Security detection method and device and security detection model training method and device

Abstract

The embodiment of the invention provides a safety detection method and device and a safety detection model training method and device. The safety detection method comprises the following steps: acquiring equipment input data of target equipment; carrying out vectorization processing on the equipment input data to obtain an equipment input vector; and inputting the equipment input vector into a security detection model to obtain a security detection result of the equipment input data, the security detection model being obtained based on training of a plurality of sample attack vectors, and the sample attack vectors being obtained based on vectorization processing of the sample attack data. By detecting the equipment input data of the target equipment, the problem of inaccurate detection caused by counterfeiting of the equipment identifier is avoided, meanwhile, continuous detection of the target equipment in the running process is realized, and moreover, the security detection model is obtained by training the sample attack vector of a large amount of sample attack data, so that the security detection efficiency is improved. And the security detection model is used for security detection, so that the accuracy of the security detection result is further improved.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of computer technology, and in particular to a security detection method and device, and a security detection model training method and device. Background Art

[0002] As cybersecurity incidents increase day by day and security threats become more severe, the offensive and defensive confrontation continues to intensify. The attack behavior of attack devices is becoming more and more covert. In order to prevent the attack behavior from being discovered, various techniques and methods can be used to make the attack behavior of attack devices bypass the security line of defense. Therefore, how to accurately perform security detection has gradually become a research hotspot.

[0003] At present, it is usually possible to collect the device identification of the device and determine whether the device is in the blacklist based on the device identification, thereby determining whether the device is safe. However, in the above method, the device identification of the attacking device is easy to forge, resulting in poor accuracy of the security detection result. Therefore, a highly accurate security detection solution is urgently needed. Summary of the invention

[0004] In view of this, an embodiment of this specification provides a security detection method. One or more embodiments of this specification also relate to a security detection device, a computing device, a computer-readable storage medium and a computer program product to solve the technical defects existing in the prior art.

[0005] According to a first aspect of an embodiment of this specification, a security detection method is provided, including:

[0006] Get device input data of the target device;

[0007] Perform vectorization processing on device input data to obtain a device input vector;

[0008] The device input vector is input into the security detection model to obtain the security detection result of the device input data, wherein the security detection model is trained based on multiple sample attack vectors, and the sample attack vector is obtained based on vectorized processing of the sample attack data.

[0009] According to a second aspect of an embodiment of this specification, a security detection model training method is provided, including:

[0010] Get multiple sample attack data;

[0011] Vectorize multiple sample attack data to obtain multiple sample attack vectors;

[0012] Input multiple sample attack vectors into the security detection model to obtain security prediction results corresponding to the multiple sample attack data respectively;

[0013] According to the security prediction results, the model parameters of the security detection model are adjusted to obtain a trained security detection model.

[0014] According to a third aspect of the embodiments of this specification, a safety detection device is provided, including:

[0015] A first acquisition module is configured to acquire device input data of a target device;

[0016] A first processing module is configured to perform vectorization processing on device input data to obtain a device input vector;

[0017] The first input module is configured to input the device input vector into the security detection model to obtain the security detection result of the device input data, wherein the security detection model is trained based on multiple sample attack vectors, and the sample attack vector is obtained based on vectorized processing of the sample attack data.

[0018] According to a fourth aspect of the embodiments of this specification, a safety detection model training device is provided, including:

[0019] A second acquisition module is configured to acquire a plurality of sample attack data;

[0020] A second processing module is configured to perform vectorization processing on the plurality of sample attack data to obtain a plurality of sample attack vectors;

[0021] The second input module is configured to input multiple sample attack vectors into the security detection model to obtain security prediction results corresponding to the multiple sample attack data respectively;

[0022] The adjustment module is configured to adjust the model parameters of the security detection model according to the security prediction results to obtain a trained security detection model.

[0023] According to a fifth aspect of an embodiment of this specification, a computing device is provided, including:

[0024] Memory and processor;

[0025] The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer programs / instructions are executed by the processor, the steps of the method provided in the first aspect or the second aspect are implemented.

[0026] According to the sixth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the method provided in the first aspect or the second aspect are implemented.

[0027] According to a seventh aspect of the embodiments of this specification, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the steps of the method provided in the first aspect or the second aspect above.

[0028] A security detection method provided by an embodiment of the present specification obtains device input data of a target device; performs vectorization processing on the device input data to obtain a device input vector; and inputs the device input vector into a security detection model to obtain a security detection result of the device input data, wherein the security detection model is obtained by training based on multiple sample attack vectors, and the sample attack vector is obtained by vectorization processing of the sample attack data. By detecting the device input data of the target device, the problem of inaccurate detection due to forged device identification is avoided, and continuous detection of the target device during operation is achieved. Moreover, since the security detection model is obtained by training with sample attack vectors of a large amount of sample attack data, the accuracy of the security detection result is further improved by using the security detection model for security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 is a flow chart of a safety detection method provided by an embodiment of this specification;

[0030] Figure 2 is a process flow chart of a security detection method provided by an embodiment of this specification;

[0031] Figure 3 is a flow chart of a security detection model training method provided by an embodiment of this specification;

[0032] Figure 4 It is a structural schematic diagram of a safety detection device provided by an embodiment of this specification;

[0033] Figure 5 It is a structural schematic diagram of a safety detection model training device provided by an embodiment of this specification;

[0034] Figure 6 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0035] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0036] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0037] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0038] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0039] First, the terms involved in one or more embodiments of this specification are explained.

