Command processing method and device, equipment, storage medium and program product
By scoring and processing the command association information of the detection command, identifying and processing malicious commands, the problem of poor identification of unknown variants and new attack methods in the prior art is solved, and the security and response speed of the system are improved.
Patent Information
- Application Number
- CN202411691452.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-25
- Publication Date
- 2025-02-18
AI Technical Summary
The existing malicious command detection technology relies on pattern matching of strings and engines based on specific rules, making it difficult to identify unknown variants and ever-changing attack methods, resulting in a decrease in recognition success rate and reducing the security of system operation.
By capturing the command association information of the command to be detected, the target detection data is determined, and the target data characteristics of each data type are extracted. These features are scored and processed using a scoring model, and the processing method of the detection command is determined based on the scoring results.
It improves the recognition and processing efficiency of malicious commands, enhances security protection capabilities and response speed, reduces the risk of system attacks, and ensures the stable, safe and efficient operation of the host.
Smart Images
Figure CN119475340A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a command processing method, apparatus, device, storage medium and program product, which can be applied to the field of network and information security. Background Art
[0002] As cloud computing and container technologies become the dominant force in software development, cloud-native environments have gradually become the core of current and future technological evolution. In this environment, a large number of applications and services rely on the kernel operating system for efficient execution and management. Therefore, ensuring the security and stability of these systems is not only the responsibility of relevant practitioners, but also an important part of the enterprise technology strategy.
[0003] Although cloud-native architecture brings many advantages to the flexible deployment and efficient operation of software, it also places higher demands on security protection. One of the most prominent security risks faced by operating systems is the execution of malicious commands, which may lead to the leakage of sensitive data, interruption of key services, or even complete control of the host.
[0004] Existing malicious command detection technologies mainly rely on string pattern matching and engines based on specific rules to locate malicious commands. Although these methods are relatively effective in identifying known samples, their success rate is significantly reduced for unknown variants and ever-changing attack methods, reducing the security of system operation. Summary of the invention
[0005] Based on this, it is necessary to provide a command processing method, device, equipment, storage medium and program product that can improve the security of system operation in response to the above technical problems.
[0006] In a first aspect, the present application provides a command processing method, comprising:
[0007] When a command to be detected is captured, target detection data is determined according to command association information of the command to be detected;
[0008] Determine target data features of each data type involved in target detection data;
[0009] The target data features of each data type are scored respectively, and the commands to be detected are processed according to the scoring results.
[0010] In one embodiment, determining target detection data according to command association information of the command to be detected includes:
[0011] The command association information of the command to be detected is mapped to a fixed template to obtain the original detection data corresponding to the command to be detected; the log information corresponding to the command to be detected is used to fill the original detection data to obtain the target detection data.
[0012] In one embodiment, determining target data features of each data type involved in target detection data includes:
[0013] A data analysis model is used to extract key detection data from target detection data; wherein the data analysis model is obtained by training a large language model with sample detection data corresponding to sample detection commands; the sample detection commands include sample normal detection commands and sample malicious detection commands; the key detection data is hashed and classified to obtain target data features of each data type involved in the target detection data.
[0014] In one embodiment, scoring is performed on target data features of each data type, and the command to be detected is processed according to the scoring result, including:
[0015] According to the first scoring model and the target data features of each data type, determine the target first score corresponding to each target data feature; wherein the first scoring model is obtained by training the incremental learning model with the sample data features corresponding to the sample detection command; determine whether there is at least one target data feature whose corresponding target first score is higher than the first threshold; if so, block the command to be detected; if not, perform secondary scoring processing on each target data feature, and process the command to be detected according to the secondary scoring result.
[0016] In one embodiment, determining a target first score corresponding to each target data feature according to the first scoring model and the target data feature of each data type includes:
[0017] For each target data feature, the first scoring model is used to score the target data feature to obtain an original first score corresponding to the target data feature; the original first score is weighted using the feature weight of the data type corresponding to the target data feature to obtain a target first score corresponding to the target data feature.
[0018] In one embodiment, each target data feature is subjected to secondary scoring, and the command to be detected is processed according to the secondary scoring result, including:
[0019] According to the second scoring model and the target data features of each data type, the target second score corresponding to each target data feature is determined; wherein the second scoring model is obtained by training the isolation forest model using the sample data features corresponding to the sample detection commands under normal host operation; it is determined whether there is at least one target data feature whose corresponding target second score is higher than the second threshold; if so, the command to be detected is blocked; if not, the command association information of the command to be detected is recorded.
