Abnormal detection method and device, abnormal alarm method and device, data processing method and device and storage medium

Abstract

The embodiment of the invention discloses an anomaly detection method and device, an anomaly alarm method and device, a data processing method and device and a storage medium. The method comprises the steps that to-be-detected item parameters in multiple target devices are acquired; the to-be-detected item parameters comprise persistent residence parameters; and according to the to-be-detected item parameters and the baseline item parameters, determining abnormal detection results of the plurality of target devices.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to anomaly detection, anomaly alarm, data processing methods and devices, and storage media. Background Art

[0002] APT (Advanced Persistent Threat) refers to a hidden and persistent computer intrusion process, usually targeting a specific target and requiring high concealment for a long time. APT attacks contain three elements: advanced, long-term, and threat. Advanced refers to the use of complex and sophisticated malware and technology to exploit vulnerabilities in the system to execute the attack process. Long-term implies that an external force will continue to monitor a specific target and obtain data from it. Threat refers to attacks planned by humans.

[0003] In the related technology, whether there are persistent resident traces of APT attacks is determined from network traffic or host behavior data. Since this method requires obtaining a large amount of network traffic and all behavioral data of host behavior, when the data volume is large, it is impossible to find the persistent resident traces of APT attacks in time, thereby reducing the speed of APT anomaly detection. Summary of the invention

[0004] In order to solve the above technical problems, the embodiments of the present application hope to provide anomaly detection, anomaly alarm, data processing methods and devices, and storage media, which can improve the speed of APT anomaly detection.

[0005] The technical solution of this application is implemented as follows:

[0006] The present invention provides an anomaly detection method, which includes:

[0007] Acquire parameters of items to be detected in multiple target devices; the parameters of the items to be detected include persistent resident parameters;

[0008] Determine abnormality detection results of the plurality of target devices according to the parameters of the items to be detected and the baseline item parameters.

[0009] The present invention provides an abnormal alarm method, which includes:

[0010] Using a large language model, abnormal alarm information is generated according to abnormal project parameters and / or associated parameters, wherein the abnormal project parameters are project parameters corresponding to the abnormal resident items in the project parameters to be detected; and the associated parameters are parameters obtained from the abnormal device and associated with the abnormal resident items.

[0011] The present invention provides a data processing method, which includes:

[0012] Obtaining build parameters in multiple target devices; the build parameters include historical persistent resident parameters;

[0013] The baseline project parameters are built according to the build parameters.

[0014] The present application provides an abnormality detection device, the device comprising:

[0015] A first acquisition unit, used for the first acquisition unit, to acquire parameters of items to be detected in multiple target devices; the parameters of the items to be detected include persistent resident parameters;

[0016] A determination unit is used to determine the abnormality detection results of the multiple target devices according to the parameters of the items to be detected and the baseline item parameters.

[0017] The present application provides a device, which includes:

[0018] A memory, a processor and a communication bus, wherein the memory communicates with the processor via the communication bus, the memory stores an abnormality detection program executable by the processor, and when the abnormality detection program is executed, the above-mentioned abnormality detection method is executed by the processor; the memory stores an abnormality alarm program executable by the processor, and when the abnormality alarm program is executed, the above-mentioned abnormality alarm method is executed by the processor; the memory stores a data processing program executable by the processor, and when the data processing program is executed, the above-mentioned data processing method is executed by the processor.

[0019] An embodiment of the present application provides a storage medium having a computer program stored thereon, which is applied to an anomaly detection device, and is characterized in that when the computer program is executed by a processor, the above-mentioned anomaly detection method is implemented; or when the computer program is executed by a processor, the above-mentioned anomaly alarm method is implemented; or when the computer program is executed by a processor, the above-mentioned data processing method is implemented.

[0020] The embodiments of the present application provide anomaly detection, anomaly alarm, data processing methods and devices, and storage media. The anomaly detection method includes: obtaining parameters of items to be detected in multiple target devices; the parameters of the items to be detected include persistent resident parameters; and determining the anomaly detection results of multiple target devices based on the parameters of the items to be detected and the baseline project parameters. By adopting the above method to implement the scheme, the anomaly detection device obtains the parameters of the items to be detected in multiple target devices, and uses the baseline project parameters to match and detect the parameters of the items to be detected, so as to quickly determine the anomaly detection results of multiple target devices, and no longer needs to search for persistent resident traces of APT attacks from a large amount of network traffic or host behavior data, thereby improving the speed of APT anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flow chart of an anomaly detection method provided in an embodiment of the present application;

[0022] Figure 2 A flow chart of an abnormal alarm method provided in an embodiment of the present application;

[0023] Figure 3 A flow chart of a data processing method provided in an embodiment of the present application;

[0024] Figure 4 An exemplary anomaly detection schematic diagram provided for an embodiment of the present application;

[0025] Figure 5 A schematic diagram of the structure of an abnormality detection device provided in an embodiment of the present application;

[0026] Figure 6 A schematic diagram of the structure of a device provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of the structure of an abnormality alarm device provided in an embodiment of the present application;

[0028] Figure 8 A schematic diagram of the composition structure of a data processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. It should be understood that the specific embodiments described here are only used to explain the present application and are not used to limit the present application.

[0030] The present application embodiment provides an anomaly detection method, which is applied to an anomaly detection device. Figure 1 A flow chart of an abnormality detection method provided in an embodiment of the present application is as follows: Figure 1 As shown, the anomaly detection method may include:

[0031] S101, obtaining parameters of items to be detected in multiple target devices.

[0032] An anomaly detection method provided in an embodiment of the present application is suitable for a scenario in which anomaly detection is performed on multiple target devices.

[0033] In the embodiments of the present application, the abnormality detection device can be implemented in various forms. For example, the abnormality detection device described in the present application may include devices such as mobile phones, cameras, tablet computers, laptop computers, PDAs, portable media players (PMPs), navigation devices, wearable devices, smart bracelets, pedometers, and devices such as digital TVs, desktop computers, and servers.

[0034] In the embodiment of the present application, the multiple target devices may be multiple host devices within the monitoring range, such as all hosts in a company.

