Security detection method, device and equipment and computer readable storage medium

Abstract

The invention discloses a security detection method, device and equipment and a computer readable storage medium, and belongs to the field of network security. The method comprises the following steps: a proxy device collects a first event; the proxy device performs first security detection on the first event to obtain a first detection result; the proxy device processes the first event to obtain a second event, and the data volume of the second event is smaller than that of the first event; the proxy device sends the first detection result and the second event to the cloud, the first detection result and the second event are used for the cloud device to perform second security detection on the second event, and a second detection result is obtained. The collected events are cooperatively detected based on the proxy device and the cloud device, so that the transmission data volume between the proxy device and the cloud device is reduced, the bandwidth cost is reduced, and the detection efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a security detection method, device, equipment and computer-readable storage medium. Background Art

[0002] Network security is an important issue that cannot be ignored in today's digital age. With the rapid development of the Internet, more and more security detection problems have emerged in the network. Therefore, it is particularly important to use reasonable network security solutions for security detection.

[0003] A security detection method is provided in the related art, in which a collection agent deployed on a user terminal collects data and a cloud device analyzes the collected data. This detection method realizes security detection by uploading the full amount of data collected by the collection agent to the cloud device for data analysis.

[0004] However, since the full amount of data collected by the collection agent needs to be uploaded to the cloud device, the data transmission volume is large, the bandwidth cost is high, and the detection efficiency is low during the transmission process. Summary of the invention

[0005] The present application provides a security detection method, device, equipment and computer-readable storage medium to solve the problems provided by related technologies. The technical solution is as follows:

[0006] In a first aspect, a security detection method is provided, which is applied to an agent device, and the method includes: collecting a first event; performing a first security detection on the first event to obtain a first detection result; processing the first event to obtain a second event, wherein the data volume of the second event is smaller than the data volume of the first event; sending the first detection result and the second event to a cloud device, wherein the first detection result and the second event are used by the cloud device to perform a second security detection on the second event to obtain a second detection result.

[0007] This application is based on the collaborative detection of collected events by proxy devices and cloud devices, thereby reducing the amount of data transmitted between the two, reducing bandwidth costs, and improving detection efficiency.

[0008] In a possible implementation, collecting the first event includes: collecting the first event according to the collection strategy sent by the cloud device or the collection configuration of the proxy device. The collection of the first event is realized by sending the collection strategy from the cloud device or the collection configuration locally configured by the proxy device, which is more flexible.

[0009] In a possible implementation, performing a first security check on the first event to obtain a first test result includes: converting the first event into a traceability graph, the traceability graph including multiple nodes and edges, the nodes representing different types of system entities included in the first event, the edges representing the operational relationship between the system entities corresponding to the connected nodes, and the nodes and edges each having corresponding attribute information; performing a first security check on the first event based on the traceability graph to obtain a first test result. Implementing security checks based on traceability graphs has higher detection efficiency and higher accuracy.

[0010] In a possible implementation, the converting of the first event into a traceability graph includes: obtaining a traceability graph model, the traceability graph model including the types of nodes and edges and the definition of fields, and also including description information for converting the event into a graph structure; determining the nodes and edges corresponding to the first event through the traceability graph model, and converting the first event into a traceability graph according to the nodes and edges corresponding to the first event. Converting the first event into a traceability graph through the traceability graph model makes the obtained traceability graph more accurate, thereby improving the efficiency of security detection based on the traceability graph.

[0011] In a possible implementation, the first security detection of the first event based on the traceability graph includes: matching the traceability graph with each security rule, assigning a corresponding alarm label and alarm value to the subgraph that hits any security rule, and the alarm label is used to indicate the alarm type; when the accumulated alarm value of the traceability graph exceeds the alarm threshold, matching the alarm label assigned to the traceability graph with the security rule combination, and when the alarm label assigned to the traceability graph hits the security rule combination, determining the subgraph assigned the alarm label as a target subgraph with a security problem, and taking the event corresponding to the target subgraph as a target event with a security problem to obtain a first detection result, and the first detection result includes the target subgraph and the target event. Matching by a single security rule and a combination of security rules makes the detection result of the security detection more accurate.

[0012] In a possible implementation, the processing of the first event to obtain the second event includes: filtering the first event that hits the security whitelist, and taking the first event that is not filtered as the second event; or, aggregating repeated events in the first event, and obtaining the second event according to the aggregation result; or, filtering the first event that hits the security whitelist, and aggregating repeated events in the first event that is not filtered, and obtaining the second event according to the aggregation result; or, aggregating repeated events in the first event, filtering the first event that hits the security whitelist in the aggregation result, and taking the first event that is not filtered as the second event. By at least one of filtering and aggregation, the data volume of the second event is reduced compared to the first event, thereby reducing the data transmission volume, reducing the transmission bandwidth, and improving the detection efficiency.

[0013] In a possible implementation, after performing a first security check on the first event and obtaining a first check result, the method further includes: when the first check result indicates that the first event has a security problem, processing the first event according to a handling strategy; and logging the handling process and the handling result. Local processing and logging the handling process and the handling result facilitate subsequent analysis.

[0014] In a second aspect, a security detection method is provided, which is applied to a cloud device, and the method includes: receiving a first detection result and a second event sent by each proxy device, the second event being obtained after the proxy device collects the first event and processes the first event, and the data volume of the second event is smaller than the data volume of the first event; performing a second security detection on the second event according to the first detection result and the second event to obtain a second detection result.

[0015] This application is based on the collaborative detection of collected events by proxy devices and cloud devices, thereby reducing the amount of data transmitted between the two, reducing bandwidth costs, and improving detection efficiency.

[0016] In a possible implementation manner, before receiving the first detection result and the second event sent by each proxy device, the method further includes: issuing a collection strategy to each proxy device, where the collection strategy is used by the proxy device to collect the first event.

[0017] In a possible implementation, before receiving the first detection result and the second event sent by each proxy device, the method further includes: sending a security whitelist to each proxy device, where the security whitelist is used by the proxy device to filter the first event to obtain the second event.

[0018] Since the first event collected by the proxy device can be implemented according to the collection strategy issued by the cloud device, the cloud device can also issue filtering configurations to the proxy device. Therefore, in addition to passively receiving data reported by the proxy device, the cloud can also dynamically adjust the collection, detection and filtering configurations of the proxy device.

[0019] In a possible implementation, a second security check is performed on the second event based on the first detection result and the second event to obtain a second detection result, including: performing correlation analysis on the second events sent by each proxy device in combination with a security information library, cross-device events, historical statistical data, and the first detection result, and obtaining a second detection result based on the correlation analysis result.

[0020] In a possible implementation, performing a second security check on the second event to obtain a second check result includes: processing the second event according to a handling strategy when the second check result indicates that the second event has a security issue.

