Abnormality detection-oriented multi-source fusion log compression method and device

Abstract

The invention discloses an anomaly detection-oriented multi-source fusion log compression method and device, and belongs to the technical field of anomaly detection. The anomaly detection-oriented multi-source fusion log compression method comprises the following steps of: compressing a multi-source fusion log based on a system audit log corresponding to electronic equipment, an application log corresponding to a target application program in the electronic equipment and a domain name system log corresponding to the electronic equipment; generating an audit traceability graph corresponding to the system audit log, an application traceability graph corresponding to the application log and a domain name traceability graph corresponding to the domain name system log; based on domain name nodes in the application traceability graph, fusing the domain name traceability graph into the application traceability graph to obtain a sub-fusion traceability graph; based on event nodes in the audit traceability graph, fusing the audit traceability graph into the sub fusion traceability graph to obtain a fusion traceability graph; and performing anomaly detection based on the fused traceability graph. According to the multi-source fusion log compression method for anomaly detection, the problems of semantic gaps and dependency explosion can be relieved.

Description

Technical Field

[0001] The present application belongs to the technical field of anomaly detection, and in particular, relates to a multi-source fusion log compression method and device for anomaly detection. Background Art

[0002] Advanced persistent threat attack detection based on the traceability graph can detect attacks in a timely manner and establish a defense mechanism to protect the security of cyberspace. In related technologies, the traceability graph is constructed through the system audit log for anomaly detection. However, the traceability graph constructed by the above method has the problems of dependency explosion and semantic gap. Summary of the invention

[0003] This application aims to solve at least one of the technical problems existing in the related art. To this end, this application proposes a multi-source fusion log compression method and device for anomaly detection, which generates a richer traceability graph, alleviates the semantic gap and dependency explosion problems, and provides a clearer path for attack detection.

[0004] In a first aspect, the present application provides a multi-source fusion log compression method for anomaly detection, the method comprising:

[0005] Based on the system audit log corresponding to the electronic device, the application log corresponding to the target application in the electronic device and the domain name system log corresponding to the electronic device, an audit traceability graph corresponding to the system audit log, an application traceability graph corresponding to the application log and a domain name traceability graph corresponding to the domain name system log are generated; the nodes in each of the traceability graphs are used to represent the entities included in the log corresponding to the traceability graph, and the edges in each of the traceability graphs are used to represent the interaction relationship between each of the entities;

[0006] Based on the domain name nodes in the application traceability graph, the domain name traceability graph is merged into the application traceability graph to obtain a sub-fused traceability graph;

[0007] Based on the event nodes in the audit traceability graph, the audit traceability graph is merged into the sub-fusion traceability graph to obtain a fusion traceability graph;

[0008] Anomaly detection is performed based on the fusion traceability graph.

[0009] According to the multi-source fusion log compression method for anomaly detection of the present application, by obtaining system audit logs, application logs and domain name system logs, and generating audit traceability graphs, application traceability graphs and domain name traceability graphs respectively, by integrating the audit traceability graphs, application traceability graphs and domain name traceability graphs, richer traceability graphs are generated, which alleviates the problems of semantic gap and dependency explosion and provides a clearer path for attack detection.

[0010] According to the multi-source fusion log compression method for anomaly detection of the present application, based on the domain name node in the application traceability graph, the domain name traceability graph is fused into the application traceability graph to obtain a sub-fusion traceability graph, including:

[0011] Matching the domain name nodes in the application traceability graph with the domain name nodes in the domain name traceability graph, and merging the matched domain name nodes in the application traceability graph with the domain name nodes in the domain name traceability graph;

[0012] Add the Internet Protocol address node corresponding to the domain name node in the domain name traceability graph to the application traceability graph to obtain the sub-fusion traceability graph.

[0013] According to the multi-source fusion log compression method for anomaly detection of the present application, based on the event nodes in the audit traceability graph, the audit traceability graph is fused into the sub-fusion traceability graph to obtain a fusion traceability graph, including:

[0014] The event nodes in the audit traceability graph are matched with the event nodes in the sub-fusion traceability graph, and the event nodes in the audit traceability graph obtained by matching are merged with the event nodes in the sub-fusion traceability graph to obtain the merged traceability graph.

[0015] According to the multi-source fusion log compression method for anomaly detection of the present application, the event nodes in the audit traceability graph are matched with the event nodes in the sub-fusion traceability graph, and the event nodes in the audit traceability graph obtained by matching are fused with the event nodes in the sub-fusion traceability graph to obtain the fusion traceability graph, including:

[0016] Matching the event nodes in the audit traceability graph with the event nodes in the sub-fusion traceability graph, and fusing the event nodes in the audit traceability graph obtained by matching with the event nodes in the sub-fusion traceability graph to obtain a first fusion traceability graph;

[0017] Extracting the path corresponding to the file download event and the path corresponding to the malicious domain name access event from the first fused traceability graph to obtain a new first fused traceability graph;

[0018] Based on the path corresponding to the file download event and the path corresponding to the malicious domain name access event, a second fusion traceability graph is obtained;

[0019] Based on the new first fusion traceability graph and the second fusion traceability graph, the fusion traceability graph is obtained.

[0020] According to the multi-source fusion log compression method for anomaly detection of the present application, anomaly detection is performed based on the fusion traceability graph, including:

[0021] Compressing the fused traceability graph to obtain a target traceability graph;

[0022] Based on the target traceability graph, the abnormal event is processed.

[0023] According to the multi-source fusion log compression method for anomaly detection of the present application, compressing the fusion traceability graph to obtain a target traceability graph includes:

[0024] Deleting redundant nodes and edges corresponding to the redundant nodes and first irrelevant nodes and edges corresponding to the first irrelevant nodes in the target traceability graph;

[0025] and / or;

[0026] Merge the second irrelevant node in the target traceability graph and the edge corresponding to the second irrelevant node;

[0027] and / or;

[0028] The repeated nodes in the target traceability graph and the edges corresponding to the repeated nodes are merged to obtain the target traceability graph.

[0029] According to the multi-source fusion log compression method for anomaly detection of the present application, the redundant node and the edge corresponding to the redundant node and the first irrelevant node and the edge corresponding to the first irrelevant node include:

[0030] At least one of nodes unrelated to a file download event and edges corresponding to the nodes unrelated to the file download event, domain name nodes corresponding to at least one of the domain name nodes between the node corresponding to the file download event and the target file corresponding to the file download event and edges corresponding to each of the domain name nodes, read operation nodes and edges corresponding to the read operation nodes, delete operation nodes and edges corresponding to the delete operation nodes, and external nodes that have no interaction with the local file system and edges corresponding to the external nodes.