[0035] In an embodiment of the present application, the abnormality detection device can, upon receiving an abnormality detection instruction, begin to obtain parameters of items to be detected in multiple target devices, and perform an abnormality detection process on multiple target devices based on the parameters of the items to be detected. It can also be a process of periodically obtaining parameters of items to be detected in multiple target devices, and performing an abnormality detection process based on the parameters of the items to be detected. The specific process can be determined based on actual conditions, and the embodiment of the present application is not limited to this.

[0036] In an embodiment of the present application, the abnormality detection device obtains items to be detected from multiple target devices. Specifically, a group of project parameters corresponding to each target device can be obtained respectively, and multiple groups of project parameters corresponding to multiple target devices are obtained, that is, the parameters of the items to be detected are obtained.

[0037] In an embodiment of the present application, persistent resident items include: driver items (Drivers / lsmod), service program items (Services), scheduled task items (schtasks / cron), automatic startup items (AutoStart(win)), registration items (registry(win)), management tool items (WMI-Consumer(win)), executable program signature providers, etc.

[0038] It should be noted that executable program signature providers are used to respond to known potential supply chain attacks.

[0039] In an embodiment of the present application, the project parameters to be detected are persistent resident parameters, which include project parameters of program items (project parameters of driver items and / or project parameters of service program items), project parameters of task items (project parameters of scheduled task items), project parameters of tool items (project parameters of management tool items), project parameters of automation items (project parameters of automatic startup items), project parameters of registration items and / or operating frequency parameters of persistent resident items (operating frequency parameters), etc.

[0040] In the embodiment of the present application, operations on persistent resident items include installation operations, uninstallation operations, running operations, etc.

[0041] In the embodiment of the present application, the content of the persistent resident item is shown in Table (1):

[0042] Table (1)

[0043]

[0044] S102: Determine abnormality detection results of multiple target devices according to the parameters of the project to be detected and the baseline project parameters.

[0045] In the embodiment of the present application, after the anomaly detection device obtains the parameters of the items to be detected in multiple target devices, it can determine the anomaly detection results of the multiple target devices based on the parameters of the items to be detected and the baseline project parameters.

[0046] It should be noted that the baseline project parameters may be the project parameters corresponding to the historical persistent resident items obtained by the anomaly detection device in multiple target devices before obtaining the project parameters to be detected (i.e., build parameters, including historical project parameters of program items, historical project parameters of task items, historical project parameters of tool items, historical project parameters of automation items, historical project parameters of registration items and / or historical operation frequency parameters).

[0047] In an embodiment of the present application, the number of abnormal detection results may be one or more. When the number of abnormal detection results is multiple, the multiple target devices and the multiple abnormal detection results may correspond one-to-one (i.e., one target device corresponds to one abnormal detection result), or one-to-many (i.e., one target device corresponds to multiple abnormal detection results), or many-to-one (i.e., some of the multiple target devices correspond to one detection result, and another part of the target devices correspond to another detection result, but the some of the target devices and the other part of the target devices may overlap).

[0048] In an embodiment of the present application, the data dimension and data type of the project parameters to be detected and the baseline project parameters are the same. Specifically, if the project parameters to be detected include project parameters of driver items, project parameters of service program items, project parameters of scheduled task items, project parameters of management tool items, project parameters of automatic startup items, project parameters of registration items, and / or operation frequency parameters of persistent resident items, then the baseline project parameters include historical project parameters of driver items, historical project parameters of service program items, historical project parameters of scheduled task items, historical project parameters of management tool items, historical project parameters of automatic startup items, historical project parameters of registration items, and / or historical operation frequency parameters of persistent resident items.

[0049] In the embodiment of the present application, the abnormality detection device compares the parameters of the project to be detected with the baseline project parameters, determines the first project parameters that deviate from the baseline project parameters, and thus determines the abnormal devices according to the first project parameters, and the devices that do not deviate from the baseline project parameters are non-abnormal devices, thereby obtaining abnormality detection results (abnormal devices and non-abnormal devices) of multiple target devices. Among them, the first project parameters represent the parameters of the project to be detected that deviate from the baseline project parameters.

[0050] In an embodiment of the present application, after the anomaly detection device determines the anomaly detection results of multiple target devices based on the parameters of the project to be detected and the baseline project parameters, if the anomaly detection result is abnormal, it uses a large language model to generate abnormal alarm information corresponding to the anomaly detection result.

[0051] It should be noted that the large language model can be a model trained in the anomaly detection device, a model transmitted to the anomaly detection device by other devices, or a model obtained by the anomaly detection device through other methods. The specific method in which the anomaly detection device obtains the large language model can be determined according to actual conditions, and the embodiments of the present application do not limit this.

[0052] In an embodiment of the present application, the abnormality detection device may also use other models to generate abnormality alarm information corresponding to the abnormality detection results. The specific manner in which the abnormality detection device generates abnormality alarm information corresponding to the abnormality detection results may be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0053] It can be understood that the anomaly detection device matches the parameters of the project to be detected with the baseline project parameters to determine that the device whose parameters of the project to be detected deviate from the baseline project parameters is an abnormal device, thereby obtaining anomaly detection results for multiple target devices and improving the speed of determining the anomaly detection results.

[0054] An abnormality detection method process provided in an embodiment of the present application includes steps S101, S21-S22:

[0055] S101, obtaining parameters of items to be detected in multiple target devices.

[0056] S21. Compare the parameters of the item to be tested with the parameters of the baseline item.

[0057] In the embodiment of the present application, after the abnormality detection device obtains the parameters of the items to be detected in multiple target devices, the parameters of the items to be detected can be compared with the parameters of the baseline items.

[0058] It should be noted that the anomaly detection device compares each project parameter of each target device with the baseline project parameter of the target device under the dimension, thereby achieving a process of comparing the project parameter to be detected with the baseline project parameter.

[0059] S22: When a difference between a first project parameter in the project parameters to be detected and a first baseline project parameter in the baseline project parameters is greater than or equal to a preset difference, determine that a first target device corresponding to the first project parameter is an abnormal device.