[0021] In a third aspect, a security detection device is provided, which includes: a transceiver module for executing the reception and / or transmission related operations performed by the security detection device in any one of the methods described in the first aspect; and a processing module for executing other operations in addition to the reception and / or transmission related operations performed by the security detection device in any one of the methods described in the first aspect.

[0022] In a fourth aspect, a security detection device is provided, comprising: a transceiver module for executing the reception and / or transmission related operations performed by the security detection device in any one of the methods described in the second aspect; and a processing module for executing other operations in addition to the reception and / or transmission related operations performed by the security detection device in any one of the methods described in the second aspect.

[0023] In a fifth aspect, another communication device is provided, the device comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other through an internal connection path, the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to control the transceiver to receive signals and control the transceiver to send signals, and when the processor executes the instructions stored in the memory, the processor executes the method in the first aspect or any possible implementation of the first aspect.

[0024] In a sixth aspect, another communication device is provided, the device comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other through an internal connection path, the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to control the transceiver to receive signals and control the transceiver to send signals, and when the processor executes the instructions stored in the memory, the processor executes the method in the second aspect or any possible implementation of the second aspect.

[0025] Optionally, the number of the processors is one or more, and the number of the memories is one or more.

[0026] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0027] In the specific implementation process, the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated with the processor on the same chip or can be set on different chips. This application does not limit the type of memory and the setting method of the memory and the processor.

[0028] In a seventh aspect, a security detection system is provided, the system comprising a proxy device and a cloud device, the proxy device is used to execute any method described in the first aspect, and the cloud device is used to execute any method described in the second aspect.

[0029] In an eighth aspect, a computer program (product) is provided, wherein the computer program (product) comprises: a computer program code, and when the computer program code is executed by a computer, the computer executes the methods in the above aspects.

[0030] In a ninth aspect, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a program or instruction. When the program or instruction runs on a computer, the methods in the above aspects are executed.

[0031] In a tenth aspect, a chip is provided, comprising a processor for calling and executing instructions stored in a memory from the memory, so that a communication device equipped with the chip executes the methods in the above aspects.

[0032] In the eleventh aspect, another chip is provided, comprising: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the methods in the above aspects.

[0033] In the twelfth aspect, a security detection device is provided, the device comprising a memory and a processor; at least one instruction is stored in the memory, and the at least one instruction is loaded and executed by the processor to enable the security detection device to perform the methods in the above aspects.

[0034] It should be understood that the beneficial effects achieved by the technical solutions of the third to twelfth aspects and the corresponding possible implementation methods can be referred to the technical effects of the first aspect or the second aspect and their corresponding possible implementation methods, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of an implementation environment provided for an embodiment of the present application;

[0036] Figure 2 A schematic diagram of another implementation environment provided for an embodiment of the present application;

[0037] Figure 3 An interactive flow chart of a security detection method provided in an embodiment of the present application;

[0038] Figure 4 A schematic diagram of the structure of a traceability diagram provided in an embodiment of the present application;

[0039] Figure 5 A schematic diagram of a reporting process of a repeated event provided in an embodiment of the present application;

[0040] Figure 6 A schematic diagram of another safety detection process provided in an embodiment of the present application;

[0041] Figure 7 A schematic diagram of another safety detection process provided in an embodiment of the present application;

[0042] Figure 8 A schematic diagram of a process of security detection on a proxy device side provided in an embodiment of the present application;

[0043] Fig. 9 A schematic diagram of the structure of a safety detection device provided in an embodiment of the present application;

[0044] Fig.10 A schematic diagram of another safety detection device structure provided in an embodiment of the present application;

[0045] Fig.11 A schematic diagram of the structure of a computer device provided in an embodiment of the present application;

[0046] Fig.12 A schematic diagram of the structure of another computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The terms used in the implementation section of this application are only used to explain the specific embodiments of this application and are not intended to limit this application.

[0048] With the rapid development of the Internet, more and more security detection problems have emerged in the network, and with the escalation of network attack and defense, more and more advanced threats and unknown samples can escape the protection of traditional security solutions. In response to this situation, endpoint detection and response (EDR) came into being and became the focus of security vendors and enterprises. Among them, the EDR solution can comprehensively monitor the program execution records on the user terminal and analyze them through big data, thus providing a security detection method that comprehensively understands security issues such as hacker attack behaviors.

[0049] In related technologies, EDR solutions generally implement security detection by a collection agent deployed on the user terminal, advanced analysis functions in the cloud, and security operators. Among them, the agent is only responsible for data collection, and most of the data analysis functions are deployed in the cloud. This solution inevitably brings heavy bandwidth and storage costs. At the same time, as the number of terminals connected to the cloud increases, it will cause greater computing pressure and lose the real-time detection. In addition, due to the large volume of certain types of data, it is impossible to send all of them to the cloud, such as reading files, reading registries, memory operations, etc. If you rely entirely on cloud analysis, you will lose key attack details.

[0050] In order to solve the cost and latency issues caused by uploading massive amounts of raw events to the cloud while retaining the cloud's ability to detect complex threats, this application embodiment proposes a cloud-edge collaborative security detection method. For example, this method can be applied to Figure 1 In the implementation environment shown. Figure 1 As shown, the implementation environment includes a cloud device 101 and an agent device 102. Each agent device 102 is connected to the cloud device 101 in a wired or wireless manner. The number of agent devices 102 can be multiple. Figure 1 Only three proxy devices 102 are shown as an example for illustration. Among them, the embodiment of the present application does not limit the product form of the cloud device 101 and the proxy device 102. For example, the cloud device 101 can be a cloud server, a cloud server cluster, a separate cloud device, or other devices that can implement security detection in the cloud. The proxy device 102 is responsible for collecting the original operations of non-cloud devices such as terminals, and can be deployed on various types of user terminal devices, such as desktops, notebooks, handheld terminals, and servers.

[0051] Exemplarily, the implementation environment may also adopt Figure 2 The distributed architecture deployment shown in the figure, Figure 2 In the implementation environment, the management and analysis platform and multiple agent devices (Agent), wherein the management and analysis platform can be deployed on Figure 1 On the cloud device 101 shown, for example, the management and analysis platform can be deployed on a public cloud or on an enterprise private cloud or a physical server. Figure 2 The proxy device in can be Figure 1 The proxy device shown is for Figure 2 Any agent device in the cloud, the agent device includes a collection module, a graph streaming processing engine (GSP) engine and a reporting module. The agent is a collection agent, which is responsible for collecting the original operations on the terminal through the collection module, collecting data and sending it to the GSP engine to complete local analysis, and executing response actions based on the analysis results, such as local disposal of events with security issues. Optionally, the GSP engine can also perform at least one of filtering and aggregation of events according to the configuration issued by the cloud device, and send the processed events to the management and analysis platform of the cloud device through the reporting module. The management and analysis platform includes an interface display module, an operation platform, a configuration issuance module, an analysis module and a storage module. The original events from each terminal are collected and saved through the operation platform, and the events from different terminals are analyzed more deeply through the analysis module to detect security issues that cannot be found in a single terminal and a short time window. For example, the threat information library, cross-terminal events, and historical statistical data are combined for correlation analysis to detect events with security issues such as advanced threats missed in a single terminal. In addition, the cloud device can also provide interface display functions through the interface display module, and the enterprise administrator or security operation personnel can view security threat events or conduct active detection through the operation platform, and send collection strategies and other configurations through the configuration sending module. In addition, the storage module can also store processing logs, etc., for subsequent analysis.

