Linux process abnormal behavior detection method and device, equipment and storage medium

Abstract

The invention discloses a linux process abnormal behavior detection method and device, equipment and a storage medium, and relates to the technical field of process abnormal behavior detection.The linux process abnormal behavior detection method comprises the steps that resource use information of all processes in a system is collected based on a preset collection period; performing behavior portraying on each process in all the processes according to the resource use information to obtain a process behavior portrait; performing anomaly detection on the process behavior portrait based on a process detection model to obtain an isolated value of the process behavior portrait, and when the isolated value is a preset abnormal value, obtaining an abnormal behavior feature according to the isolated value, the process detection model being obtained by an improved isolated forest algorithm, the improved isolated forest algorithm adds calculation and statistics of isolated features; and generating a detection result according to the current process and the abnormal behavior characteristics, outputting the detection result, and detecting whether the host is abnormal from the perspective of the process by analyzing the behavior of the process.

Description

Technical Field

[0001] The present application relates to the technical field of abnormal behavior detection of processes, and in particular to a method, device, equipment and storage medium for detecting abnormal behavior of Linux processes. Background Art

[0002] At present, cybersecurity threats are spreading around the world. Malicious programs from abroad are increasing year by year, and there are more and more special-purpose and more targeted attacks. The number of hosts infected with malicious programs in my country has reached 3 million, a year-on-year increase of 26%. The number of general security vulnerabilities recorded by the National Information Security Vulnerability Sharing Platform has increased significantly by 89% year-on-year, of which more than 86% are related to the host. Therefore, enterprise hosts are extremely vulnerable to attacks by external intruders, resulting in unavailability of service hosts, abuse of resources, or theft of important information. Secondly, there are many Linux versions, including Debian, CentOS, RedHat and other mainstream Linux distributions. Due to the diversity of systems and the diversity of running services, it becomes complicated and difficult for administrators to manually discover and handle anomalies, and manual detection often has lags and omissions.

[0003] As the most commonly used security mechanism in the industry, intrusion detection system (IDS) provides data integrity, confidentiality and system availability protection in the face of different attacks. IDS monitors real-time data in the network or host to detect malicious activities, such as DDoS attacks and port scans. When malicious activities are detected, it will generate an alarm. According to the way of detecting attacks, IDS can be divided into misuse detection and anomaly detection. Misuse detection, also known as misuse detection, defines a feature library of known attack features. If a behavior matching any attack feature in the library is detected in the network traffic or system, an alarm will be issued. The feature library is pre-defined by the administrator and attempts to accurately list and retain all possible abnormal network and system behaviors, while other known and unknown behaviors are considered normal. Anomaly detection, also known as behavior-based detection, is based on the premise that the attack behavior in the network is uncommon and can distinguish all normal behaviors. Anomaly detection technology first needs to establish their normal behavior model based on the normal behavior information of users or systems. If the current behavior is detected to deviate from the baseline model, it is considered to be abnormal.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of this application is to provide a method, device, equipment and storage medium for detecting abnormal behavior of a Linux process, aiming to solve the technical problems in the prior art that either a predefined feature library is required or new attack behaviors cannot be detected, resulting in low efficiency in detecting abnormal behavior of the process.

[0006] To achieve the above purpose, the present application proposes a method for detecting abnormal behavior of a Linux process, and the method for detecting abnormal behavior of a Linux process includes:

[0007] Collect resource usage information of all processes in the system based on a preset collection period;

[0008] Performing a behavior profile on each process in all the processes according to the resource usage information to obtain a process behavior profile;

[0009] Based on the process detection model, anomaly detection is performed on the process behavior portrait to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm. The improved isolation forest algorithm adds calculation and statistics of isolated features.

[0010] Generate a detection result based on the current process and the abnormal behavior characteristics, and output the detection result.

[0011] In one embodiment, the step of collecting resource usage information of all processes in the system based on a preset collection period includes:

[0012] Remotely obtain preset collection cycles;

[0013] Initialize the running time of the current collection cycle and record the running time of the current collection cycle;

[0014] When the running time of the current collection cycle is less than the preset collection cycle, updating the process set and updating the running time of the current collection cycle;

[0015] When the running time of the current collection cycle is not less than the preset collection cycle, the process set is written into a log to obtain resource usage information of all processes.

[0016] In one embodiment, the step of performing a behavior profile on each process in all the processes according to the resource usage information to obtain the process behavior profile comprises:

[0017] Parsing the resource usage information, and determining the maximum value, minimum value, average value and standard deviation of the resource usage indicators in the resource usage information;

[0018] When the standard deviation of the resource usage indicator of the process is less than the first standard deviation, determining the process as a process of stable resource usage;

[0019] When the range of the resource usage indicator of the process is greater than the preset range and the standard deviation is less than the second standard deviation, the process is determined as a resource usage peak class process, and the range is the difference between the maximum value and the minimum value;

[0020] When the standard deviation of the resource usage indicator of the process is greater than a third standard deviation, determining the process as a process of scattered resource usage;

[0021] The process is profiled according to the resource usage stable class process, the resource usage peak class process or the resource usage scattered class process to obtain a process behavior profile.

[0022] In one embodiment, the process detection model is used to perform anomaly detection on the process behavior portrait to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm. The improved isolation forest algorithm adds the steps of calculating and counting isolated features, including:

[0023] Determine a corresponding historical resource usage log according to the process behavior profile, and pre-process the historical resource usage log to obtain a process resource usage data set;

[0024] determining the number of binary trees in the isolation forest and the size of the sample set, and constructing the isolation forest using the data set according to the process resources;

[0025] Obtain the current resource usage log of the process;

[0026] Preprocessing the current resource usage log, and adding the preprocessed resource usage log to the isolation forest to obtain an isolated value, and determining the isolated value as an abnormal value;

[0027] Compare the abnormal value with a first threshold to obtain a first result, and compare the abnormal value with a second threshold to obtain a second result;

[0028] When the number of abnormal points of the first result is greater than the number of abnormal points of the second result, determining that the current process is abnormal;

[0029] When the process is abnormal, an abnormal window is determined, and the proportion of each isolated value is determined to obtain abnormal behavior characteristics.

[0030] In one embodiment, after the step of obtaining the current resource usage log of the process, the method further includes:

[0031] Parsing the current resource usage log of the process to determine the user type of the process;

[0032] When the user type is a common user, determining a valid user type of the process when it is running;

[0033] When the valid user type is a common user, performing the step of preprocessing the current resource usage log, adding the preprocessed resource usage log to the isolation forest, obtaining an isolated value, and determining the isolated value as an abnormal value;

[0034] When the effective user type is a super user, the current process is determined to be a privileged process, and anomaly detection is performed based on a privileged process detection strategy to obtain abnormal behavior characteristics.

[0035] In one embodiment, when the valid user type is a super user, determining the current process as a privileged process, performing anomaly detection based on a privileged process detection strategy, and obtaining the abnormal behavior characteristics comprises:

[0036] When the effective user type is a super user, determining the current process as a privileged process;

[0037] Obtaining system call sequence information of the privileged process when it is running in a normal environment, and using the system call sequence as training data;

[0038] Determine the calling frequency of each system according to the training data;

[0039] Determine a state set of the calling frequency of each of the systems based on a Markov chain;

[0040] Determine an initial probability vector and a state transfer matrix according to the state set;

[0041] Abnormal state detection is performed according to the initial probability vector and the state transfer matrix to obtain abnormal behavior characteristics.