[0060] In an embodiment of the present application, the abnormality detection device compares the parameters of the project to be detected with the baseline project parameters. When it is determined that the difference between the first project parameter in the project parameters to be detected and the first baseline project parameter in the baseline project parameters is greater than or equal to the preset difference, the first target device corresponding to the first project parameter is determined to be an abnormal device.

[0061] In the embodiment of the present application, the preset difference value may be a difference value configured in the abnormality detection device, or a value transmitted to the abnormality detection device by other devices, or a value obtained by the abnormality detection device in other ways. The specific way in which the abnormality detection device obtains the preset difference value may be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0062] It should be noted that the first item parameter represents a parameter of the item parameter to be detected that deviates from the baseline item parameter.

[0063] In the embodiment of the present application, the first project parameter is a part of the project parameters in the project parameters to be detected. The first baseline project parameter is a part of the parameters in the baseline project parameters.

[0064] In the embodiment of the present application, the first project parameter and the first baseline project parameter are project parameters of the same dimension in the same target device.

[0065] In the embodiment of the present application, the first target device is a part of the target devices among the multiple target devices. The number of the first target device can be one, or the number of the first target devices can be multiple (and the number of the multiple first target devices is less than the number of the multiple target devices). The specific number of the first target devices can be determined according to the actual situation, and the embodiment of the present application does not limit this.

[0066] In the embodiment of the present application, the number of the first target devices is the same as the number of the abnormal devices.

[0067] Among the plurality of target devices, the abnormality detection device determines a second target device other than the first target device; and determines the second target device as a non-abnormal device.

[0068] In the embodiment of the present application, after the anomaly detection device determines that the first target device corresponding to the first project parameter is an abnormal device, it determines a second target device other than the first target device among multiple target devices; and determines that the second target device is a non-abnormal device.

[0069] In the embodiment of the present application, the second target device is a part of the target devices among the multiple target devices. The number of the second target device can be one, or the number of the second target devices can be multiple (and the number of the multiple second target devices is less than the number of the multiple target devices). The specific number of the second target devices can be determined according to actual conditions, and the embodiment of the present application does not limit this.

[0070] In the embodiment of the present application, the number of the second target devices is the same as the number of the non-abnormal devices.

[0071] In the embodiment of the present application, the abnormality detection device determines abnormal devices and non-abnormal devices as multiple abnormality detection results.

[0072] In the embodiment of the present application, after the abnormality detection device determines that the second target device is a non-abnormal device, the abnormal device and the non-abnormal device are determined as a plurality of abnormality detection results.

[0073] In an embodiment of the present application, the abnormality detection device compares the parameters of the project to be detected with the baseline project parameters. When the difference between the first project parameter in the project parameters to be detected and the first baseline project parameter in the baseline project parameters is greater than or equal to the preset difference, the first target device corresponding to the first project parameter is determined to be an abnormal device. Each project parameter in the project parameters to be detected is used to predict the deviation of the project parameters to be detected, thereby determining the abnormal device, thereby improving the accuracy of determining the abnormal device.

[0074] An abnormality detection method process provided in an embodiment of the present application includes steps S101, S31-S34:

[0075] S101, obtaining parameters of items to be detected in multiple target devices.

[0076] It should be noted that the parameters of the items to be detected also include the number of each persistent resident item resident in multiple target devices.

[0077] S31. Sort the resident quantity of each persistent resident item to obtain a resident quantity sequence.

[0078] In the embodiment of the present application, after the anomaly detection device obtains the parameters of the items to be detected in multiple target devices, it can sort the resident quantity of each persistent resident item to obtain a resident quantity sequence.

[0079] In an embodiment of the present application, the process of an anomaly detection device sorting the resident quantity of each persistent resident item to obtain a resident quantity sequence includes: in multiple target devices, respectively determining the number of resident devices of each dimension of the persistent resident item in the resident persistent resident item to obtain multiple resident quantities; then sorting the multiple resident quantities according to the quantity values ​​of the multiple resident quantities to obtain a resident quantity sequence.

[0080] In an embodiment of the present application, the abnormality detection device determines the number of resident devices of each persistent resident item in the resident persistent items in multiple target devices respectively to obtain a plurality of resident quantities, including: determining the number of devices in which the first persistent resident item in the multiple persistent resident items exists in the multiple target devices to obtain a first resident quantity; determining the number of devices in which the second dimension persistent resident items in the multiple persistent resident items exist in the multiple target devices to obtain a second resident quantity, until multiple resident quantities corresponding to the multiple persistent resident items are determined in the multiple target devices; the multiple resident quantities include the first resident quantity and the second resident quantity.

[0081] In an embodiment of the present application, an abnormality detection device determines, among multiple target devices, the number of devices having persistent resident items of a first dimension among multiple persistent resident items, and obtains a first resident quantity; determines, among multiple target devices, the number of devices having persistent resident items of a second dimension among multiple persistent resident items, and obtains a second resident quantity; ... determines, among multiple target devices, the number of devices having persistent resident items of a last dimension among multiple persistent resident items, and obtains a last resident quantity; and takes the first resident quantity, the second resident quantity, ..., the last resident quantity as multiple resident quantities.

[0082] In an embodiment of the present application, the abnormality detection device sorts the multiple resident quantities according to the quantity values ​​of the multiple resident quantities to obtain a resident quantity sequence.

[0083] In an embodiment of the present application, the anomaly detection device determines the number of resident devices of each persistent resident item in multiple target devices respectively. After obtaining multiple resident quantities, the multiple resident quantities are sorted according to the quantity values ​​of the multiple resident quantities to obtain a resident quantity sequence.

[0084] In an embodiment of the present application, the abnormality detection device can sort the multiple resident quantities in order of the quantity values ​​from small to large according to the sizes of the multiple resident quantities to obtain a resident quantity sequence; or it can sort the multiple resident quantities in order of the quantity values ​​from large to small to obtain a resident quantity sequence. The specific method of sorting the multiple resident quantities to obtain the resident quantity sequence can be determined according to actual conditions, and the embodiment of the present application does not limit this.

[0085] S32. Determine a first detection result according to the resident quantity sequence.

