Network behavior analysis method and device, electronic equipment and storage medium

Abstract

The invention discloses a network behavior analysis method and device, electronic equipment and a storage medium, and the method comprises the steps: carrying out the precise classification and behavior judgment of metadata and operation commands in original data according to the obtained original data, and generating first behavior graph data; the first behavior graph data is stored according to a graph structuring mode, second behavior graph data is generated, the data form of the second behavior graph data comprises nodes and edges, the nodes are used for indicating entity objects in the metadata, and the edges are used for indicating operation commands between the entity objects in the metadata; and identifying the second behavior graph data to obtain an abnormal behavior analysis result. Therefore, the graph data model is constructed by combining each entity object in the original data and the operation command, and the relationship between the entity objects can be better represented. And an abnormal behavior analysis result is obtained through a graph calculation technology and graph data model identification, so that the precision and efficiency of network abnormal behavior detection can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a network behavior analysis method, device, electronic device and storage medium. Background Art

[0002] In today's highly networked environment, network abnormal behavior analysis has become an important research direction in the field of information security. Traditional network security analysis methods mainly rely on the collection and processing of log data, and detect abnormal behaviors through rule matching and statistical methods. These methods usually rely on preset rules and patterns, which are suitable for detecting known attack patterns and abnormal behaviors, but they are often unable to cope with the ever-evolving new attacks and complex abnormal behaviors. Therefore, a more advanced network abnormal behavior analysis method is needed to overcome the limitations of traditional methods, improve the accuracy and efficiency of abnormal behavior detection, more comprehensively identify potential threats, and respond to various network security challenges in a timely manner. Summary of the invention

[0003] The embodiments of the present application provide a network behavior analysis method, device, electronic device and storage medium, which can improve the accuracy and efficiency of network abnormal behavior detection by combining graph data models and graph computing technology.

[0004] In a first aspect, an embodiment of the present application provides a network behavior analysis method, which may include:

[0005] Acquiring original data, wherein the original data includes metadata and operation commands in the network environment;

[0006] Accurately classify and determine the behavior of the original data to generate first behavior graph data, where the first behavior graph data is used to indicate the association relationship between the entity object and the operation command in the metadata;

[0007] The first behavior graph data is stored in a graph structured manner to generate second behavior graph data, wherein the data form of the second behavior graph data includes nodes and edges, the nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata;

[0008] The second behavior graph data is identified to obtain an abnormal behavior analysis result, where the abnormal behavior analysis result is used to indicate whether abnormal behavior exists in the original data.

[0009] In one embodiment, the above-mentioned accurately classifying and judging the behavior of the original data to generate the first behavior graph data includes:

[0010] Decomposing metadata and operation commands in the original data to obtain a plurality of entity objects and target operation commands between the plurality of entity objects;

[0011] generating the first behavior graph data according to the plurality of entity objects and target operation commands between the plurality of entity objects;

[0012] The storing the first behavior graph data in a graph structured manner to generate the second behavior graph data includes:

[0013] Decomposing the plurality of entity objects and target operation commands between the plurality of entity objects to obtain a node attribute table and an edge attribute table, wherein the node attribute table includes each entity object and an attribute corresponding to each entity object, and the edge attribute table includes entity objects connected by each edge and an attribute of each edge, wherein the attribute of the edge is used to indicate an attribute of the target operation command;

[0014] The node attribute table and the edge attribute table are stored to generate the second behavior as graph data.

[0015] In one embodiment, the above-mentioned identifying the second behavior graph data to obtain abnormal behavior analysis results includes:

[0016] By using a graph traversal method and an artificial subgraph, the second behavior graph data is identified and analyzed to obtain known abnormal behavior information, wherein the artificial subgraph is graph data constructed based on the known abnormal behavior;

[0017] By using the graph embedding method and the artificial subgraph, the second behavior graph data is identified and analyzed to obtain unknown abnormal behavior information;

[0018] The abnormal behavior analysis result is generated according to the known abnormal behavior information and the location abnormal behavior information.

[0019] In one embodiment, the above-mentioned identification and analysis of the second behavior graph data by using the graph traversal method and the artificial subgraph to obtain the known abnormal behavior information includes:

[0020] By using the graph traversal method, comparative analysis is performed on the data of nodes and edges in the artificial subgraph and the second behavior graph data to obtain the connection depth between each of the nodes;

[0021] The connection depth is matched with a depth threshold to determine the known abnormal behavior information.

[0022] In one embodiment, the above-mentioned method of identifying and analyzing the second behavior graph data by using the graph embedding method and the artificial subgraph to obtain unknown abnormal behavior information includes:

[0023] By using the graph embedding method, a subgraph similarity between the artificial subgraph and the second behavior graph data is calculated;

[0024] The subgraph similarity is matched with a similarity threshold to determine the unknown abnormal behavior information.

[0025] In one embodiment, before the above-mentioned identifying and analyzing the second behavior graph data by using the graph traversal method and the artificial subgraph to obtain the known abnormal behavior information, the method further includes:

[0026] The behavior rules in the graph data of known normal behaviors and the graph data of known abnormal behaviors are analyzed to construct the artificial subgraph.

[0027] In one embodiment, the above-mentioned identifying the second behavior graph data to obtain an abnormal behavior analysis result, wherein the abnormal behavior analysis result is used to indicate whether there is an abnormal behavior in the original data, further includes:

[0028] Reviewing the abnormal behavior analysis result to obtain an abnormal event review result, wherein the abnormal event review result is used to indicate whether there is a real threat in the original data;

[0029] When the abnormal event review result indicates that there is a real threat in the original data, an alarm message and abnormal behavior analysis result are sent to security personnel.

[0030] In a second aspect, an embodiment of the present application provides a network behavior analysis device, which may include:

[0031] An original data acquisition module, used to acquire original data, wherein the original data includes metadata and operation commands in a network environment;

[0032] A first raw data analysis module, used for accurately classifying and judging the behavior of the raw data, and generating first behavior graph data, wherein the first behavior graph data is used for indicating the association relationship between the entity object and the operation command in the metadata;

[0033] A second original data analysis module is used to store the first behavior graph data in a graph structured manner to generate second behavior graph data, wherein the data form of the second behavior graph data includes nodes and edges, the nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata;

[0034] The abnormal analysis module is used to identify the second behavior graph data to obtain an abnormal behavior analysis result, and the abnormal behavior analysis result is used to indicate whether there is abnormal behavior in the original data.