[0042] In one embodiment, the process detection model is used to perform anomaly detection on the process behavior portrait to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm. The improved isolation forest algorithm adds a step of calculating and counting isolated features, and further includes:

[0043] Obtaining a process set according to all processes, and generating a process undirected graph according to the process set;

[0044] Determine the weight of each process, and generate a weighted process undirected graph according to the weight of each process and the process undirected graph;

[0045] determining a universal value for each process in the weighted process undirected graph;

[0046] Compare the common value with a preset common value, and if the common value is greater than the preset common value, add the process corresponding to the common value to the main process whitelist;

[0047] Perform sensitive resource detection on the process whose general value is less than the preset general value to obtain a detection result;

[0048] When the detection result is that sensitive resources are contained, adding the process whose common value is less than the preset common value to the sub-process whitelist;

[0049] When the process does not belong to the main process whitelist or the sub-process whitelist, determining abnormal behavior characteristics of the process;

[0050] Generate a detection result based on the current process and the abnormal behavior characteristics, and output the detection result.

[0051] In addition, to achieve the above purpose, the present application also proposes a detection device for abnormal behavior of a Linux process, and the detection device for abnormal behavior of a Linux process includes:

[0052] A resource acquisition module, used to collect resource usage information of all processes in the system based on a preset collection period;

[0053] A process description module, used for performing a behavior profile on each process in all the processes according to the resource usage information to obtain a process behavior profile;

[0054] A behavior detection module is used to perform anomaly detection on the process behavior portrait based on a process detection model to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm, and the improved isolation forest algorithm adds calculation and statistics of isolated features.

[0055] The result output module is used to generate a detection result according to the current process and the abnormal behavior characteristics, and output the detection result.

[0056] In addition, to achieve the above-mentioned purpose, the present application also proposes a device for detecting abnormal behavior of a Linux process, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the method for detecting abnormal behavior of a Linux process as described above.

[0057] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the method for detecting abnormal behavior of a Linux process as described above are implemented.

[0058] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the method for detecting abnormal behavior of a Linux process as described above are implemented.

[0059] One or more technical solutions proposed in the present application have at least the following technical effects: collecting resource usage information of all processes in the system based on a preset collection period; performing behavior profiling on each of the all processes based on the resource usage information to obtain a process behavior profile; performing anomaly detection on the process behavior profile based on a process detection model to obtain an isolated value of the process behavior portrait, and when the isolated value is a preset abnormal value, obtaining an abnormal behavior feature based on the isolated value, the process detection model is obtained by an improved isolation forest algorithm, and the improved isolation forest algorithm adds calculation and statistics of isolated features; generating a detection result based on the current process and the abnormal behavior feature, and outputting the detection result, and detecting whether an abnormality occurs in the host from the perspective of the process by analyzing the behavior of the process. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0061] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0062] Figure 1 A flowchart of a first embodiment of a method for detecting abnormal behavior of a Linux process according to the present application is provided;

[0063] Figure 2 A resource usage information collection flow chart provided for an embodiment of a method for detecting abnormal behavior of a Linux process in this application;

[0064] Figure 3 A schematic diagram of a process abnormality detection flow for resource usage provided in an embodiment of a method for detecting abnormal behavior of a Linux process in the present application;

[0065] Figure 4 A schematic diagram of a privileged process detection flow for an embodiment of a method for detecting abnormal behavior of a Linux process according to the present application;

[0066] Figure 5 A schematic flow chart of sensitive resource detection provided in accordance with an embodiment of a method for detecting abnormal behavior of a Linux process in the present application;

[0067] Figure 6 This is a schematic diagram of the module structure of a device for detecting abnormal behavior of a Linux process according to an embodiment of the present application;

[0068] Figure 7 This is a schematic diagram of the device structure of the hardware operating environment involved in the method for detecting abnormal behavior of a Linux process in an embodiment of the present application.

[0069] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0070] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0071] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0072] The main solution of the embodiment of the present application is: collecting resource usage information of all processes in the system based on a preset collection period;

[0073] Performing a behavior profile on each process in all the processes according to the resource usage information to obtain a process behavior profile;

[0074] Based on the process detection model, anomaly detection is performed on the process behavior portrait to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm. The improved isolation forest algorithm adds calculation and statistics of isolated features.

[0075] Generate a detection result based on the current process and the abnormal behavior characteristics, and output the detection result.

[0076] In this embodiment, for ease of description, the following description is made by taking a detection device for identifying abnormal behavior of a Linux process as the execution subject.

[0077] As the most commonly used security mechanism in the industry, the intrusion detection system (IDS) in the existing technology provides data integrity, confidentiality and system availability protection in the face of different attacks. IDS monitors real-time data in the network or host to detect malicious activities, such as DDoS attacks and port scans. When malicious activities are detected, it will generate an alarm. According to the way of detecting attacks, IDS can be divided into misuse detection and anomaly detection. Misuse detection is also called misuse detection. This method defines a feature library of known attack features. If a behavior matching any attack feature in the library is detected in the network traffic or system, an alarm will be issued. The feature library is pre-defined by the administrator, trying to accurately list and retain all possible abnormal network and system behaviors, while other known and unknown behaviors are considered normal. Anomaly detection is also called behavior-based detection. The premise of this technology is that the attack behavior in the network is uncommon and can distinguish all normal behaviors. Anomaly detection technology first needs to establish their normal behavior model based on the normal behavior information of users or systems. If the current behavior is detected to deviate from the baseline model, it is considered that an abnormality has occurred. However, this method has two disadvantages: first, it cannot detect new attack behaviors; second, it requires administrators to continuously maintain the feature library in a timely manner.

[0078] This application provides a solution that first needs to detect unknown abnormal behaviors from the host, and then further detect specific threat events based on the detected abnormal behaviors, thereby ensuring the security, reliability and availability of the host. Due to the diversity and unpredictability of abnormalities in the host, developers can detect abnormalities by identifying process behaviors.

[0079] It can be seen from the above embodiments that the present application collects resource usage information of all processes in the system based on a preset collection period; performs behavior profiling on each of the all processes based on the resource usage information to obtain a process behavior profile; performs anomaly detection on the process behavior profile based on a process detection model to obtain an isolated value of the process behavior portrait, and when the isolated value is a preset abnormal value, obtains an abnormal behavior feature based on the isolated value, the process detection model is obtained by an improved isolation forest algorithm, and the improved isolation forest algorithm adds the calculation and statistics of isolated features; generates a detection result based on the current process and the abnormal behavior feature, and outputs the detection result, and detects whether an abnormality occurs in the host from the perspective of the process by analyzing the behavior of the process.

[0080] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a detection device for abnormal behavior of a Linux process, etc. The following takes the detection device for abnormal behavior of a Linux process as an example to illustrate this embodiment and the following embodiments.

[0081] Based on this, the embodiment of the present application provides a method for detecting abnormal behavior of a Linux process, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the method for detecting abnormal behavior of a Linux process in the present application.