[0040] Deep Self-Attention (Transformer) Model: It is a network structure based on a multi-head self-attention mechanism module, mainly used to process sequence data. The Transformer model consists of a number of encoders and decoders that can be repeatedly stacked. This design allows the Transformer to efficiently learn long-term dependencies and is suitable for a variety of natural language processing tasks including machine translation, text summarization, and question-answering systems.

[0041] Berkeley Packet Filter Compiler Collection (BCC) framework: used to develop and deploy efficient kernel tracing and analysis programs.

[0042] Enhanced Gradient Boosting (XGBoost): is a machine learning library for developing scalable machine learning models and data science models. XGBoost is a powerful implementation of the gradient boosting framework, using decision trees as weak learners. XGBoost can handle large data sets and can be used for a variety of machine learning tasks, such as classification tasks, regression tasks, and sorting tasks. It has been successfully applied to applications including natural language processing, image recognition, and financial forecasting.

[0043] Human Interface Device (HID): refers to various devices that interact with humans and computers, such as keyboards, mice, game controllers, touch screens, scanners, digital cameras, microphones, etc. HID devices are connected to computers or other devices through interfaces such as Universal Serial Bus (USB) or Bluetooth. Since HID devices use standard USB protocols or HID protocols for communication, HID devices do not require the installation of drivers, which makes them easy to use and plug and unplug, reducing the user's tedious operations and device compatibility issues. HID devices are widely used in personal computers, game consoles, medical equipment, industrial automation, smart homes and other fields, providing users with a convenient and fast operating experience.

[0044] BadUSB: refers to a method of attacking and controlling a computer or other device by exploiting security vulnerabilities at the firmware level of a USB device and modifying the firmware code of the USB device so that the device automatically executes malicious programs when connected to a computer or other device. One reason for the BadUSB attack is the lack of effective access control over the enumeration process in the USB protocol. The host determines the interface type requested by the device based solely on the declaration of the external USB device in the device descriptor, allowing attackers to apply for a HID interface for a USB device that is not a human-computer interaction device, thereby ultimately gaining the ability to simulate keyboard tapping and other operations. The concept of BadUSB emphasizes the potential security risks of USB devices, and traditional security measures often have difficulty detecting or preventing such attacks at the underlying firmware level. Once a USB device is maliciously modified into a BadUSB, an attack may be triggered simply by connecting the device, even if no obvious malicious files are stored on the device.

[0045] Endpoint Detection and Response (EDR): is a network security technology that focuses on protecting endpoint devices (such as personal computers, workstations, servers, and mobile devices) in computer networks from malicious attacks. EDR systems continuously monitor activities on endpoints, collect and analyze data to detect possible threats. Once abnormal behavior or potential attacks are detected, EDR can provide immediate alerts and take measures to contain the threats, while providing security teams with investigation tools to deeply analyze the incidents and take necessary response actions.

[0046] Host-based Intrusion Detection System (HIDS): A network security technology used to monitor and analyze the internal activities of a single computer system or a host in a network to identify malicious behavior or policy violations. HIDS is usually installed on the host that needs to be protected to detect possible signs of intrusion by monitoring system logs, file integrity, network connections, process behavior, registry changes, etc.

[0047] Since HID devices are usually small devices with limited internal hardware resources and cannot accommodate complex security protocols, attackers can easily attack HID devices by exploiting these security design flaws through firmware tampering, man-in-the-middle attacks, etc. Among the attacks against HID devices, a typical attack method is BadUSB, in which attackers often install malicious firmware on some common USB devices, such as flash drives, mice, keyboards, or even a charging cable, and then deliberately lose these common USB devices in public places or in phishing emails so that they can be accessed by ordinary users. When a user plugs a USB device into his or her computer, the BadUSB program can simulate the keyboard to open the shell command line as an administrator to attack and control the computer or other devices. Therefore, a trusted authentication mechanism for HID devices is urgently needed to deal with related security threats.

[0048] At present, common USB security detection can only detect access control during USB startup, does not support HID behavior during runtime, and cannot effectively detect BadUSB attack behavior. In addition, most security software uses a blacklist control method, which is easily bypassed by attacks and forgeries, and the current whitelisted USB devices are limited in the features they can collect.

[0049] In order to solve the above problems, the embodiments of this specification propose a security detection method, which detects the device input data of the target device to avoid the problem of inaccurate detection due to forged device identification, and at the same time realizes continuous detection of the target device during operation. In addition, a security detection model is obtained by training sample attack vectors of a large amount of sample attack data, and the security detection model is further used to perform security detection, thereby improving the accuracy of the security detection results, thereby more accurately responding to related security threats.

[0050] It is worth noting that the security detection method proposed in the embodiments of this specification can be used on a Linux server or desktop, and can be applied to office terminal security protection products (such as EDR) or server terminal security protection products (such as HIDS).

[0051] In this specification, a security detection method is provided. This specification also relates to a security detection device, a computing device, a computer-readable storage medium and a computer program product, which are described in detail one by one in the following embodiments.

[0052] See also Figure 1 , Figure 1 A flowchart of a safety detection method provided by an embodiment of this specification is shown, which specifically includes the following steps:

[0053] Step 102: Obtain device input data of the target device.

[0054] In one or more embodiments of the present specification, during security detection, device input data of the target device may be obtained, thereby performing continuous security detection on the operation process of the target device.

[0055] Specifically, the target device can be a hardware component connected to a computer network, such as a network card, or a HID device. The selection is made according to the actual situation, and the embodiments of this specification do not impose any restrictions on this. The device input data of the target device refers to the information or instructions transmitted to the computer for processing by the target device. When the user operates the target device, the target device can convert the user's operation into an electronic signal, which is understood and executed by the computer. The target device can be a device in different scenarios, such as a card reader, signature pad, password keyboard, etc. in a financial scenario, and a cash register, a QR code scanner, etc. in a transaction scenario.