[0020] In a second aspect, the present application further provides a command processing device, comprising:
[0021] A data determination module, used to determine target detection data according to command association information of the command to be detected when a command to be detected is captured;
[0022] A feature determination module, used to determine target data features of each data type involved in target detection data;
[0023] The scoring module is used to score the target data features of each data type respectively, and process the command to be detected according to the scoring results.
[0024] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:
[0025] When a command to be detected is captured, target detection data is determined according to command association information of the command to be detected;
[0026] Determine target data features of each data type involved in target detection data;
[0027] The target data features of each data type are scored respectively, and the commands to be detected are processed according to the scoring results.
[0028] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:
[0029] When a command to be detected is captured, target detection data is determined according to command association information of the command to be detected;
[0030] Determine target data features of each data type involved in target detection data;
[0031] The target data features of each data type are scored respectively, and the commands to be detected are processed according to the scoring results.
[0032] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:
[0033] When a command to be detected is captured, target detection data is determined according to command association information of the command to be detected;
[0034] Determine target data features of each data type involved in target detection data;
[0035] The target data features of each data type are scored respectively, and the commands to be detected are processed according to the scoring results.
[0036] The above-mentioned command processing method, device, equipment, storage medium and program product, when capturing the command to be detected, determine the target detection data according to the command association information of the command to be detected, and determine the target data features of each data type involved in the target detection data, and then score the target data features of each data type respectively, and process the command to be detected according to the scoring result. Compared with the related art, which only relies on string pattern matching, engines based on specific rules and behavioral analysis to locate malicious commands, the above-mentioned method is used to score the target data features of each data type respectively to process the command to be detected, which can improve the recognition and processing efficiency of malicious commands, improve security protection capabilities and response speed, reduce the risk of system attacks, and thus ensure stable, safe and efficient operation of the host. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0038] Figure 1 A flowchart of a command processing method in one embodiment;
[0039] Figure 2 A schematic diagram of a process for determining target data features in one embodiment;
[0040] Figure 3 A schematic diagram of a scoring process in one embodiment;
[0041] Figure 4 A schematic diagram of a flow chart of scoring processing in another embodiment;
[0042] Figure 5is a flowchart of a command processing method in another embodiment;
[0043] Figure 6 is a structural block diagram of a command processing device in one embodiment;
[0044] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION
[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0046] As cloud computing and container technologies become the dominant force in software development, cloud-native environments have gradually become the core of current and future technological evolution. In this environment, a large number of applications and services rely on the kernel operating system for efficient execution and management. Therefore, ensuring the security and stability of these systems is not only the responsibility of relevant practitioners, but also an important part of the enterprise technology strategy.
[0047] Although cloud-native architecture brings many advantages to the flexible deployment and efficient operation of software, it also places higher demands on security protection. One of the most prominent security risks faced by operating systems is the execution of malicious commands, which may lead to the leakage of sensitive data, interruption of key services, or even complete control of the host.
[0048] Existing malicious command detection technologies mainly rely on string pattern matching and engines based on specific rules to locate malicious commands. Although these methods are relatively effective in identifying known samples, their success rate is significantly reduced for unknown variants and ever-changing attack methods, reducing the security of system operation.
[0049] Based on this, in an exemplary embodiment, Figure 1 As shown, a command processing method is provided, which is described by taking the method applied to a command processing device as an example, and specifically includes the following steps:
[0050] S101, when a command to be detected is captured, target detection data is determined according to command association information of the command to be detected.
[0051] Among them, the command to be detected is the command that needs to be detected; the command association information is the command information associated with the command to be detected, for example, the full path of the command to be detected and its parameter list, etc.; the target detection data is used to characterize the data that can detect the command to be detected.
[0052] In this application, in order to capture the command to be detected (script Shell command) in time, the Extended Berkeley Packet Filter (eBPF) program can be configured and loaded into the Linux operating system kernel, and converted into BPF bytecode through compilation front-end technology; then, the eBPF program is run to capture the command to be detected.
[0053] Specifically, the BPF Compiler Collection (BCC) can be selected as a development tool to write eBPF programs, which mainly monitor system calls and their parameters to capture operations such as command execution and file access of user controls; in addition, the above eBPF programs are compiled into BPF programs using the compiler Clang and the underlying virtual machine (LLVM), and loaded into the Linux kernel through the BCC loading tool to achieve kernel-level monitoring.