[0082] In this embodiment, the method for detecting abnormal behavior of a Linux process includes steps S10 to S40:

[0083] Step S10: collecting resource usage information of all processes in the system based on a preset collection period.

[0084] It should be noted that the resource usage information of the process is the data source for anomaly detection based on the process, so collecting process behavior information is the basis for anomaly detection. The system refers to the Linux system, and the preset collection cycle refers to the set collection cycle, which is used to describe the frequency of collecting resource usage information of all processes in the system.

[0085] In the specific implementation, the behavior information generated when the process is running is the data source for anomaly detection based on the process, so collecting process behavior information is the basis for anomaly detection. Generally speaking, most processes will not actively write logs during normal operation, because this will generate a lot of meaningless debugging information. Only when the process runs abnormally or errors, will the abnormal or error information be actively written to the system log. Therefore, by using the Linux system log, it is possible to detect whether the process has an abnormality during operation and the cause of the abnormality.

[0086] The Linux system log does not record the use of host resources by the process during operation. When a process is abnormal during operation, it is often reflected in its use of host resources. For example, after the apache process is attacked by DDoS, its CPU usage rate will increase abnormally and generate a large amount of network connection information. Malicious programs such as mining software will also occupy a large amount of host computing resources when running in the host. Therefore, the use of host resources by the process during operation can be used to detect whether the process is abnormal. There are many tools in Linux that can view the running information of the process, among which the most commonly used are ps, top and netstat commands. By using the tools provided by Linux, you can easily view the process start time, user, process ID, parent process ID, process status, process CPU usage, process memory usage, process network connection and other information. Although the Linux system log does not record the resource usage information of the process, the Linux kernel provides a pseudo file system " / proc". The process runs in memory, and all the data in the memory is written to the " / proc" directory. Therefore, users and programs can obtain the resource usage information of the system and process during operation through " / proc". However, there are many files in the " / proc / " directory and the format is relatively complex. The directory that records each process information changes frequently, and the content in some files is unreadable. In order to solve these problems, the present embodiment can use the psutil library in Python to collect the resource usage information of the process. Psutil is an open source, cross-platform Python library that implements the functions of various command line tools in Linux, such as ps, top, iotop, lsof, netstat, ifconfig, free, etc. Using psutil, it is possible to obtain a variety of host resource usage information of the process, such as CPU usage, memory usage, network connection information, etc. Therefore, by using the psutil library to write a Python script, the need to obtain the host resource usage information of the process can be easily realized, and the resource usage information of all processes in the system can be collected based on a preset collection period.

[0087] In a feasible implementation manner, the step of collecting resource usage information of all processes in the system based on a preset collection period includes:

[0088] Remotely obtain preset collection cycles;

[0089] Initialize the running time of the current collection cycle and record the running time of the current collection cycle;

[0090] When the running time of the current collection cycle is less than the preset collection cycle, updating the process set and updating the running time of the current collection cycle;

[0091] When the running time of the current collection cycle is not less than the preset collection cycle, the process set is written into a log to obtain resource usage information of all processes.

[0092] It should be noted that the running time of the current collection cycle is used to describe the time of the current collection cycle and to describe whether the current collection cycle is completed.

[0093] In the specific implementation, since the use of host resources by processes is dynamically changing, such as CPU usage and memory usage, which may change all the time, but since there are many processes in the host, constantly collecting resource usage information of all processes in the host will not only take up a lot of disk space, but also seriously affect the performance of the host, which is obviously unreasonable. The collection script used in the present invention sets a collection time to periodically record the resource usage information of all processes in the host. The collection cycle size can also be dynamically adjusted as needed. The specific process is as follows: Figure 2 As shown, Figure 2 The resource usage information collection flow chart. cycle_time indicates the size of a collection cycle, which can be adjusted dynamically. current_cycle_time indicates how long the current cycle has been running. The process set P records the host resource usage information of all processes. The update process of process set P is: add the processes that are not in set P at the current moment to set P. This ensures that even when the collection cycle is relatively long, the resource usage information of processes with shorter running time can be recorded in the log. Resource usage information is divided into two types: numerical and text. Some numerical information is cumulative, such as CPU usage time in user mode, disk read and write bytes, etc. Since cumulative data cannot directly reflect the resource usage of the process at the current moment, and text data cannot be directly used for outlier detection algorithms, it is necessary to preprocess the collected process resource usage logs.

[0094] The calculation formula for process CPU usage is:

[0095]

[0096] Where cpu_use_time t2 Indicates the total CPU usage time of the process at time t2, including in the user and kernel models, cpu_total_time t2 Indicates the total CPU usage time of the system at time t2, also including user and kernel modes, and cores is the number of cores of the host CPU. The CPU usage of a process is calculated by the CPU usage time of the process in user mode and kernel mode, so the present invention only uses CPU usage to represent the use of host computing resources by the process.

[0097] The process memory usage calculation formula is:

[0098]

[0099] Where memUsed represents the process physical memory usage, memTotal represents the host memory size. The process memory usage is calculated from the process physical memory usage, so the present invention only uses the memory usage to represent the process's use of host memory resources.

[0100] The calculation formula for process disk read and write speed is:

[0101]

[0102] In the above formula, disk_read represents the total number of bytes read by the process, t1 and t2 represent time in seconds, and divided by 1024 represents the disk read speed in kb / s. The disk write speed calculation formula is similar to the disk read speed calculation formula, so it is not repeated here. The disk read and write speed is calculated from the number of bytes read and written by the process, so the present invention uses the process disk read and write speed to represent the process's use of the host disk resources.

[0103] For text-based resource usage information, directly convert them into the size of their respective sets. For example, use the number of network connections to represent the current network resource usage of the process, and use the number of open files to represent the file resource usage of the process.

[0104] Based on the above analysis, the present invention uses the resource usage indicators in Table 1 to describe the current usage of host resources by the process, and uses these resource usage indicators to detect in real time whether the process is running abnormally.

[0105] Table 1:

[0106] index type CPU usage float Memory usage float Disk read speed float Disk write speed float Number of network connections int Number of open files int Number of threads used int

[0107] Step S20, performing a behavior profile on each process in all the processes according to the resource usage information to obtain a process behavior profile.

[0108] It should be noted that the process behavior profile is used to describe the behavioral characteristics of the process and is measured based on the resource usage indicators of the resources used by each process.

[0109] In the specific implementation, the process resource usage information collection script periodically collects the process's use of host resources. Therefore, a process's use of host resources will be continuously collected during operation. After preprocessing the process resource usage log, the resource usage data set of the process is obtained. The maximum value, minimum value, average value, standard deviation, and probability distribution of resource usage index values ​​can be used to describe the resource usage indicators in the above table according to the obtained process resource usage data set, and the resource usage behavior of all processes in the host can be profiled to obtain process behavior portraits such as stable resource usage, peak resource usage, or scattered resource usage.