[0056] In practical applications, there are many ways to obtain the device input data of the target device, which are selected according to the actual situation. The embodiments of this specification do not limit this. In one possible implementation of this specification, the device input data of the target device can be read from other data acquisition devices or databases. In another possible implementation of this specification, the behavior of the target device can be monitored, and the behavior events obtained by monitoring can be analyzed to obtain the device input data of the target device.

[0057] In an optional embodiment of the present specification, taking the target device including a human-machine interface device as an example, the human-machine interface device includes a universal serial bus device, and the universal serial bus device includes at least one of an input device, a storage device, and a communication device; the above-mentioned acquisition of device input data of the target device may include the following steps:

[0058] Monitor the behavior of the human-machine interface device and obtain the behavior events of the human-machine interface device;

[0059] Parse behavioral events and obtain device input data of human-machine interface devices.

[0060] Specifically, a universal serial bus device refers to a hardware device that can communicate with a host computer through a USB interface. An input device refers to a device that allows a user to input information into a computer. Common input devices include, but are not limited to, keyboards, mice, touchpads, and scanners. A storage device refers to a device that is connected to a computer through a USB interface and is used to store data. Common storage devices include, but are not limited to, flash drives, mobile hard drives, solid-state drives, and card readers. A communication device refers to a device that exchanges data with a computer or other device through a USB interface, and is mainly used for network communication or data transmission. Common communication devices include, but are not limited to, Bluetooth adapters, phone adapters, and fax adapters.

[0061] Behavioral events refer to input signals or actions generated by human-computer interface devices during interaction with users. These signals are designed to trigger corresponding responses in computer systems. Behavioral events include, but are not limited to, key events, mouse movement and click events, and game controller action events. Among them, key events refer to key down or key up events generated when a user presses or releases a key on the keyboard. These events carry key code information, and the system performs corresponding character input or function operations based on the key code. Mouse movement and click events refer to a series of movement events generated by the mouse moving or clicking on a plane. Mouse movement and click events include mouse click (down) events, double click (double click) events, or release (up) events, and also include mouse wheel scrolling events.

[0062] For example, taking the human-machine interface device as a keyboard, assuming that the behavior event of the human-machine interface device is: the user presses the "ctr l" key + the "c" key. By parsing the behavior event, it can be determined that the device input data of the human-machine interface device is "copy the selected text or object to the clipboard".

[0063] In practical applications, there are many ways to monitor the behavior of a human-machine interface device and obtain the behavior events of the human-machine interface device. The method is selected according to the actual situation, and the embodiments of this specification do not impose any restrictions on this. In one possible implementation of this specification, the behavior of a human-machine interface device can be monitored in user space through an application programming interface provided by a computer operating system to obtain the behavior events of the human-machine interface device. In another possible implementation of this specification, the behavior event function of the human-machine interface device can be intercepted (hooked) in kernel space to collect the behavior events of the human-machine interface device.

[0064] It should be noted that there are multiple ways to parse the behavior event and obtain the device input data of the human-machine interface device, which can be selected according to the actual situation. The embodiments of this specification do not impose any restrictions on this. In one possible implementation of this specification, the behavior event can be parsed through the application programming interface provided by the computer operating system to obtain the device input data of the human-machine interface device. In another possible implementation of this specification, at least one behavior association data of the behavior event can be determined first, and the device input data of the human-machine interface device can be determined based on the at least one behavior association data.

[0065] By applying the solution of the embodiments of this specification, the behavior of the human-machine interface device is monitored, and the device input data of the human-machine interface device is determined based on the behavioral events of the human-machine interface device obtained by monitoring, thereby achieving continuous detection of the human-machine interface device during operation, making the device input data more comprehensive.

[0066] In an optional embodiment of the present specification, the above-mentioned monitoring of the behavior of the human-machine interface device and obtaining the behavior events of the human-machine interface device may include the following steps:

[0067] Obtaining a behavior monitoring program, wherein the behavior monitoring program is an extended Berkeley packet filter program;

[0068] The behavior of the human-machine interface device is monitored based on the behavior monitoring program, and the behavior events of the human-machine interface device are captured in the kernel space.

[0069] Specifically, the Extended Berkeley Packet Filter eBPF (Extended Berkeley Packet Filter) is a high-performance kernel program technology that provides a safe and efficient method to allow user space applications to load bytecode programs into the kernel and execute these programs at specific event points (such as system calls, function entry / exit, timers, etc.).

[0070] It should be noted that there are many ways to obtain the behavior monitoring program, which can be selected according to the actual situation, and the embodiments of this specification do not limit this. In one possible implementation of this specification, the behavior monitoring program can be read from other data acquisition devices or databases. In another possible implementation of this specification, the behavior monitoring program can be written in C language, and it is ensured that the behavior monitoring program complies with the restrictions of eBPF (such as no infinite loops, etc.).

[0071] Furthermore, when the behavior of the human-machine interface device is monitored based on the behavior monitoring program, the behavior monitoring program can be loaded into the kernel space, and the behavior monitoring program can be used to hook into the relevant functions in the kernel that process the behavior events of the human-machine interface device (such as hide_input_report, hide_handle_event, etc.), thereby capturing the behavior events of the human-machine interface device.