[0035] In a third aspect, an embodiment of the present application provides an electronic device, the device comprising:

[0036] processor;

[0037] a memory for storing processor-executable instructions;

[0038] The processor is configured to execute instructions to implement the network behavior analysis method as shown in any one of the embodiments of the first aspect.

[0039] In a fourth aspect, an embodiment of the present application provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, a network behavior analysis method as shown in any one of the embodiments of the first aspect is implemented.

[0040] In the fifth aspect, an embodiment of the present application also provides a computer program product, which includes a computer program stored in a readable storage medium, and at least one processor of the device reads and executes the computer program from the storage medium, so that the device executes the network behavior analysis method shown in any one of the embodiments of the first aspect.

[0041] The embodiments of the present application provide a network behavior analysis method, device, electronic device, and storage medium. Compared with the prior art, the present application has the following beneficial effects:

[0042] A network behavior analysis method, device, electronic device, and storage medium of an embodiment of the present application accurately classifies and judges the metadata and operation commands in the original data based on the acquired original data to generate first behavior graph data. The first behavior graph data is then stored in a graph-structured manner to generate second behavior graph data, wherein the data form of the second behavior graph data includes nodes and edges, the nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata, and then the second behavior graph data is identified to obtain abnormal behavior analysis results.

[0043] Therefore, by combining the entity objects and operation commands in the original data to construct a graph data model, the relationship between entity objects can be better represented. Then, through graph computing technology and graph data model recognition, abnormal behavior analysis results can be obtained, which can improve the accuracy and efficiency of network abnormal behavior detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0045] Figure 1 It is a flowchart of a network behavior analysis method provided in an embodiment of the present application;

[0046] Figure 2 It is a schematic diagram of a network behavior graph data model provided by an embodiment of the present application;

[0047] Figure 3 It is a functional architecture diagram of a network behavior analysis device provided in an embodiment of the present application;

[0048] Figure 4 This is a schematic diagram of a decomposition of a raw data analysis module provided in an embodiment of the present application;

[0049] Figure 5 This is a schematic diagram of a known threat analysis module decomposition provided in an embodiment of the present application;

[0050] Figure 6 This is a schematic diagram of the decomposition of an unknown behavior analysis module provided in an embodiment of the present application;

[0051] Figure 7 It is a structural diagram of a module relationship provided in an embodiment of the present application;

[0052] Figure 8 It is a structural diagram of a network behavior analysis device provided in an embodiment of the present application;

[0053] Fig. 9 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0055] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0056] Based on the background technology, it can be seen that the existing technical solutions still have some shortcomings when applying graph data models to analyze network abnormal behavior. Most current technical solutions focus on graphical modeling of physical entities, such as servers and network devices, while ignoring the modeling of logical node elements such as operators, accounts, and data sensitivity levels. This results in the inability to fully utilize the advantages of graph data models when dealing with abnormal analysis involving complex behaviors. In addition, most existing technologies rely on static rules or simple graph traversal algorithms, lack dynamic learning and deep analysis capabilities, and are inefficient in identifying unknown threats and complex attack patterns.

[0057] In order to solve the problems existing in the prior art, the embodiments of the present application provide a network behavior analysis method, device, electronic device and storage medium, which accurately classify and judge the metadata and operation commands in the original data according to the acquired original data to generate first behavior graph data. The first behavior graph data is then stored in a graph-structured manner to generate second behavior graph data, wherein the data form of the second behavior graph data includes nodes and edges, the nodes are used to indicate the entity objects in the metadata, and the edges are used to indicate the operation commands between the entity objects in the metadata, and then the second behavior graph data is identified to obtain abnormal behavior analysis results.

[0058] Therefore, by combining the entity objects and operation commands in the original data to construct a graph data model, the relationship between entity objects can be better represented. Then, through graph computing technology and graph data model recognition, abnormal behavior analysis results can be obtained, which can improve the accuracy and efficiency of network abnormal behavior detection.

[0059] The present application embodiment provides a network behavior analysis method, device, electronic device and storage medium. The network behavior analysis method provided by the present application embodiment is first introduced below. Figure 1 As shown, the network behavior analysis method provided in the embodiment of the present application includes the following steps:

[0060] S101: Acquire original data, where the original data includes metadata and operation commands in a network environment;

[0061] S102: accurately classify and determine the behavior of the original data to generate first behavior graph data, where the first behavior graph data is used to indicate the association relationship between the entity object in the metadata and the operation command;

[0062] S103: storing the first behavior graph data in a graph structured manner to generate second behavior graph data, wherein the data format of the second behavior graph data includes nodes and edges, wherein the nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata;

[0063] S104: Identify the second behavior graph data to obtain an abnormal behavior analysis result, where the abnormal behavior analysis result is used to indicate whether there is an abnormal behavior in the original data.

[0064] The embodiment of the present application provides a network behavior analysis method, device, electronic device and storage medium, which accurately classifies and judges the metadata and operation commands in the original data according to the acquired original data to generate first behavior graph data. The first behavior graph data is then stored in a graph structured manner to generate second behavior graph data, wherein the data form of the second behavior graph data includes nodes and edges, the nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata, and then the second behavior graph data is identified to obtain abnormal behavior analysis results.

[0065] Therefore, by combining the entity objects and operation commands in the original data to construct a graph data model, the relationship between entity objects can be better represented. Then, through graph computing technology and graph data model recognition, abnormal behavior analysis results can be obtained, which can improve the accuracy and efficiency of network abnormal behavior detection.

[0066] In S101, the original data may include metadata and operation commands in the network environment, wherein metadata refers to basic information about various entities in the network environment, including but not limited to personnel information, host information, account information, service configuration, sensitivity information, etc. Metadata can be obtained through log analysis, configuration file parsing, API interface call, etc. Operation commands refer to various operations performed by users or systems in the network environment, including but not limited to system commands, application commands, network operations, etc. Operation commands can be obtained through real-time monitoring, log file analysis, command line recording, etc.

[0067] In S102, the original data (including metadata and operation commands) is firstly accurately classified and behavior-judged to generate first behavior graph data. The first behavior graph data is used to indicate the association between entity objects (such as personnel, hosts, service configurations, accounts, etc.) and operation commands in the metadata. In this way, the first behavior graph data can accurately describe the operation behavior and its related entities in the network environment, providing basic support for subsequent threat analysis and anomaly detection.