[0054] In the eBPF program, for the execve system call of the execution file, the full path of the executed command and its parameter list are captured; for the openat (a way to create a file descriptor) system call, the access operation to the file is captured, and the file path and operation type (read / write) are recorded; then, the return function of the eBPF program is used to output this captured information (that is, the command association information of the command to be detected) to the user space.
[0055] When a command to be detected is captured, in an optional implementation, command association information of the command to be detected may be input into a trained data extraction model, and the data extraction model outputs target detection data based on the command association information and model parameters.
[0056] In another optional implementation, the command association information of the command to be detected can be directly mapped to a fixed data template to obtain target detection data. For example, the command association information is mapped to an array object structure provided by eBPF to obtain target detection data.
[0057] S102, determining target data features of each data type involved in the target detection data.
[0058] Among them, the target data features are data features corresponding to the target detection data under each data type.
[0059] In an optional implementation, detection data under each data type can be pre-extracted from the target detection data; then, for the detection data under each data type, the detection data under the data type can be input into a trained feature extraction model, and the feature extraction model outputs the target data features under the data type based on the detection data and model parameters.
[0060] S103, scoring the target data features of each data type respectively, and processing the command to be detected according to the scoring results.
[0061] In an optional implementation, for each target data feature of a data type, the target data feature of the data type may be compared with the standard data feature of the data type, and a score for the target data feature of the data type may be determined based on the difference in the comparison, wherein the greater the difference, the higher the score.
[0062] Furthermore, when the score of any target data feature is higher than a preset threshold, it is determined that the command to be detected is abnormal (a malicious Shell command). At this time, the command to be detected needs to be sent to the operation and maintenance personnel, who will further determine whether the command to be detected is a malicious command based on the target data features of each data type corresponding to the command to be detected.
[0063] When the scores of each target data feature are lower than the preset threshold, the command to be detected is executed normally.
[0064] In the above command processing method, when the command to be detected is captured, the target detection data is determined according to the command association information of the command to be detected, and the target data features of each data type involved in the target detection data are determined, and then the target data features of each data type are scored and processed respectively, and the command to be detected is processed according to the scoring results. Compared with the related art, which only relies on string pattern matching, engines based on specific rules, and behavioral analysis to locate malicious commands, the above method is used to process the command to be detected by scoring the target data features of each data type respectively, which can improve the recognition and processing efficiency of malicious commands, improve security protection capabilities and response speed, reduce the risk of system attacks, and thus ensure stable, safe and efficient operation of the host.
[0065] In order to ensure the comprehensiveness of the target detection data, based on the above embodiments, in the embodiments of the present application, an optional implementation method for determining the target detection data is provided, specifically, the command association information of the command to be detected is mapped to a fixed template to obtain the original detection data corresponding to the command to be detected; the log information corresponding to the command to be detected is used to fill the original detection data to obtain the target detection data.
[0066] The original detection data is the data obtained after the command association information is mapped.
[0067] In an optional implementation, the command association information of the command to be detected can be first mapped to a fixed template to obtain the original detection data corresponding to the command to be detected. For example, the command association information can be mapped to the array object structure (Map structure) provided by eBPF to obtain the original detection data D raw .
[0068] In order to ensure the comprehensiveness of the detection data, the log information corresponding to the command to be detected can be obtained from the log according to the command identifier, and the log information corresponding to the command to be detected can be used to fill the original detection data to obtain the target detection data. For example, the log record corresponding to the command to be detected can be used to fill the empty data in the original detection data to obtain the target detection data D' raw .
[0069] In the embodiment of the present application, the original detection data is filled with the log information corresponding to the command to be detected to obtain the target detection data, which can ensure the comprehensiveness and accuracy of the target detection data.
[0070] In order to ensure the accuracy of the target data features, based on the above embodiments, in the embodiments of the present application, an optional method for determining the target data features is provided, such as Figure 2 As shown, the specific steps include:
[0071] S201, using a data analysis model to extract key detection data from target detection data.
[0072] Among them, the data analysis model is obtained by training the large language model with sample detection data corresponding to sample detection commands; the sample detection commands include sample normal detection commands and sample malicious detection commands; the key detection data is detection data with key features.
[0073] In this application, a large number of labeled sample normal detection commands and sample malicious detection commands can be used to form a Shell command knowledge base, and the Shell command knowledge base can be connected to a large language model to construct a data analysis model LLM-RAG in the field of command analysis. Among them, LLM (Large Language Models) refers to a large language model that can understand, generate or translate natural language; RAG (Retrieval-Augmented Generation) is a technology that combines retrieval and generation capabilities to improve the performance of information retrieval and natural language processing tasks.