[0072] By applying the solution of the embodiments of this specification, the behavior of the human-machine interface device is monitored based on the behavior monitoring program, and the behavior events of the human-machine interface device are captured in the kernel space. The feature collection points of the human-machine interaction device are sunk to the kernel state through the eBPF technology, thereby collecting the behavior sequence of the human-machine interface device function level, further making the device input data more comprehensive and improving the accuracy of security detection.

[0073] In an optional embodiment of the present specification, the above-mentioned parsing behavior events to obtain device input data of the human-machine interface device may include the following steps:

[0074] Parsing the behavior event, and determining at least one behavior-related data in the behavior event;

[0075] The behavior association data is decoded according to a data identifier of at least one behavior association data to obtain device input data of the human-machine interface device.

[0076] Specifically, behavior-related data refers to data that is associated with the behavior event of the target device. For example, in a keyboard key event, the behavior-related data may be a specific key character, such as the "ctr l" character + the "c" character. The data identifier of the behavior-related data is used to uniquely identify the behavior-related data. Taking the behavior-related data as the "ctr l" character + the "c" character as an example, the data identifier may be "ctr l" and "c".

[0077] In practical applications, there are many ways to parse behavior events and determine at least one behavior-related data in the behavior events. The specific method is selected according to the actual situation, and the embodiments of this specification do not impose any restrictions on this. In one possible implementation of this specification, behavior keywords can be extracted from the behavior events, and at least one behavior-related data can be determined based on the behavior keywords. In another possible implementation of this specification, the behavior events can be parsed through a graphical user interface toolkit (such as the Swing framework) to determine at least one behavior-related data in the behavior events.

[0078] It should be noted that there are multiple ways to decode the behavior-related data based on the data identifier of at least one behavior-related data to obtain the device input data of the human-machine interface device, and the specific selection is based on the actual situation. The embodiments of this specification do not impose any restrictions on this. In one possible implementation of this specification, the behavior-related data can be decoded by a decoder based on the data identifier of at least one behavior-related data, wherein the decoder is such as a Keycode decoder. A Keycode decoder refers to a software or hardware tool that can convert encoding forms such as scan codes and virtual key codes generated by a keyboard or other HID device into readable device input data (such as characters or commands). In another possible implementation of this specification, a data mapping table can be obtained, and the device input data corresponding to the data identifier of at least one behavior-related data can be read from the data mapping table, wherein the data mapping table includes multiple data identifiers and device input data corresponding to each data identifier.

[0079] By applying the solution of the embodiments of this specification, the behavior association data is decoded according to the data identifier of at least one behavior association data, and the device input data of the human-machine interface device is obtained, thereby realizing the conversion of the behavior events of the human-machine interface device into machine-readable device input data, thereby ensuring continuous detection of the device during operation.

[0080] Step 104: Perform vectorization processing on the device input data to obtain a device input vector.

[0081] In one or more embodiments of the present specification, after acquiring the device input data of the target device, the device input data may be further vectorized to obtain a device input vector.

[0082] Specifically, vectorization refers to the process of converting non-numeric data into a numerical vector representation. Since most machine learning models can only process numerical data, it is very important to vectorize the device input data. The device input vector refers to the numerical vector converted from the device input data by the vectorization method. The device input vector can be used as the model input of the subsequent security detection model.

[0083] In practical applications, there are many ways to vectorize the device input data and obtain the device input vector, which can be selected according to the actual situation. The embodiments of this specification do not impose any restrictions on this. In one possible implementation of this specification, the device input data can be vectorized using a bag of words model based on a hash vectorizer to obtain a device input vector. At this time, the device input vector can be a word segmentation vector matrix. In another possible implementation of this specification, the device input data can be vectorized based on term frequency-inverse document frequency (TF-IDF, Term Frequency-Inverse Document Frequency) or One-Hot encoding to obtain a device input vector.

[0084] For example, when the bag-of-words model based on the Hash ing Vectorizer performs vectorization processing on the device input data, the device input data is decomposed into words, and the decomposed words can be mapped to index positions in a fixed-size feature space through a hash function to form a sparse matrix (word segmentation vector matrix). In this matrix, each row represents a document, each column represents a potential feature, and the values ​​in the matrix represent the frequency or existence of the corresponding word in the device input data.

[0085] Step 106: Input the device input vector into the security detection model to obtain a security detection result of the device input data, wherein the security detection model is trained based on multiple sample attack vectors, and the sample attack vector is obtained based on vectorized processing of the sample attack data.

[0086] In one or more embodiments of the present specification, device input data of a target device is obtained; after vectorization is performed on the device input data to obtain a device input vector, the device input vector can be further input into a security detection model to obtain a security detection result of the device input data.

[0087] Specifically, the security detection model is used to identify potential attack behaviors and malicious activities in the target device or the device input data of the target device. The security detection model is a model obtained by training based on multiple sample attack vectors. When training the security detection model, the XGB classifier (a classifier built based on the XGBoost library) can be used as the base model for training, or the Transformer model can be used as the base model for training. The embodiments of this specification do not impose any restrictions on the base model in the security detection model training process. The security detection model can be called a malicious payload (Pay load) detection model. Malicious Pay load detection refers to the process of identifying and analyzing data fragments or codes that potentially contain malicious intent in the field of network security. Pay load generally refers to the part that actually performs harmful operations in an attack, such as the payload code in malware. The purpose of malicious Pay load is to control the system, steal data, destroy system functions, or spread to other systems.