[0052] See also Figure 3 The security detection method provided in the embodiment of the present application may include but is not limited to the following steps S301-S306.

[0053] In S301 , the agent device collects a first event.

[0054] The embodiment of the present application does not limit the triggering conditions for the agent device to collect the first event. It can be real-time collection, or it can be triggered after receiving the collection instruction, or it can be periodic triggering of the collection of the first event. For example, the cloud device sends a collection strategy to each agent device, and the collection strategy is used for the agent device to collect the first event. Therefore, the agent device collects the first event, including: collecting the first event according to the collection strategy issued by the cloud device or the collection configuration of the agent device. Among them, the first event is an operation event on the terminal connected to the agent device management, and the embodiment of the present application does not limit the type and quantity of the first event. For example, the first event may include a process start event, file read / write / rename / delete / create / modify security attributes, network transmission and reception, registry creation / modification / deletion, memory read / write / modify attributes, inter-process communication (IPC), local procedure call (LPC), process injection, thread start and stop, thread call stack, user mouse event, universal serial bus (USB) hardware event, etc.

[0055] In S302, the proxy device performs a first security detection on the first event to obtain a first detection result.

[0056] In the embodiment of the present application, the data corresponding to the first event collected from the terminal usually shows obvious graph features, or is called a subject-predicate-object structure, such as the "PROC_FORK (derive instruction process)" event describing process A generating child process B, and the "FILE_WRITE (write file)" event describing process A writing data to file B. Therefore, the EDR original event, that is, the first event, can be mapped to a dependency edge of "(head)-[edge]->(tail)", and the detection and association of complex threats can be completed with the help of the graph model. For example, the above-mentioned process fork (derive) event will be converted into

[0057] (A process: pid = 9) - [PROC_FORK: cmdLine = XXX] --> (B process: pid = 99) dependency edge. This graph data structure built based on the original EDR event is called a provenance graph (PG).

[0058] In one possible implementation, the proxy device performs a first security check on the first event and obtains a first detection result, including: converting the first event into a traceability graph, the traceability graph includes multiple nodes and edges, the nodes represent different types of system entities included in the first event, the edges represent the operational relationship between the system entities corresponding to the connected nodes, and the nodes and edges each have corresponding attribute information; performing a first security check on the first event based on the traceability graph to obtain a first detection result.

[0059] by Figure 4 As an example, the system entities in the event can be represented by different types of nodes. System entities include but are not limited to processes, networks, files, registries, domain name systems (DNS), etc. Figure 4 In the system, nodes of different shapes can be used to represent the operational relationships between system entities, and the operational relationships between system entities are represented by different types of dependency edges. The direction of the dependency edge represents the actual direction of dependency diffusion. Each type of node has a universally unique identifier (UUID). For example, processes have their own process UUIDs, and files are uniquely identified by full paths. Similarly, the registry is uniquely identified by full paths. In addition, both nodes and edges can carry additional attribute information for security analysis. For example, process nodes can carry attributes such as process identifier (PID), command line (cmdLine), message digest algorithm (message-digest algorithm version.5, MD5), and file nodes can carry attributes such as creation time, last modification time, and md5.

[0060] Among them, converting the first event into a traceability graph includes but is not limited to: obtaining a traceability graph model, the traceability graph model includes the types of nodes and edges and the definition of fields, and also includes descriptive information for converting the event into a graph structure; determining the nodes and edges corresponding to the first event through the traceability graph model, and converting the first event into a traceability graph according to the nodes and edges corresponding to the first event.

[0061] Among them, the tracing graph model (Scheme) can be sent from the cloud device to the proxy device, or it can be built-in to the proxy device, by converting the original event into a dependent edge structure of (head)-[edge]->(tail). The Scheme here refers to the definition of a tracing graph model, which includes the types of nodes and edges and the definition of each field, as well as a description of how to convert the graph structure according to the original event. A hidden prerequisite for the successful conversion of the graph structure is that the original event sent by the collection end contains all the necessary fields. There are many methods in the industry for event collection through kernel state or user state code, which will not be repeated in the embodiments of this application. The Scheme can be dynamically adjusted according to demand to adapt to the new downstream analysis module. Taking the original events of process creation, file modification, and registry modification operations in Table 1 below, that is, the first event, as an example, a possible tracing graph model is described.

[0062] Table 1

[0063]

[0064] For example, the process can be as follows Figure 6 As shown, the proxy device sends the collected first event to the GSP in real time. After the GSP uses the built-in or cloud-based traceability graph model to determine the nodes and edges corresponding to the first event, it will transform the first event into dependent edges. After obtaining the graph structure, the dependent edges, that is, the determined nodes and edges, are inserted into the traceability graph in real time to complete the real-time update and security detection of the traceability graph. In a possible implementation, the GSP can implement the caching of graph data and the update and elimination of expired data based on a circular queue to ensure that the engine memory usage does not exceed the limit. For example, the default configuration is that the GSP caches the latest reference number of events, such as 10,000 events. The reference number can be modified according to the memory usage and the desired detection effect. With this mechanism, the newly occurring event will automatically update the earliest event. After updating the graph structure, that is, obtaining the traceability graph, you can enter the real-time detection process, output the detected events with security issues, and trigger subsequent disposal; then continue to process the next first event.

[0065] The detection process can also be Figure 7 As shown in the figure, the GSP engine receives the first event sent by the collection end in real time. The GSP engine supports the attachment of different custom detection operators (user define function, UDF), which are designed based on the concept of real-time graph computing to meet performance constraints and detection latency requirements. For example, abnormal subgraph detection based on RiskScore accumulation, attack path detection based on streaming attack indicators (indicator of attack, IOA) matching, etc. If any operator detects a threat, that is, if an event with a security problem is detected, an alarm result will be output.