[0086] In an embodiment of the present application, the process of an abnormality detection device determining a first detection result based on a resident number sequence includes determining, from a plurality of target devices, a first target device corresponding to the two end points of the resident number sequence; and determining that the first target device is an abnormal device; determining a second target device other than the first target device among the plurality of target devices; and determining that the second target device is a non-abnormal device; and taking the abnormal device and the non-abnormal device as a plurality of abnormality detection results.

[0087] In an embodiment of the present application, the abnormality detection device sorts multiple resident quantities according to the quantity values ​​of the multiple resident quantities. After obtaining the resident quantity sequence, the first target device corresponding to the two end points of the resident quantity sequence can be determined from the multiple target devices; and the first target device is determined to be an abnormal device.

[0088] In the embodiment of the present application, the two endpoints of the resident quantity sequence are the head end and the tail end of the resident quantity sequence. That is, the first target resident quantity with the largest quantity value and the second target resident quantity with the smallest quantity value are selected from the resident quantity sequence. The devices corresponding to the first target resident quantity and the second target resident quantity are used as the first target devices.

[0089] In the embodiment of the present application, the first target device corresponding to an end point of the resident quantity sequence can also be determined from multiple target devices, that is, the first target resident quantity with the largest quantity value or the second target resident quantity with the smallest quantity value is selected from the resident quantity sequence, and the device corresponding to the first target resident quantity or the second target resident quantity is used as the first target device.

[0090] S33: Determine a second test result based on a comparison result between the parameters of the item to be tested and the parameters of the baseline item.

[0091] In an embodiment of the present application, the abnormality detection device may first determine the first detection result according to the resident number sequence, and then determine the second detection result according to the comparison result between the parameters of the item to be detected and the parameters of the baseline item. The second detection result may also be determined first according to the comparison result between the parameters of the item to be detected and the parameters of the baseline item, and then the first detection result may be determined according to the resident number sequence. The second detection result may also be determined according to the comparison result between the parameters of the item to be detected and the parameters of the baseline item while the first detection result is determined according to the resident number sequence.

[0092] In an embodiment of the present application, the abnormality detection device determines the second detection result according to the comparison result of the parameters of the project to be detected and the baseline project parameters. The process can be to compare the parameters of the project to be detected and the baseline project parameters, and when the difference between the first project parameter in the parameters of the project to be detected and the first baseline project parameter in the baseline project parameters is greater than or equal to the preset difference, determine that the first target device corresponding to the first project parameter is an abnormal device. Then determine the second target device other than the first target device; and determine that the second target device is a non-abnormal device. Finally, the abnormal device and the non-abnormal device are determined as multiple abnormal detection results, that is, the second detection result is obtained.

[0093] S34. Determine an abnormal detection result according to the first detection result and the second detection result.

[0094] In the embodiment of the present application, after the abnormality detection device determines the second detection result based on the comparison result of the parameters of the item to be detected and the parameters of the baseline item, it can determine the abnormality detection result based on the first detection result and the second detection result.

[0095] In an embodiment of the present application, the process of the abnormal detection device determining the abnormal detection result based on the first detection result and the second detection result can be to treat both the abnormal devices in the first detection result and the abnormal devices in the second detection result as abnormal devices; and determine that the devices other than the abnormal devices in multiple target devices are non-abnormal devices.

[0096] It should be noted that the abnormal devices in the first detection result and the abnormal devices in the second detection result may be abnormal devices in different ranges.

[0097] Exemplarily, the number of multiple target devices is 5, namely, target device 1, target device 2, target device 3, target device 4, and target device 5; the abnormal devices in the first detection result may be target device 1 and target device 2; the abnormal devices in the second detection result may be target device 2 and target device 5, then by determining the abnormal detection result based on the first detection result and the second detection result, it can be determined that target device 1, target device 2, and target device 5 are all abnormal devices.

[0098] In an embodiment of the present application, the anomaly detection device determines a first detection result by sorting the resident quantity of each persistent resident item, and comprehensively judges the first detection result with a second detection result determined based on the comparison result of the parameters of the item to be detected and the parameters of the baseline item, thereby determining the anomaly detection results of multiple target devices, thereby improving the accuracy of determining the anomaly detection results.

[0099] An abnormality detection method process provided in an embodiment of the present application includes steps S101 and S41:

[0100] S101, obtaining parameters of items to be detected in multiple target devices.

[0101] S41 . Determine an abnormality detection result according to a project parameter change rate corresponding to the project parameter to be detected and a project parameter change rate corresponding to the baseline project parameter.

[0102] In an embodiment of the present application, after the anomaly detection device obtains the parameters of the items to be detected in multiple target devices, it can determine the anomaly detection result according to the project parameter change rate corresponding to the project parameters to be detected and the project parameter change rate corresponding to the baseline project parameters.

[0103] In an embodiment of the present application, the abnormality detection device determines the abnormality detection result according to the change rate of the project parameter corresponding to the project parameter to be detected and the change rate of the project parameter corresponding to the baseline project parameter, and the process can be to determine multiple baseline project parameter change rates corresponding to the baseline project parameter within a preset first period; determine multiple project parameter change rates corresponding to the project parameter to be detected within a preset second period; when the first change rate among the multiple project parameter change rates is different from the first baseline project parameter change rate among the multiple baseline project parameter change rates, determine that the first target device corresponding to the first change rate is an abnormal device. Determine a second target device other than the first target device among the multiple target devices, and determine that the second target device is a non-abnormal device; determine the abnormal device and the non-abnormal device as multiple abnormality detection results.

[0104] In the embodiment of the present application, the preset first period of the abnormality detection device can be one week, one month, one day, or other time lengths. The specific preset first period can be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0105] In an embodiment of the present application, the abnormality detection device may first obtain preset baseline project parameters within a preset first period from the baseline project parameters, and then determine the change rates of multiple baseline project parameters according to the preset baseline project parameters.

[0106] In an embodiment of the present application, after the abnormality detection device determines the change rates of multiple baseline project parameters corresponding to the baseline project parameters within a preset first period, it can determine the change rates of multiple project parameters corresponding to the project parameters to be detected (project parameters to be detected) within a preset second period; the abnormality detection device can also first determine the change rates of multiple project parameters corresponding to the project parameters to be detected within the preset second period, and then determine the change rates of multiple baseline project parameters corresponding to the baseline project parameters within the preset first period; the abnormality detection device can also determine the change rates of multiple baseline project parameters corresponding to the baseline project parameters within the preset first period while determining the change rates of multiple project parameters corresponding to the project parameters to be detected within the preset second period.