[0088] Security detection results refer to the conclusions or evaluation results drawn by the security detection model after analyzing the device input vector. Security detection results usually include two types: safe and malicious. Among them, safe means that the input data conforms to the expected behavior pattern and no anomalies or threats are found. Malicious means that there are obvious abnormal behaviors or known threat characteristics in the input data, which may pose a security risk.

[0089] Sample attack data refers to data used to carry out attacks, fraud or other malicious activities in a network or information system. Sample attack data can be code, files, messages or any other form of digital information. Sample attack data usually includes various types of attack instances, vulnerability exploit samples, malicious code snippets, network traffic records, malicious Uniform Resource Locator (URL) lists, malicious file samples, etc. Sample attack vectors refer to numerical vectors converted from sample attack data by vectorization processing methods.

[0090] By applying the solution of the embodiments of the present specification, the device input data of the target device is detected, thereby avoiding the problem of inaccurate detection due to forged device identification, and at the same time achieving continuous detection of the target device during operation. Moreover, since the security detection model is trained using sample attack vectors of a large amount of sample attack data, the security detection is performed using the security detection model, which further improves the accuracy of the security detection results.

[0091] In an optional embodiment of the present specification, after inputting the device input vector into the security detection model and obtaining the security detection result of the device input data, the following steps may also be included:

[0092] When the security detection result indicates that the device input data is attack data, the device input data is intercepted.

[0093] It should be noted that when the security detection result is safe, it means that the device input data is safe data and the target device is a safe device. When the security detection result is malicious, it means that the device input data is attack data or malicious data and the target device is an attack device or malicious device.

[0094] In a possible implementation of the present specification, when the security detection result indicates that the device input data is attack data, the next device input data of the target device may not be attack data, and therefore the device input data currently determined to be attack data may be intercepted.

[0095] By applying the solution of the embodiments of this specification, it is determined whether the device input data is attack data based on the security detection results. If so, it means that the device input data may pose a security threat. At this time, the device input data can be intercepted to avoid security risks and improve computer security.

[0096] In an optional embodiment of the present specification, after inputting the device input vector into the security detection model and obtaining the security detection result of the device input data, the following steps may also be included:

[0097] In the case where the security detection result indicates that the device input data is attack data, the target device is determined to be an attack device and the target device is intercepted.

[0098] In another possible implementation of the present specification, when the security detection result indicates that the device input data is attack data, the next device input data of the target device may still be attack data. In order to avoid potential security threats, not only the device input data can be intercepted, but also the target device can be determined as an attack device and intercepted. For example, when a USB device is determined as an attack device, the USB device can be ejected.

[0099] By applying the solution of the embodiments of this specification, it is determined whether the device input data is attack data based on the security detection results. If so, it means that the target device may pose a security threat. At this time, the target device can be intercepted to avoid security risks and improve computer security.

[0100] In an optional embodiment of the present specification, a training method of the security detection model is described. That is, before inputting the device input vector into the security detection model and obtaining the security detection result of the device input data, the following steps may be included:

[0101] Get multiple sample attack data;

[0102] Vectorize multiple sample attack data to obtain multiple sample attack vectors;

[0103] Input multiple sample attack vectors into the security detection model to obtain security prediction results corresponding to the multiple sample attack data respectively;

[0104] According to the security prediction results, the model parameters of the security detection model are adjusted to obtain a trained security detection model.

[0105] Specifically, the security prediction result refers to the conclusion or evaluation result drawn by the security detection model after analyzing the sample attack vector. The security prediction result refers to the conclusion or evaluation result drawn by the security detection model after analyzing the sample attack vector. Security prediction results usually include two types: security and malicious. Since the sample attack data is attack data, the sample attack data naturally carries the sample prediction result "malicious". The training method of the security detection model is supervised training, that is, the sample attack data carries the real sample prediction result, and the sample prediction result is the processing target of the security detection model, which is used to guide the training process of the security detection model.

[0106] The method for obtaining multiple sample attack data may be to read multiple sample attack data from other data acquisition devices or databases. It may also be to receive multiple sample attack data input by a user. The method for obtaining multiple sample attack data is selected according to the actual situation, and the embodiments of this specification do not impose any restrictions on this. The implementation method of "vectorizing multiple sample attack data to obtain multiple sample attack vectors; inputting multiple sample attack vectors into a security detection model to obtain security prediction results corresponding to multiple sample attack data" is the same as the above-mentioned implementation method of "vectorizing device input data to obtain device input vectors; inputting device input vectors into a security detection model to obtain security detection results of device input data", and the embodiments of this specification will not be repeated.

[0107] In actual applications, when adjusting the model parameters of the security detection model according to the security prediction results, the loss value can be calculated according to the security prediction results and the sample prediction results, and the model parameters of the security detection model can be adjusted based on the loss value until the preset stopping conditions are reached to obtain a trained security detection model, wherein the preset stopping conditions include but are not limited to the loss value being less than or equal to a preset threshold and the number of iterations reaching a preset number of iterations. The preset threshold and the preset number of iterations are selected according to the actual situation, and the embodiments of this specification do not impose any limitations on this.

[0108] By applying the solution of the embodiments of this specification, a security detection model is obtained by training sample attack vectors of a large amount of sample attack data. During the training process, the sample attack data naturally carries sample prediction results for training guidance, so that the security detection model has the ability of security detection.

[0109] In an optional embodiment of the present specification, after adjusting the model parameters of the security detection model according to the security prediction results and obtaining the trained security detection model, the following steps may also be included:

[0110] Carry out interface encapsulation on the security detection model to obtain the security detection interface;

[0111] Inputting the device input vector into the security detection model to obtain the security detection result of the device input data may include the following steps:

[0112] Through the security detection interface, the security detection model is called to detect the device input vector and obtain the security detection result of the device input data.