[0110] In a feasible implementation manner, the step of performing a behavior profile on each process in all the processes according to the resource usage information to obtain the process behavior profile includes:

[0111] Parsing the resource usage information, and determining the maximum value, minimum value, average value and standard deviation of the resource usage indicators in the resource usage information;

[0112] When the standard deviation of the resource usage indicator of the process is less than the first standard deviation, determining the process as a process of stable resource usage;

[0113] When the range of the resource usage indicator of the process is greater than the preset range and the standard deviation is less than the second standard deviation, the process is determined as a resource usage peak class process, and the range is the difference between the maximum value and the minimum value;

[0114] When the standard deviation of the resource usage indicator of the process is greater than a third standard deviation, determining the process as a process of scattered resource usage;

[0115] The process is profiled according to the resource usage stable class process, the resource usage peak class process or the resource usage scattered class process to obtain a process behavior profile.

[0116] It should be noted that the maximum and minimum values ​​in the resource usage indicator determine the value space of the resource usage indicator, and the average value determines where the value of the resource usage indicator fluctuates. The standard deviation determines the dispersion of the resource usage indicator value. The larger the standard deviation, the more discrete the value of the resource usage indicator and the greater the fluctuation. The probability distribution of the resource usage indicator value is the probability of each resource usage indicator value.

[0117] It should be noted that the first standard deviation is the standard deviation used to determine the behavior portrait of processes with stable resource usage, the preset range is the difference between the preset maximum and minimum values, the second standard deviation is the standard deviation used to determine the behavior portrait of processes with peak resource usage, and the third standard deviation is the standard deviation used to determine the behavior portrait of processes with scattered resource usage.

[0118] In the specific implementation, taking a host A as an example, the resource usage data set generated by all processes running on the host for one week is collected to profile all processes in the host. Assume that the host is used by multiple users, multiple processes are running in the host, and there are n types of processes running in the host in a week. The resource usage behaviors of all processes in the host are divided into three categories: stable resource usage, peak resource usage, and scattered resource usage.

[0119] Most processes in the host belong to the category of stable resource usage. They use various host resources very stably, and the standard deviation of all resource usage indicators is less than 1. These processes are mostly system kernel processes, daemon processes with low resource usage requirements, and processes generated by some commonly used command line tools.

[0120] Some processes in the host belong to the resource usage peak category. Their characteristics are that some resource usage indicators are stable in most cases, but suddenly increase at a few moments. The characteristics of these resource indicators are reflected in the measurement that the maximum and minimum values ​​are far apart, the average value is close to the minimum value, and the standard deviation is small. Such processes are generally long-term processes. In most cases, the processes have no tasks or the tasks are relatively fixed, but at some point the tasks will suddenly increase.

[0121] A small number of processes in the host belong to the category of scattered resource usage. Their characteristics are that the standard deviation of some resource usage indicators is relatively large, the average value is between the minimum and maximum values, and the indicator value distribution is relatively scattered. Most of these processes are short-term processes with a short running time. They are mainly generated by users running programs written by themselves or downloaded third-party applications in the host.

[0122] Step S30, performing anomaly detection on the process behavior portrait based on the process detection model to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, the abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm, and the improved isolation forest algorithm adds calculation and statistics of isolated features.

[0123] It should be noted that the process detection model is obtained by an improved isolation forest algorithm, and the improved isolation forest algorithm adds calculation and statistics of isolated features.

[0124] In the specific implementation, the iForest isolation forest algorithm can well detect abnormal data in multidimensional data and calculate an abnormal score for each data point, but iForest cannot determine which abnormal features of the abnormal data cause the data to be detected as abnormal. Assume the following two scenarios, one is that the abnormal increase in the CPU usage of the process causes the process to be abnormal, and the other is that the abnormal increase in the memory usage of the process causes the process to be abnormal. iForest can only determine that an abnormality occurs when the process is running, but cannot distinguish which resource usage abnormality causes the process to be judged as abnormal. Based on this, this embodiment proposes a processing method for locating abnormal features.

[0125] Assume that iTree is a binary tree, and divide the data by randomly selecting features and feature values. When feature q is selected to branch iTree, data point x is divided into a leaf node, and feature q is called the isolated feature of data point x. Because data point x is isolated by feature q during division, and the earlier it is divided into an isolated point, the greater the possibility that the feature causes the data to be abnormal. Based on this idea, the specific steps of the improved algorithm proposed by the present invention are as follows:

[0126] 1) Set an isolated feature array for each data in the data set, such as F = (F1, F2, ..., Ft), where Fi represents the isolated value of the i-th feature and t is the number of features of the data in the data set.

[0127] 2) After building the isolation forest, initialize the isolated feature array of each data and set the isolated values ​​of the features to 0.

[0128] 3) When calculating the path length of a data point in each iTree, the data point traverses downward according to the characteristics and characteristic values ​​of the branch nodes, and stops when the traversal reaches the leaf node. Assuming that the characteristic that causes the leaf node to be generated is q, the item corresponding to the q characteristic in F is added with a value, and the increased value is 1 / (L.size*e). Where L.size is the number of data divided out on the leaf node, and e is the path length from the root node to the leaf node.

[0129] 4) According to step 3, when calculating the average path length of a data point in iForest, traverse each iTree and finally statistically calculate the isolated value of each isolated feature of the data point.

[0130] Based on the above steps, compared with the classic isolation forest algorithm, the improved algorithm has the function of statistically calculating the isolated values ​​of isolated features of data points. Since the improved algorithm proposed in the present invention does not modify the original isolation forest algorithm, it only adds the calculation and statistics of isolated features on the basis of the original algorithm, so it will not have any impact on the original algorithm. And since in actual applications only the isolated values ​​of the isolated features of the data to be detected are calculated, the memory burden of the algorithm will not be increased. The improved iForest algorithm can quickly locate the abnormal resource usage indicators when abnormal process resource usage is detected, helping administrators analyze the causes of process abnormalities.

[0131] In a feasible implementation manner, the process detection model is based on which anomaly detection is performed on the process behavior portrait to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm. The improved isolation forest algorithm adds the steps of calculating and counting isolated features, including:

[0132] Determine a corresponding historical resource usage log according to the process behavior profile, and pre-process the historical resource usage log to obtain a process resource usage data set;

[0133] determining the number of binary trees in the isolation forest and the size of the sample set, and constructing the isolation forest using the data set according to the process resources;

[0134] Obtain the current resource usage log of the process;

[0135] Preprocessing the current resource usage log, and adding the preprocessed resource usage log to the isolation forest to obtain an isolated value, and determining the isolated value as an abnormal value;

[0136] Compare the abnormal value with a first threshold to obtain a first result, and compare the abnormal value with a second threshold to obtain a second result;

[0137] When the number of abnormal points of the first result is greater than the number of abnormal points of the second result, determining that the current process is abnormal;

[0138] When the process is abnormal, an abnormal window is determined, and the proportion of each isolated value is determined to obtain abnormal behavior characteristics.

[0139] It should be noted that the first threshold and the second threshold are parameter values ​​used to judge the outliers in the isolation forest and are used to measure the current anomaly detection result. The first result is the result of comparing the outlier with the first threshold, and the second result is the result of comparing the outlier with the second threshold.

[0140] In the specific implementation, the improved isolation forest algorithm is used, and the process anomaly detection based on resource usage is mainly divided into the following steps: Figure 3 As shown, Figure 3 Schematic diagram of the process anomaly detection process for resource usage:

[0141] 1) Obtain the process historical resource usage log from the log information platform, preprocess the log, and obtain the process resource usage dataset T.