[0107] It should be noted that the time length of the preset first cycle is the same as the time length of the preset second cycle.

[0108] It should be noted that the multiple project parameter change rates are the change rates of the multiple project parameters to be detected over time.

[0109] In the embodiment of the present application, the project parameters to be detected are project parameters within a preset second period.

[0110] In an embodiment of the present application, the abnormality detection device can determine the change rates of multiple project parameters corresponding to the parameters of the project to be detected within a preset second period, and can also determine the change rates of multiple project parameters based on the parameters of the project to be detected and the baseline project parameters. The change rates of multiple project parameters can also be determined based on the fact that some of the parameters of the project to be detected and the baseline project parameters are close to the baseline project parameters within the preset second period. The specific method of determining the change rates of multiple project parameters corresponding to the parameters of the project to be detected can be determined according to actual conditions, and the embodiment of the present application does not limit this.

[0111] In the embodiment of the present application, the first change rate is a partial change rate among multiple project parameter change rates. The first baseline project parameter change rate is a partial change rate among multiple baseline project parameter change rates. The first change rate and the first baseline project parameter change rate are project parameter change rates in the same dimension in the same target device.

[0112] In the embodiment of the present application, the anomaly detection device may also select the first dimension project parameter with turning points or extreme points from the project parameters to be detected, and use the device corresponding to the first dimension project parameter as the first target device, and use the first target device as the abnormal device. Specifically, the method in which the anomaly detection device determines the abnormal first target device based on the project parameters to be detected can be determined according to actual conditions, and the embodiment of the present application does not limit this.

[0113] In an embodiment of the present application, the process of screening out the first dimension project parameters with turning points or extreme points from the project parameters to be detected can be to use time as the horizontal axis and the parameter value of the project parameters to be detected as the vertical axis, and draw the curves of the project parameters to be detected respectively, and screen out the target curve with turning points or extreme points in the project parameters to be detected according to the curve, and determine the first dimension project parameters corresponding to the target curve in the project parameters to be detected. It is also possible to match the data corresponding to each time point in the project parameters to be detected on the time axis, and compare the data of adjacent time nodes, so as to determine the first dimension project parameters with turning points or extreme points. It is also possible to screen out the first dimension project parameters with turning points or extreme points from the project parameters to be detected in other ways. The specific implementation method can be determined according to the actual situation, and the embodiment of the present application is not limited to this.

[0114] It can be understood that the anomaly detection device can quickly determine the anomaly detection results of multiple target devices by obtaining the parameters of the items to be detected in multiple target devices and matching the parameters of the items to be detected with the baseline project parameters. There is no need to search for persistent resident traces of APT attacks from a large amount of network traffic or host behavior data, thereby improving the speed of APT anomaly detection.

[0115] The embodiment of the present application provides an abnormality alarm method, which is applied to an abnormality alarm device. Figure 2 A flowchart of an abnormal alarm method provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the abnormal alarm method may include:

[0116] S201. Generate abnormal warning information based on abnormal project parameters and / or associated parameters using a large language model.

[0117] An abnormal alarm method provided in an embodiment of the present application is suitable for a scenario in which abnormal alarms are issued to multiple target devices.

[0118] In the embodiments of the present application, the abnormal alarm device can be implemented in various forms. For example, the abnormal alarm device described in the present application may include devices such as mobile phones, cameras, tablet computers, laptop computers, PDAs, portable media players (PMPs), navigation devices, wearable devices, smart bracelets, pedometers, and devices such as digital TVs, desktop computers, and servers.

[0119] It should be noted that the abnormal project parameters are the project parameters corresponding to the abnormal resident items in the project parameters to be detected; the abnormal resident items are the resident items corresponding to the abnormal detection results determined from multiple persistent resident items; the associated parameters are the parameters associated with the abnormal resident items obtained from the abnormal device; the abnormal device is the device corresponding to the abnormal detection result determined from multiple target devices.

[0120] In an embodiment of the present application, the abnormal alarm device can also use a large language model to generate abnormal alarm information according to abnormal project parameters, abnormal resident items and / or associated parameters.

[0121] In an embodiment of the present application, the abnormal alarm device uses a large language model to generate abnormal alarm information according to abnormal project parameters, abnormal resident items and / or associated parameters, including, when multiple abnormal detection results are abnormal, determining the abnormal project parameters corresponding to the abnormal detection results from the parameters of the project to be detected; determining the abnormal device corresponding to the abnormal detection result among multiple target devices; obtaining the associated parameters associated with the abnormal resident items in the abnormal devices respectively; and generating abnormal alarm information according to the abnormal project parameters, abnormal resident items, abnormal devices and associated parameters using the large language model.

[0122] In the embodiment of the present application, after the abnormal alarm device determines the abnormal project parameters corresponding to the abnormal detection result from the parameters of the project to be detected, it determines the abnormal device corresponding to the abnormal detection result from multiple target devices.

[0123] In an embodiment of the present application, after the abnormal alarm device determines the abnormal device corresponding to the abnormal detection result among multiple target devices, it can obtain the associated parameters associated with the abnormal resident items in the abnormal devices respectively; it can also obtain the associated parameters associated with the abnormal resident items in the abnormal devices respectively, and then determine the abnormal device corresponding to the abnormal detection result among multiple target devices; it can also obtain the associated parameters associated with the abnormal resident items in the abnormal devices respectively while determining the abnormal device corresponding to the abnormal detection result among multiple target devices.

[0124] Specifically, the abnormal alarm device obtains the resident item program path, resident item file name, resident item digital signature verification result and / or resident item resident parameters corresponding to the resident item in the abnormal device.