[0113] It should be noted that interface encapsulation refers to hiding the internal implementation details of the complex model and interacting with the outside through a set of clearly defined interfaces. Interface encapsulation can provide a concise and consistent way of using the model while protecting the internal logic of the model from external influences. The security detection interface refers to an application programming interface designed for security detection tasks. This application programming interface can receive a device input vector and return a security detection result on whether the device input vector is safe. The security detection interface allows the use of complex security detection functions of the security detection model through simple calls without understanding the internal implementation details of the security detection model.

[0114] For example, the flag framework can be used to encapsulate the interface of the security detection model to obtain a security detection interface in RESTFUL format. The security detection interface in RESTFUL format is a page service interface design that follows the representational state transfer (RESTR) architectural style, which can make the security detection service more concise, scalable and easy to understand.

[0115] By applying the solution of the embodiments of this specification, the security detection model is interface-encapsulated to obtain a security detection interface. Through the security detection interface, the security detection model is called to detect the device input vector to obtain the security detection result of the device input data. This can make the security detection service provided by the security detection model more concise, scalable and easy to understand, thereby lowering the security detection threshold.

[0116] The following combination Figure 2Taking the security detection method provided in this specification for the security detection of HID devices as an example, the security detection method is further described. Figure 2 A processing flow chart of a security detection method provided by an embodiment of the present specification is shown, which specifically includes two stages: model training and security detection. Next, these two stages are described in detail respectively.

[0117] Model training: In user space, multiple sample attack data are obtained and used to train the security detection model. During the training of the security detection model, first, the bag-of-words model based on the Hash ing Vectorizer generates sample attack vectors of multiple sample attack data; second, the XGB classifier sample attack vector is used for model training to obtain the trained security detection model (xgb_detect_model l); finally, the fl ask framework is used to encapsulate the interface of the security detection model to obtain the security detection interface in RESTFUL format.

[0118] Security detection: First, after the HID device is connected to the computer and the USB driver of the HID device is enabled, the feature collection points of the HID device can be sunk into the kernel space through the eBPF program and the BCC framework. In the kernel space, the kernel probe (kprobe, Kernel probe) is used to hook the HID behavior event function (such as the hid input_h id_event function) as the behavior event collection point without modifying the kernel program code, and the behavior events reported by the HID device are collected; secondly, the decoder is used in the BCC framework to translate at least one behavior-related data in the behavior event into device input data;

[0119] Next, the device input data is vectorized based on the bag-of-words model of the Hashing Vectorizer to obtain the device input vector. Finally, through the security detection interface, the security detection model is called to detect the device input vector to obtain the security detection result of the device input data.

[0120] By applying the scheme of the embodiment of this specification, a security detection model based on XGBoost is trained based on multiple sample attack data. Experiments have shown that the area under the curve (AUC) index of the security detection model is greater than 98%. Therefore, the security detection model has very good security detection capabilities. In the security detection process, by hooking the HID behavior event function of the kernel, the behavior events of the HID device (such as the keyboard) can be collected, and then the behavior events are restored to the device input data (such as keyboard typed characters) through the decoder. Finally, the device input data collected by the kernel is security-checked through the security detection interface, realizing the security detection of HID device behavior based on XGBoost and eBPF technology. In addition, the behavior event detection problem of the HID device is converted into the detection problem of the device input vector, which improves the overall accuracy of security detection.

[0121] See also Figure 3 , Figure 3 A flowchart of a security detection model training method provided by an embodiment of this specification is shown, which specifically includes the following steps:

[0122] Step 302: Acquire multiple sample attack data.

[0123] Step 304: vectorize the multiple sample attack data to obtain multiple sample attack vectors.

[0124] Step 306: Input multiple sample attack vectors into the security detection model to obtain security prediction results corresponding to the multiple sample attack data.

[0125] Step 308: According to the security prediction result, adjust the model parameters of the security detection model to obtain a trained security detection model.

[0126] It should be noted that the implementation of steps 302 to 308 is the same as Figure 1 The training method of the security detection model in the security detection method shown is the same, and will not be repeated in this embodiment of the specification.

[0127] By applying the solution of the embodiments of this specification, a security detection model is obtained by training sample attack vectors of a large amount of sample attack data. During the training process, the sample attack data naturally carries sample prediction results for training guidance, so that the security detection model has the ability of security detection.

[0128] Corresponding to the above-mentioned safety detection method embodiment, this specification also provides a safety detection device embodiment, Figure 4 FIG. 1 is a schematic diagram showing the structure of a safety detection device provided by an embodiment of the present specification. Figure 4 As shown, the device comprises:

[0129] A first acquisition module 402 is configured to acquire device input data of a target device;

[0130] The first processing module 404 is configured to perform vectorization processing on the device input data to obtain a device input vector;

[0131] The first input module 406 is configured to input the device input vector into the security detection model to obtain the security detection result of the device input data, wherein the security detection model is trained based on multiple sample attack vectors, and the sample attack vector is obtained based on vectorized processing of the sample attack data.

[0132] Optionally, the target device includes a human-machine interface device, the human-machine interface device includes a universal serial bus device, and the universal serial bus device includes at least one of an input device, a storage device, and a communication device; the first acquisition module 402 is further configured to monitor the behavior of the human-machine interface device and obtain behavioral events of the human-machine interface device; parse the behavioral events and obtain device input data of the human-machine interface device.