[0031] According to the multi-source fusion log compression method for anomaly detection of the present application, the second irrelevant node in the target traceability graph and the edge corresponding to the second irrelevant node include:

[0032] At least one of a redirection node and an edge corresponding to the redirection node, a jump operation node and an edge corresponding to the jump operation node, and a benign node and an edge corresponding to the benign node, wherein the benign node is a node that does not participate in the attack.

[0033] According to the multi-source fusion log compression method for anomaly detection of the present application, the repeated nodes in the target traceability graph and the edges corresponding to the repeated nodes include:

[0034] The target node and the edge corresponding to the target node in the node corresponding to the file download event that matches the node corresponding to the local file operation, and the multiple edges between the first node and the second node in the fusion traceability graph.

[0035] According to the multi-source fusion log compression method for anomaly detection of the present application, based on the system audit log corresponding to the electronic device, the application log corresponding to the target application in the electronic device and the domain name system log corresponding to the electronic device, an audit traceability graph corresponding to the system audit log, an application traceability graph corresponding to the application log and a domain name traceability graph corresponding to the domain name system log are generated, including:

[0036] Respectively extract at least one entity from the system audit log, the application log, and the domain name system log, and the relationship between the entities;

[0037] Constructing the audit provenance graph based on the event nodes and Internet Protocol address nodes in the system audit log and the association relationship between the event nodes and the Internet Protocol address nodes;

[0038] Based on the event nodes and domain name nodes in the application log, and the association relationship between the event nodes and the domain name nodes, construct the application traceability graph;

[0039] The domain name traceability graph is constructed based on the domain name nodes and Internet Protocol address nodes in the domain name log, and the association relationship between the domain name nodes and the Internet Protocol addresses.

[0040] In a second aspect, the present application provides a multi-source fusion log compression device for anomaly detection, the device comprising:

[0041] A first processing module is used to generate an audit traceability graph corresponding to the system audit log, an application traceability graph corresponding to the application log, and a domain name traceability graph corresponding to the domain name system log based on the system audit log corresponding to the electronic device, the application log corresponding to the target application in the electronic device, and the domain name traceability graph corresponding to the domain name system log; the nodes in each of the traceability graphs are used to represent the entities included in the log corresponding to the traceability graph, and the edges in each of the traceability graphs are used to represent the interaction relationship between each of the entities;

[0042] A second processing module is used to merge the domain name traceability graph into the application traceability graph based on the domain name nodes in the domain name traceability graph to obtain a sub-fused traceability graph;

[0043] A third processing module is used to fuse the audit traceability graph into the sub-fusion traceability graph based on the event nodes in the audit traceability graph to obtain a fusion traceability graph;

[0044] A third processing module is used to fuse the audit traceability graph into the sub-fusion traceability graph based on the event nodes in the audit traceability graph to obtain a fusion traceability graph;

[0045] The fourth processing module is used to perform anomaly detection based on the fusion traceability graph.

[0046] According to the multi-source fusion log compression device for anomaly detection of the present application, by obtaining system audit logs, application logs and domain name system logs, and generating audit traceability graphs, application traceability graphs and domain name traceability graphs respectively, a richer traceability graph is generated by integrating the audit traceability graph, the application traceability graph and the domain name traceability graph, thereby alleviating the problems of semantic gap and dependency explosion and providing a clearer path for attack detection.

[0047] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the computer program, the multi-source fusion log compression method for anomaly detection as described in the first aspect above is implemented.

[0048] In a fourth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the multi-source fusion log compression method for anomaly detection as described in the first aspect above is implemented.

[0049] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the multi-source fusion log compression method for anomaly detection as described in the first aspect above.

[0050] The above one or more technical solutions in the embodiments of the present application have at least one of the following technical effects:

[0051] By obtaining system audit logs, application logs and domain name system logs, and generating audit traceability graphs, application traceability graphs and domain name traceability graphs respectively, and by integrating audit traceability graphs, application traceability graphs and domain name traceability graphs, richer traceability graphs are generated to alleviate the problems of semantic gap and dependency explosion, and provide a clearer path for attack detection.

[0052] Furthermore, by separating the path corresponding to the file download event and the path corresponding to the malicious domain name access event, the first fused traceability graph is effectively divided into multiple sub-graphs, and a fused traceability graph with a clearer structure and easier analysis is obtained, thereby improving the efficiency of subsequent anomaly detection processing based on the fused traceability graph.

[0053] Furthermore, by compressing the fused traceability graph, the data volume of the fused traceability graph is effectively reduced, and a target traceability graph with a streamlined structure and rich information is obtained, thereby improving the analysis efficiency of the target traceability graph and thus improving the efficiency and accuracy of subsequent abnormal event processing.

[0054] Furthermore, by extracting at least one entity and the relationship between the entities in the system audit log, application log and domain name system log respectively, and constructing the traceability graph corresponding to each log based on the association relationship between the entities, the log information is effectively represented in a graphical way, thereby improving the readability and intuitiveness of the log information.

[0055] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0057] Figure 1 It is a flowchart of a multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0058] Figure 2 This is one of the principle schematic diagrams of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0059] Figure 3 This is the second principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0060] Figure 4 This is the third principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0061] Figure 5 This is the fourth principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0062] Figure 6 This is the fifth principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0063] Figure 7 This is the sixth principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0064] Figure 8 This is the seventh principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0065] Fig. 9 This is the eighth principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0066] Fig.10 This is the ninth principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0067] Fig.11 This is the tenth principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0068] Fig.12 This is the eleventh principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0069] Fig.13 This is the twelfth principle schematic diagram of the multi-source fusion log compression method for anomaly detection provided by an embodiment of the present application;

[0070] Fig.14 It is a structural schematic diagram of a multi-source fusion log compression method and device for anomaly detection provided by an embodiment of the present application;

[0071] Fig.15 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0073] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0074] In conjunction with the accompanying drawings, the following describes in detail the multi-source fusion log compression method for anomaly detection, the multi-source fusion log compression device for anomaly detection, the electronic device, and the readable storage medium provided in the embodiments of the present application through specific embodiments and their application scenarios.

[0075] Among them, the multi-source fusion log compression method for anomaly detection can be applied to a terminal, and can be specifically executed by hardware or software in the terminal.