[0142] 2) Set the number of iTrees in the isolation forest, t, and the size of the sample set, n, and use the data set T to construct the isolation forest.

[0143] 3) Obtain the host resource usage log of the process at the current moment, put the information into the constructed isolation forest after preprocessing, and calculate the outlier value of the data point.

[0144] 4) Determine whether the current process is abnormal by setting two thresholds μ1 and μ2. μ1 is used to determine whether the resource usage of the process is abnormal at the current moment, and μ2 is used to determine whether the resource usage of the process is abnormal within a time window. When the proportion of abnormal points with abnormal values ​​greater than μ1 within a time window T exceeds μ2, the process is judged to be abnormal.

[0145] 5) By using the improved isolation forest algorithm, when a process anomaly is detected, the ratio of each isolated eigenvalue of all abnormal data points in the abnormal window is calculated to find the resource usage indicator that causes the process anomaly.

[0146] The system call is the smallest functional unit in the operating system and can directly reflect the behavior of the process. However, although the Linux log system has a powerful logging function and can record the operation information of the system and applications on the host as well as various security and authentication event information, the log system belongs to the user state, while the system call of the process belongs to the kernel state, so the system call information of the process cannot be recorded through the log system.

[0147] System calls divide the Linux operating system into user state and kernel state, also known as user space and kernel space. The kernel is essentially a software that can control computer hardware resources and provide a safe and stable operating environment for processes. User space is the space provided for process operation. In order for processes in user space to access hardware resources managed by the kernel, the kernel must provide a set of common interfaces for processes to use, and these interfaces are system calls. Using system calls to separate user programs from the kernel not only protects the security of the kernel, but also makes it easier for developers to use the services provided by the kernel.

[0148] Linux audit is a log subsystem that can collect various events that occur on the system. The collection scope includes but is not limited to process system call information, file access information, and user execution commands. A large amount of system call information will be generated during the operation of the process. If the system call information used by all processes in the host is recorded, it will not only consume a large amount of computing resources and storage resources of the host, but also bring a huge load to the host. It will also cause other applications in the host to be unavailable or run incorrectly. In general, attackers often use vulnerabilities in applications that set the setuid or setgid bit to perform privilege escalation operations, allowing the intruder code to run in the context of the privileged process, thereby undermining the security of the host. Therefore, this embodiment only records the system call information generated when the privileged process is running, which can greatly reduce the amount of recorded information while improving the detection targeting.

[0149] In a feasible implementation manner, after the step of obtaining the current resource usage log of the process, the step further includes:

[0150] Parsing the current resource usage log of the process to determine the user type of the process;

[0151] When the user type is a common user, determining a valid user type of the process when it is running;

[0152] When the valid user type is a common user, performing the step of preprocessing the current resource usage log, adding the preprocessed resource usage log to the isolation forest, obtaining an isolated value, and determining the isolated value as an abnormal value;

[0153] When the effective user type is a super user, the current process is determined to be a privileged process, and anomaly detection is performed based on a privileged process detection strategy to obtain abnormal behavior characteristics.

[0154] It should be noted that user types include ordinary users and super users, which can be determined by the assignment of uid and suid.

[0155] In the specific implementation, the audit rules are empty by default, and no events are audited. Therefore, it is necessary to set rules in audit.rules to clarify which events are audited. Privileged processes are processes generated when applications that set setuid or setgid are running. These processes have a characteristic that the user running the process is a common user, i.e., uid! = 0, but the effective user running the process is a super user, i.e., suid = 0. Based on this, the present invention sets two rules in Table 2 to record the system call information of all privileged processes when they are running.

[0156] Table 2 audit rules:

[0157]

[0158] Based on the above rules, audit can record the system call information generated by all privileged processes in the form of logs in the audit log. Each log in the audit log contains multiple fields, including log type, timestamp, system call number, whether the system call is successful, etc. By parsing the audit log, the system call sequence generated by the privileged process each time it runs can be obtained.

[0159] In a feasible implementation manner, when the valid user type is a super user, determining the current process as a privileged process, performing anomaly detection based on a privileged process detection strategy, and obtaining the abnormal behavior characteristics comprises:

[0160] When the effective user type is a super user, determining the current process as a privileged process;

[0161] Obtaining system call sequence information of the privileged process when it is running in a normal environment, and using the system call sequence as training data;

[0162] Determine the calling frequency of each system according to the training data;

[0163] Determine a state set of the calling frequency of each of the systems based on a Markov chain;

[0164] Determine an initial probability vector and a state transfer matrix according to the state set;

[0165] Abnormal state detection is performed according to the initial probability vector and the state transfer matrix to obtain abnormal behavior characteristics.

[0166] In the specific implementation, a first-order homogeneous Markov chain model is used to profile the system call behavior of the privileged process, and a normal behavior model of the privileged process is established. The obtained profile model is used to use the latest system call information to detect whether the privileged process is running abnormally.

[0167] The profiling process uses the system call sequence generated by the privileged process in the normal environment as training data to calculate the initial state probability vector of the Markov chain model. And the state transfer matrix A. The specific steps are as follows:

[0168] 1) Get training data

[0169] The system call sequence information generated by the privileged process when running in a normal environment is obtained as training data. Assume that the normal behavior data of the privileged process contains M sequences, denoted as T = (R1, R 2, ...RM ), where the i-th sequence is r(i) represents the number of system calls in the ith sequence. This paper defines r = r(1) + r(2) + ... + r(M), where r is the total number of system calls in normal training data.

[0170] 2) Count the frequency of each system call in the training data

[0171] Assume that there are N different system calls in normal training data, recorded as And suppose the jth system call The probability of appearing in the training data is p i , and its calculation formula is:

[0172] P i =C j / r(1≤j≤N)

[0173] Among them, C j for The number of times it appears in the training data.

[0174] 3) Markov chain model state determination

[0175] Set a frequency threshold μ, The system calls with a frequency greater than or equal to the threshold μ are extracted. Assume that there are W (W≤N) system calls with a frequency greater than or equal to μ, recorded as Their frequencies are denoted as P1′, P2′, ..., P W ′, where P k ′ is S k ′ is the frequency of occurrence in the training data T. Finally, the number of states in the Markov chain model is determined to be W+1, and the state set is O={S1′, S2′, ..., S′ W , S′ W+1},S′ W+1 It is an additional state, recorded as "others", and its frequency calculation formula is as follows:

[0176]

[0177] 4) Calculation of Markov chain model parameters

[0178] The initial probability vector of the Markov chain Π=(π1,π2,...,π W+1 ) is used to describe the probability of each state corresponding to each system call appearing in the training data when the privileged process is running normally. The state transition matrix A = (a ij ) (W+1)×(W+1)It is used to describe the temporal correlation between the states corresponding to each system call. The probability of each state in Π is equal to the frequency of each state obtained in the previous step, that is, π i =P i '. State transition a ij The calculation formula is as follows:

[0179] a ij =Z ij / Y i

[0180] Where Z ij is the state sequence (s i ′,s j ′) appears in the training data T, Y i For state s i ’The total number of transitions to each state.