[0074] In an optional implementation, the target detection data can be directly input into a trained data analysis model, which performs lexical and semantic analysis on the target detection data and extracts a structured feature information set from each command record in the target detection data as key detection data. For example, key detection data may include but is not limited to the absolute path of the command, parameter list, timestamp, etc.
[0075] In another optional implementation, before extracting the key detection data, the target detection data may be preprocessed. Specifically, the target detection data D' raw Data cleaning is performed to remove incomplete system call tracking records in the target detection data, and to preliminarily filter out some obviously irrelevant records of the operating system itself, to obtain the cleaned detection data D clean =cleanse(D' raw ).
[0076] Furthermore, special characters (such as quotation marks and spaces) in the cleaned detection data can be escaped to obtain the escaped detection data D escape =escape(D clean ); Then, the detected data D after the escape processing escape Input to the trained data analysis model, and the data analysis model is based on the detection data D escape and model parameters, and output key detection data.
[0077] S202, performing hash processing on the key detection data, and classifying the key detection data after the hash processing to obtain target data features of each data type involved in the target detection data.
[0078] In an optional implementation, the key detection data may be hashed to obtain overall data features corresponding to the key detection data; then, the overall data features may be classified according to functional types of system call parameters to obtain target data features of each data type involved in the target detection data.
[0079] For example, a preset hash algorithm H can be used to perform hash processing on the key detection data L to obtain the overall data features =H(L). Then, the overall data features can be classified by each functional type to obtain the target data features V of each data type. sub =divide( ,T i ). Among them, T i is the i-th data type.
[0080] In an embodiment of the present application, by adopting a data analysis model, key detection data is extracted from the target detection data, and hash processing is performed on the key detection data to obtain target data features of each data type involved in the target detection data, thereby ensuring the accuracy of the target data features.
[0081] In order to ensure the reliability of the scoring process, based on the above embodiments, an optional method for scoring processing is provided in the embodiments of the present application, such as Figure 3 As shown, the specific steps include:
[0082] S301 : Determine a target first score corresponding to each target data feature according to a first scoring model and target data features of each data type.
[0083] Among them, the first scoring model is obtained by training the incremental learning model using the sample data features corresponding to the sample detection command; the target first score is the score value obtained by performing the first scoring processing on the target data features. Furthermore, the higher the target first score, the higher the maliciousness of the command to be detected.
[0084] In the present application, the sample data features corresponding to the sample detection commands can be used to train an incremental learning model (for example, a fast parallel machine learning Vowpal Wabbit model) to obtain a first scoring model so that the first scoring model can determine the malicious tendency of the command to be detected.
[0085] In an optional implementation, the target data features of each data type can be input into the first scoring model one by one, and the first scoring model outputs the target first score S corresponding to each target data feature one by one according to the target data features and model parameters. primary .
[0086] S302, determine whether there is at least one target data feature corresponding to a target first score higher than a first threshold; if so, execute S303; if not, execute S304.
[0087] Among them, the first threshold is used to characterize a numerical value that can measure the degree of abnormality of the target first score. In the present application, the first threshold can be determined by the operation and maintenance personnel based on historical experience, or based on a large number of experiments, and there is no limitation on this.
[0088] In an optional implementation, the target first score S corresponding to each target data feature can be primary , respectively compared with the first threshold S1, if there is a target first score S corresponding to any target data feature primary If the target first score S corresponding to each target data feature is higher than the first threshold S1, S303 is executed; primaryIf both are lower than the first threshold S1, S304 is executed.
[0089] S303, blocking the command to be detected.
[0090] It can be understood that since the higher the target first score is, the higher the maliciousness of the command to be detected is, therefore, when there is any target first score S corresponding to the target data feature, primary When it is higher than the first threshold S1, it proves that the command to be detected is obviously malicious. At this time, it is necessary to block the command to be detected and trigger an alarm.
[0091] Subsequently, referring to the above step S103, the command to be detected can be sent to the operation and maintenance personnel, who can further determine whether the command to be detected is a malicious command based on the target data features of each data type corresponding to the command to be detected. At the same time, the command to be detected can be used as a new sample detection command to update the data analysis model.
[0092] S304, performing secondary scoring processing on each target data feature, and processing the command to be detected according to the secondary scoring result.