[0076] The terminal includes but is not limited to portable communication devices such as mobile phones or tablet computers. It should also be understood that in some embodiments, the terminal may not be a portable communication device, but a desktop computer.

[0077] In the following various embodiments, a terminal including a display and a touch-sensitive surface is described. However, it should be understood that the terminal may include one or more other physical user interface devices such as a physical keyboard, a mouse and a joystick.

[0078] The multi-source fusion log compression method for anomaly detection provided in the embodiment of the present application may be executed by an electronic device or a functional module or functional entity in the electronic device that can implement the multi-source fusion log compression method for anomaly detection. The electronic devices mentioned in the embodiment of the present application include but are not limited to mobile phones, tablet computers, computers, cameras, and wearable devices. The multi-source fusion log compression method for anomaly detection provided in the embodiment of the present application is described below by taking the electronic device as an example of the execution subject.

[0079] like Figure 1 As shown, the multi-source fusion log compression method for anomaly detection includes: step 110, step 120, step 130 and step 140.

[0080] Step 110: Based on the system audit log corresponding to the electronic device, the application log corresponding to the target application in the electronic device, and the domain name system log corresponding to the electronic device, generate an audit traceability graph corresponding to the system audit log, an application traceability graph corresponding to the application log, and a domain name traceability graph corresponding to the domain name system log;

[0081] In this step, electronic devices include but are not limited to mobile phones, tablet computers, computers, cameras, and wearable devices.

[0082] The electronic device is the attacked device.

[0083] The target application is the application being attacked.

[0084] The system audit log is used to record security events of the computer system. These records contain detailed information on various operations such as user login, user logout, permission changes, system startup, system shutdown, and file operation-related events (such as creating files, opening files, and deleting files).

[0085] The events recorded in the system audit log provide a reliable timeline for the underlying operations and are the basis for tracing the attack behavior of advanced persistent threats.

[0086] Application logs are log information generated by the target application during its operation. Application logs include various activities, events, and status of the target application.

[0087] Application logs record network requests and responses when users access web pages through browsers, including information such as network requests, redirections, and file downloads.

[0088] Application logs can explain what the attacker did in the browser and provide contextual clues for review through behaviors such as file downloads.

[0089] The DNS log is used to record information related to domain name resolution, mapping domain names to Internet Protocol addresses.

[0090] DNS logs can reveal potentially malicious activity communicating through the DNS.

[0091] The traceability graph is an abstract directed graph obtained by transforming log information.

[0092] The nodes in each traceability graph are used to represent the entities included in the log corresponding to the traceability graph, and the edges in each traceability graph are used to represent the interaction relationship between the entities.

[0093] It should be noted that the information in the traceability graph can represent the control flow, data flow and all execution history records between system entities, and the traceability graph has rich semantics.

[0094] The audit traceability diagram is a traceability diagram obtained by transforming the information in the system audit log.

[0095] The application traceability graph is a traceability graph obtained by transforming the information in the application log.

[0096] The domain name traceability graph is obtained by transforming the information in the domain name system log.

[0097] During the actual execution process, the information in each log can be parsed by field analysis to extract key information, extract subject, object, event and other information, and build a traceability graph based on the extracted subject, object, event and other information.

[0098] like Figure 2As shown, through the parser, the required fields can be captured from each log record, such as timestamp, source address of the data packet, destination address of the data packet, operation type and other information.

[0099] The captured fields can be used to build provenance graphs that capture key nodes and events in systems and networks.

[0100] Step 120: Based on the domain name nodes in the application traceability graph, the domain name traceability graph is merged into the application traceability graph to obtain a sub-fused traceability graph;

[0101] In this step, the domain name node in the application traceability graph is the address of the website requested by the user.

[0102] The sub-fusion traceability graph is a traceability graph obtained by fusing the application traceability graph and the domain name traceability graph.

[0103] The application traceability graph can reflect the user's operation behavior in the browser, and each operation corresponds to a domain name node.

[0104] Different operations may correspond to different domain name nodes.

[0105] In the actual execution process, the domain name traceability graph can be used as a benchmark, and based on the association between the domain name nodes in the application traceability graph and the domain name traceability graph, the domain name traceability graph and the application function traceability graph can be fused to obtain a sub-fused traceability graph.

[0106] Step 130: Based on the event nodes in the audit traceability graph, the audit traceability graph is merged into the sub-fused traceability graph to obtain a fused traceability graph;

[0107] In this step, the event nodes in the audit provenance graph are event nodes involved in the operations performed by the user through the browser.

[0108] It is understandable that when a user performs different events, the entities corresponding to the event nodes may be different.

[0109] The entities corresponding to the event node may include: files, processes, sockets, Internet Protocol addresses, and Uniform Resource Locators, etc.

[0110] The fusion traceability graph is a directed graph that includes key information of system audit logs, application logs, and domain name system logs.

[0111] When a user downloads a file through a browser, the interaction between the browser and the local file system can be characterized through the audit provenance graph and application provenance graph related to the file download event.

[0112] In the actual execution process, based on the association between the event nodes in the audit traceability graph and the sub-fusion traceability graph, the audit traceability graph and the sub-fusion traceability graph can be fused to obtain a fusion traceability graph.

[0113] Step 140: Perform anomaly detection based on the fused traceability graph.

[0114] In this step, the fused provenance graph contains more contextual information.

[0115] In the actual execution process, malicious attack events can be extracted by analyzing the information contained in each node and edge in the fusion traceability graph, thereby performing anomaly detection.

[0116] During the research and development process, the inventors found that advanced persistent threat attack detection based on the traceability graph can detect attacks in a timely manner and establish a defense mechanism to protect the security of cyberspace. However, in the related art, the traceability graph is constructed through the system audit log for anomaly detection. The traceability graph constructed by the above method has the problems of dependency explosion and semantic gap.

[0117] Among them, dependency explosion means that the output events in the traceability graph are assumed to be causally dependent on all previous input events, making attack detection very difficult.

[0118] The semantic gap is that attacks leave different traces in logs of different types and levels of sources. A single level of logs cannot reveal the full picture of the attack. For downstream detection tasks, only using system audit logs will miss more effective information.

[0119] This application obtains system audit logs, application logs and domain name system logs, parses the field information in each log that can capture key nodes and events in the system and network, and constructs audit traceability graphs, application traceability graphs and domain name traceability graphs respectively, provides a basic system behavior model, and supplements the low-level log information with higher-level application information by fusing the audit traceability graphs, application traceability graphs and domain name traceability graphs to generate richer traceability graphs for anomaly detection, alleviate the semantic gap problem, and provide a clearer path for attack detection. By fusing the audit traceability graphs, application traceability graphs and domain name traceability graphs, a fused traceability graph is obtained, which effectively addresses the dependency explosion problem caused by anomaly detection through audit traceability graphs.