[0181] Based on the above four steps, a profile of the system call behavior of a privileged process is completed. The profile result is the state set and initial probability vector in the first-order homogeneous Markov chain model. And the state transfer matrix A.

[0182] By using the first-order homogeneous Markov chain model, the privileged process is detected to see if it is abnormal based on the system call sequence generated when the privileged process is currently running. The specific steps of the detection phase are shown in 4. Figure 4 Schematic diagram of the privileged process detection process:

[0183] 1) Get the system call sequence generated when the privileged process is running

[0184] The system call sequence generated by the privileged process when it is running is obtained from the log information platform as anomaly detection data. Assume that the sequence is R = (s1, s2, ..., s r ,), where s i , represents the i-th system call in the system call sequence, and r is the length of the system call sequence.

[0185] 2) Get the status sequence

[0186] Using the state set obtained previously and the matching method between system calls and states, the system call sequence is converted into the corresponding state sequence Q = (q1, q2, ..., q r ). where q i Corresponding to the i-th system call s in the system call sequence R i , if s i In the set Ω, then q i =s′1, if not, then q i =s′ W+1 .

[0187] 3) Use a sliding window to truncate the state sequence into short sequences

[0188] Use a sliding window with a length of w and a step size of 1 to convert the state sequence Q = (q1, q2, ..., q r ) is cut into r-w+1 short sequences. The short sequence obtained in the i-th window is S qi =(q i ,q i+1 ,…,q i+w-1 ), where w <r,1≤i≤r-w+1。

[0189] 4) Calculate the probability of each short sequence based on the parameters Π and A of the Markov chain model obtained previously. The calculation formula is as follows:

[0190] P(S qi )=P(q i )×P(q i+1 |q i )×…×P(q i+w-1 |q i+w-2 )

[0191] Where P(q i ) represents the state q i The probability of appearing in the training data, P(q i+1 |q i ) represents the state q i To state q i+1 The probability of transfer. Let q i =m,q i+1 =n, then P(q i )=π m , P(q i+1 |q i )=a mn , where i≤m,n≤W+1. According to the formula, calculate the probability values ​​of all short sequences.

[0192] 5) Abnormal judgment

[0193] Use two thresholds λ1 and λ2 to determine whether a system call sequence is abnormal. The sum of λ1 is obtained based on the training data, which is the probability value of the smallest short sequence obtained according to the above four steps in the M system call sequences in the training data T. Assume that a system call sequence is truncated into L short sequences, of which C short sequences have values ​​less than the sum of λ1. If C / L>λ2, the system call sequence is judged to be abnormal, and the corresponding privileged process is running abnormally.

[0194] In a feasible implementation manner, the process detection model is used to perform anomaly detection on the process behavior portrait to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm. The improved isolation forest algorithm adds a step of calculating and counting isolated features, and further includes:

[0195] Obtaining a process set according to all processes, and generating a process undirected graph according to the process set;

[0196] Determine the weight of each process, and generate a weighted process undirected graph according to the weight of each process and the process undirected graph;

[0197] determining a universal value for each process in the weighted process undirected graph;

[0198] Compare the common value with a preset common value, and if the common value is greater than the preset common value, add the process corresponding to the common value to the main process whitelist;

[0199] Perform sensitive resource detection on the process whose general value is less than the preset general value to obtain a detection result;

[0200] When the detection result is that sensitive resources are contained, adding the process whose common value is less than the preset common value to the sub-process whitelist;

[0201] When the process does not belong to the main process whitelist or the sub-process whitelist, determining abnormal behavior characteristics of the process;

[0202] Generate a detection result based on the current process and the abnormal behavior characteristics, and output the detection result.

[0203] In the specific implementation, refer to Figure 5 , Figure 5 The following is a flowchart for sensitive resource detection. By using the system call information of the privileged process and the resource usage information of the process to establish a normal behavior model of the process, it can be used to detect abnormalities in the process in the host, and by using the system log, it can be used to analyze the cause of the process abnormality. However, the above method cannot detect unfamiliar malicious processes in the host. Therefore, it is necessary to first establish a process whitelist, detect unfamiliar malicious processes in the host by using the whitelist, and establish a normal behavior model for the legitimate processes in the whitelist to detect whether the process is abnormal during operation.

[0204] This embodiment assumes that there is a server cluster, and different services are running on each host, which are used by different users, but many processes are very common in each host. For example, the daemon processes cron, rsyslogd, atd, etc. generated by the default installed services in the Linux system, the processes mysql, apache, python, etc. generated by commonly used third-party applications, and the processes ps, cd, vim, etc. generated by common commands. The existence of these processes in the host is very common, and they are all safe and legal. Based on this, the present invention proposes a process whitelist creation algorithm, which establishes a network topology diagram of the process according to the distribution of the process on the server cluster host, and establishes a process whitelist according to the "universality" of the process in the server cluster host.

[0205] The process whitelist creation algorithm proposed in this embodiment is mainly divided into the following five steps, and the specific information is as follows:

[0206] 1) Build an undirected graph of processes

[0207] First, as many processes as possible are collected from the server cluster hosts, and then a process set is constructed from all the collected processes. Finally, each process in the set is used as a vertex in an undirected graph. For example, a process Pi in the process set corresponds to a vertex i in the undirected graph. The present invention stipulates that when process p i and process p j When vertices i and j appear in the same host at the same time, there is an edge e(i,j) in the undirected graph.

[0208] 2) Construct a weighted process undirected graph

[0209] When two processes co-exist on one host, it means something different than when they co-exist on multiple hosts. The more hosts two processes co-exist on, the more common they are, but in an undirected graph of processes like the one above, their commonness cannot be distinguished.

[0210] Based on the above analysis, the present invention makes some improvements to the unweighted process undirected graph by adding weight attributes to each connecting edge. i and p j Running on n ij In the host, the weight of the connecting edge between the vertices corresponding to the two processes is w ij , n ij The larger the value of w ij The specific calculation formula is shown below.

[0211]

[0212] where u i and u jRespectively represent the process p i and p j The host set where γ is located, the number of all hosts, |u i ∩u j | indicates process p i and p j The number of hosts on the same host. In order to ensure that the weight of each edge is within a reasonable range, the present invention uses the normalization formula The weight of each edge is normalized.

[0213] 3) Calculate the degree of each process vertex

[0214] After the above steps, a weighted undirected graph representing the universality of the process is obtained. The more edges the process corresponds to, the greater the weight of the edge, and the more universality the process can be reflected. Therefore, the present invention quantifies the universality of the process as the degree value of the vertex corresponding to the process.

[0215] Assume that process p i In the graph, the corresponding vertex i has a total of m edges, denoted as {e(i,1),e(i,2),…,e(i,m)}, and the weights of these edges are {w i1 ,w i2 ,…,w im}, then the degree value of vertex i is calculated as shown in the following formula. After statistical calculation using the above method, each process will obtain a universal degree value.

[0216]

[0217] 4) Main process whitelist creation

[0218] By executing the above algorithm on all processes in all hosts in the server cluster, the prevalence value of each process is calculated. The present invention sets a threshold μ and adds all processes with a prevalence value greater than μ to the main process whitelist. There is only one main process whitelist, which is applicable to all hosts in the server cluster.