[0125] In the embodiment of the present application, when the persistent resident item includes a driver item, the associated parameters include the driver path (resident item program path), the file name (resident item file name), the driver digital signature verification result (resident item digital signature verification result), the digital certificate subject item (resident parameter of the resident item), and the driver file hash (resident parameter of the resident item); when the persistent resident item includes a service program item, the associated parameters include the service program path (resident item program path), the file name (resident item file name), the digital signature verification result (resident item digital signature verification result), the service program name (resident item resident parameter), and the service program name. resident parameters), program running parameters (resident parameters of resident items), service program description (resident parameters of resident items), and digital signature certificate issuer (resident parameters of resident items); when the persistent resident item includes a scheduled task item, the associated parameters include the program path for scheduled execution (resident item program path), the file name (resident item file name), the digital signature verification result (resident item digital signature verification result), the scheduled task cycle information (resident parameters of resident items), program running parameters (resident parameters of resident items), program description (resident parameters of resident items) and / or digital signature certificate issuer (resident parameters of resident items).

[0126] In an embodiment of the present application, for driver projects (Drivers / lsmod), since each computer usually has dozens of drivers, this embodiment can extract the driver path (ImagePath), file name, digital certificate subject item (Cert_Subject), driver digital signature verification result, and driver file hash as key elements (associated parameters); for service programs (Services), this embodiment can extract the service program path, service program name, program running parameters, service program description, file name, digital signature certificate issuer, and digital signature verification result as key elements (associated parameters); for scheduled tasks (schtasks / cron), this embodiment can extract scheduled task cycle (month / week / day / hour / minute) information, scheduled execution program path, program running parameters, program description, file name, digital signature certificate issuer and / or digital signature verification result as key elements (associated parameters).

[0127] In an embodiment of the present application, after the abnormal alarm device obtains the associated parameters associated with the abnormal resident items in the abnormal device respectively, it can use the large language model to generate abnormal alarm information according to the abnormal project parameters, abnormal resident items, abnormal devices and associated parameters.

[0128] In the embodiment of the present application, the abnormal alarm device uses a large language model to generate abnormal alarm information according to abnormal project parameters, abnormal resident items or associated parameters, and then outputs the abnormal alarm information.

[0129] In an embodiment of the present application, the abnormal alarm device includes a display, and the abnormal alarm information can be displayed on the display; the abnormal alarm information can also be transmitted to a display device and displayed using the display device; the abnormal alarm information can also be displayed in other ways; the specific method can be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0130] In an embodiment of the present application, the abnormal alarm device can also determine other operation change rate evaluation parameters such as installation operation change rate evaluation parameters, uninstallation operation change rate evaluation parameters, and running operation change rate evaluation parameters for persistent resident items in multiple target devices, thereby determining abnormal devices from multiple target devices based on these evaluation parameters.

[0131] In an embodiment of the present application, abnormal alarm information is displayed to an anomaly detection expert so that the anomaly detection expert can re-determine the anomaly detection result corresponding to the abnormal device based on the abnormal project parameters, abnormal resident items and associated parameters, that is, determine whether there are actually persistent resident traces of APT attacks in the abnormal device.

[0132] In an embodiment of the present application, the alarm information may also be alarm information in the form of sound, and the abnormal alarm device outputs the alarm information. The alarm information may also be alarm information in other forms, which may be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0133] It can be understood that the abnormal alarm device uses a large language model to generate abnormal alarm information according to abnormal project parameters, abnormal resident items or associated parameters, and outputs the abnormal alarm information, prompting APT attack detection experts to promptly re-judge the abnormal detection results based on the abnormal alarm information to determine whether the device corresponding to the abnormal detection result is an APT attack device, thereby improving the speed of APT abnormal detection.

[0134] The present application embodiment provides a data processing method, which is applied to a data processing device. Figure 3 A flow chart of a data processing method provided in an embodiment of the present application is as follows: Figure 3 As shown, the data processing method may include:

[0135] S301, obtaining construction parameters in multiple target devices.

[0136] A data processing method provided in an embodiment of the present application is suitable for building baseline project parameters for multiple target devices.

[0137] In the embodiments of the present application, the data processing device can be implemented in various forms. For example, the data processing device described in the present application can include devices such as mobile phones, cameras, tablet computers, laptop computers, PDAs, portable media players (PMPs), navigation devices, wearable devices, smart bracelets, pedometers, and devices such as digital TVs, desktop computers, and servers.

[0138] It should be noted that the build parameters include historical persistent resident parameters. Specifically, the historical persistent resident parameters include historical project parameters of program items (historical project parameters of driver items, historical project parameters of service program items), historical project parameters of task items (historical project parameters of scheduled task items), historical project parameters of tool items (historical project parameters of management tool items), historical project parameters of automation items (historical project parameters of automatic startup items), historical project parameters of registration items and / or historical operation frequency parameters (historical operation frequency parameters of persistent resident items).

[0139] In the embodiment of the present application, the data processing device can obtain the construction parameters of multiple target devices upon receiving the instruction.

[0140] In an embodiment of the present application, the data processing device can obtain construction parameters from a database; it can also obtain construction parameters from other devices; it can also obtain the carried construction parameters from the transmitted instructions; the specific way in which the data processing device obtains the construction parameters can be determined based on actual conditions, and the embodiment of the present application does not limit this.

[0141] S52. Build baseline project parameters according to the build parameters.

[0142] In the embodiment of the present application, after the data processing apparatus obtains the construction parameters in the plurality of target devices, it can construct the baseline project parameters according to the construction parameters.

[0143] In the embodiment of the present application, the data processing device can directly use the construction parameters as the baseline project parameters. It can also adjust the data format of the construction parameters according to a preset data format to obtain the baseline project parameters. It can also be constructed according to the construction parameters in other ways. The specific method can be determined according to the actual situation, and the embodiment of the present application does not limit this.

[0144] For example, Figure 4As shown: The anomaly detection method in the embodiment of the present application is based on the anomaly detection results of multiple target devices in a combination of spatial domain and time domain. Specifically, in the spatial domain, the baseline deviation evaluation is performed on the persistent resident telemetry items (parameters of the items to be detected) of multiple hosts (multiple target devices) within the monitoring range, and the persistent program items with low frequency occurrence are identified to identify suspected APT attacks. In the time domain, the frequency change rate of the installation, uninstallation, and operation actions of various categories of persistent resident telemetry items is periodically and continuously evaluated to identify suspected APT attacks. Based on the large language model, through natural language interaction technology, an alarm summary (abnormal alarm information) related to the persistent resident traces of suspected APT attacks is generated for the user. Multiple target devices include: PC1, PC2, PC3, PC4, ..., PC-n. Persistent resident items include: service program items (service1, service2, service3, ...), driver items (Drivers), scheduled task items (schTask), accounts, AutoStart, win account login, ...