[0066] In one possible implementation, a first security check is performed on the first event based on the provenance graph, including: matching the provenance graph with each security rule, assigning a corresponding alarm label and alarm value (also called a risk score (riskScore)) to the subgraph that hits any security rule, and the alarm label is used to indicate the alarm type; when the accumulated alarm value of the provenance graph exceeds the alarm threshold, the alarm label assigned to the provenance graph is matched with the security rule combination, and when the alarm label assigned to the provenance graph hits the security rule combination, the subgraph assigned the alarm label is determined as a target subgraph with a security issue, and the event corresponding to the target subgraph is used as a target event with a security issue to obtain a first detection result, and the first detection result includes the target subgraph and the target event. Among them, when the behavioral alarm labels are converged in real time along the provenance graph, such as Figure 7 As shown, the virus alarm results can also be aggregated and then the riskScore is accumulated. When the accumulated alarm value of the traceability graph exceeds the alarm threshold, the alarm label assigned to the traceability graph is sent to the multi-mode rule engine, which matches it with the security rule combination. When the multi-mode combination described by the rule in the security rule combination is hit, the threat event (that is, the above-mentioned target event) and the threat subgraph (that is, the above-mentioned target event) are output. After that, the threat subgraph is sent to the disposal module to complete the disposal and reporting.

[0067] The embodiments of the present application do not limit the content and number of security rules, and security rules can also be called single-mode matching rules. An example of a single-mode matching rule, i.e., a security rule, is as follows:

[0068]

[0069]

[0070] Exemplarily, the embodiments of the present application do not limit the content of the security rule combination. For example, an example of a multi-pattern matching rule, that is, a security rule combination, is as follows:

[0071]

[0072] Attack path detection based on streaming IOA matching and abnormal subgraph detection based on riskScore accumulation are implementation methods of the above detection process. Both of them transmit and converge alarm labels along the traceability graph. The propagation direction can be one-way transmission or convergence along the subgraph. The embodiments of this application will not be described one by one here.

[0073] Regardless of the detection method used, after performing a first security detection on the first event and obtaining the first detection result, it also includes: when the first detection result indicates that there is a security problem with the first event, processing the first event according to the disposal strategy; logging the disposal process and disposal results. For example, when the proxy device detects a first event with a security problem, it notifies the user through a pop-up window or other mechanism, and logs the disposal process and disposal results. In addition, the embodiment of the present application does not limit the way in which the first event is processed according to the disposal strategy. For example, if the calculation result shows that a threatening event has occurred, that is, an event with a security problem, a subsequent response is triggered, which includes but is not limited to local disposal and sending to a cloud device. For example, the proxy device can deeply dispose along the traceability graph, kill processes, isolate virus samples, restore registry modifications, clean up scheduled tasks / services, etc.

[0074] In summary, if Figure 8 As shown, the proxy device collects the original first event and sends it to the GSP. The GSP engine implements cache self-elimination based on the circular queue to ensure stable memory usage. At the same time, the detection logic is designed based on the real-time graph computing concept, so as to ensure high performance and real-time detection. Finally, local processing is performed based on the detection results of the GSP engine (such as the threat subgraph obtained, which is also the target subgraph mentioned above). After the detection is completed, the detection completion signal can be output to exit the detection process.

[0075] In S303, the proxy device processes the first event to obtain a second event, and the data volume of the second event is smaller than the data volume of the first event.

[0076] In the cloud-edge collaboration method adopted in the embodiment of the present application, in addition to performing security detection locally, the proxy device can also process the first event to obtain a second event with a data volume less than the data volume of the first event. The second event can be subsequently reported to the cloud device, thereby realizing cloud-edge collaboration. Among them, the embodiment of the present application does not limit the way in which the proxy device processes the first event, and it is sufficient to reduce the data volume of the first event and ensure that the data reflected by the second event is not missing. For example, the proxy device can use at least one of filtering and aggregation to process the first event. The filtering configuration includes but is not limited to overall filtering based on the above-mentioned event types, and also includes filtering based on specific objects such as trusted application lists (also called white lists), trusted IP / DNS, program hashes, etc.

[0077] Exemplarily, the first event is processed to obtain the second event, including but not limited to the following processing methods.

[0078] Processing method 1: filter the first event that hits the security whitelist, and use the first event that is not filtered as the second event.

[0079] The security whitelist used in the first processing method can be sent from the cloud device to each proxy device, and the proxy device can filter the first event to obtain the second event. For specific tenants or machines, security operators can configure the filtering whitelist as needed to filter a large number of events in the security whitelist, thereby reducing bandwidth and storage pressure. The proxy device only reports events that require attention, that is, events that are not in the security whitelist. It should be noted that the reporting filter occurs after the graph engine has fully analyzed the event. Only events that hit the security whitelist and the graph engine does not detect suspicious signals will be filtered. As shown in Table 2 below, this is an example of application events in the security whitelist that can be filtered.

[0080] Table 2

[0081] Process belongs to the software Process (with path suffix) operate Operation Object XXX software xyz\xxx\xxx\xyz.exe write speedmem2.hg-xxx XX Security Software xx\xxx\xxx\xxx.exe write config.db-xxx XX software xxx\xxx\xxx\xxx.exe write FailRecord.dat-xxx

[0082] Processing method 2 is to aggregate repeated events in the first event and obtain the second event according to the aggregation result.

[0083] Since the original first event collected will contain a lot of duplicate data, such as a process continuously writing data to a log file, or a remote conference program continuously accessing the same network address. For threat detection and attack investigation, it is possible to complete event aggregation and deduplication without losing attack dependencies. Therefore, after the original first event is analyzed by the GSP graph engine, it will complete the event aggregation based on the consistency of <head-edge-tail>, and report the aggregation times and intervals at a certain interval. Figure 5 Taking the aggregate reporting process based on the GSP engine shown in as an example, Table 3 shows examples of repeated events that can be aggregated in actual machines.

[0084] Table 3

[0085] Process (header) Operation (edge) Operation object (tail) Repetitions svchost.exe write svrpfsyslog-xxx 34193 jamshare.exe write 2023-04-07.log-xxx 30927 grafana.exe write grafana.db-xxx 2397

[0086] Processing method three: filter the first event that hits the security whitelist, aggregate the repeated events in the first event that are not filtered, and obtain the second event according to the aggregation result.

[0087] In the third processing method, the process of filtering the first event can refer to the first processing method, and the process of aggregating repeated events in the unfiltered first event can refer to the second processing method, which will not be described again here.

[0088] Processing method four is to aggregate repeated events in the first event, filter the first event that hits the security whitelist in the aggregation result, and use the first event that is not filtered as the second event.

[0089] The difference between the processing method 4 and the processing method 3 is that the order of aggregation and filtering is different. The process of aggregation and filtering can refer to the above-mentioned processing method 1 and processing method 2, which will not be repeated here.

[0090] In S304, the proxy device sends the first detection result and the second event to the cloud device, and the first detection result and the second event are used by the cloud device to perform a second security detection on the second event to obtain a second detection result.

[0091] Based on the above S301-S303 process, the proxy device obtains the first detection result and the second event, and sends the first detection result and the second event to the cloud device, which performs further detection to achieve cloud-edge collaborative security detection. The embodiment of the present application does not limit the timing and method of the proxy device sending the first detection result and the second event to the cloud device. For example, after the proxy device detects and obtains the first detection result, it can send the first detection result to the cloud device, or after detecting and obtaining the first detection result and processing the second event, it can send the first detection result and the second event together to the cloud device. Alternatively, after the proxy device receives the receive or obtain instruction sent by the cloud device, it sends the first detection result and the second event to the cloud device.