[0068] In a specific embodiment, entity objects are first classified according to the attributes of metadata. For example, different records in the operation log will be identified as different types of entity objects, such as user accounts, hosts, services, files, etc. The system will assign a unique identifier to each type of entity to facilitate subsequent operations. The collected operation commands are then analyzed and classified by type. For example, the system divides commands into file operation commands, network operation commands, user management commands, etc. For complex commands, the system will further decompose and extract the core operation content and associated objects of the command. Finally, behavior judgment is performed. Based on the classification of entities and operation commands, the system judges each operation behavior to determine the association relationship between it and the relevant entity object. For example, if a command involves access to sensitive files, the system will record the interactive relationship between the command and the file entity. Finally, the judged operation behavior and the related entity objects are expressed in the form of a graph to generate the first behavior graph data.

[0069] In one embodiment, the accurately classifying and behaviorally judging the raw data to generate first behavioral graph data includes:

[0070] Decomposing metadata and operation commands in the original data to obtain a plurality of entity objects and target operation commands between the plurality of entity objects;

[0071] generating the first behavior graph data according to the plurality of entity objects and target operation commands between the plurality of entity objects;

[0072] The storing the first behavior graph data in a graph structured manner to generate the second behavior graph data includes:

[0073] Decomposing the plurality of entity objects and target operation commands between the plurality of entity objects to obtain a node attribute table and an edge attribute table, wherein the node attribute table includes each entity object and an attribute corresponding to each entity object, and the edge attribute table includes entity objects connected by each edge and an attribute of each edge, wherein the attribute of the edge is used to indicate an attribute of the target operation command;

[0074] The node attribute table and the edge attribute table are stored to generate the second behavior as graph data.

[0075] The above embodiment is described below with a specific embodiment. Assume that in an enterprise network, the original data includes a variety of metadata and operation commands, such as: server IP, user account, file path, operation type (such as read, write, delete), timestamp, etc. Among them, the metadata and operation commands in the original data are decomposed to obtain multiple entity objects and target operation commands between the multiple entity objects, and the step of generating the first behavior graph data according to the multiple entity objects and the target operation commands between the multiple entity objects can specifically include the performance of identifying each entity object (such as server, user, file, etc.) and the operation command between the entity objects (such as a user connecting to a server via SSH) by analyzing these metadata, that is, the first behavior graph data can include each entity object (such as server, user, file, etc.) and the operation command between the entity objects (such as a user connecting to a server via SSH). For example, user A logs in to server B via SSH and reads file C on server B. Then these behaviors can be decomposed into: entity objects (user A, server B, file C) and target operation commands (SSH login, file reading).

[0076] Correspondingly, the target operation commands between the multiple entity objects and the multiple entity objects are decomposed to obtain a node attribute table and an edge attribute table, and the node attribute table and the edge attribute table are stored. The step of generating the second behavior graph data can be specifically manifested as follows: based on the entity objects (user A, server B, file C) and the target operation commands (SSH login, file reading) decomposed in the above steps, a node attribute table and an edge attribute table can be generated, wherein the node attribute table includes each entity object and its corresponding attributes, and the edge attribute table includes the entity objects connected by each edge and the attributes of the edge (the edge represents the operation attribute). For example, node A (user A) is connected to node B (server B) through an edge (SSH login), and node B is connected to node C (file C) through another edge (file reading). Finally, this behavior graph data is stored according to the storage structure of the graph database to generate the second behavior graph data.

[0077] In S103, the first behavior graph data is stored in a graph-structured manner, which may specifically include representing each entity object as a node in the graph, and the operation command is represented as an edge between the nodes, and the direction of the edge represents the execution direction of the operation. For example, a file access operation may generate a graph structure of "user account→access→file", where "user account" and "file" are nodes, and "access" is an edge. In addition, after generating the first behavior graph data, the system will optimize the graph data to improve the efficiency of storage and query. For example, the graph structure can be simplified by removing redundant nodes, merging similar edges, etc. The generated second behavior graph data will be stored in the graph database for subsequent analysis. The graph database can efficiently store and query complex graph structure data and support large-scale concurrent operations.

[0078] Here is an actual case as an example: Step 1, collect metadata: In a certain enterprise's network system, the original data includes operation log records (such as Linux history logs), which record the user's operation commands and related host, time and other information. Step 2, classify operation commands: The system recognizes a complex command, such as scp / etc / passwduser@remote: / backup / , which is a file transfer command. The system decomposes the command into several parts: "user account", "source file", "destination host", and "transfer command". Step 3, generate behavior graph data: According to the decomposition results, the system generates corresponding behavior graph data: nodes include "user account", "file entity", and "remote host", and edges represent "transfer" operations, forming a graph structure of "user account→transfer→file entity" and "file entity→transfer→remote host". Step 4, storage and subsequent analysis: The generated graph data is stored in the graph database, and the system can query and further analyze the behavior when needed.

[0079] In S104, the second behavior graph data can be identified through known anomaly analysis and unknown abnormal behavior analysis, wherein the known abnormal behavior analysis mainly deals with abnormal behaviors that have been defined by the system and discovered in past experience. These known behaviors include known attack patterns, illegal operations, and operational behaviors that violate security policies. Unknown abnormal behavior analysis aims to detect abnormal behaviors that the system cannot directly identify through known rules, especially zero-day attacks, new threats, or atypical attack patterns. Combining known abnormal behavior analysis with unknown abnormal behavior analysis can achieve more comprehensive abnormal behavior detection and analysis.

[0080] In one embodiment, the identifying the second behavior graph data to obtain an abnormal behavior analysis result includes:

[0081] By using a graph traversal method and an artificial subgraph, the second behavior graph data is identified and analyzed to obtain known abnormal behavior information, wherein the artificial subgraph is graph data constructed based on the known abnormal behavior;

[0082] By using the graph embedding method and the artificial subgraph, the second behavior graph data is identified and analyzed to obtain unknown abnormal behavior information;

[0083] The abnormal behavior analysis result is generated according to the known abnormal behavior information and the location abnormal behavior information.

[0084] In the above embodiment, known mainly refers to the known normal access behavior graph and abnormal access behavior graph, and the analysis engine has been able to understand the decomposed commands including basic operation commands and combined operation commands. This module analysis is based on known basic behavior rules, known complex behavior rules, and known abnormal behavior rules. Known basic behavior rules include basic operable commands (such as file transfer, account creation, etc.). Complex behavior rules can be set manually, such as file transfer link depth, sub-graph association analysis based on the importance of data assets and behaviors (such as creating an account, what is done with the new account, clearing operations, etc. to outline a sub-graph model).