[0145] It should be noted that by obtaining the parameters of the items to be detected in multiple target devices (project parameters of program items, project parameters of task items, project parameters of tool items, project parameters of automation items, project parameters of registration items and / or operation frequency parameters), the baseline project parameters (historical project parameters of program items, historical project parameters of task items, historical project parameters of tool items, historical project parameters of automation items, historical project parameters of registration items and / or historical operation frequency parameters) are used to match the parameters of the items to be detected, and the abnormal detection results in multiple target devices are determined according to the matching results. In the case where the abnormal detection result is abnormal, the large language model is used to generate abnormal alarm information corresponding to the abnormal detection result, so as to remind manual intervention through the abnormal alarm information, and the abnormal detection result is re-determined manually according to the abnormal alarm information to determine whether the device corresponding to the abnormal detection result is a device attacked by APT, thereby determining the device with parameters that have attack risks.

[0146] It can be understood that the data processing device obtains the construction parameters in multiple target devices and constructs baseline project parameters based on the construction parameters, so that the baseline project parameters can be used to match and detect the project parameters to be detected, thereby quickly determining the abnormal detection results of multiple target devices. There is no need to search for persistent resident traces of APT attacks from a large amount of network traffic or host behavior data, thereby improving the speed of APT anomaly detection.

[0147] Based on the same inventive concept as the above-mentioned abnormality detection method, the embodiment of the present application provides an abnormality detection device 1, corresponding to an abnormality detection method; Figure 5A schematic diagram of the structure of an abnormality detection device provided in an embodiment of the present application Figure 1 , the abnormality detection device 1 may include:

[0148] The first acquisition unit 11 is used to acquire parameters of items to be detected in multiple target devices; the parameters of the items to be detected include persistent resident parameters;

[0149] The determination unit 12 is used to determine the abnormality detection results of the multiple target devices according to the parameters of the items to be detected and the baseline item parameters.

[0150] In some embodiments of the present application, the apparatus further comprises a generating unit;

[0151] The generating unit is used to generate abnormal warning information corresponding to the abnormal detection result by using a large language model when the abnormal detection result is abnormal.

[0152] In some embodiments of the present application, the persistent resident parameters include project parameters of program items, project parameters of task items, project parameters of tool items, project parameters of automation items, project parameters of registration items and / or operation frequency parameters.

[0153] In some embodiments of the present application, the device further comprises a comparison unit;

[0154] The comparison unit is used to compare the parameters of the item to be detected with the parameters of the baseline item;

[0155] The determination unit 12 is used to determine that a first target device corresponding to a first project parameter in the project parameters to be detected is an abnormal device when a difference between a first project parameter in the baseline project parameters is greater than or equal to a preset difference, wherein the first project parameter represents a parameter in the project parameters to be detected that deviates from the baseline project parameter.

[0156] In some embodiments of the present application, the parameter of the item to be detected further includes the number of each persistent resident item resident in the plurality of target devices; the apparatus further includes a sorting unit;

[0157] The sorting unit is used to sort the resident quantity of each persistent resident item to obtain a resident quantity sequence;

[0158] The determination unit 12 is used to determine a first detection result according to the resident quantity sequence; determine a second detection result according to a comparison result between the parameters of the item to be detected and the parameters of the baseline item; and determine the abnormal detection result according to the first detection result and the second detection result.

[0159] In some embodiments of the present application, the determination unit 12 is used to determine the abnormality detection result according to the project parameter change rate corresponding to the to-be-detected project parameter and the project parameter change rate corresponding to the baseline project parameter.

[0160] It should be noted that, in actual applications, the above-mentioned first acquisition unit 11 and determination unit 12 can be implemented by a processor 13 on the device 2, specifically a CPU (Central Processing Unit), an MPU (Microprocessor Unit), a DSP (Digital Signal Processing) or a field programmable gate array (FPGA); the above-mentioned data storage can be implemented by a memory 14 on the device 2.

[0161] The present application embodiment also provides a device 2, corresponding to the abnormality detection device, such as Figure 6 As shown, the device 1 includes: a processor 13, a memory 14 and a communication bus 15. The memory 14 communicates with the processor 13 via the communication bus 15. The memory 14 stores a program executable by the processor 13. When the program is executed, the abnormality detection method described above is executed by the processor 13.

[0162] In practical applications, the memory 14 may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk (HDD) or a solid-state drive (SSD); or a combination of the above types of memory, and provide instructions and data to the processor 13.

[0163] An embodiment of the present application provides a computer-readable storage medium having a computer program thereon, and when the program is executed by the processor 13, the anomaly detection method as described above is implemented.

[0164] It can be understood that the anomaly detection device can quickly determine the anomaly detection results of multiple target devices by obtaining the parameters of the items to be detected in multiple target devices and matching the parameters of the items to be detected with the baseline project parameters. There is no need to search for persistent resident traces of APT attacks from a large amount of network traffic or host behavior data, thereby improving the speed of APT anomaly detection.

[0165] Based on the same inventive concept as the above-mentioned abnormal alarm method, the embodiment of the present application provides an abnormal alarm device 3, corresponding to an abnormal alarm method; Figure 7 A schematic diagram of the structure of an abnormal alarm device provided in an embodiment of the present application Figure 1 , the abnormal alarm device 3 may include:

[0166] The generation unit 21 is used to generate abnormal alarm information by using a large language model according to abnormal project parameters and / or associated parameters, wherein the abnormal project parameters are project parameters corresponding to the abnormal resident items in the project parameters to be detected; and the associated parameters are parameters obtained from the abnormal device and associated with the abnormal resident items.

[0167] In some embodiments of the present application, the associated parameters include a resident item program path, a resident item file name, a resident item digital signature verification result and / or a resident item resident parameter.