[0093] The target first score S corresponding to each target data feature primary When all are lower than the first threshold value S1, in order to ensure the accuracy of command checking, it is necessary to further perform secondary scoring processing on each target data feature, and process the command to be detected according to the secondary scoring result.
[0094] In the embodiment of the present application, by adopting the first scoring model, the maliciousness of the command to be detected is preliminarily scored, thereby ensuring the accuracy of command detection.
[0095] In order to ensure the rationality of the target first score, on the basis of the above embodiments, in the embodiments of the present application, an optional method for determining the target first score is provided, specifically, for each target data feature, a first scoring model is used to score the target data feature to obtain the original first score corresponding to the target data feature; the feature weight of the data type corresponding to the target data feature is used to weight the original first score to obtain the target first score corresponding to the target data feature.
[0096] The original first score is the score output by the first scoring model.
[0097] It is understandable that in order to ensure the rationality of the target first score, the feature weight corresponding to each data type may be determined according to the importance of each data type.
[0098] In an optional implementation, for each target data feature, the target data feature may be input into a first scoring model, and the first scoring model outputs an original first score of the target data feature based on the target data feature and model parameters.
[0099] The target first score corresponding to the target data feature can be obtained by weighting the original first score of the target data feature using the feature weight of the data type corresponding to the target data feature.
[0100] In the embodiment of the present application, the original first score output by the first scoring model is weighted by adopting the feature weight of the data type to obtain the target first score, which can ensure the rationality of the target first score.
[0101] In order to ensure the reliability of the scoring process, based on the above embodiment, another optional way of scoring process is provided in the embodiment of the present application, such as Figure 4 As shown, the specific steps include:
[0102] S401, determining a target second score corresponding to each target data feature according to a second scoring model and target data features of each data type.
[0103] Among them, the second scoring model is obtained by training the isolation forest model using the sample data features corresponding to the sample detection commands under normal host operation. The target second score is a score value obtained by performing a second scoring process on the target data features. Furthermore, the higher the target second score, the higher the maliciousness of the command to be detected.
[0104] In the present application, the isolation forest model can be trained using sample data features corresponding to sample detection commands under normal host operation to obtain a second scoring model, so that the second scoring model can determine the difference between the command to be detected and the sample data features under normal operation.
[0105] In an optional implementation, the target data features of each data type may be input into the second scoring model one by one, and the second scoring model may output the original second score corresponding to each target data feature one by one based on the target data features and model parameters.
[0106] Furthermore, the original second score of each target data feature is weighted by using the feature weight of the data type corresponding to each target data feature, so as to obtain the target second score S corresponding to each target data feature. abnormal .
[0107] S402, determine whether there is at least one target data feature corresponding to a target second score higher than a second threshold; if so, execute S403; if not, execute S404.
[0108] The second threshold is used to characterize a numerical value that can measure the degree of abnormality of the target second score. In the present application, the second threshold can be determined by operation and maintenance personnel based on historical experience or based on a large number of experiments, and there is no limitation on this.
[0109] In an optional implementation, the target second score S corresponding to each target data feature can be abnormal , and are compared with the second threshold S2 respectively. If there is a target first score S corresponding to any target data feature, abnormal is higher than the second threshold S2, then execute S403; if the target first score S corresponding to each target data feature is abnormal If both are lower than the second threshold value S2, S404 is executed.
[0110] S403, blocking the command to be detected.
[0111] It can be understood that since the higher the target second score is, the higher the abnormality of the command to be detected is, therefore, when there is any target data feature corresponding to the target second score S abnormal When it is higher than the second threshold value S2, it proves that the abnormality of the command to be detected is obvious. At this time, it is necessary to block the command to be detected and trigger an alarm.
[0112] Subsequently, referring to the above step S103, the command to be detected can be sent to the operation and maintenance personnel, who can further determine whether the command to be detected is a malicious command based on the target data features of each data type corresponding to the command to be detected. At the same time, the command to be detected can be used as a new sample detection command to update the data analysis model.
[0113] S404: Record command association information of the command to be detected.
[0114] The target second score S corresponding to each target data feature abnormal When both are less than the second threshold value S2, it proves that the abnormality degree of the command to be detected is low. At this time, the command to be detected can be executed normally, and the command association information of the command to be detected and the score association score information are recorded.
[0115] In the embodiment of the present application, by adopting the second scoring model, the abnormality degree of the command to be detected is subjected to secondary scoring processing, so that the accuracy of command detection can be ensured.