[0092] In S305, the cloud device receives the first detection result and the second event sent by each proxy device. The second event is obtained after the proxy device collects the first event and processes the first event. The data volume of the second event is smaller than the data volume of the first event.

[0093] As described in S304 above, the proxy device can send the first detection result and the second event separately to the cloud device, and the cloud device receives the first detection result and the second event separately. If the proxy device sends the first detection result and the second event together to the cloud device, the cloud device receives the first detection result and the second event together.

[0094] In S306, the cloud device performs a second security check on the second event based on the first detection result and the second event to obtain a second detection result.

[0095] In a possible implementation, after receiving the second event, the cloud device may also obtain a traceability diagram and perform a security check based on the traceability diagram. The embodiment of the present application does not limit the manner in which the cloud device performs a security check on the second event. Exemplarily, the cloud device performs a second security check on the second event based on the first test result and the second event to obtain a second test result, including: performing a correlation analysis on the second event sent by each proxy device in combination with a security information library, cross-device events, historical statistical data, and the first test result, and obtaining a second test result based on the correlation analysis result.

[0096] For example, after the management and analysis platform receives the second event and the first detection result, it stores them in the big data platform, which can be a data lake or a graph database. Afterwards, the management and analysis platform combines historical statistical information, cross-terminal data, and cross-data source information (static detection combined with the security information library) to complete the correlation analysis to detect missed advanced threats. This detection can be triggered in real time or at a scheduled time. For example, this detection can also be actively triggered by security operations personnel to conduct attack investigations and security detections.

[0097] The cloud device performs a second security check on the second event to obtain a second detection result, including: when the second detection result indicates that the second event has a security issue, the second event is processed according to the disposal strategy. The embodiment of the present application does not limit the manner in which the cloud device processes the second event. For example, the detected threat event, i.e., the event with a security issue, is presented on a page, and the security operator completes the disposal.

[0098] The method provided in the embodiment of the present application realizes security detection through cloud-edge collaboration, solves the storage and performance problems of real-time graph computing, and has higher detection accuracy and real-time performance for complex threats. Since the data volume of the second event is smaller than that of the first event, the original first event is sent less, and only the key second event is reported to the cloud, which improves the detection efficiency and saves bandwidth. The cloud device can ensure the recall rate and traceability integrity of complex threats. In addition, since the first event collected by the proxy device can be implemented according to the collection strategy issued by the cloud device, the cloud device can also issue filtering configurations to the proxy device. Therefore, in addition to passively receiving the data reported by the proxy device, the cloud can also dynamically adjust the collection, detection and filtering configurations of the proxy device.

[0099] The above introduces the security detection method provided by the embodiment of the present application. Corresponding to the above method, the embodiment of the present application also provides a security detection device. Fig. 9 is a schematic diagram of a safety detection device provided in an embodiment of the present application, which is applied to the above Figure 3 Proxy devices in. Based on Fig. 9 As shown in the following multiple modules, the Fig. 9 The security detection device shown can perform all or part of the operations performed by the proxy device. It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown, and the embodiments of the present application are not limited to this. Fig. 9 As shown, the device comprises:

[0100] A collection module 901 is used to collect a first event;

[0101] A detection module 902, configured to perform a first security detection on a first event to obtain a first detection result;

[0102] A processing module 903 is used to process the first event to obtain a second event, where the data volume of the second event is smaller than the data volume of the first event;

[0103] The sending module 904 is used to send the first detection result and the second event to the cloud device. The first detection result and the second event are used by the cloud device to perform a second security detection on the second event to obtain a second detection result.

[0104] In a possible implementation, the collection module 901 is used to collect the first event according to the collection strategy sent by the cloud device or the collection configuration of the proxy device.

[0105] In one possible implementation, the detection module 902 is used to convert the first event into a traceability graph, where the traceability graph includes multiple nodes and edges, where the nodes represent different types of system entities included in the first event, and the edges represent the operational relationships between the system entities corresponding to the connected nodes, and the nodes and edges each have corresponding attribute information; a first security detection is performed on the first event based on the traceability graph to obtain a first detection result.

[0106] In one possible implementation, the detection module 902 is used to obtain a traceability graph model, which includes the types of nodes and edges and the definition of fields, and also includes descriptive information for converting events into a graph structure; determine the nodes and edges corresponding to the first event through the traceability graph model, and convert the first event into a traceability graph according to the nodes and edges corresponding to the first event.

[0107] In one possible implementation, the detection module 902 is used to match the traceability graph with each security rule, and assign a corresponding alarm label and alarm value to the subgraph that hits any security rule, where the alarm label is used to indicate the alarm type; when the accumulated alarm value of the traceability graph exceeds the alarm threshold, the alarm label assigned to the traceability graph is matched with the security rule combination, and when the alarm label assigned to the traceability graph hits the security rule combination, the subgraph assigned the alarm label is determined as a target subgraph with a security issue, and the event corresponding to the target subgraph is used as a target event with a security issue, to obtain a first detection result, which includes the target subgraph and the target event.

[0108] In one possible implementation, processing module 903 is used to filter the first event that hits the security whitelist, and use the unfiltered first event as the second event; or, aggregate the repeated events in the first event, and obtain the second event according to the aggregation result; or, filter the first event that hits the security whitelist, aggregate the repeated events in the unfiltered first event, and obtain the second event according to the aggregation result; or, aggregate the repeated events in the first event, filter the first event that hits the security whitelist in the aggregation result, and use the unfiltered first event as the second event.

[0109] In a possible implementation, the processing module 903 is further configured to process the first event according to a handling strategy when the first detection result indicates that the first event has a security problem; and log the handling process and handling results.

[0110] Corresponding to the above method, the embodiment of the present application also provides a security detection device. Fig.10 is a schematic diagram of a safety detection device provided in an embodiment of the present application, which is applied to the above Figure 3 Based on the cloud device. Fig.10 As shown in the following multiple modules, the Fig.10 The security detection device shown can perform all or part of the operations performed by the cloud device. It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown, and the embodiments of the present application are not limited to this. Fig.10 As shown, the device comprises:

[0111] The receiving module 1001 is used to receive the first detection result and the second event sent by each proxy device, where the second event is obtained after the proxy device collects the first event and processes the first event, and the data volume of the second event is less than the data volume of the first event;

[0112] The detection module 1002 is used to perform a second security detection on the second event according to the first detection result and the second event to obtain a second detection result.

[0113] In a possible implementation, the apparatus further includes a first sending module, configured to send a collection strategy to each proxy device, where the collection strategy is used by the proxy device to collect the first event.