[0168] It should be noted that, in actual applications, the above-mentioned generation unit 21 can be implemented by the processor 13 on the device 2, specifically a CPU (Central Processing Unit), an MPU (Microprocessor Unit), a DSP (Digital Signal Processing) or a field programmable gate array (FPGA); the above-mentioned data storage can be implemented by the memory 14 on the device 2.

[0169] The embodiment of the present application provides a device 2, corresponding to an abnormal alarm device, such as Figure 6 As shown, the device 2 includes: a processor 13, a memory 14 and a communication bus 15. The memory 14 communicates with the processor 13 via the communication bus 15. The memory 14 stores a program executable by the processor 13. When the program is executed, the abnormal alarm method described above is executed by the processor 13.

[0170] In practical applications, the memory 14 may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk (HDD) or a solid-state drive (SSD); or a combination of the above types of memory, and provide instructions and data to the processor 13.

[0171] An embodiment of the present application provides a computer-readable storage medium having a computer program thereon, and when the program is executed by the processor 13, the abnormal alarm method as described above is implemented.

[0172] It can be understood that the abnormal alarm device uses a large language model to generate abnormal alarm information according to abnormal project parameters, abnormal resident items or associated parameters, and outputs the abnormal alarm information, prompting APT attack detection experts to promptly re-judge the abnormal detection results based on the abnormal alarm information to determine whether the device corresponding to the abnormal detection result is an APT attack device, thereby improving the speed of APT abnormal detection.

[0173] Based on the same inventive concept as the above-mentioned data processing method, the embodiment of the present application provides a data processing device 4 corresponding to a data processing method; Figure 8 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application Figure 1 , the data processing device 4 may include:

[0174] The second acquisition unit 31 is used to acquire the construction parameters in multiple target devices; the construction parameters include historical persistent resident parameters;

[0175] The construction unit 32 is used to construct baseline project parameters according to the construction parameters.

[0176] It should be noted that, in actual applications, the above-mentioned second acquisition unit 31 and construction unit 32 can be implemented by the processor 13 on the device 2, specifically a CPU (Central Processing Unit), an MPU (Microprocessor Unit), a DSP (Digital Signal Processing) or a field programmable gate array (FPGA); the above-mentioned data storage can be implemented by the memory 14 on the device 2.

[0177] The device 2 provided in the embodiment of the present application also includes a data processing device, such as Figure 6 As shown, the device 2 includes: a processor 13, a memory 14 and a communication bus 15. The memory 14 communicates with the processor 13 via the communication bus 15. The memory 14 stores a program executable by the processor 13. When the program is executed, the data processing method described above is executed by the processor 13.

[0178] In practical applications, the memory 14 may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk (HDD) or a solid-state drive (SSD); or a combination of the above types of memory, and provide instructions and data to the processor 13.

[0179] An embodiment of the present application provides a computer-readable storage medium having a computer program thereon, and when the program is executed by the processor 13, the data processing method as described above is implemented.

[0180] It can be understood that the data processing device obtains the construction parameters in multiple target devices and constructs baseline project parameters based on the construction parameters, so that the baseline project parameters can be used to match and detect the project parameters to be detected, thereby quickly determining the abnormal detection results of multiple target devices. There is no need to search for persistent resident traces of APT attacks from a large amount of network traffic or host behavior data, thereby improving the speed of APT anomaly detection.

[0181] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0182] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0183] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0184] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0185] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Acquire parameters of items to be detected in multiple target devices; the parameters of the items to be detected include persistent resident parameters; Determine abnormality detection results of the plurality of target devices according to the parameters of the items to be detected and the baseline item parameters.

2. The method according to claim 1, characterized in that After determining the abnormality detection results of the plurality of target devices according to the parameters of the items to be detected and the baseline item parameters, the method further includes: When the abnormality detection result is abnormal, a large language model is used to generate abnormality warning information corresponding to the abnormality detection result.

3. The method according to claim 1, characterized in that The persistent resident parameters include project parameters of program items, project parameters of task items, project parameters of tool items, project parameters of automation items, project parameters of registration items and / or operation frequency parameters.

4. The method according to claim 1, characterized in that: The determining, according to the parameters of the project to be detected and the baseline project parameters, the abnormality detection results of the plurality of target devices comprises: The abnormality detection result is determined according to the project parameter change rate corresponding to the to-be-detected project parameter and the project parameter change rate corresponding to the baseline project parameter.

5. An abnormal alarm method, characterized in that: The method comprises: Using a large language model, abnormal alarm information is generated according to abnormal project parameters and / or associated parameters, wherein the abnormal project parameters are project parameters corresponding to the abnormal resident items in the project parameters to be detected; and the associated parameters are parameters obtained from the abnormal device and associated with the abnormal resident items.

6. The method according to claim 5, characterized in that The associated parameters include a resident item program path, a resident item file name, a resident item digital signature verification result and / or a resident item resident parameter.

7. A data processing method, characterized in that: The method includes: Obtaining build parameters in multiple target devices; the build parameters include historical persistent resident parameters; The baseline project parameters are built according to the build parameters.

8. An abnormality detection device, characterized in that: The device comprises: A first acquisition unit is used to acquire parameters of items to be detected in multiple target devices; the parameters of the items to be detected include persistent resident parameters; A determination unit is used to determine the abnormality detection results of the multiple target devices according to the parameters of the items to be detected and the baseline item parameters.

9. A device, characterized in that: The device comprises: A memory, a processor and a communication bus, wherein the memory communicates with the processor via the communication bus, the memory stores an abnormality detection program executable by the processor, and when the abnormality detection program is executed, the method as claimed in any one of claims 1 to 4 is executed by the processor; the memory stores an abnormality alarm program executable by the processor, and when the abnormality alarm program is executed, the method as claimed in any one of claims 5 to 6 is executed by the processor; the memory stores a data processing program executable by the processor, and when the data processing program is executed, the method as claimed in claim 7 is executed by the processor.

10. A storage medium having a computer program stored thereon, applied to an abnormality detection device, an abnormality alarm device and a data processing device, characterized in that: When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 4; or when the computer program is executed by a processor, it implements the method described in any one of claims 5 to 6; or when the computer program is executed by a processor, it implements the method described in claim 7.

Images