[0116] Figure 5 FIG. 2 is a flowchart of a command processing method in another embodiment. Based on the above embodiment, this embodiment provides an optional example of a command processing method. Figure 5 The specific implementation process is as follows:
[0117] S501, when a command to be detected is captured, command association information of the command to be detected is mapped to a fixed template to obtain original detection data corresponding to the command to be detected.
[0118] S502, using the log information corresponding to the command to be detected to fill the original detection data to obtain target detection data.
[0119] S503, using a data analysis model to extract key detection data from the target detection data.
[0120] The data analysis model is obtained by training a large language model using sample detection data corresponding to sample detection commands; the sample detection commands include sample normal detection commands and sample malicious detection commands.
[0121] S504, performing hash processing on the key detection data, and classifying the key detection data after the hash processing to obtain target data features of each data type involved in the target detection data.
[0122] S505: Determine a target first score corresponding to each target data feature according to the first scoring model and the target data features of each data type.
[0123] Among them, the first scoring model is obtained by training the incremental learning model using the sample data features corresponding to the sample detection command.
[0124] Optionally, for each target data feature, a first scoring model is used to score the target data feature to obtain an original first score corresponding to the target data feature; the original first score is weighted using the feature weight of the data type corresponding to the target data feature to obtain a target first score corresponding to the target data feature.
[0125] S506, determining whether there is at least one target data feature corresponding to a target first score higher than a first threshold; if so, executing S509; if not, executing S507.
[0126] S507: Determine a target second score corresponding to each target data feature according to the second scoring model and the target data feature of each data type.
[0127] The second scoring model is obtained by training the isolation forest model using sample data features corresponding to sample detection commands under normal host operation.
[0128] S508, determining whether there is at least one target data feature corresponding to a target second score higher than a second threshold; if so, executing S509; if not, executing S510.
[0129] S509: Block the command to be detected.
[0130] S510: Record command association information of the command to be detected.
[0131] The specific process of the above S501-S510 can refer to the description of the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.
[0132] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.
[0133] Based on the same inventive concept, the embodiment of the present application also provides a command processing device for implementing the command processing method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more command processing device embodiments provided below can refer to the limitations on the command processing method above, and will not be repeated here.
[0134] In an exemplary embodiment, Figure 6 As shown, a command processing device 1 is provided, comprising: a data determination module 10, a feature determination module 20 and a scoring module 30, wherein:
[0135] The data determination module 10 is used to determine the target detection data according to the command association information of the command to be detected when the command to be detected is captured;
[0136] A feature determination module 20, used to determine target data features of each data type involved in target detection data;
[0137] The scoring module 30 is used to score the target data features of each data type respectively, and process the command to be detected according to the scoring results.
[0138] In an exemplary embodiment, the data determination module 10 is specifically used for:
[0139] The command association information of the command to be detected is mapped to a fixed template to obtain the original detection data corresponding to the command to be detected; the log information corresponding to the command to be detected is used to fill the original detection data to obtain the target detection data.
[0140] In an exemplary embodiment, the feature determination module 20 is specifically configured to:
[0141] A data analysis model is used to extract key detection data from target detection data; wherein the data analysis model is obtained by training a large language model with sample detection data corresponding to sample detection commands; the sample detection commands include sample normal detection commands and sample malicious detection commands; the key detection data is hashed and classified to obtain target data features of each data type involved in the target detection data.
[0142] In an exemplary embodiment, the scoring module 30 includes:
[0143] The first scoring unit is used to determine a target first score corresponding to each target data feature based on a first scoring model and target data features of each data type; wherein the first scoring model is obtained by training an incremental learning model using sample data features corresponding to sample detection commands; and to determine whether there is at least one target data feature whose corresponding target first score is higher than a first threshold; if so, blocking the command to be detected; if not, performing a secondary scoring process on each target data feature, and processing the command to be detected based on the secondary scoring result.
[0144] In an exemplary embodiment, the first scoring unit is further configured to:
[0145] For each target data feature, the first scoring model is used to score the target data feature to obtain an original first score corresponding to the target data feature; the original first score is weighted using the feature weight of the data type corresponding to the target data feature to obtain a target first score corresponding to the target data feature.
[0146] In an exemplary embodiment, the scoring module 30 further includes:
[0147] The second scoring unit is used to determine the target second score corresponding to each target data feature according to the second scoring model and the target data features of each data type; wherein the second scoring model is obtained by training the isolation forest model using the sample data features corresponding to the sample detection commands under normal host operation; and to determine whether there is at least one target data feature whose corresponding target second score is higher than a second threshold; if so, blocking the command to be detected; if not, recording the command association information of the command to be detected.