[0219] 5) Subprocess whitelist creation

[0220] After adding all processes with a prevalence value greater than μ to the main process whitelist, there are still some processes with a prevalence value lower than μ. For those processes with a prevalence value lower than μ, they are tested for sensitive resources. The test content is as follows:

[0221] Whether to communicate externally: If the process communicates externally, it will not be passed.

[0222] Whether sensitive files are accessed: for example, files in the / etc / passwd, / etc / rc.local, and / var / log directories.

[0223] CPU and memory usage are too high: If the average CPU and memory usage exceeds 50%, it will fail.

[0224] Is the disk read and write speed too fast? If the average disk read and write speed exceeds 100k / s, the test will fail.

[0225] If they pass the sensitive resource detection, they will be added to the sub-process whitelist of the host. If they fail the sensitive resource detection, manual judgment is required. If they pass the manual judgment, they will be added to the corresponding sub-process whitelist, otherwise they are abnormal processes and need to be handled in time. Each host maintains a sub-process whitelist, and each sub-process whitelist is only for the processes in the host it corresponds to.

[0226] By using the above process whitelist creation algorithm, the present invention can obtain two types of process whitelists, namely, the main process whitelist, which has only one copy and is applicable to all hosts; and the sub-process whitelist, which is maintained for each host and is only applicable to the corresponding host. By using the process whitelist, unfamiliar abnormal processes in the host can be discovered in a timely manner.

[0227] When some new processes are added to the host, those processes with less prevalence may also be widely present in various hosts of the server cluster. Therefore, in order to ensure the timeliness and correctness of the process whitelist, it is necessary to implement a process whitelist update method to update the process whitelist. The whitelist update algorithm proposed in this embodiment is divided into the following steps:

[0228] (1) When a new unfamiliar process appears in the host, it is first tested for sensitive resources. If it passes, it goes to step 3; if it fails, it goes to step 2.

[0229] (2) An alarm is sounded, and then a manual judgment is made. If the manual judgment is normal, go to step 3. Otherwise, the process is an abnormal process and is killed in time using the kill command.

[0230] (3) Check whether there is a vertex corresponding to the process in the process graph. If so, update the process graph, recalculate the popularity value of each process, and add each process to the corresponding whitelist according to the process whitelist creation method mentioned above. If not, add a node corresponding to the process in the process graph and add the new process to the sub-process whitelist corresponding to the host.

[0231] Step S40, generating a detection result according to the current process and the abnormal behavior characteristics, and outputting the detection result.

[0232] In the specific implementation, a process is a dynamic concept. In Linux, a process is uniquely identified by a process id and a timestamp. Therefore, for an application in a host, a new process will be generated each time it is restarted. If a process is determined in this way, all newly started processes in the host will be identified as unfamiliar processes. Therefore, in order to ensure that the same application can be regarded as a process when started with the same startup parameters, in this embodiment, a process is uniquely identified by the executable file path plus the startup parameters when the application is started. The current process and the abnormal behavior characteristics can be combined to generate a detection result, and the corresponding detection result is output.

[0233] The present embodiment provides a method for detecting abnormal behavior of a Linux process, which collects resource usage information of all processes in a system based on a preset collection period; performs behavior profiling on each of the all processes based on the resource usage information to obtain a process behavior profile; performs abnormality detection on the process behavior profile based on a process detection model to obtain an isolated value of the process behavior profile, and when the isolated value is a preset abnormal value, obtains an abnormal behavior feature based on the isolated value, the process detection model is obtained by an improved isolation forest algorithm, and the improved isolation forest algorithm adds calculation and statistics of isolated features; generates a detection result based on the current process and the abnormal behavior feature, and outputs the detection result, and detects whether an abnormality occurs in the host from the perspective of the process by analyzing the behavior of the process.

[0234] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the detection method of abnormal behavior of Linux processes in the present application. More simple transformations based on this technical concept are all within the protection scope of the present application.

[0235] This application also provides a detection device for abnormal behavior of Linux processes, please refer to Figure 6 , the detection device for abnormal behavior of Linux process includes:

[0236] A resource acquisition module 10, used to collect resource usage information of all processes in the system based on a preset collection period;

[0237] A process description module 20, configured to perform a behavior profile on each of the processes in the process according to the resource usage information to obtain a process behavior profile;

[0238] A behavior detection module 30 is used to perform anomaly detection on the process behavior portrait based on a process detection model to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm, and the improved isolation forest algorithm adds calculation and statistics of isolated features.

[0239] The result output module 40 is used to generate a detection result according to the current process and the abnormal behavior characteristics, and output the detection result.

[0240] The device for detecting abnormal behavior of a Linux process provided by the present application adopts the method for detecting abnormal behavior of a Linux process in the above-mentioned embodiment, which can solve the technical problem that in the prior art, either a predefined feature library is required or new attack behaviors cannot be detected when performing abnormal process detection, resulting in low efficiency of abnormal process detection. Compared with the prior art, the beneficial effects of the device for detecting abnormal behavior of a Linux process provided by the present application are the same as the beneficial effects of the method for detecting abnormal behavior of a Linux process provided by the above-mentioned embodiment, and other technical features of the device for detecting abnormal behavior of a Linux process are the same as the features disclosed in the above-mentioned embodiment method, which will not be described in detail here.

[0241] The present application provides a device for detecting abnormal behavior of a Linux process, and the device for detecting abnormal behavior of a Linux process includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for detecting abnormal behavior of a Linux process in the above-mentioned embodiment 1.

[0242] Reference below Figure 7 , which shows a schematic diagram of the structure of a detection device for abnormal behavior of a linux process suitable for implementing an embodiment of the present application. The detection device for abnormal behavior of a linux process in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The device for detecting abnormal behavior of a Linux process shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0243] like Figure 7As shown, the detection device for abnormal behavior of a Linux process may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. Various programs and data required for the operation of the detection device for abnormal behavior of a Linux process are also stored in RAM1004. The processing device 1001, ROM1002, and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 may allow the detection device for abnormal behavior of a linux process to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a detection device for abnormal behavior of a linux process with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0244] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0245] The device for detecting abnormal behavior of a Linux process provided by the present application adopts the method for detecting abnormal behavior of a Linux process in the above embodiment, which can solve the technical problem that in the prior art, either a predefined feature library is required or new attack behaviors cannot be detected when performing abnormal process detection, resulting in low efficiency of abnormal process detection. Compared with the prior art, the beneficial effects of the device for detecting abnormal behavior of a Linux process provided by the present application are the same as the beneficial effects of the method for detecting abnormal behavior of a Linux process provided by the above embodiment, and other technical features of the device for detecting abnormal behavior of a Linux process are the same as the features disclosed in the method of the previous embodiment, which will not be described in detail here.

[0246] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0247] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0248] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, the computer-readable program instructions being used to execute the method for detecting abnormal behavior of a Linux process in the above-mentioned embodiment.

[0249] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0250] The computer-readable storage medium may be included in the device for detecting abnormal behavior of a Linux process; or may exist independently without being assembled into the device for detecting abnormal behavior of a Linux process.