[0133] Optionally, the first acquisition module 402 is further configured to acquire a behavior monitoring program, wherein the behavior monitoring program is an extended Berkeley packet filter program; perform behavior monitoring on the human-machine interface device based on the behavior monitoring program, and capture behavior events of the human-machine interface device in kernel space.

[0134] Optionally, the first acquisition module 402 is further configured to parse the behavior event, determine at least one behavior-related data in the behavior event, and decode the behavior-related data according to a data identifier of the at least one behavior-related data to obtain device input data of the human-machine interface device.

[0135] Optionally, the device also includes: a training module configured to obtain multiple sample attack data; perform vectorization processing on the multiple sample attack data to obtain multiple sample attack vectors; input the multiple sample attack vectors into the security detection model to obtain security prediction results corresponding to the multiple sample attack data; adjust the model parameters of the security detection model according to the security prediction results to obtain a trained security detection model.

[0136] Optionally, the device also includes: an encapsulation module, configured to perform interface encapsulation on the security detection model to obtain a security detection interface; a first input module 406, further configured to call the security detection model through the security detection interface to detect the device input vector and obtain a security detection result of the device input data.

[0137] Optionally, the apparatus further includes: a first interception module configured to intercept device input data when a security detection result indicates that the device input data is attack data.

[0138] Optionally, the apparatus further includes: a first interception module configured to determine the target device as an attacking device and intercept the target device when the security detection result indicates that the device input data is attacking data.

[0139] By applying the solution of the embodiments of the present specification, the device input data of the target device is detected, thereby avoiding the problem of inaccurate detection due to forged device identification, and at the same time achieving continuous detection of the target device during operation. Moreover, since the security detection model is trained using sample attack vectors of a large amount of sample attack data, the security detection is performed using the security detection model, which further improves the accuracy of the security detection results.

[0140] The above is a schematic scheme of a safety detection device of this embodiment. It should be noted that the technical scheme of the safety detection device and the technical scheme of the above safety detection method belong to the same concept, and the details of the technical scheme of the safety detection device that are not described in detail can be referred to the description of the technical scheme of the above safety detection method.

[0141] Corresponding to the above-mentioned security detection model training method embodiment, this specification also provides a security detection model training device embodiment, Figure 5 A schematic diagram of the structure of a safety detection model training device provided by an embodiment of this specification is shown.

[0142] like Figure 5 As shown, the device comprises:

[0143] A second acquisition module 502 is configured to acquire a plurality of sample attack data;

[0144] The second processing module 504 is configured to perform vectorization processing on the multiple sample attack data to obtain multiple sample attack vectors;

[0145] The second input module 506 is configured to input multiple sample attack vectors into the security detection model to obtain security prediction results corresponding to the multiple sample attack data respectively;

[0146] The adjustment module 508 is configured to adjust the model parameters of the security detection model according to the security prediction result to obtain a trained security detection model.

[0147] By applying the solution of the embodiments of this specification, a security detection model is obtained by training sample attack vectors of a large amount of sample attack data. During the training process, the sample attack data naturally carries sample prediction results for training guidance, so that the security detection model has the ability of security detection.

[0148] The above is a schematic scheme of a security detection model training device of this embodiment. It should be noted that the technical scheme of the security detection model training device and the technical scheme of the security detection model training method described above belong to the same concept, and the details not described in detail in the technical scheme of the security detection model training device can be found in the description of the technical scheme of the security detection model training method described above.

[0149] Figure 6 The block diagram of a computing device provided by an embodiment of the present specification is shown. The components of the computing device 600 include but are not limited to a memory 610 and a processor 620. The processor 620 is connected to the memory 610 via a bus 630, and the database 650 is used to store data.

[0150] The computing device 600 also includes an access device 640 that enables the computing device 600 to communicate via one or more networks 660. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 640 may include one or more of any type of network interface, wired or wireless (e.g., a network interface card (NIC)), such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Wide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0151] In one embodiment of the present specification, the above components of the computing device 600 and Figure 6Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 6 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0152] The computing device 600 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 600 may also be a mobile or stationary server.

[0153] Among them, the processor 620 is used to execute computer programs / instructions, which, when executed by the processor, implement the steps of the above-mentioned security detection method or security detection model training method.

[0154] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above-mentioned security detection method and security detection model training method belong to the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the above-mentioned security detection method or security detection model training method.

[0155] An embodiment of the present specification also provides a computer-readable storage medium storing a computer program / instruction, which implements the steps of the above-mentioned security detection method or security detection model training method when executed by a processor.

[0156] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the above-mentioned security detection method and security detection model training method belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the above-mentioned security detection method or security detection model training method.

[0157] An embodiment of the present specification also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned security detection method or security detection model training method.

[0158] The above is a schematic scheme of a computer program product of this embodiment. It should be noted that the technical scheme of the computer program product and the technical scheme of the above-mentioned security detection method and security detection model training method belong to the same concept, and the details not described in detail in the technical scheme of the computer program product can be referred to the description of the technical scheme of the above-mentioned security detection method or security detection model training method.

[0159] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0160] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0161] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0162] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0163] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A safety detection method comprising: Get device input data of the target device; Performing vectorization processing on the device input data to obtain a device input vector; The device input vector is input into a security detection model to obtain a security detection result of the device input data, wherein the security detection model is trained based on multiple sample attack vectors, and the sample attack vectors are obtained based on vectorized processing of sample attack data.

2. The method according to claim 1, wherein the target device comprises a human-machine interface device, the human-machine interface device comprises a universal serial bus device, and the universal serial bus device comprises at least one of an input device, a storage device, and a communication device; The acquiring device input data of the target device includes: Performing behavior monitoring on the human-machine interface device to obtain behavior events of the human-machine interface device; The behavior event is parsed to obtain device input data of the human-machine interface device.