[0114] In a possible implementation, the apparatus further includes a second sending module, which is used to send a security whitelist to each proxy device, where the security whitelist is used by the proxy device to filter the first event to obtain the second event.

[0115] In a possible implementation, the detection module 1002 is used to perform correlation analysis on the second events sent by each proxy device in combination with the security information library, cross-device events, historical statistical data, and the first detection result, and obtain the second detection result according to the correlation analysis result.

[0116] In a possible implementation, the detection module 1002 is configured to process the second event according to a handling strategy when the second detection result indicates that the second event has a security issue.

[0117] It should be understood that the above Fig. 9 or Fig.10 When the device provided realizes its functions, only the division of the above-mentioned functional modules is used as an example for illustration. In practical applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0118] See also Fig.11 , Fig.11 A schematic diagram of the structure of a computer device 2000 provided by an exemplary embodiment of the present application is shown. Fig.11 The computer device 2000 shown is used to execute the above Figure 3 The operations involved in the security detection method shown. The computer device 2000 is, for example, a switch, a router, etc. The computer device 2000 can be implemented by a general bus architecture.

[0119] like Fig.11 As shown, the computer device 2000 includes at least one processor 2001 , a memory 2003 , and at least one communication interface 2004 .

[0120] The processor 2001 is, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing units (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, the processor 2001 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute various logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of the present invention. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0121] Optionally, the computer device 2000 further includes a bus. The bus is used to transmit information between the components of the computer device 2000. The bus may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.11 The fact that only one line is used in the diagram does not mean that there is only one bus or only one type of bus.

[0122] The memory 2003 is, for example, a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2003 is, for example, independent and connected to the processor 2001 via a bus. The memory 2003 can also be integrated with the processor 2001.

[0123] The communication interface 2004 uses any transceiver-like device to communicate with other devices or communication networks, and the communication network can be Ethernet, radio access network (RAN) or wireless local area network (WLAN), etc. The communication interface 2004 can include a wired communication interface and can also include a wireless communication interface. Specifically, the communication interface 2004 can be an Ethernet interface, a Fast Ethernet (FE) interface, a Gigabit Ethernet (GE) interface, an Asynchronous Transfer Mode (ATM) interface, a wireless local area network (WLAN) interface, a cellular network communication interface or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface or a combination thereof. In an embodiment of the present application, the communication interface 2004 can be used for the computer device 2000 to communicate with other devices.

[0124] In a specific implementation, as an embodiment, the processor 2001 may include one or more CPUs, such as Fig.110 and CPU1 shown in FIG. Each of these processors may be a single-core CPU processor or a multi-core CPU processor. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0125] In a specific implementation, as an embodiment, the computer device 2000 may include multiple processors, such as Fig.11 2001 and 2005 are shown in FIG. Each of these processors may be a single-core CPU or a multi-core CPU. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0126] In a specific implementation, as an embodiment, the computer device 2000 may also include an output device and an input device. The output device communicates with the processor 2001 and can display information in a variety of ways. For example, the output device may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device communicates with the processor 2001 and can receive user input in a variety of ways. For example, the input device may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0127] In some embodiments, the memory 2003 is used to store the program code 2010 for executing the solution of the present application, and the processor 2001 can execute the program code 2010 stored in the memory 2003. That is, the computer device 2000 can implement the task scheduling method provided by the method embodiment through the processor 2001 and the program code 2010 in the memory 2003. The program code 2010 may include one or more software modules. Optionally, the processor 2001 itself can also store the program code or instruction for executing the solution of the present application.

[0128] In a specific embodiment, the computer device 2000 of the embodiment of the present application may correspond to the proxy device or cloud device in the above-mentioned various method embodiments, and the processor 2001 in the computer device 2000 reads the instructions in the memory 2003, so that Fig.11 The computer device 2000 shown is capable of performing all or part of the operations performed by an agent device or a cloud device.

[0129] The computer device 2000 may also correspond to the above Fig. 9 or Fig.10 In the task scheduling device shown, each functional module in the task scheduling device is implemented by software of the computer device 2000. In other words, the functional modules included in the task scheduling device are generated after the processor 2001 of the computer device 2000 reads the program code 2010 stored in the memory 2003.

[0130] in, Figure 3 Each step of the security detection method shown is completed by an integrated logic circuit of hardware or software instructions in the processor of the computer device 2000. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor, or a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0131] See also Fig.12 , Fig.12 FIG. 2 shows a schematic diagram of the structure of a computer device 2100 provided by another exemplary embodiment of the present application. Fig.12 The computer device 2100 shown is used to perform the above Figure 3 All or part of the operations involved in the security detection method shown. The computer device 2100 is, for example, a switch, a router, etc. The computer device 2100 can be implemented by a general bus architecture.

[0132] like Fig.12 As shown, the computer device 2100 includes: a main control board 2110 and an interface board 2130 .

[0133] The main control board is also called the main processing unit (MPU) or route processor card. The main control board 2110 is used to control and manage various components in the computer device 2100, including routing calculation, device management, device maintenance, and protocol processing functions. The main control board 2110 includes: a central processing unit 2111 and a memory 2112.

[0134] The interface board 2130 is also called a line processing unit (LPU), a line card (linecard) or a service board. The interface board 2130 is used to provide various service interfaces and realize the forwarding of data packets. The service interface includes but is not limited to an Ethernet interface, a POS (Packet over SONET / SDH) interface, etc., and the Ethernet interface is, for example, a Flexible Ethernet Service Interface (Flexible Ethernet Clients, FlexE Clients). The interface board 2130 includes: a central processing unit 2131, a network processor 2132, a forwarding table entry memory 2134 and a physical interface card (physical interface card, PIC) 2133.

[0135] The central processor 2131 on the interface board 2130 is used to control and manage the interface board 2130 and communicate with the central processor 2111 on the main control board 2110 .

[0136] The network processor 2132 is used to implement the forwarding processing of the message. The network processor 2132 can be in the form of a forwarding chip. The forwarding chip can be a network processor (NP). In some embodiments, the forwarding chip can be implemented by an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA). Specifically, the network processor 2132 is used to forward the received message based on the forwarding table stored in the forwarding table entry memory 2134. If the destination address of the message is the address of the computer device 2100, the message is sent to the CPU (such as the central processor 2131) for processing; if the destination address of the message is not the address of the computer device 2100, the next hop and the output interface corresponding to the destination address are found from the forwarding table according to the destination address, and the message is forwarded to the output interface corresponding to the destination address. Among them, the processing of the uplink message may include: processing of the message input interface, forwarding table search; the processing of the downlink message may include: forwarding table search, etc. In some embodiments, the central processor can also perform the function of the forwarding chip, such as implementing software forwarding based on a general-purpose CPU, so that the forwarding chip is not required in the interface board.

