a preset alarm level.

[0158] In an optional embodiment, the association detection unit includes: a first detection subunit and a first determination subunit.

[0159] Optionally, the first detection subunit is used to detect whether multiple target events satisfy a preset event logical relationship when the target association rule has a preset event logical relationship, and obtain a logical relationship detection result; the first determination subunit is used to determine whether there is an attack behavior based on the logical relationship detection result.

[0160] In an optional embodiment, the association detection unit further includes: a second detection subunit and a third detection subunit.

[0161] Optionally, the second detection sub-unit is used to detect whether multiple target events satisfy a preset event association relationship when the target association rule has a preset event association relationship, and obtain an association relationship detection result; the third detection sub-unit is used to detect whether multiple target events satisfy a preset event logical relationship when the association relationship detection result indicates that there are at least two target events among the multiple target events that satisfy the preset event association relationship, and obtain a logical relationship detection result.

[0162] In an optional embodiment, the preset event association relationship includes at least one of an equivalence relationship, an inequality relationship, an inclusion relationship, a numerical value relationship, and a parent-child process chain relationship between attribute values ​​of different events that satisfy the target association rule.

[0163] In an optional embodiment, the preset event logical relationship includes at least one of the following: a first logical relationship, a second logical relationship, a third logical relationship, a fourth logical relationship and a fifth logical relationship, wherein the first logical relationship is used to characterize the simultaneous occurrence of different events; the second logical relationship is used to characterize the prohibition of different events from occurring simultaneously; the third logical relationship is used to characterize that different events belong to the same preset event set; the fourth logical relationship is used to characterize that there is a preset sequence between the generation times of different events; and the fifth logical relationship is used to characterize that the second event is prohibited from occurring within a preset period after the occurrence of the first of the two events.

[0164] In an optional embodiment, the target association rule further includes a preset time length, and the second detection subunit includes: an extraction module, a first determination module, a detection module, and a second determination module.

[0165] Optionally, an extraction module is used to extract the attribute value of each target event from the event data of each target event; a first determination module is used to determine, for each target event, a time window with the generation time of the target event as the starting time, to obtain multiple time windows, and the duration of each time window is equal to the preset time length; a detection module is used to detect, for each time window, whether the target event in the time window satisfies the preset event association relationship based on the attribute value of the target event whose generation time is within the time window, and obtain the detection result corresponding to the time window; a second determination module is used to determine the association relationship detection result based on the detection results corresponding to multiple time windows.

[0166] In an optional embodiment, each association rule has a mapping relationship expression, the mapping relationship expression includes a plurality of preset identifiers, and the second determination unit includes: a matching subunit and a second determination subunit.

[0167] Optionally, a matching subunit is used to match the rule identifiers of single event rules respectively satisfied by multiple target events with the mapping relationship expressions in each association rule respectively; and a second determination subunit is used to determine the association rule to which the mapping relationship expression of the rule identifiers of the single event rules satisfied by all target events belongs as the target association rule.

[0168] It can be seen from the above content that the technical solution of the present application first matches the behavioral events that need to be judged whether there is an attack behavior with different categories of single event rules to obtain multiple target events. Therefore, the multiple target events that subsequently participate in the association detection of the present application include not only the behavioral events that are matched by the first type of single event rules and are alarm events, but also the behavioral events that are not alarm events matched by the second type of single event rules, such as basic behavioral events such as network connection events, thereby achieving the purpose of increasing the diversity of target events that subsequently participate in the association detection and the coverage of the association detection.

[0169] In addition, the present application queries and obtains a target association rule that matches the rule identifier of a single event rule satisfied by multiple target events from among multiple pre-set association rules. Afterwards, the present application performs association detection on multiple target events based on the target association rule, and determines whether there is an attack behavior in the multiple target events based on the association detection results, thereby filling the gap in the prior art in performing association detection between multiple behavior events, and further overcoming the problem of missed detection of attack behaviors caused by only performing single event detection on behavior events in the prior art.

[0170] It can be seen that the present application fills the gap in the prior art of only performing single event detection on behavioral events but lacking association detection between multiple behavioral events by matching behavioral events with single event rules of different categories and performing association detection on the obtained multiple target events based on target association rules. At the same time, it improves the diversity of target events involved in association detection and the coverage of association detection, thereby achieving the technical effect of improving the accuracy of security detection of behavioral events, and further solving the technical problem of low accuracy of security detection of behavioral events caused by only performing single event detection on behavioral events in the prior art.

[0171] According to another aspect of an embodiment of the present application, a computer program product is further provided. The computer program product includes a stored computer program, wherein when the computer program is running, the computer program product is controlled to execute any one of the above-mentioned behavior event detection methods.

[0172] According to another aspect of an embodiment of the present application, an electronic device is also provided, including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned behavioral event detection methods by executing the executable instructions.

[0173] Optionally, Figure 3 is a schematic diagram of an optional electronic device according to an embodiment of the present application, such as Figure 3As shown, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor, and when the processor executes the program, any one of the above-mentioned behavior event detection methods is implemented.