[0085] It should be noted that some specific subgraphs can be constructed manually to describe some complex attack behaviors, such as exporting data on a database server, encrypting and compressing data, transmitting compressed data or source files, uploading or downloading to machines outside the core area, and finally downloading on a certain machine. By modeling this series of behaviors, the abnormal subgraph model outlined is stored, and a similar search is performed in the large graph to find and match similar behaviors. The artificial subgraphs described above include but are not limited to specific subgraphs used to describe complex attack behaviors. They are used to refer to artificially constructed subgraphs used to identify and analyze the second behavior graph data. In addition, subgraphs can also be constructed through graph traversal algorithms. Starting from a vertex in the graph, the remaining vertices in the graph are visited, and each vertex is visited only once. This process is called graph traversal.

[0086] The specific working process of known abnormal behavior analysis can include: first, the system has a series of known abnormal behavior rules (i.e., artificial subgraphs) built in, which are pre-defined by security experts or learned from historical data. For example, the system may contain some rules to detect whether there are abnormal file transfers, unauthorized account creation or deletion, abnormal login activities, etc. During the analysis process, the system will match the rules of the behavior graph data generated in real time. The system checks one by one whether the operation behaviors in the behavior graph data meet the known abnormal behavior rules (i.e., artificial subgraphs). For example, a user frequently tries to log in to multiple different hosts, and this behavior may be marked as abnormal. Once an abnormal behavior that meets the known rules is detected, the system will immediately mark the behavior and assign an abnormality score. The higher the score, the more serious the abnormal behavior. These marked abnormal behaviors will be recorded and reported to security personnel or related modules for further processing.

[0087] The specific working process of unknown abnormal behavior analysis can include: First, the system constructs a historical profile of normal behavior by statistically analyzing long-term historical behavior data. For example, a user usually only accesses certain resources at specific times on weekdays, and any behavior outside this range may be considered abnormal. Then using statistical analysis methods, such as Z-Score, the system can identify abnormal changes in behavior frequency. For example, if a user's operation frequency suddenly increases or decreases, this may be a potential abnormal signal. For more complex behaviors, the system uses graph embedding technology to map the behavior graph into a high-dimensional vector space and calculate the similarity with known attack patterns. By calculating the similarity between the behavior graph and the known threat subgraph, the system can detect possible new threats. The system can also use machine learning technology to continuously adjust and update its own detection model based on newly discovered threats to improve its ability to identify unknown threats.

[0088] In one example, before the second behavior graph data is identified and analyzed by a graph traversal method and an artificial subgraph to obtain known abnormal behavior information, the method further includes:

[0089] The behavior rules in the graph data of known normal behaviors and the graph data of known abnormal behaviors are analyzed to construct the artificial subgraph.

[0090] In the above embodiment, the normal and abnormal behavior rules are first analyzed, and the rules extracted from the normal behavior and abnormal behavior graph data are comprehensively analyzed to determine which patterns represent normal behavior and which patterns represent abnormal behavior. For example, the normal pattern may include user A logging into server B only from the company's internal IP address, while the abnormal pattern may include user A trying to log into server B from IP addresses in multiple countries. Then construct an artificial subgraph, and manually construct a subgraph based on the analyzed rules. These subgraphs include nodes and edges representing specific behavior patterns. For example, one subgraph may represent a "normal login mode" and another subgraph may represent an "abnormal login mode." Subgraph example: Normal behavior subgraph: includes nodes (user A, server B), edges (normal login). Abnormal behavior subgraph: includes nodes (user A, server B, IP address 1, IP address 2), edges (abnormal login). Finally, store and apply artificial subgraphs, store these artificial subgraphs in a graph database, and apply these subgraphs for matching when performing abnormal behavior analysis. When new operation behavior data is analyzed, the system compares these data with the artificial subgraph to detect whether there is abnormal behavior.

[0091] In one embodiment, the identifying and analyzing the second behavior graph data by using a graph traversal method and an artificial subgraph to obtain known abnormal behavior information includes:

[0092] By using the graph traversal method, comparative analysis is performed on the data of nodes and edges in the artificial subgraph and the second behavior graph data to obtain the connection depth between each of the nodes;

[0093] The connection depth is matched with a depth threshold to determine the known abnormal behavior information.

[0094] In the above embodiment, for example, first, for a known abnormal time, according to the entity attribute table, the entity and attribute information of the event is obtained, such as the IP, account, data and other information involved in the event; the collected entity attribute table can be regarded as a small graph, which contains some access, data transmission, link and other situations in this event; start the risk association algorithm of graph traversal. The specific logic is as follows: First, determine the entity attribute table obtained in the previous step, and for all entities in the table, traverse the entities in the existing graph database that are consistent with its attributes (which can be considered to be the same entity), and analyze all its edge connections with these entities as the center. Entities within the connection depth n can be considered to be at risk and need to be reminded or checked. n can be specified a priori by experts or obtained adaptively by the algorithm; adaptive depth parameter n. For the small graph obtained in step 2, we can find all the edges and their depth Ki of each entity i, and the average depth of all m entities in the current event can be used as the depth parameter n of this graph traversal. That is:

[0095]

[0096] It should be noted that the depth threshold can be set according to actual needs and is not limited here.

[0097] In one embodiment, the identifying and analyzing the second behavior graph data by using the graph embedding method and the artificial subgraph to obtain unknown abnormal behavior information includes:

[0098] By using the graph embedding method, a subgraph similarity between the artificial subgraph and the second behavior graph data is calculated;

[0099] The subgraph similarity is matched with a similarity threshold to determine the unknown abnormal behavior information.

[0100] In the above embodiment, an example is given to illustrate that a historical profile is formed by statistical analysis of existing access behaviors, and suspected abnormal behaviors are discovered through frequency mutations. The specific method is to calculate the Z-Score:

[0101]

[0102] For example, the average number of visits to a host or a service is 100 times a day, with a standard deviation of 15 times, and the Z-Score threshold is (-2, 2). Then when X>2*15+100=130 or x<-2*15+100=70, it is considered to be an abnormality that needs to be suspected, and subsequent reporting and analysis are carried out. Some advanced attack behaviors can be sorted out and solidified, that is, a subgraph of a certain known threat is solidified, and then the unknown or abnormal behaviors are matched one by one, and the similarities are selected to be greater than the similarity threshold. Because the nodes and attributes of the graph mentioned in this solution have complex properties, traditional graph similarity is difficult to measure. Therefore, in particular, the subgraph similarity graph is calculated by graph embedding. It should be noted that the similarity threshold can be set according to actual needs and is not limited here.