3. The method according to claim 2, wherein the step of monitoring the behavior of the human-machine interface device and obtaining the behavior events of the human-machine interface device comprises: Obtaining a behavior monitoring program, wherein the behavior monitoring program is an extended Berkeley packet filter program; The behavior of the human-machine interface device is monitored based on the behavior monitoring program, and the behavior events of the human-machine interface device are captured in the kernel space.

4. The method according to claim 2, wherein parsing the behavioral event to obtain device input data of the human-machine interface device comprises: parsing the behavior event to determine at least one behavior-related data in the behavior event; The behavior association data is decoded according to a data identifier of the at least one behavior association data to obtain device input data of the human-machine interface device.

5. The method according to claim 1, before inputting the device input vector into the security detection model to obtain the security detection result of the device input data, further comprising: Obtain multiple sample attack data; performing vectorization processing on the plurality of sample attack data to obtain a plurality of sample attack vectors; Inputting the plurality of sample attack vectors into a security detection model to obtain security prediction results corresponding to the plurality of sample attack data respectively; According to the security prediction result, the model parameters of the security detection model are adjusted to obtain a trained security detection model.

6. The method according to claim 5, wherein after adjusting the model parameters of the security detection model according to the security prediction result to obtain a trained security detection model, the method further comprises: Performing interface encapsulation on the security detection model to obtain a security detection interface; Inputting the device input vector into a security detection model to obtain a security detection result of the device input data includes: The security detection model is called through the security detection interface to detect the device input vector and obtain a security detection result of the device input data.

7. The method according to claim 1, after inputting the device input vector into a security detection model to obtain a security detection result of the device input data, further comprising: If the security detection result indicates that the device input data is attack data, the device input data is intercepted.

8. The method according to claim 1, after inputting the device input vector into a security detection model to obtain a security detection result of the device input data, further comprising: In a case where the security detection result indicates that the device input data is attack data, the target device is determined to be an attack device and the target device is intercepted.

9. A security detection model training method comprising: Obtain multiple sample attack data; performing vectorization processing on the plurality of sample attack data to obtain a plurality of sample attack vectors; Inputting the plurality of sample attack vectors into a security detection model to obtain security prediction results corresponding to the plurality of sample attack data respectively; According to the security prediction result, the model parameters of the security detection model are adjusted to obtain a trained security detection model.

10. A safety detection device comprising: A first acquisition module is configured to acquire device input data of a target device; A first processing module is configured to perform vectorization processing on the device input data to obtain a device input vector; The first input module is configured to input the device input vector into a security detection model to obtain a security detection result of the device input data, wherein the security detection model is trained based on multiple sample attack vectors, and the sample attack vectors are obtained based on vectorized processing of sample attack data.

11. The apparatus according to claim 10, wherein the target device comprises a human-machine interface device, the human-machine interface device comprises a universal serial bus device, and the universal serial bus device comprises at least one of an input device, a storage device, and a communication device; The first acquisition module is further configured to monitor the behavior of the human-machine interface device to obtain behavior events of the human-machine interface device; and analyze the behavior events to obtain device input data of the human-machine interface device.

12. The apparatus according to claim 11, wherein the first acquisition module is further configured to acquire a behavior monitoring program, wherein: The behavior monitoring program is an extended Berkeley packet filter program; the behavior of the human-machine interface device is monitored based on the behavior monitoring program, and the behavior events of the human-machine interface device are captured in the kernel space.

13. According to the device according to claim 11, the first acquisition module is further configured to parse the behavioral event and determine at least one behavioral association data in the behavioral event; decode the behavioral association data according to the data identifier of the at least one behavioral association data to obtain the device input data of the human-computer interface device.

14. The apparatus according to claim 10, further comprising: A training module, configured to obtain a plurality of sample attack data; performing vectorization processing on the plurality of sample attack data to obtain a plurality of sample attack vectors; The multiple sample attack vectors are input into a security detection model to obtain security prediction results corresponding to the multiple sample attack data respectively; according to the security prediction results, the model parameters of the security detection model are adjusted to obtain a trained security detection model.

15. The apparatus according to claim 14, further comprising: An encapsulation module is configured to perform interface encapsulation on the security detection model to obtain a security detection interface; The first input module is further configured to call the security detection model through the security detection interface to detect the device input vector and obtain a security detection result of the device input data.

16. The apparatus according to claim 10, further comprising: The first interception module is configured to intercept the device input data if the security detection result indicates that the device input data is attack data.

17. The apparatus according to claim 10, further comprising: The first interception module is configured to, when the security detection result indicates that the device input data is attack data, determine the target device as an attack device and intercept the target device.

18. A safety detection model training device comprising: A second acquisition module is configured to acquire a plurality of sample attack data; a second processing module configured to perform vectorization processing on the plurality of sample attack data to obtain a plurality of sample attack vectors; A second input module is configured to input the multiple sample attack vectors into a security detection model to obtain security prediction results corresponding to the multiple sample attack data respectively; The adjustment module is configured to adjust the model parameters of the security detection model according to the security prediction result to obtain a trained security detection model.

19. A computing device comprising: memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer program / instructions are executed by the processor, the steps of the method described in any one of claims 1 to 8 or claim 9 are implemented.

20. A computer-readable storage medium storing a computer program / instruction, wherein the computer program / instruction, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8 or claim 9.

21. A computer program product comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8 or claim 9.

Images