[0174] The above-mentioned embodiments or examples disclosed in the present application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection disclosed in the present application. In the absence of contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0175] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0176] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0177] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0178] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0179] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0180] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0181] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0182] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0183] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A behavioral event detection method, characterized in that: include: Determine a plurality of target events, wherein the plurality of target events include: behavior events that are alarm events matched by the first type of single event rule and behavior events that are not alarm events matched by the second type of single event rule; Determining a target association rule from among the multiple association rules according to the rule identifiers of the single event rules respectively satisfied by the multiple target events, wherein the multiple preset identifiers of the target association rule include the rule identifiers of the single event rules respectively satisfied by the multiple target events; Perform association detection on the multiple target events according to the target association rule to obtain a detection result; Determine whether there is an attack behavior based on the detection result.

2. The behavioral event detection method according to claim 1, characterized in that: When the detection result indicates that an attack behavior exists, the method further includes: Determine the behavior event that is not an alarm event and is matched by the second type single event rule as an alarm event; and / or, The alarm level corresponding to each target event among the multiple target events is adjusted to a preset alarm level.

3. The behavioral event detection method according to claim 1, characterized in that: In the process of performing association detection on the multiple target events according to the target association rule to obtain the detection result, the method further includes: In the case where the target association rule has a preset event logical relationship, detecting whether the multiple target events satisfy the preset event logical relationship, and obtaining a logical relationship detection result; Determine whether there is an attack behavior based on the detection result, including: Determine whether there is an attack behavior based on the logical relationship detection result.

4. The behavioral event detection method according to claim 3, characterized in that: In the process of performing association detection on the multiple target events according to the target association rule to obtain the detection result, the method further includes: In the case where the target association rule has a preset event association relationship, detecting whether the multiple target events satisfy the preset event association relationship, and obtaining an association relationship detection result; In the case where the target association rule has a preset event logical relationship, detecting whether the multiple target events satisfy the preset event logical relationship, and obtaining a logical relationship detection result, includes: When the association relationship detection result indicates that there are at least two target events among the multiple target events that satisfy the preset event association relationship, it is detected whether the multiple target events satisfy the preset event logical relationship to obtain the logical relationship detection result.

5. The behavioral event detection method according to claim 4, characterized in that: The preset event association relationship includes at least one of an equivalence relationship, an inequality relationship, an inclusion relationship, a numerical value relationship, and a parent-child process chain relationship between attribute values ​​of different events that satisfy the target association rule.

6. The behavioral event detection method according to claim 3, characterized in that: The preset event logical relationship includes at least one of the following: a first logical relationship, a second logical relationship, a third logical relationship, a fourth logical relationship and a fifth logical relationship, wherein the first logical relationship is used to characterize the simultaneous occurrence of different events; the second logical relationship is used to characterize the prohibition of different events from occurring simultaneously; the third logical relationship is used to characterize that different events belong to the same preset event set; the fourth logical relationship is used to characterize that there is a preset sequence between the generation times of different events; and the fifth logical relationship is used to characterize that within a preset period after the occurrence of the first of two events, the second event is prohibited from occurring.

7. The behavioral event detection method according to any one of claims 4 to 6, characterized in that: The target association rule also includes a preset time length. When the target association rule has a preset event association relationship, detecting whether the multiple target events satisfy the preset event association relationship, and obtaining an association relationship detection result includes: Extracting the attribute value of each target event from the event data of each target event; For each of the target events, determine a time window starting at the generation time of the target event to obtain multiple time windows, and the length of each time window is equal to the preset time length; For each of the time windows, according to the attribute value of the target event generated at the time in the time window, detecting whether the target event in the time window satisfies the preset event association relationship, and obtaining the detection result corresponding to the time window; The association relationship detection result is determined according to the detection results corresponding to the multiple time windows.

8. The behavioral event detection method according to any one of claims 1 to 6, characterized in that: Each of the association rules has a mapping relationship expression, and the mapping relationship expression includes a plurality of preset identifiers; Determining a target association rule from a plurality of association rules according to the rule identifiers of the single event rules respectively satisfied by the plurality of target events includes: Matching the rule identifiers of the single event rules respectively satisfied by the multiple target events with the mapping relationship expressions in each of the association rules; An association rule to which a mapping relationship expression containing rule identifiers of all single event rules satisfied by the target events belongs is determined as the target association rule.

9. A behavior event detection device, characterized in that: include: A first determining unit is used to determine a plurality of target events, wherein the plurality of target events include: a behavior event that is matched by a first type of single event rule and is an alarm event, and a behavior event that is matched by a second type of single event rule and is not an alarm event; a second determining unit, configured to determine a target association rule from a plurality of association rules according to rule identifiers of the single event rules respectively satisfied by the plurality of target events, wherein the plurality of preset identifiers of the target association rule include rule identifiers of the single event rules respectively satisfied by the plurality of target events; an association detection unit, configured to perform association detection on the plurality of target events according to the target association rule to obtain a detection result; The third determining unit is used to determine whether there is an attack behavior according to the detection result.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the behavioral event detection method described in any one of claims 1 to 8.

Images