[0103] In one embodiment, after identifying the second behavior graph data to obtain an abnormal behavior analysis result, wherein the abnormal behavior analysis result is used to indicate whether there is abnormal behavior in the original data, the method further includes:

[0104] Reviewing the abnormal behavior analysis result to obtain an abnormal event review result, wherein the abnormal event review result is used to indicate whether there is a real threat in the original data;

[0105] When the abnormal event review result indicates that there is a real threat in the original data, an alarm message and abnormal behavior analysis result are sent to security personnel.

[0106] In the above embodiment, for behaviors that are judged as threat events by the unknown behavior analysis module and the known threat analysis module, expert review and confirmation are performed to determine whether they are real threats; for those judged by experts as abnormal events, an email alert is sent to notify security personnel and detailed information on the abnormal behavior is provided. For events judged as false alarms, they are marked and adjusted in the corresponding threat module; security personnel take corresponding behavior blocking strategies according to the severity and characteristics of the events to prevent further spread of the threats.

[0107] In order to better illustrate the method provided by the embodiment of the present application, the following is an introduction based on a specific embodiment. Figure 2 The network behavior graph data model diagram shown in the figure includes:

[0108] Based on graph theory, various subjects, objects, behaviors, and sensitivities in the network environment are combined to build a model. The relevant subjects and objects mainly include personnel, personnel accounts, hosts, databases, application middleware, big data components, host system logs, host account files, data files, application configuration files, host configuration files, application configuration files, and the sensitivity of each object. The relevant behaviors mainly include accessing sensitive data files, transmitting and downloading data files, generating data files, creating and deleting accounts, clearing historical commands, and modifying key configuration data. The schematic diagram of the network behavior graph data model is as follows: Figure 2 The entire atlas is composed of a large number of unit graphs connected by account behavior and classification. It is a massive, complex and three-dimensional graph. Figure 3 It is a functional architecture diagram of a network behavior analysis device provided in an embodiment of the present application.

[0109] The following is an overview and breakdown of each module:

[0110] The raw data analysis module (No. 101), such as Figure 4 As shown:

[0111] This module is mainly based on metadata (relatively static data, such as personnel, hosts, host service configuration, accounts, etc., which can be further connected to the result data generated by the data asset discovery system) and related operation commands, and performs precise classification and behavior judgment, decomposing each operation behavior command. The decomposed results are suitable for graph storage.

[0112] 101-1: Decompose various operation commands, including background host operation commands and foreground service operation commands. Take background operation commands as an example. If it is a Linux background, save the historical logs recorded by the Linux history command. By continuously accumulating the ability of command decomposition modules, it is necessary to decompose basic commands and complex commands (such as complex commands with pipes, xargs, etc.). The goal is to extract the account, operation command, operation object, whether it involves sending to an external host, and whether it involves various suspected high-risk operations. For example, the following example can query the information of the operator who executes the mysql command on the background host, the operation database, and whether it is saved (high-risk operation).

[0113] history>history.txt

[0114] grep'mysql'history.txt|awk'{print$1,$3,$5}'

[0115] 101-2: An operation command must be related to an account, and it occurs on a certain host and operates a certain object. This information is associated with asset sensitivity metadata, asset sensitive data, and personnel metadata to obtain behavior graph data that can describe the operation in detail. This behavior data can locate people, machines, and whether sensitive assets have been accessed. For example, if it is a background operation, it will involve the Linux / Windows user account of the background host operation account. If it is a front-end operation, it will involve the login account of the specific business. Then locate the specific operator through the personnel master account list or other similar ledgers.

[0116] In this step, record the account name (front-end service login account / back-end operation host account, associated personnel account), host IP and specific operations for each operation, such as the object type of the operation (file, database, log, front-end business, etc.) and the operation type (create, modify, delete, etc.).

[0117] 101-3: Combined with the syntax of the specific graph database storage engine (see 201-2 for details), the analyzed behavior data is converted into a data format that can be imported in batches. Most graph databases accept data in the form of entity data of nodes and edges, where node data includes the node index and node attributes, and edge data includes the connected nodes and edge attributes. For details, see the graph data storage module (No. 201)

[0118] 101-4: Use the Spark interface of the graph database to load data into the graph data storage in a distributed, batch, high-speed, and continuous manner.

[0119] Figure data storage module (No. 201):

[0120] This module mainly stores the analyzed behavior data in the form of a graph, which mainly includes points, edges (with image edges), point labels, edge labels, etc.

[0121] 201-1: Decompose the entity sum generated in step 101-2, as shown in Table 1 and Table 2:

[0122] Table 1: Entity attribute table

[0123]

[0124] Table 2: Edge attribute table

[0125]

[0126]

[0127] The edge attributes include mutual visit, operation, generation, creation, deletion, etc.

[0128] 201-2: The decomposed entities and edges are stored using the big data platform and graph database. Taking the JanusGraph graph database combined with the Spark big data platform as an example, Pyspark is used to read the entity and edge nodes as graphData, and then pushed to the JanusGraph database. The key code of Pyspark is as follows:

[0129] #Create a JanusGraph connection

[0130] graph=Graph().traversal().withRemote(DriverRemoteConnection('ws: / / janu sgraph-server:8182 / gremlin','g'))

[0131] #Assume that the graph data structure graphData is obtained from Spark processing, which contains the processed graph data structure, including vertices and edges, and stores the graph data in JanusGraph

[0132] for vertex in graphData.vertices:

[0133] g.addV(vertex.label).property('property1',vertex.property1).property('property2',vertex.property2).next()

[0134] for edge in graphData.edges:

[0135] gV().has('label',edge.outV).addE(edge.label).to(gV().has('label',edge.inV)).property('property1',edge.property1).next()

[0136] Known threat analysis module (number 301), such as Figure 5 As shown:

[0137] This module focuses on the known definition. The known mainly refers to the known normal access behavior graph and abnormal access behavior graph, and the commands that the analysis engine can understand and decompose include basic operation commands and combined operation commands. The analysis in this module is based on known basic behavior rules, known complex behavior rules, and known abnormal behavior rules. Known basic behavior rules include basic operable commands (such as file transfer, account creation, etc.). Complex behavior rules can be set manually, such as file transfer link depth, sub-graph association analysis based on the importance of data assets and behaviors (such as creating an account, what is done with the new account, clearing operations, etc. to outline a sub-graph model).