[0148] Each module in the above command processing device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.
[0149] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store command data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a command processing method is implemented.
[0150] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0151] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:
[0152] When a command to be detected is captured, target detection data is determined according to command association information of the command to be detected;
[0153] Determine target data features of each data type involved in target detection data;
[0154] The target data features of each data type are scored respectively, and the commands to be detected are processed according to the scoring results.
[0155] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:
[0156] The command association information of the command to be detected is mapped to a fixed template to obtain the original detection data corresponding to the command to be detected; the log information corresponding to the command to be detected is used to fill the original detection data to obtain the target detection data.
[0157] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:
[0158] A data analysis model is used to extract key detection data from target detection data; wherein the data analysis model is obtained by training a large language model with sample detection data corresponding to sample detection commands; the sample detection commands include sample normal detection commands and sample malicious detection commands; the key detection data is hashed and classified to obtain target data features of each data type involved in the target detection data.
[0159] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:
[0160] According to the first scoring model and the target data features of each data type, determine the target first score corresponding to each target data feature; wherein the first scoring model is obtained by training the incremental learning model with the sample data features corresponding to the sample detection command; determine whether there is at least one target data feature whose corresponding target first score is higher than the first threshold; if so, block the command to be detected; if not, perform secondary scoring processing on each target data feature, and process the command to be detected according to the secondary scoring result.
[0161] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:
[0162] For each target data feature, the first scoring model is used to score the target data feature to obtain an original first score corresponding to the target data feature; the original first score is weighted using the feature weight of the data type corresponding to the target data feature to obtain a target first score corresponding to the target data feature.
[0163] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:
[0164] According to the second scoring model and the target data features of each data type, the target second score corresponding to each target data feature is determined; wherein the second scoring model is obtained by training the isolation forest model using the sample data features corresponding to the sample detection commands under normal host operation; it is determined whether there is at least one target data feature whose corresponding target second score is higher than the second threshold; if so, the command to be detected is blocked; if not, the command association information of the command to be detected is recorded.
[0165] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:
[0166] When a command to be detected is captured, target detection data is determined according to command association information of the command to be detected;
[0167] Determine target data features of each data type involved in target detection data;
[0168] The target data features of each data type are scored respectively, and the commands to be detected are processed according to the scoring results.
[0169] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:
[0170] The command association information of the command to be detected is mapped to a fixed template to obtain the original detection data corresponding to the command to be detected; the log information corresponding to the command to be detected is used to fill the original detection data to obtain the target detection data.
[0171] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:
[0172] A data analysis model is used to extract key detection data from target detection data; wherein the data analysis model is obtained by training a large language model with sample detection data corresponding to sample detection commands; the sample detection commands include sample normal detection commands and sample malicious detection commands; the key detection data is hashed and classified to obtain target data features of each data type involved in the target detection data.
[0173] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:
[0174] According to the first scoring model and the target data features of each data type, determine the target first score corresponding to each target data feature; wherein the first scoring model is obtained by training the incremental learning model with the sample data features corresponding to the sample detection command; determine whether there is at least one target data feature whose corresponding target first score is higher than the first threshold; if so, block the command to be detected; if not, perform secondary scoring processing on each target data feature, and process the command to be detected according to the secondary scoring result.
[0175] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:
[0176] For each target data feature, the first scoring model is used to score the target data feature to obtain an original first score corresponding to the target data feature; the original first score is weighted using the feature weight of the data type corresponding to the target data feature to obtain a target first score corresponding to the target data feature.
[0177] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:
[0178] According to the second scoring model and the target data features of each data type, the target second score corresponding to each target data feature is determined; wherein the second scoring model is obtained by training the isolation forest model using the sample data features corresponding to the sample detection commands under normal host operation; it is determined whether there is at least one target data feature whose corresponding target second score is higher than the second threshold; if so, the command to be detected is blocked; if not, the command association information of the command to be detected is recorded.
[0179] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:
[0180] When a command to be detected is captured, target detection data is determined according to command association information of the command to be detected;
[0181] Determine target data features of each data type involved in target detection data;
[0182] The target data features of each data type are scored respectively, and the commands to be detected are processed according to the scoring results.
[0183] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:
[0184] The command association information of the command to be detected is mapped to a fixed template to obtain the original detection data corresponding to the command to be detected; the log information corresponding to the command to be detected is used to fill the original detection data to obtain the target detection data.