[0120] According to the multi-source fusion log compression method for anomaly detection provided by the embodiment of the present application, by obtaining the system audit log, application log and domain name system log, and generating the audit traceability graph, application traceability graph and domain name traceability graph respectively, by integrating the audit traceability graph, application traceability graph and domain name traceability graph, a richer traceability graph is generated, which alleviates the problems of semantic gap and dependency explosion and provides a clearer path for attack detection.

[0121] Continue to refer Figure 3 In some embodiments, step 110 may further include:

[0122] Extract at least one entity and the relationship between the entities in the system audit log, application log and domain name system log respectively;

[0123] Based on the event nodes and Internet Protocol address nodes in the system audit log, and the association relationship between the event nodes and the Internet Protocol address nodes, an audit traceability graph is constructed;

[0124] Based on the event nodes and domain name nodes in the application log, and the relationship between the event nodes and domain name nodes, an application traceability graph is constructed;

[0125] A domain name traceability graph is constructed based on the domain name nodes and Internet Protocol address nodes in the domain name log, as well as the association between the domain name nodes and the Internet Protocol addresses.

[0126] In this embodiment, if Figure 3 As shown, in the actual execution process, after obtaining the system audit log, application log and domain name system log, the system audit log, application log and domain name system log can be parsed through the log parser to obtain different log fields and event operation information, and the parsed log fields and event operation information are converted into nodes and edges in the traceability graph.

[0127] like Figure 4 As shown, the entities corresponding to the nodes in the traceability graph include but are not limited to: processes, files, sockets, domain names, and uniform resource locators.

[0128] like Figure 5 As shown, the traceability graph may also include multiple events, such as events corresponding to processes to files and events corresponding to files to processes.

[0129] In the traceability graph, the attributes of the edge include: source node (source), target node (target), operation type (type), timestamp (timestamp) and the specific form of the operation (rel).

[0130] The properties of a node include: node unique identifier (nodeid) and node type (type).

[0131] It should be noted that different types of entities in the system, such as processes, files, and Internet Protocol addresses, may share the same identifier, such as PID or ObjID.

[0132] In the actual execution process, multiple fields can be combined to ensure the uniqueness of each node.

[0133] For example, fields such as pname, ppname, u_name, and d_ip are combined to represent a node.

[0134] The node type is used to identify the type of the node, such as process node, event node, user node, and Internet Protocol address node.

[0135] The event nodes in the system audit log can be used as entities connected by directed edges in the traceability graph.

[0136] The event corresponding to the event node can be file creation or process startup, etc.

[0137] By parsing the field information in the system audit log, the operation process in the system can be visualized and the potential attack behavior can be revealed. Figure 6 The audit provenance diagram shown.

[0138] The network jump, redirection, file download, and file request events recorded in the application log can be identified as nodes and edges in the traceability graph, generating a graph that reflects the user's operation behavior in the browser, such as Figure 7 The application provenance diagram shown.

[0139] Each event corresponds to an Internet Protocol address node.

[0140] For example, when a user performs a file download event, the file download event corresponds to an Internet Protocol address node.

[0141] Application provenance graphs are critical for identifying attack campaigns conducted via malicious web pages, especially when malicious code may be hidden in file downloads and redirects.

[0142] like Figure 8 As shown, in the domain name traceability graph, the domain name node and the Internet Protocol address node serve as nodes of the traceability graph. When the domain name node is resolved to the corresponding Internet Protocol address node, a directed edge is established from the domain name node to the Internet Protocol address node.

[0143] The domain name traceability graph reveals the domain name resolution relationship in the network and can help identify the source of malicious domain names and potential malicious traffic.

[0144] According to the multi-source fusion log compression method for anomaly detection provided by the embodiment of the present application, by respectively extracting at least one entity from the system audit log, application log and domain name system log and the relationship between the entities, and based on the association relationship between the entities, a traceability graph corresponding to each log is constructed, so that the log information is effectively represented in a graphical manner, thereby improving the readability and intuitiveness of the log information.

[0145] In some embodiments, step 120 may further include:

[0146] Match the domain name nodes in the domain name traceability graph with the domain name nodes in the application traceability graph, and merge the matched domain name nodes in the application traceability graph with the domain name nodes in the domain name traceability graph;

[0147] Add the Internet Protocol address node corresponding to the domain name node in the domain name traceability graph to the application traceability graph to obtain a sub-fusion traceability graph.

[0148] In this embodiment, the domain name traceability graph includes multiple domain name nodes, and the application traceability graph also includes multiple domain name nodes.

[0149] In the actual implementation process, the domain name traceability diagram can reveal the correspondence between each domain name node and the Internet Protocol address node.

[0150] In the process of fusing the domain name traceability graph and the application traceability graph, each domain name node in the application traceability graph can be matched with the node in the domain name traceability graph, and the Internet Protocol address node corresponding to the domain name node in the domain name traceability graph that is the same as the domain name node in the application traceability graph is added to the application traceability graph to obtain a sub-fused traceability graph.

[0151] The sub-fusion traceability graph can also record the operation and timestamp information of the event node corresponding to the domain name node.

[0152] In the case where a request in an application traceability graph involves a specific domain name, the Internet Protocol address corresponding to the domain name in the domain name traceability graph that matches the specific domain name in the application traceability graph can be linked to form a cross-level traceability path.

[0153] According to the multi-source fusion log compression method for anomaly detection provided by the embodiment of the present application, by matching the domain name nodes in the domain name traceability graph and the domain name nodes in the application traceability graph, the domain name traceability graph and the application traceability graph are fused through the same domain name nodes, and the Internet Protocol address nodes in the domain name traceability graph are effectively added to the application traceability graph, thereby improving the accuracy of the traceability graph fusion and enriching the information included in the traceability graph.

[0154] In some embodiments, step 130 may further include:

[0155] Match the event nodes in the audit traceability graph with the event nodes in the sub-fusion traceability graph, and fuse the event nodes in the matched audit traceability graph with the event nodes in the sub-fusion traceability graph to obtain a fusion traceability graph.

[0156] In this embodiment, the audit provenance graph may include different event nodes, and the sub-fusion provenance graph may include different event nodes.