[0251] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the device for detecting abnormal behavior of a Linux process, the device for detecting abnormal behavior of a Linux process:

[0252] Collect resource usage information of all processes in the system based on a preset collection period;

[0253] Performing a behavior profile on each process in all the processes according to the resource usage information to obtain a process behavior profile;

[0254] Based on the process detection model, anomaly detection is performed on the process behavior portrait to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm. The improved isolation forest algorithm adds calculation and statistics of isolated features.

[0255] Generate a detection result based on the current process and the abnormal behavior characteristics, and output the detection result.

[0256] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0257] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0258] The modules involved in the embodiments of the present application may be implemented by software or hardware, wherein the name of the module does not limit the unit itself in some cases.

[0259] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned method for detecting abnormal behavior of a Linux process, and can solve the technical problem that in the prior art, either a predefined feature library is required or new attack behaviors cannot be detected when performing process abnormality detection, resulting in low efficiency of process abnormal behavior detection. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the method for detecting abnormal behavior of a Linux process provided by the above-mentioned embodiment, and will not be elaborated here.

[0260] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned method for detecting abnormal behavior of a Linux process when executed by a processor.

[0261] The computer program product provided by the present application can solve the technical problem in the prior art that when performing process anomaly detection, either a predefined feature library is required or new attack behaviors cannot be detected, resulting in low efficiency in detecting process anomaly behaviors. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as those of the method for detecting abnormal behavior of a Linux process provided by the above embodiment, and will not be elaborated here.

[0262] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for detecting abnormal behavior of a Linux process, characterized in that: The method for detecting abnormal behavior of a Linux process includes: Collect resource usage information of all processes in the system based on a preset collection period; Performing a behavior profile on each process in all the processes according to the resource usage information to obtain a process behavior profile; Based on the process detection model, anomaly detection is performed on the process behavior portrait to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm. The improved isolation forest algorithm adds calculation and statistics of isolated features. Generate a detection result based on the current process and the abnormal behavior characteristics, and output the detection result.

2. The method according to claim 1, characterized in that The step of collecting resource usage information of all processes in the system based on a preset collection period includes: Remotely obtain preset collection cycles; Initialize the running time of the current collection cycle and record the running time of the current collection cycle; When the running time of the current collection cycle is less than the preset collection cycle, updating the process set and updating the running time of the current collection cycle; When the running time of the current collection cycle is not less than the preset collection cycle, the process set is written into a log to obtain resource usage information of all processes.

3. The method according to claim 1, characterized in that The step of performing a behavior profile of each process in all the processes according to the resource usage information to obtain the process behavior profile comprises: Parsing the resource usage information, and determining the maximum value, minimum value, average value and standard deviation of the resource usage indicators in the resource usage information; When the standard deviation of the resource usage indicator of the process is less than the first standard deviation, determining the process as a process of stable resource usage; When the range of the resource usage indicator of the process is greater than the preset range and the standard deviation is less than the second standard deviation, the process is determined as a resource usage peak class process, and the range is the difference between the maximum value and the minimum value; When the standard deviation of the resource usage indicator of the process is greater than a third standard deviation, determining the process as a process of scattered resource usage; The process is profiled according to the resource usage stable class process, the resource usage peak class process or the resource usage scattered class process to obtain a process behavior profile.

4. The method according to claim 1, characterized in that The process detection model is used to perform anomaly detection on the process behavior portrait to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm. The improved isolation forest algorithm adds a new step of calculating and counting isolated features, including: Determine a corresponding historical resource usage log according to the process behavior profile, and pre-process the historical resource usage log to obtain a process resource usage data set; determining the number of binary trees in the isolation forest and the size of the sample set, and constructing the isolation forest using the data set according to the process resources; Obtain the current resource usage log of the process; Preprocessing the current resource usage log, and adding the preprocessed resource usage log to the isolation forest to obtain an isolated value, and determining the isolated value as an abnormal value; Compare the abnormal value with a first threshold to obtain a first result, and compare the abnormal value with a second threshold to obtain a second result; When the number of abnormal points of the first result is greater than the number of abnormal points of the second result, determining that the current process is abnormal; When the process is abnormal, an abnormal window is determined, and the proportion of each isolated value is determined to obtain abnormal behavior characteristics.

5. The method according to claim 4, characterized in that After the step of obtaining the current resource usage log of the process, the method further includes: Parsing the current resource usage log of the process to determine the user type of the process; When the user type is a common user, determining a valid user type of the process when it is running; When the valid user type is a common user, performing the step of preprocessing the current resource usage log, adding the preprocessed resource usage log to the isolation forest, obtaining an isolated value, and determining the isolated value as an abnormal value; When the effective user type is a super user, the current process is determined to be a privileged process, and anomaly detection is performed based on a privileged process detection strategy to obtain abnormal behavior characteristics.

6. The method according to claim 5, characterized in that The step of determining the current process as a privileged process when the valid user type is a super user, performing anomaly detection based on a privileged process detection strategy, and obtaining abnormal behavior characteristics comprises: When the effective user type is a super user, determining the current process as a privileged process; Obtaining system call sequence information of the privileged process when it is running in a normal environment, and using the system call sequence as training data; Determine the calling frequency of each system according to the training data; Determine a state set of the calling frequency of each of the systems based on a Markov chain; Determine an initial probability vector and a state transfer matrix according to the state set; Abnormal state detection is performed according to the initial probability vector and the state transfer matrix to obtain abnormal behavior characteristics.

7. The method according to claim 4, characterized in that The process detection model is used to perform anomaly detection on the process behavior portrait to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm. The improved isolation forest algorithm adds a step of calculating and counting isolated features, and further includes: Obtaining a process set according to all processes, and generating a process undirected graph according to the process set; Determine the weight of each process, and generate a weighted process undirected graph according to the weight of each process and the process undirected graph; determining a universal value for each process in the weighted process undirected graph; Compare the common value with a preset common value, and if the common value is greater than the preset common value, add the process corresponding to the common value to the main process whitelist; Perform sensitive resource detection on the process whose general value is less than the preset general value to obtain a detection result; When the detection result is that sensitive resources are contained, adding the process whose common value is less than the preset common value to the sub-process whitelist; When the process does not belong to the main process whitelist or the sub-process whitelist, determining abnormal behavior characteristics of the process; Generate a detection result based on the current process and the abnormal behavior characteristics, and output the detection result.

8. A device for detecting abnormal behavior of a Linux process, characterized in that: The device comprises: A resource acquisition module, used to collect resource usage information of all processes in the system based on a preset collection period; A process description module, used for performing a behavior profile on each process in all the processes according to the resource usage information to obtain a process behavior profile; A behavior detection module is used to perform anomaly detection on the process behavior portrait based on a process detection model to obtain an isolated value of the process behavior portrait. When the isolated value is a preset abnormal value, an abnormal behavior feature is obtained according to the isolated value. The process detection model is obtained by an improved isolation forest algorithm, and the improved isolation forest algorithm adds calculation and statistics of isolated features. The result output module is used to generate a detection result according to the current process and the abnormal behavior characteristics, and output the detection result.

9. A device for detecting abnormal behavior of a Linux process, characterized in that: The device comprises: a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the method for detecting abnormal behavior of a Linux process as claimed in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the method for detecting abnormal behavior of a Linux process as described in any one of claims 1 to 7 are implemented.

Images