[0138] 301-1: Through the sub-graphs of personnel, personnel affiliations, hosts, and accounts, it is possible to intuitively analyze whether the accounts are reasonable, whether there are isolated accounts, illegally created accounts, and accounts with large actual operating permissions, and mark the contaminated hosts.

[0139] 301-2: General abnormal behavior refers to some obviously abnormal behaviors, including file transfer link tracking (transmission link is too long, there is a suspicion of jump), account jump tracking, login abnormality tracking (logging into many hosts or important hosts), etc. The abnormal data is detected through graph analysis.

[0140] 301-3: Hotspot behavior is used to discover frequently used hosts, accounts, accessed files, etc. so that these can be monitored intensively.

[0141] 301-4-1: By artificially constructing some specific subgraphs to describe some complex attack behaviors, such as exporting data on the database server, encrypting and compressing data, transmitting compressed data or source files, uploading or downloading to machines outside the core area, and finally downloading on a certain machine, the abnormal subgraph model outlined is stored by modeling this series of behaviors, and a similar search is performed in the large graph to find and match similar behaviors.

[0142] 301-4-2: A subgraph can also be constructed through a graph traversal algorithm. Starting from a vertex in the graph, we visit all the other vertices in the graph, and each vertex is visited only once. This process is called graph traversal.

[0143] 1. Combined with the data structure in 101, for a known abnormal event, use the parsing logic in 101-1 to obtain the entity and attribute information of the event according to the entity attribute table, such as the IP, account, data, etc. involved in the event;

[0144] 2. The entity attribute table collected in the previous step can be regarded as a small graph, which includes some access, data transmission, link and other situations in this event;

[0145] 3. Start the risk association algorithm of graph traversal. The specific logic is as follows: First, determine the entity attribute table obtained in the previous step. For all entities in the table, traverse the entities with the same attributes in the existing graph database (which can be considered as the same entity). With these entities as the center, analyze all their edge connections. Entities with a connection depth of n can be considered to have risks and need to be reminded or checked. n can be specified a priori by experts or obtained adaptively by the algorithm;

[0146] 4. Adaptive depth parameter n. For the small graph obtained in step 2, we can find all the edges and depth Ki of each entity i, and use the average depth of all m entities in the current event as the depth parameter n for this graph traversal. That is,

[0147]

[0148] 5. For the risk entities obtained by the graph traversal algorithm, follow-up reporting is carried out as detailed in module 501.

[0149] Unknown behavior analysis module (No. 401), such as Figure 6 and Figure 7 As shown:

[0150] This module is mainly responsible for further analysis of unknown and abnormal behaviors, including behaviors that existing rules and previous models cannot accurately judge in a timely manner.

[0151] 401-1: Through statistical analysis of existing access behaviors, a historical profile is formed, and suspected abnormal behaviors are discovered through frequency mutations. The specific method is to calculate the Z-Score:

[0152]

[0153] For example, the average number of visits to a host or service is 100 times per day, with a standard deviation of 15 times, and the Z-Score threshold is (-2, 2). Then when X>2*15+100=130 or x<-2*15+100=70, it is considered an abnormality that needs to be suspected and subsequent reporting and analysis are carried out.

[0154] 401-2: Based on step 301-4, some advanced attack behaviors can be sorted out and solidified, that is, a certain subgraph of known threats can be solidified (using the methods of 301-4-1 and 301-4-2), and then unknown or abnormal behaviors can be matched one by one to select those with a similarity greater than a certain threshold.

[0155] The nodes and attributes of the graph mentioned in this patent have complex properties, and traditional graph similarity is difficult to measure. Therefore, in particular, the subgraph similarity graph is calculated by graph embedding. The specific method is:

[0156] 401-2-1: Give each node's attribute an initial embedding vector and calculate the adjacency matrix A of the original graph.

[0157] 401-2-2: Construct a multi-layer neural network and use node embedding as the input of the neural network.

[0158] 401-2-3: Position the dimension of the neural network output as a vector of the same length as the original embedding, calculate the inner product of each pair of vectors as the adjacency matrix A', and use ||A-A'|| as the reconstruction loss function for learning.

[0159] 401-2-4: Get the learned embedding of each node. The embedding of each edge is the concatenation of the embeddings of the connected nodes.

[0160] 401-2-5: The embedding of the subgraph is the mean of all node embeddings plus the mean of all edge embeddings.

[0161] 401-2-6: Calculate the cosine distance of the subgraph embedding as the similarity, and select those with a similarity greater than a certain threshold (for example, 0.5) as suspicious anomalies that require subsequent reporting and analysis.

[0162] 401-3: Further extending the method in 401-2, the neural network that learns the subgraph reconstruction loss function is expanded to a threat identification neural network. The specific method is:

[0163] 401-3-1: Same as 401-2-1

[0164] 401-3-2: Same as 401-2-2.

[0165] The above two steps can also directly use the embedding trained by 401-2 as input.

[0166] 401-3-3: All known threats (regardless of category) are used as positive samples, and normal access / operation records are selected as negative samples at a ratio of 10 times or closer to the actual situation to construct supervised learning.

[0167] 401-3-4: Use the trained neural network to screen for anomalies, and conduct subsequent reporting and analysis for those that the model identifies as unknown abnormal risks.

[0168] 401-4: Report scripts or commands that cannot be identified in a timely manner. For details, see the Abnormal Behavior Analysis Module (No. 501)

[0169] Abnormal behavior processing module (No. 501): This module is mainly responsible for the further and final processing of abnormal behaviors, including sending to experts for review and confirmation, alarm email notification, false alarm discarding, behavior blocking, notification disposal system, abnormal display, etc.

[0170] 501-1: Experts review and confirm the threat events identified in modules 3 and 4, and determine whether they are real threats.

[0171] 501-2: Send email alerts to security personnel for events that experts identify as abnormal events, including detailed information on the abnormal behavior, event description, timestamp, impact range, and other important information; mark events that experts identify as false positives, and confirm in the known threat module whether to delete the changed events, and modify the related negative samples in the unknown threat module.

[0172] 501-3: Security personnel adopt corresponding behavior blocking strategies based on the severity and characteristics of the incident, such as blocking related IP addresses, prohibiting specific operations, or shutting down affected system services.