[0157] Users may have different operations corresponding to event nodes.

[0158] For example, the event node is a file download operation.

[0159] As another example, the event node is a file creation operation.

[0160] During the actual execution process, the operations corresponding to the event nodes in the audit traceability graph can be matched with the operations corresponding to the event nodes in the sub-fusion traceability graph. For example, when the event nodes in the audit traceability graph are consistent with file downloads, and the event nodes in the sub-fusion traceability graph are consistent with file downloads, the event nodes in the matched audit traceability graph are fused with the event nodes in the sub-fusion traceability graph to obtain a fused traceability graph.

[0161] In some embodiments, the audit provenance graph and the application provenance graph may also be fused through preset fusion rules.

[0162] In this embodiment, the preset fusion rule is pre-set based on the association relationship between each event node.

[0163] In the actual execution process, when the operation corresponding to the event node meets the file download or other related conditions, the corresponding operation information can be integrated, that is, the audit traceability graph and the sub-traceability graph are integrated to obtain the following: Figure 3 The fusion traceability diagram shown.

[0164] According to the multi-source fusion log compression method for anomaly detection provided by the embodiment of the present application, by matching the event nodes in the audit traceability graph with the event nodes in the sub-fusion traceability graph, the association relationship between the audit traceability graph and the sub-fusion traceability graph is effectively constructed, and the event nodes performing the same or related operations are obtained. Based on the event nodes, the audit traceability graph and the sub-fusion traceability graph are fused to obtain a fusion traceability graph including information of the system audit log, application log and domain name system log, and the traceability graph including context information is effectively obtained, thereby improving the accuracy of subsequent attack detection.

[0165] In some embodiments, matching the event nodes in the audit traceability graph with the event nodes in the sub-fusion traceability graph, fusing the event nodes in the matched audit traceability graph with the event nodes in the sub-fusion traceability graph to obtain the fusion traceability graph may also include:

[0166] Matching the event nodes in the audit traceability graph with the event nodes in the sub-fusion traceability graph, and fusing the event nodes in the matched audit traceability graph with the event nodes in the sub-fusion traceability graph to obtain a first fusion traceability graph;

[0167] Extracting the path corresponding to the file download event and the path corresponding to the malicious domain name access event from the first fused traceability graph to obtain a new first fused traceability graph;

[0168] Based on the path corresponding to the file download event and the path corresponding to the malicious domain name access event, a second fusion traceability graph is obtained;

[0169] Based on the new first fusion traceability graph and the second fusion traceability graph, a fusion traceability graph is obtained.

[0170] In this embodiment, the first fused traceability graph is a traceability graph obtained by fusing the audit traceability graph and the sub-fused traceability graph.

[0171] By fusing the audit traceability graph with the sub-fusion traceability graph, we can get the following: Fig. 9 The first fusion traceability diagram is shown.

[0172] The path corresponding to the file download event is the path formed by the nodes and edges involved in the traceability graph when the user performs the file download operation through the browser.

[0173] The path corresponding to the malicious domain name access event is the path formed by the nodes and edges involved in the traceability graph when the user accesses the malicious domain name through the browser.

[0174] The new first fused traceability graph is a first fused traceability graph that does not include the path corresponding to the file download event and the path corresponding to the malicious domain name access event.

[0175] The second fused traceability graph is a traceability graph composed of the path corresponding to the file download event and the path corresponding to the malicious domain name access event.

[0176] In the actual execution process, in order to solve the dependency explosion problem of browser nodes, we can adopt the method of separating paths, extract the paths corresponding to the key file download operations and the paths corresponding to the malicious domain name access events from the dependency relationship of the first fusion traceability graph, and obtain a new first fusion traceability graph. Through the new first fusion traceability graph and the second fusion traceability graph, we can determine the following: Fig.10 The fusion traceability diagram shown.

[0177] According to the multi-source fusion log compression method for anomaly detection provided by the embodiment of the present application, by separating the path corresponding to the file download event and the path corresponding to the malicious domain name access event, the first fusion traceability graph is effectively divided into multiple sub-graphs, and a fusion traceability graph with a clearer structure and easy to analyze is obtained, thereby improving the efficiency of subsequent anomaly detection processing based on the fusion traceability graph.

[0178] In some embodiments, step 140 may further include:

[0179] Compress the fused traceability graph to obtain the target traceability graph;

[0180] Anomaly detection is performed based on the target traceability graph.

[0181] In this embodiment, the target provenance graph is a simplified provenance graph obtained on the basis of retaining key information of the fused provenance graph.

[0182] The fused traceability graph introduces information from system audit logs, application logs, and domain name system logs, making the semantics richer. However, the traceability graph has a large amount of data and may not be suitable for real-time or efficient attack detection.

[0183] In the actual execution process, the information irrelevant to anomaly detection in the fusion traceability graph can be deleted, and the duplicate nodes and information can be deleted.

[0184] In the actual execution process, the compression function may be preset, such as the type of nodes to be deleted and the type of edges to be deleted.

[0185] The compression function may be determined based on the actual situation of the malicious attack, for example, deleting nodes that are not related to the malicious attack and deleting edges that are not related to the malicious attack.

[0186] like Fig.11 As shown, the compression function may be a function for determining the association relationship between two nodes, a function for connecting two nodes, and the like.

[0187] During the actual execution process, the fused traceability graph can be compressed based on the set compression function to obtain a streamlined target traceability graph. Based on the target traceability graph, the information of malicious attack events recorded in the target traceability graph can be analyzed to perform anomaly detection.

[0188] like Figure 3 As shown, after compressing the fused traceability graph, the number of nodes and edges of the obtained traceability graph can be reduced.

[0189] During the research and development process, the inventors discovered that the traceability graph constructed in the relevant technology has a large amount of data, which affects the efficiency of anomaly detection.

[0190] The present application compresses the obtained fusion traceability graph, and on the basis of retaining the key information of the fusion traceability graph, effectively reduces the number of nodes and edges of the fusion traceability graph, obtains a target traceability graph with a streamlined structure, thereby improving the efficiency of subsequent anomaly detection based on the target traceability graph.

[0191] According to the multi-source fusion log compression method for anomaly detection provided in the embodiment of the present application, the data volume of the fusion traceability graph is effectively reduced by compressing the fusion traceability graph, so as to obtain a target traceability graph with a streamlined structure and rich information, thereby improving the analysis efficiency of the target traceability graph and thus improving the efficiency and accuracy of subsequent abnormal event processing.