[0137] The physical interface card 2133 is used to implement the physical layer docking function, whereby the original traffic enters the interface board 2130, and the processed message is sent out from the physical interface card 2133. The physical interface card 2133, also called a daughter card, can be installed on the interface board 2130, and is responsible for converting the photoelectric signal into a message and forwarding the message to the network processor 2132 for processing after checking the legitimacy of the message. In some embodiments, the central processor 2131 can also perform the functions of the network processor 2132, such as implementing software forwarding based on a general-purpose CPU, so that the network processor 2132 is not required in the physical interface card 2133.

[0138] Optionally, the computer device 2100 includes a plurality of interface boards, for example, the computer device 2100 further includes an interface board 2140, and the interface board 2140 includes: a central processing unit 2141, a network processor 2142, a forwarding table entry memory 2144, and a physical interface card 2143. The functions and implementation methods of the components in the interface board 2140 are the same or similar to those of the interface board 2130, and are not described in detail herein.

[0139] Optionally, the computer device 2100 further includes a switching fabric board 2120. The switching fabric board 2120 may also be referred to as a switch fabric unit (SFU). When the computer device 2100 has multiple interface boards, the switching fabric board 2120 is used to complete data exchange between the interface boards. For example, the interface board 2130 and the interface board 2140 may communicate via the switching fabric board 2120.

[0140] The main control board 2110 is coupled to the interface board. For example, the main control board 2110, the interface board 2130, the interface board 2140, and the switching network board 2120 are connected to the system backplane through the system bus to achieve intercommunication. In a possible implementation, an inter-process communication (IPC) channel is established between the main control board 2110 and the interface board 2130 and the interface board 2140, and the main control board 2110 and the interface board 2130 and the interface board 2140 communicate through the IPC channel.

[0141] Logically, the computer device 2100 includes a control plane and a forwarding plane. The control plane includes a main control board 2110 and a central processing unit 2111. The forwarding plane includes various components for performing forwarding, such as a forwarding table entry memory 2134, a physical interface card 2133, and a network processor 2132. The control plane performs functions such as a router, generating a forwarding table, processing signaling and protocol messages, and configuring and maintaining the status of the computer device. The control plane sends the generated forwarding table to the forwarding plane. On the forwarding plane, the network processor 2132 forwards the message received by the physical interface card 2133 based on the forwarding table sent by the control plane. The forwarding table sent by the control plane can be stored in the forwarding table entry memory 2134. In some embodiments, the control plane and the forwarding plane can be completely separated and not on the same computer device.

[0142] It is worth noting that there may be one or more main control boards, and when there are multiple boards, they may include a primary main control board and a backup main control board. There may be one or more interface boards. The stronger the data processing capability of the computer device, the more interface boards are provided. There may also be one or more physical interface cards on the interface board. There may be no switching network board, or there may be one or more switching network boards. When there are multiple switching network boards, they can jointly realize load sharing and redundant backup. Under the centralized forwarding architecture, the computer device may not need a switching network board, and the interface board is responsible for the processing function of the business data of the entire system. Under the distributed forwarding architecture, the computer device may have at least one switching network board, and the switching network board is used to realize data exchange between multiple interface boards, providing large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of computer devices with distributed architecture are greater than those of computer devices with centralized architecture. Optionally, the computer device may have only one board, that is, no switching board, and the functions of the interface board and the main control board are integrated on the board. In this case, the central processor on the interface board and the central processor on the main control board can be combined into one central processor on the board to perform the functions of the two. This type of computer device has low data exchange and processing capabilities (for example, low-end switches or routers and other computer devices). The specific architecture to be adopted depends on the specific networking deployment scenario and is not limited.

[0143] In a specific embodiment, the computer device 2100 corresponds to the above Fig. 9 or Fig.10 The device shown is applied to security detection of proxy devices or cloud devices.

[0144] The embodiment of the present application also provides a communication device, which includes: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other through an internal connection path, the memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to control the transceiver to receive signals and control the transceiver to send signals, and when the processor executes the instructions stored in the memory, the processor executes the method required to be executed by the cloud device or the proxy device.

[0145] It should be understood that the processor may be a CPU, or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the advanced reduced instruction set machine (ARM) architecture.

[0146] Further, in an optional embodiment, the memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. The memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0147] The memory may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memory. Among them, the nonvolatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM) and direct memory bus random access memory (DR RAM).

[0148] An embodiment of the present application also provides a computer-readable storage medium, in which at least one instruction is stored. The instruction is loaded and executed by a processor so that a computer implements any of the security detection methods described above.

[0149] The embodiments of the present application also provide a computer program (product), which, when executed by a computer, can enable a processor or a computer to execute the corresponding steps and / or processes in the above method embodiments.

[0150] An embodiment of the present application also provides a chip, including a processor, for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes any of the security detection methods described above.

[0151] An embodiment of the present application also provides another chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute any of the security detection methods described above.

[0152] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integration. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (solid state disk)), etc.

[0153] Those of ordinary skill in the art will appreciate that, in conjunction with the various method steps and modules described in the embodiments disclosed herein, they can be implemented in software, hardware, firmware, or any combination thereof. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0154] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0155] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer program instructions. As an example, the method of the embodiment of the present application can be described in the context of a machine executable instruction, and the machine executable instruction is such as included in the program module executed in the device on the real or virtual processor of the target. Generally speaking, a program module includes a routine, a program, a library, an object, a class, a component, a data structure, etc., which performs a specific task or realizes a specific abstract data structure. In various embodiments, the function of the program module can be merged or divided between the described program modules. The machine executable instruction for the program module can be executed in a local or distributed device. In a distributed device, the program module can be located in both a local and a remote storage medium.

[0156] The computer program code for realizing the method for the embodiment of the present application can be written in one or more programming languages. These computer program codes can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by a computer or other programmable data processing device, causes the function / operation specified in the flow chart and / or block diagram to be implemented. The program code can be executed completely on a computer, partially on a computer, as an independent software package, partially on a computer and partially on a remote computer or completely on a remote computer or server.

[0157] In the context of the embodiments of the present application, computer program codes or related data may be carried by any appropriate carrier to enable a device, apparatus or processor to perform the various processes and operations described above. Examples of carriers include signals, computer readable media, and the like.

[0158] Examples of signals may include electrical, optical, radio, acoustic or other forms of propagated signals, such as carrier waves, infrared signals, etc.

[0159] A machine-readable medium may be any tangible medium that contains or stores a program for or related to an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. More detailed examples of machine-readable storage media include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0160] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0161] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the module is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, or it can be an electrical, mechanical or other form of connection.

[0162] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0163] In addition, each functional module in each embodiment of the present application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0164] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0165] In this application, the terms "first", "second", etc. are used to distinguish between identical or similar items with substantially the same effects and functions. It should be understood that there is no logical or temporal dependency between "first", "second", and "nth", nor is there a limitation on the quantity and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another element.