[0185] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:
[0186] A data analysis model is used to extract key detection data from target detection data; wherein the data analysis model is obtained by training a large language model with sample detection data corresponding to sample detection commands; the sample detection commands include sample normal detection commands and sample malicious detection commands; the key detection data is hashed and classified to obtain target data features of each data type involved in the target detection data.
[0187] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:
[0188] According to the first scoring model and the target data features of each data type, determine the target first score corresponding to each target data feature; wherein the first scoring model is obtained by training the incremental learning model with the sample data features corresponding to the sample detection command; determine whether there is at least one target data feature whose corresponding target first score is higher than the first threshold; if so, block the command to be detected; if not, perform secondary scoring processing on each target data feature, and process the command to be detected according to the secondary scoring result.
[0189] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:
[0190] For each target data feature, the first scoring model is used to score the target data feature to obtain an original first score corresponding to the target data feature; the original first score is weighted using the feature weight of the data type corresponding to the target data feature to obtain a target first score corresponding to the target data feature.
[0191] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:
[0192] According to the second scoring model and the target data features of each data type, the target second score corresponding to each target data feature is determined; wherein the second scoring model is obtained by training the isolation forest model using the sample data features corresponding to the sample detection commands under normal host operation; it is determined whether there is at least one target data feature whose corresponding target second score is higher than the second threshold; if so, the command to be detected is blocked; if not, the command association information of the command to be detected is recorded.
[0193] It should be noted that the data involved in this application (including but not limited to sample testing data, etc.) are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.
[0194] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.
[0195] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.
[0196] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.
Claims
1. A command processing method, characterized in that: The method comprises: In the case where a command to be detected is captured, determining target detection data according to command association information of the command to be detected; Determining target data features of each data type involved in the target detection data; The target data features of each data type are scored respectively, and the command to be detected is processed according to the scoring result.
2. The method according to claim 1, characterized in that The step of determining target detection data according to the command association information of the command to be detected includes: Mapping the command association information of the command to be detected to a fixed template to obtain original detection data corresponding to the command to be detected; The original detection data is filled with the log information corresponding to the command to be detected to obtain the target detection data.
3. The method according to claim 1, characterized in that The determining of target data features of each data type involved in the target detection data includes: A data analysis model is used to extract key detection data from the target detection data; wherein the data analysis model is obtained by training a large language model using sample detection data corresponding to sample detection commands; the sample detection commands include sample normal detection commands and sample malicious detection commands; The key detection data are hashed and classified to obtain target data features of each data type involved in the target detection data.
4. The method according to claim 1, characterized in that: The scoring process is performed on the target data features of each data type respectively, and the command to be detected is processed according to the scoring result, including: Determine a target first score corresponding to each target data feature according to the first scoring model and the target data features of each data type; wherein the first scoring model is obtained by training an incremental learning model using the sample data features corresponding to the sample detection command; Determine whether there is at least one target data feature corresponding to a target first score higher than a first threshold; If yes, blocking the command to be detected; If not, a secondary scoring process is performed on each target data feature, and the command to be detected is processed according to the secondary scoring result.
5. The method according to claim 1, characterized in that The step of determining a target first score corresponding to each target data feature according to the first scoring model and the target data features of each data type includes: For each target data feature, a first scoring model is used to score the target data feature to obtain an original first score corresponding to the target data feature; The original first score is weighted by using the feature weight of the data type corresponding to the target data feature to obtain a target first score corresponding to the target data feature.
6. The method according to claim 4, characterized in that The performing secondary scoring processing on each target data feature and processing the command to be detected according to the secondary scoring result includes: Determine a target second score corresponding to each target data feature according to the second scoring model and the target data features of each data type; wherein the second scoring model is obtained by training an isolation forest model using sample data features corresponding to sample detection commands under normal host operation; Determine whether there is at least one target data feature corresponding to a target second score higher than a second threshold; If yes, blocking the command to be detected; If not, the command association information of the command to be detected is recorded.
7. A command processing device, characterized in that: The device comprises: A data determination module, configured to determine target detection data according to command association information of the command to be detected when a command to be detected is captured; A feature determination module, used to determine target data features of each data type involved in the target detection data; The scoring module is used to score the target data features of each data type respectively, and process the command to be detected according to the scoring results.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of each of the methods of claims 1 to 6 are implemented.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method described in each of claims 1 to 6 are implemented.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in each of claims 1 to 6 are implemented.