[0192] In some embodiments, compressing the fused provenance graph to obtain a target provenance graph may further include:

[0193] Delete the redundant nodes and the edges corresponding to the redundant nodes and the first irrelevant nodes and the edges corresponding to the first irrelevant nodes in the target traceability graph;

[0194] and / or;

[0195] Merge the second irrelevant node in the target traceability graph and the edge corresponding to the second irrelevant node;

[0196] and / or;

[0197] Merge the repeated nodes and the edges corresponding to the repeated nodes in the target traceability graph to obtain the target traceability graph.

[0198] In this embodiment, the redundant node and the first irrelevant node are nodes irrelevant to the attack behavior.

[0199] The redundant nodes and the first irrelevant nodes include: reading and writing of temporary files and running of irrelevant processes, etc.

[0200] It is understandable that the redundant nodes and the first irrelevant nodes make the fusion traceability graph large and complex, interfering with the analysis of the attack path.

[0201] The second irrelevant node is a node that records entities corresponding to the same event in different forms.

[0202] It should be noted that the second irrelevant node provides different detailed information for the attack event, but in attack detection, more detailed information will distract the analyst's attention and reduce the analysis efficiency.

[0203] In the actual execution process, multiple second irrelevant nodes may be merged, and the edges corresponding to each second irrelevant node may be merged at the same time, so as to simplify the path of irrelevant operations and retain key operation nodes.

[0204] A repeated node is a node where the same entity or operation is recorded repeatedly in multiple locations in the traceability graph.

[0205] In the actual execution process, after obtaining the fused traceability graph, the nodes and edges in the fused traceability graph can be deleted or the nodes and edges in the fused traceability graph can be merged.

[0206] like Fig.13 As shown, in the actual execution process, after obtaining the fused traceability graph, irrelevant information in the fused traceability graph can be deleted, irrelevant information can be merged, and duplicate nodes in the merged traceability graph can be obtained to obtain the target traceability graph.

[0207] According to the multi-source fusion log compression method for anomaly detection provided by the embodiment of the present application, the fusion traceability graph is effectively compressed by deleting redundant nodes and first irrelevant nodes, merging second irrelevant nodes and duplicate nodes, and deleting edges corresponding to nodes or merging edges corresponding to nodes. Without losing key attack information, the redundancy of the traceability graph is effectively reduced, the structure of the target traceability graph is optimized, and the target traceability graph is more suitable for attack detection tasks, thereby improving the accuracy and efficiency of attack detection.

[0208] In some embodiments, the redundant node and the edge corresponding to the redundant node and the first irrelevant node and the edge corresponding to the first irrelevant node may include:

[0209] At least one of nodes unrelated to file download events and edges corresponding to nodes unrelated to file download events, domain name nodes corresponding to at least one domain name node between a node corresponding to a file download event and a target file corresponding to the file download event, read operation nodes and edges corresponding to read operation nodes, delete operation nodes and edges corresponding to delete operation nodes, and external nodes that have no interaction with the local file system and edges corresponding to the external nodes.

[0210] In this embodiment, the target file is the file operated by the file download event.

[0211] In the file download scenario, more attention is paid to the Internet Protocol address of the file download. Similarly, some Internet Protocol address nodes that have not interacted with the local file system can be deleted from the traceability graph as redundant nodes, and the edges corresponding to the redundant nodes can be deleted to simplify the fused traceability graph.

[0212] like Fig.12 As shown, in the actual execution process, the nodes irrelevant to the file download event and the edges corresponding to the nodes irrelevant to the file download event can be deleted through the compression function F1.

[0213] The Internet Protocol address of the file download event is connected to the target file through the compression function F2, and the intermediate domain name node and the edge corresponding to the domain name node are deleted.

[0214] The compression function F3 is used to delete temporary event nodes that only have read operations in the system and the edges corresponding to the read operation nodes.

[0215] The compression function F4 is used to delete temporary event nodes in the system that only have deletion operations and the edges corresponding to the deletion operation nodes.

[0216] The external nodes that have no interaction with the local file system and the edges corresponding to the external nodes are deleted through the compression function F5.

[0217] According to the multi-source fusion log compression method for anomaly detection provided by the embodiment of the present application, by determining the specific types of redundant nodes and first irrelevant nodes, the nodes in the fusion traceability graph are effectively deleted based on the determined redundant nodes and first irrelevant nodes, thereby reducing the data volume of the fusion traceability graph.

[0218] Continue to refer Fig.12 In some embodiments, the second irrelevant node and the edge corresponding to the second irrelevant node in the target provenance graph include:

[0219] At least one of a redirection node and an edge corresponding to the redirection node, a jump operation node and an edge corresponding to the jump operation node, and a benign node and an edge corresponding to the benign node.

[0220] In this embodiment, during the actual execution process, the redirection node and the edge corresponding to the redirection node and the jump operation node and the edge corresponding to the jump operation in the access request may be merged by using the compression function F6.

[0221] The compression function F6 may retain only the root node and the affected nodes related to the attack.

[0222] Benign nodes can be merged by compression function F7.

[0223] Benign nodes are nodes that do not participate in attacks.

[0224] The behavior of benign nodes has certain rules.

[0225] The compression function F7 can reduce redundancy associated with file input or output operations.

[0226] According to the multi-source fusion log compression method for anomaly detection provided by the embodiment of the present application, by determining the type of the second irrelevant node, the second irrelevant node can be accurately screened out from the fusion traceability graph, and multiple second irrelevant nodes can be merged, thereby effectively reducing the complexity of the fusion traceability graph, enabling attack detection personnel to focus on the potential attack paths of the target traceability graph and improving detection efficiency.

[0227] Continue to refer Fig.12 In some embodiments, the repeated nodes and the edges corresponding to the repeated nodes in the target traceability graph may include:

[0228] The target node and the edge corresponding to the target node in the node corresponding to the file download event that matches the node corresponding to the local file operation, and the multiple edges between the first node and the second node in the fusion traceability graph.

[0229] In this embodiment, the target node is the same node among the nodes corresponding to the file download event and the nodes corresponding to the local file operation.

[0230] The first node is any node in the fusion traceability graph.

[0231] The second node is a node in the fusion traceability graph connected to the first node.

[0232] In the actual execution process, the file download events in the application log can be matched with the local file events in the system audit log through the compression function F9 to reduce duplicate nodes.

[0233] The compression function F10 can be used to retain one edge between two nodes, and the information of other edges can be merged into the retained edge. The same operation can be performed and counted.