[0166] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0167] The term "at least one" in this application means one or more, and the term "multiple" in this application means two or more, for example, multiple second messages means two or more second messages. The terms "system" and "network" are often used interchangeably herein.

[0168] It should be understood that the terms used in the description of the various examples herein are only for describing specific examples and are not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0169] It should also be understood that the term "and / or" used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The term "and / or" is a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this application generally indicates that the associated objects before and after are in an "or" relationship.

[0170] It should also be understood that the term “comprise” (also known as “includes,” “including,” “comprises” and / or “comprising”) when used in this specification specifies the presence of stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0171] It should also be understood that the terms "if" and "if" may be interpreted to mean "when" or "upon" or "in response to determining" or "in response to detecting." Similarly, the phrases "if it is determined that ..." or "if [a stated condition or event] is detected" may be interpreted to mean "upon determining that ..." or "in response to determining that ..." or "upon detecting [a stated condition or event]" or "in response to detecting [a stated condition or event]," depending on the context.

[0172] It should be understood that determining B based on A does not mean determining B only based on A. B can also be determined based on A and / or other information.

[0173] It should also be understood that the references to "one embodiment", "an embodiment", or "a possible implementation" throughout the specification mean that specific features, structures, or characteristics related to the embodiment or implementation are included in at least one embodiment of the present application. Therefore, the references to "in one embodiment" or "in an embodiment", or "a possible implementation" throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0174] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for security detection, characterized in that: The method is applied to a proxy device, and the method comprises: Collect the first event; Performing a first security detection on the first event to obtain a first detection result; Processing the first event to obtain a second event, wherein the amount of data of the second event is smaller than the amount of data of the first event; The first detection result and the second event are sent to a cloud device, where the first detection result and the second event are used by the cloud device to perform a second security detection on the second event to obtain a second detection result.

2. The method according to claim 1, characterized in that The collecting of the first event comprises: The first event is collected according to the collection strategy sent by the cloud device or the collection configuration of the proxy device.

3. The method according to claim 1 or 2, characterized in that: The performing a first security detection on the first event to obtain a first detection result includes: Converting the first event into a traceability graph, wherein the traceability graph includes a plurality of nodes and edges, wherein the nodes represent different types of system entities included in the first event, and the edges represent operation relationships between system entities corresponding to the connected nodes, and the nodes and edges each have corresponding attribute information; A first security check is performed on the first event based on the source tracing diagram to obtain a first check result.

4. The method according to claim 3, characterized in that The converting the first event into a traceability graph includes: Obtaining a traceability graph model, wherein the traceability graph model includes definitions of node and edge types and fields, and also includes description information for converting an event into a graph structure; The nodes and edges corresponding to the first event are determined through the traceability graph model, and the first event is converted into a traceability graph according to the nodes and edges corresponding to the first event.

5. The method according to claim 3 or 4, characterized in that: The performing a first security detection on the first event based on the tracing graph includes: Match the traceability graph with each security rule, and assign a corresponding alarm label and alarm value to the subgraph that hits any security rule, wherein the alarm label is used to indicate the alarm type; When the accumulated alarm value of the traceability graph exceeds the alarm threshold, the alarm label assigned to the traceability graph is matched with the security rule combination. When the alarm label assigned to the traceability graph hits the security rule combination, the subgraph assigned with the alarm label is determined as the target subgraph with a security issue, and the event corresponding to the target subgraph is used as the target event with a security issue to obtain a first detection result, which includes the target subgraph and the target event.

6. The method according to any one of claims 1 to 5, characterized in that: The processing of the first event to obtain a second event includes: Filter the first event that hits the security whitelist, and use the first event that is not filtered as the second event; Alternatively, repeated events in the first event are aggregated, and the second event is obtained according to the aggregation result; Alternatively, the first event that hits the security whitelist is filtered, repeated events in the first event that are not filtered are aggregated, and the second event is obtained according to the aggregation result; Alternatively, repeated events in the first events are aggregated, first events that hit the security whitelist in the aggregation results are filtered, and unfiltered first events are used as the second events.

7. The method according to any one of claims 1 to 6, characterized in that: After performing a first security check on the first event and obtaining a first check result, the method further includes: When the first detection result indicates that the first event has a security problem, processing the first event according to a handling strategy; Keep a log of the disposal process and disposal results.

8. A safety detection method, characterized in that: The method is applied to a cloud device, and the method includes: receiving a first detection result and a second event sent by each proxy device, where the second event is obtained after the proxy device collects the first event and processes the first event, and the data volume of the second event is smaller than the data volume of the first event; A second safety check is performed on the second event according to the first detection result and the second event to obtain a second detection result.

9. The method according to claim 8, characterized in that Before receiving the first detection result and the second event sent by each proxy device, the method further includes: A collection strategy is issued to each of the proxy devices, where the collection strategy is used by the proxy device to collect the first event.

10. The method according to claim 8 or 9, characterized in that: Before receiving the first detection result and the second event sent by each proxy device, the method further includes: A security whitelist is issued to each of the proxy devices, where the security whitelist is used by the proxy device to filter the first event to obtain the second event.

11. The method according to any one of claims 8 to 10, characterized in that: The performing a second security detection on the second event according to the first detection result and the second event to obtain a second detection result includes: The second events sent by the respective proxy devices are subjected to correlation analysis in combination with the security information library, cross-device events, historical statistical data, and the first detection result, and the second detection result is obtained according to the correlation analysis result.

12. The method according to any one of claims 8 to 11, characterized in that: The performing a second security detection on the second event to obtain a second detection result includes: When the second detection result indicates that the second event has a security issue, the second event is processed according to a handling strategy.

13. A safety detection device, characterized in that: The device comprises: A transceiver module, used to perform the receiving and / or sending related operations performed by the security detection device in the method according to any one of claims 1 to 7; A processing module, used to perform other operations besides the receiving and / or sending related operations performed by the security detection device in the method described in any one of claims 1 to 7.

14. A safety detection device, characterized in that: The device comprises: A transceiver module, used to perform the receiving and / or sending related operations performed by the security detection device in the method described in any one of claims 8 to 12; A processing module, used to perform other operations besides the receiving and / or sending related operations performed by the security detection device in the method described in any one of claims 8-12.

15. A safety detection device, characterized in that: The device includes a memory and a processor; at least one instruction is stored in the memory, and the at least one instruction is loaded and executed by the processor, so that the security detection device implements the security detection method described in any one of claims 1-12.

16. A safety detection system, characterized in that: The system includes a proxy device and a cloud device, wherein the proxy device is used to execute the method described in any one of claims 1 to 7, and the cloud device is used to execute the method described in any one of claims 8 to 12.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, which is loaded and executed by a processor to implement the security detection method according to any one of claims 1 to 12.

18. A computer program product, characterized in that The computer program product includes a computer program / instructions, and the computer program / instructions are executed by a processor to enable a computer to implement the security detection method according to any one of claims 1 to 12.

Images