[0173] The working principle of the network abnormal behavior analysis device based on the graph data model:

[0174] The working principle involves several key steps, from the analysis of raw data to the storage of graph data, to the analysis of known threats, unknown behavior analysis and abnormal behavior processing. The following is a summary of the working process:

[0175] Raw data analysis process: First, the device analyzes metadata (such as personnel, host, service configuration, account, etc.) and operation commands through the raw data analysis module for accurate classification and behavior judgment. Operation commands are decomposed to meet the needs of graph storage; operation commands (including background host and foreground service operation commands) are decomposed to extract information such as account, operation command, operation object (for example, Linux background operation commands will be recorded and decomposed to identify whether they involve high-risk operations) to complete command decomposition; operation commands are associated with account, host, object and other information to generate behavior graph data that can describe the operation in detail (data can locate specific people, machines, and whether sensitive assets have been accessed).

[0176] Graph data storage process: The analyzed behavioral data is stored in a graph format through the graph data storage module, including points, edges, point labels, edge labels, etc.; the entities and edges generated in the steps are decomposed and stored using a big data platform and a graph database (such as JanusGraph combined with Spark). Specifically, Pyspark is used to read the entity and edge data, and then pushed to the JanusGraph database to complete the decomposition and storage of entities and edges.

[0177] Known threat analysis: Through the known threat analysis module, we focus on analyzing known normal access behavior graphs and abnormal access behavior graphs, including basic operation commands and combined operation commands. The analysis is based on known basic behavior rules and complex behavior rules, as well as known abnormal behavior rules. We manually construct specific subgraphs to describe complex attack behaviors. In addition, we construct subgraphs through graph traversal algorithms, starting from a vertex in the graph and traversing the remaining vertices in the graph to analyze whether the account is reasonable, whether there are isolated accounts, etc. We use the risk association algorithm of graph traversal to determine all entities in the entity attribute table and entities in the graph database that are consistent with their attributes, and analyze all their edge connections. Entities with a connection depth of n or less can be considered to have risks and need to be reminded or checked.

[0178] Unknown behavior analysis: Through statistical analysis of existing access behaviors, historical portraits are formed, and the Z-Score calculation method is used to discover sudden changes in access frequency, identify suspected abnormal behaviors, and complete historical portraits and abnormal behavior discovery; some advanced attack behaviors are solidified into subgraphs of known threats, and unknown or abnormal behaviors are matched with these subgraphs, and behaviors with similarity greater than a certain threshold are selected. Subgraph similarity is calculated through graph embedding; based on the graph embedding method, the neural network that learns the subgraph reconstruction loss function is expanded to a threat identification neural network, using known threats as positive samples and normal access / operation records as negative samples for supervised learning to screen out unknown abnormal risks and conduct subsequent reporting and judgment; scripts or commands that cannot be judged by the model are reported in a timely manner for further abnormal behavior analysis.

[0179] Abnormal behavior handling:

[0180] For behaviors identified as threat events by the unknown behavior analysis module and the known threat analysis module, expert review and confirmation are carried out to determine whether they are real threats; for those identified as abnormal events by experts, email alerts are sent to notify security personnel and detailed information on the abnormal behavior is provided; for events identified as false alarms, they are marked and adjusted in the corresponding threat modules; security personnel take corresponding behavior blocking strategies based on the severity and characteristics of the events to prevent further spread of the threats.

[0181] Based on a network behavior analysis method provided in the above embodiment, accordingly, Figure 8 As shown, the embodiment of the present application provides a network behavior analysis device 800, which may include:

[0182] The original data acquisition module 801 is used to acquire original data, where the original data includes metadata and operation commands in the network environment;

[0183] A first raw data analysis module 802, used to accurately classify and determine the behavior of the raw data, and generate first behavior graph data, where the first behavior graph data is used to indicate the association relationship between the entity object and the operation command in the metadata;

[0184] A second original data analysis module 803 is used to store the first behavior graph data in a graph structured manner to generate second behavior graph data, wherein the data form of the second behavior graph data includes nodes and edges, wherein the nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata;

[0185] The abnormal analysis module 804 is used to identify the second behavior graph data to obtain an abnormal behavior analysis result, and the abnormal behavior analysis result is used to indicate whether there is abnormal behavior in the original data.

[0186] In one embodiment, the first raw data analysis module may include:

[0187] A first decomposition unit is used to decompose the metadata and the operation command in the original data to obtain a plurality of the entity objects and a target operation command between the plurality of the entity objects;

[0188] A first generating unit, configured to generate the first behavior graph data according to the plurality of entity objects and target operation commands between the plurality of entity objects;

[0189] Correspondingly, the second raw data analysis module can be specifically used for:

[0190] A second decomposition unit is used to decompose the multiple entity objects and the target operation commands between the multiple entity objects to obtain a node attribute table and an edge attribute table, wherein the node attribute table includes each entity object and the attributes corresponding to each entity object, and the edge attribute table includes the entity objects connected by each edge and the attributes of each edge, and the attributes of the edge are used to indicate the attributes of the target operation command;

[0191] The second generating unit is used to store the node attribute table and the edge attribute table to generate the second behavior graph data.

[0192] In one embodiment, the anomaly analysis module may include:

[0193] A first identification unit is used to identify and analyze the second behavior graph data through a graph traversal method and an artificial subgraph to obtain known abnormal behavior information, wherein the artificial subgraph is graph data constructed based on the known abnormal behavior;

[0194] A second recognition unit is used to recognize and analyze the second behavior graph data by using a graph embedding method and the artificial subgraph to obtain unknown abnormal behavior information;

[0195] The third generating unit is used to generate the abnormal behavior analysis result according to the known abnormal behavior information and the location abnormal behavior information.

[0196] In one embodiment, the first identification unit may be specifically used for:

[0197] By using the graph traversal method, comparative analysis is performed on the data of nodes and edges in the artificial subgraph and the second behavior graph data to obtain the connection depth between each of the nodes;

[0198] The connection depth is matched with a depth threshold to determine the known abnormal behavior information.

[0199] In one embodiment, the second identification unit may be specifically used for:

[0200] By using the graph embedding method, a subgraph similarity between the artificial subgraph and the second behavior graph data is calculated;

[0201] The subgraph similarity is matched with a similarity threshold to determine the unknown abnormal behavior information.

[0202] In one embodiment, the abnormality analysis module may further include:

[0203] A construction unit is used to analyze the behavior rules in the graph data of known normal behaviors and the graph data of known abnormal behaviors to construct the artificial subgraph.

[0204] In one embodiment, the network behavior analysis device may further include:

[0205] An audit module is used to audit the abnormal behavior analysis result to obtain an abnormal event audit result, wherein the abnormal event audit result is used to indicate whether there is a real threat in the original data;

[0206] The alarm module is used to send alarm information and abnormal behavior analysis results to security personnel when the abnormal event review result indicates that there is a real threat in the original data.