[0234] According to the multi-source fusion log compression method for anomaly detection provided by the embodiment of the present application, by determining the type of duplicate nodes, it is possible to quickly find duplicate nodes in the fusion traceability graph, improve the fusion efficiency of duplicate nodes, reduce the impact of duplicate nodes and redundant edges, and optimize the scale and structure of the target traceability graph, thereby improving the accuracy and efficiency of subsequent anomaly detection based on the target traceability graph.

[0235] The multi-source fusion log compression method for anomaly detection provided in the embodiment of the present application can be executed by a multi-source fusion log compression device for anomaly detection. In the embodiment of the present application, the multi-source fusion log compression method for anomaly detection is executed by a multi-source fusion log compression device for anomaly detection as an example to illustrate the multi-source fusion log compression device for anomaly detection provided in the embodiment of the present application.

[0236] The embodiment of the present application also provides a multi-source fusion log compression device for anomaly detection.

[0237] like Fig.14 As shown, the multi-source fusion log compression device for anomaly detection includes: a first processing module 1410 , a second processing module 1420 , a third processing module 1430 and a fourth processing module 1440 .

[0238] The first processing module 1410 is used to generate an audit traceability graph corresponding to the system audit log, an application traceability graph corresponding to the application log, and a domain name traceability graph corresponding to the domain name system log based on the system audit log corresponding to the electronic device, the application log corresponding to the target application in the electronic device, and the domain name system log corresponding to the electronic device; the nodes in each traceability graph are used to represent the entities included in the log corresponding to the traceability graph, and the edges in each traceability graph are used to represent the interaction relationship between the entities;

[0239] The second processing module 1420 is used to merge the domain name traceability graph into the application traceability graph based on the domain name nodes in the domain name traceability graph to obtain a sub-fused traceability graph;

[0240] The third processing module 1430 is used to fuse the audit traceability graph into the sub-fused traceability graph based on the event nodes in the audit traceability graph to obtain a fused traceability graph;

[0241] The fourth processing module 1440 is used to perform anomaly detection based on the fused traceability graph.

[0242] According to the multi-source fusion log compression device for anomaly detection provided by the embodiment of the present application, by obtaining system audit logs, application logs and domain name system logs, and generating audit traceability graphs, application traceability graphs and domain name traceability graphs respectively, a richer traceability graph is generated by integrating the audit traceability graph, the application traceability graph and the domain name traceability graph, thereby alleviating the problems of semantic gap and dependency explosion and providing a clearer path for attack detection.

[0243] In some embodiments, the second processing module 1420 may also be used to:

[0244] Matching the domain name nodes in the application traceability graph with the domain name nodes in the domain name traceability graph, and merging the matched domain name nodes in the application traceability graph with the domain name nodes in the domain name traceability graph;

[0245] Add the Internet Protocol address node corresponding to the domain name node in the domain name traceability graph to the application traceability graph to obtain a sub-fusion traceability graph.

[0246] In some embodiments, the third processing module 1430 may also be used to:

[0247] Match the event nodes in the audit traceability graph with the event nodes in the sub-fusion traceability graph, and fuse the event nodes in the matched audit traceability graph with the event nodes in the sub-fusion traceability graph to obtain a fusion traceability graph.

[0248] In some embodiments, the third processing module 1430 may also be used to:

[0249] Matching the event nodes in the audit traceability graph with the event nodes in the sub-fusion traceability graph, and fusing the event nodes in the matched audit traceability graph with the event nodes in the sub-fusion traceability graph to obtain a first fusion traceability graph;

[0250] Extracting the path corresponding to the file download event and the path corresponding to the malicious domain name access event from the first fused traceability graph to obtain a new first fused traceability graph;

[0251] Based on the path corresponding to the file download event and the path corresponding to the malicious domain name access event, a second fusion traceability graph is obtained;

[0252] Based on the new first fusion traceability graph and the second fusion traceability graph, a fusion traceability graph is obtained.

[0253] In some embodiments, the fourth processing module 1440 may also be used to:

[0254] Compress the fused traceability graph to obtain the target traceability graph;

[0255] Handle abnormal events based on the target traceability diagram.

[0256] In some embodiments, the fourth processing module 1440 may also be used to:

[0257] Delete the redundant nodes and the edges corresponding to the redundant nodes and the first irrelevant nodes and the edges corresponding to the first irrelevant nodes in the target traceability graph;

[0258] and / or;

[0259] Merge the second irrelevant node in the target traceability graph and the edge corresponding to the second irrelevant node;

[0260] and / or;

[0261] Merge the repeated nodes and the edges corresponding to the repeated nodes in the target traceability graph to obtain the target traceability graph.

[0262] The multi-source fusion log compression device for anomaly detection in the embodiment of the present application can be an electronic device, or a component in an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or it can be other devices other than a terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0263] The multi-source fusion log compression device for anomaly detection in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an IOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0264] The multi-source fusion log compression device for anomaly detection provided in the embodiment of the present application can achieve Figures 1 to 13 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0265] In some embodiments, Fig.15 As shown, an embodiment of the present application also provides an electronic device 1500, including a processor 1501, a memory 1502, and a computer program stored in the memory 1502 and executable on the processor 1501. When the program is executed by the processor 1501, each process of the above-mentioned multi-source fusion log compression method embodiment for anomaly detection is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0266] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0267] The embodiment of the present application also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each process of the embodiment of the multi-source fusion log compression method for anomaly detection is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0268] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0269] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned multi-source fusion log compression method for anomaly detection when executed by a processor.

[0270] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0271] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement each process of the above-mentioned multi-source fusion log compression method embodiment for anomaly detection, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0272] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0273] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0274] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0275] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0276] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0277] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. A multi-source fusion log compression method for anomaly detection, characterized in that: include: Based on the system audit log corresponding to the electronic device, the application log corresponding to the target application in the electronic device and the domain name system log corresponding to the electronic device, an audit traceability graph corresponding to the system audit log, an application traceability graph corresponding to the application log and a domain name traceability graph corresponding to the domain name system log are generated; the nodes in each of the traceability graphs are used to represent the entities included in the log corresponding to the traceability graph, and the edges in each of the traceability graphs are used to represent the interaction relationship between each of the entities; Based on the domain name nodes in the application traceability graph, the domain name traceability graph is merged into the application traceability graph to obtain a sub-fused traceability graph; Based on the event nodes in the audit traceability graph, the audit traceability graph is merged into the sub-fusion traceability graph to obtain a fusion traceability graph; Anomaly detection is performed based on the fusion traceability graph.

2. The multi-source fusion log compression method for anomaly detection according to claim 1 is characterized in that: Based on the domain name nodes in the application traceability graph, the domain name traceability graph is merged into the application traceability graph to obtain a sub-fused traceability graph, including: Matching the domain name nodes in the application traceability graph with the domain name nodes in the domain name traceability graph, and merging the matched domain name nodes in the application traceability graph with the domain name nodes in the domain name traceability graph; Add the Internet Protocol address node corresponding to the domain name node in the domain name traceability graph to the application traceability graph to obtain the sub-fusion traceability graph.

3. The multi-source fusion log compression method for anomaly detection according to claim 1 is characterized in that: Based on the event nodes in the audit traceability graph, the audit traceability graph is fused into the sub-fused traceability graph to obtain a fused traceability graph, including: The event nodes in the audit traceability graph are matched with the event nodes in the sub-fusion traceability graph, and the event nodes in the audit traceability graph obtained by matching are merged with the event nodes in the sub-fusion traceability graph to obtain the merged traceability graph.

4. The multi-source fusion log compression method for anomaly detection according to claim 3 is characterized in that: The matching of the event nodes in the audit traceability graph with the event nodes in the sub-fusion traceability graph, and fusing the event nodes in the audit traceability graph obtained by matching with the event nodes in the sub-fusion traceability graph to obtain the fusion traceability graph includes: Matching the event nodes in the audit traceability graph with the event nodes in the sub-fusion traceability graph, and fusing the event nodes in the audit traceability graph obtained by matching with the event nodes in the sub-fusion traceability graph to obtain a first fusion traceability graph; Extracting the path corresponding to the file download event and the path corresponding to the malicious domain name access event from the first fused traceability graph to obtain a new first fused traceability graph; Based on the path corresponding to the file download event and the path corresponding to the malicious domain name access event, a second fusion traceability graph is obtained; Based on the new first fusion traceability graph and the second fusion traceability graph, the fusion traceability graph is obtained.

5. The multi-source fusion log compression method for anomaly detection according to any one of claims 1 to 4, characterized in that: The performing anomaly detection based on the fusion traceability graph includes: Compressing the fused traceability graph to obtain a target traceability graph; Based on the target traceability graph, the abnormal event is processed.

6. The multi-source fusion log compression method for anomaly detection according to claim 5 is characterized in that: The step of compressing the fused traceability graph to obtain a target traceability graph includes: Deleting redundant nodes and edges corresponding to the redundant nodes and first irrelevant nodes and edges corresponding to the first irrelevant nodes in the target traceability graph; and / or; Merge the second irrelevant node in the target traceability graph and the edge corresponding to the second irrelevant node; and / or; The repeated nodes in the target traceability graph and the edges corresponding to the repeated nodes are merged to obtain the target traceability graph.

7. The multi-source fusion log compression method for anomaly detection according to claim 6 is characterized in that: The redundant node and the edge corresponding to the redundant node and the first irrelevant node and the edge corresponding to the first irrelevant node include: At least one of nodes unrelated to a file download event and edges corresponding to the nodes unrelated to the file download event, domain name nodes corresponding to at least one of the domain name nodes between the node corresponding to the file download event and the target file corresponding to the file download event and edges corresponding to each of the domain name nodes, read operation nodes and edges corresponding to the read operation nodes, delete operation nodes and edges corresponding to the delete operation nodes, and external nodes that have no interaction with the local file system and edges corresponding to the external nodes.

8. The multi-source fusion log compression method for anomaly detection according to claim 6 is characterized in that: The second irrelevant node in the target traceability graph and the edge corresponding to the second irrelevant node include: At least one of a redirection node and an edge corresponding to the redirection node, a jump operation node and an edge corresponding to the jump operation node, and a benign node and an edge corresponding to the benign node, wherein the benign node is a node that does not participate in the attack.

9. The multi-source fusion log compression method for anomaly detection according to claim 6 is characterized in that: The repeated nodes and the edges corresponding to the repeated nodes in the target traceability graph include: The target node and the edge corresponding to the target node in the node corresponding to the file download event that matches the node corresponding to the local file operation, and the multiple edges between the first node and the second node in the fusion traceability graph.

10. The multi-source fusion log compression method for anomaly detection according to any one of claims 1 to 4, characterized in that: The method of generating an audit traceability graph corresponding to the system audit log, an application traceability graph corresponding to the application log, and a domain name traceability graph corresponding to the domain name system log based on the system audit log corresponding to the electronic device, the application log corresponding to the target application in the electronic device, and the domain name traceability graph corresponding to the domain name system log includes: Respectively extract at least one entity from the system audit log, the application log, and the domain name system log, and the relationship between the entities; Constructing the audit provenance graph based on the event nodes and Internet Protocol address nodes in the system audit log and the association relationship between the event nodes and the Internet Protocol address nodes; Based on the event nodes and domain name nodes in the application log, and the association relationship between the event nodes and the domain name nodes, construct the application traceability graph; The domain name traceability graph is constructed based on the domain name nodes and Internet Protocol address nodes in the domain name log, and the association relationship between the domain name nodes and the Internet Protocol addresses.

11. A multi-source fusion log compression device for anomaly detection, characterized in that: include: A first processing module is used to generate an audit traceability graph corresponding to the system audit log, an application traceability graph corresponding to the application log, and a domain name traceability graph corresponding to the domain name system log based on the system audit log corresponding to the electronic device, the application log corresponding to the target application in the electronic device, and the domain name traceability graph corresponding to the domain name system log; the nodes in each of the traceability graphs are used to represent the entities included in the log corresponding to the traceability graph, and the edges in each of the traceability graphs are used to represent the interaction relationship between each of the entities; A second processing module is used to merge the domain name traceability graph into the application traceability graph based on the domain name nodes in the domain name traceability graph to obtain a sub-fused traceability graph; A third processing module is used to fuse the audit traceability graph into the sub-fusion traceability graph based on the event nodes in the audit traceability graph to obtain a fusion traceability graph; The fourth processing module is used to perform anomaly detection based on the fusion traceability graph.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the multi-source fusion log compression method for anomaly detection according to any one of claims 1 to 10 is implemented.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the multi-source fusion log compression method for anomaly detection as described in any one of claims 1 to 10 is implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the multi-source fusion log compression method for anomaly detection according to any one of claims 1 to 10 is implemented.

Images