[0207] Based on the network behavior analysis method and device provided in the above embodiments, the present application embodiment further provides an electronic device 900, such as Fig. 9 As shown:

[0208] It includes a processor 901, a memory 902, and a computer program stored in the memory 902 and executable on the processor 901. When the computer program is executed by the processor 901, each process of the above-mentioned network behavior analysis method embodiment is implemented, and the same technical effect can be achieved.

[0209] Specifically, the processor 901 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0210] The memory 902 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 902 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 902 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 902 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 902 is a non-volatile solid-state memory.

[0211] In certain embodiments, the memory may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, typically, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of the present application.

[0212] The processor 901 implements any one of the network behavior analysis methods in the above embodiments by reading and executing computer program instructions stored in the memory 902 .

[0213] In one example, the electronic device may further include a communication interface 903 and a bus 910. As an example, Fig. 9 As shown, the processor 901, the memory 902, and the communication interface 903 are connected via a bus 910 and communicate with each other.

[0214] The communication interface 903 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0215] Bus 910 includes hardware, software or both, and the parts of online data flow billing equipment are coupled to each other. For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front-end bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 910 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0216] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned network behavior analysis method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. Among them, the computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0217] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0218] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0219] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0220] The above reference is according to the flowchart and / or block diagram of the method, device and computer program product of the embodiment of the present application to describe various aspects of the present application.It should be understood that each square block in the flowchart and / or block diagram and the combination of each square block in the flowchart and / or block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the realization of the function / action specified in one or more square blocks of the flowchart and / or block diagram.Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.It can also be understood that each square block in the block diagram and / or flowchart and the combination of square blocks in the block diagram and / or flowchart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0221] The above are only specific implementation methods of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A network behavior analysis method, characterized in that: include: Acquiring original data, wherein the original data includes metadata and operation commands in the network environment; Accurately classify and determine the behavior of the original data to generate first behavior graph data, where the first behavior graph data is used to indicate the association relationship between the entity object and the operation command in the metadata; The first behavior graph data is stored in a graph structured manner to generate second behavior graph data, wherein the data form of the second behavior graph data includes nodes and edges, the nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata; The second behavior graph data is identified to obtain an abnormal behavior analysis result, where the abnormal behavior analysis result is used to indicate whether abnormal behavior exists in the original data.

2. The method according to claim 1, characterized in that The step of accurately classifying and determining the behavior of the original data to generate first behavior graph data includes: Decomposing metadata and operation commands in the original data to obtain a plurality of entity objects and target operation commands between the plurality of entity objects; generating the first behavior graph data according to the plurality of entity objects and target operation commands between the plurality of entity objects; The storing the first behavior graph data in a graph structured manner to generate the second behavior graph data includes: Decomposing the plurality of entity objects and target operation commands between the plurality of entity objects to obtain a node attribute table and an edge attribute table, wherein the node attribute table includes each entity object and an attribute corresponding to each entity object, and the edge attribute table includes entity objects connected by each edge and an attribute of each edge, wherein the attribute of the edge is used to indicate an attribute of the target operation command; The node attribute table and the edge attribute table are stored to generate the second behavior as graph data.

3. The method according to claim 1, characterized in that: The identifying the second behavior graph data to obtain an abnormal behavior analysis result includes: By using a graph traversal method and an artificial subgraph, the second behavior graph data is identified and analyzed to obtain known abnormal behavior information, wherein the artificial subgraph is graph data constructed based on the known abnormal behavior; By using the graph embedding method and the artificial subgraph, the second behavior graph data is identified and analyzed to obtain unknown abnormal behavior information; The abnormal behavior analysis result is generated according to the known abnormal behavior information and the location abnormal behavior information.

4. The method according to claim 3, characterized in that: The method of identifying and analyzing the second behavior graph data by using a graph traversal method and an artificial subgraph to obtain known abnormal behavior information includes: By using the graph traversal method, comparative analysis is performed on the data of nodes and edges in the artificial subgraph and the second behavior graph data to obtain the connection depth between each of the nodes; The connection depth is matched with a depth threshold to determine the known abnormal behavior information.

5. The method according to claim 4, characterized in that The step of identifying and analyzing the second behavior graph data by using the graph embedding method and the artificial subgraph to obtain unknown abnormal behavior information includes: By using the graph embedding method, a subgraph similarity between the artificial subgraph and the second behavior graph data is calculated; The subgraph similarity is matched with a similarity threshold to determine the unknown abnormal behavior information.

6. The method according to claim 3, characterized in that Before the second behavior graph data is identified and analyzed by the graph traversal method and the artificial subgraph to obtain the known abnormal behavior information, the method further includes: The behavior rules in the graph data of known normal behaviors and the graph data of known abnormal behaviors are analyzed to construct the artificial subgraph.

7. The method according to any one of claims 1 to 6, characterized in that: After the second behavior graph data is identified to obtain an abnormal behavior analysis result, wherein the abnormal behavior analysis result is used to indicate whether there is an abnormal behavior in the original data, the method further includes: Reviewing the abnormal behavior analysis result to obtain an abnormal event review result, wherein the abnormal event review result is used to indicate whether there is a real threat in the original data; When the abnormal event review result indicates that there is a real threat in the original data, an alarm message and abnormal behavior analysis result are sent to security personnel.

8. A network behavior analysis device, characterized in that: The device comprises: An original data acquisition module, used to acquire original data, wherein the original data includes metadata and operation commands in a network environment; A first raw data analysis module, used for accurately classifying and judging the behavior of the raw data, and generating first behavior graph data, wherein the first behavior graph data is used for indicating the association relationship between the entity object and the operation command in the metadata; A second original data analysis module is used to store the first behavior graph data in a graph structured manner to generate second behavior graph data, wherein the data form of the second behavior graph data includes nodes and edges, the nodes are used to indicate entity objects in the metadata, and the edges are used to indicate operation commands between entity objects in the metadata; The abnormal analysis module is used to identify the second behavior graph data to obtain an abnormal behavior analysis result, and the abnormal behavior analysis result is used to indicate whether there is abnormal behavior in the original data.

9. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the network behavior analysis method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the network behavior analysis method according to any one of claims 1 to 7 is implemented.

11. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of an electronic device, the electronic device executes the network behavior analysis method as described in any one of claims 1 to 7.

Images