Rule-based security detection method and device, storage medium and electronic equipment

Abstract

The invention discloses a rule-based security detection method and device, a storage medium and electronic equipment, and relates to the technical field of network security, the method comprises the following steps: obtaining target detection data, and determining a behavior type of the target detection data; determining a detection channel matched with the behavior type of the target detection data in the plurality of detection channels as a target detection channel; querying whether a detection result of the first detection data exists in a preset storage space or not; and under the condition that the detection result of the first detection data exists, determining a security detection result of the target detection data according to the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data. Through the method and the device, the problem of relatively low detection efficiency caused by one-to-one matching between the behavior data set and each rule in the rule set when potential security threats of the terminal equipment are detected based on the rules in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a rule-based security detection method, device, storage medium and electronic device. Background Art

[0002] With the rapid development of Internet technology, the interaction and data transmission of resources such as web pages, apps, and SDKs are becoming increasingly frequent, and the complexity and diversity of user behaviors have also increased significantly. These behaviors include not only regular logins, registrations, transactions, and browsing, but may also cover more complex operational processes, such as social media interactions, online game activities, and the execution of financial transactions. Behind these behaviors are massive data streams that may carry sensitive information, such as personal identity data, financial transaction details, corporate secrets, etc. If these data are not properly protected during transmission, they can easily become targets of hacker attacks, leading to serious security risks and data leaks.

[0003] In the face of the current complex Internet environment, traditional behavior detection methods usually rely on manually constructed detection rule sets. These rule sets are based on known attack patterns or abnormal behavior characteristics. Through rule matching, user behavior data is analyzed in real time or post-event to identify potential threats. When faced with high-frequency and large-volume behavior data, matching each rule in the rule base one by one is not only inefficient, but also requires huge computing resources. When the rule base is large in scale, this inefficient matching process will seriously slow down the system's response speed, affecting user experience and the real-time performance of the security system.

[0004] When detecting potential security threats of terminal devices based on rules in related technologies, it is necessary to match the behavior data set with each rule in the rule set one-to-one, which leads to low detection efficiency. No effective solution has been proposed yet. Summary of the invention

[0005] The main purpose of this application is to provide a rule-based security detection method, device, storage medium and electronic device to solve the problem in the related art that when detecting potential security threats of terminal devices based on rules, it is necessary to match the behavior data set with each rule in the rule set one-to-one, resulting in low detection efficiency.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a rule-based security detection method is provided, which includes: obtaining target detection data, and determining a behavior type of the target detection data; determining a detection channel among multiple detection channels that matches the behavior type of the target detection data as a target detection channel, wherein different detection channels are constructed based on rules corresponding to different behavior types; querying whether there is a detection result of first detection data in a preset storage space, wherein the first detection data is data obtained by detecting a target sub-channel in the target detection channel, and each target attribute in a target attribute set corresponding to the target sub-channel belongs to an attribute of the target detection data; in the case where there is a detection result of the first detection data, determining the security detection result of the target detection data based on the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data.

[0007] Furthermore, before determining the detection channel in multiple detection channels that matches the behavior type of the target detection data as the target detection channel, the method also includes: classifying multiple preset rules according to the behavior type detected by the rule to obtain a rule set corresponding to each behavior type; for the rule set corresponding to each behavior type, classifying the rule set according to the attribute set detected by the rule to obtain rule subsets under the rule set corresponding to different attribute sets; constructing the multiple detection channels based on multiple first mapping relationships, and constructing multiple sub-channels of each detection channel based on multiple second mapping relationships, wherein the first mapping relationship represents the mapping relationship between the rule set and the behavior type detected by the rule, and the second mapping relationship represents the mapping relationship between the rule subset and the attribute set under the rule set.

[0008] Furthermore, the method also includes: in the absence of detection results of the first detection data, detecting the attribute value of each target attribute of the first detection data according to the rules corresponding to the target sub-channel to obtain the security detection result of the target detection data, and storing the security detection result of the target detection data in the preset storage space.

[0009] Furthermore, the method also includes: for each sub-channel, determining the attribute set corresponding to the sub-channel; performing target processing on multiple attributes included in the attribute set to obtain a first string, wherein the target processing includes at least one of the following: concatenation, hash calculation; generating a second string based on the attribute value of at least one attribute involved in the rule corresponding to the attribute set corresponding to the sub-channel; and generating a mapping relationship between the attribute set corresponding to the sub-channel and the rule corresponding to the sub-channel based on the first string and the second string.

[0010] Furthermore, querying whether there is a detection result of the first detection data in the preset storage space includes: matching all attributes of the target detection data with attribute sets corresponding to each sub-channel of the target detection channel to obtain a second matching result; when the second matching result indicates that there is a matching attribute set, determining the sub-channel corresponding to the matching attribute set as the target sub-channel; and querying whether there is the first detection data whose detection result is obtained by the rule detection corresponding to the target sub-channel in the preset storage space.

[0011] Further, the security detection result of the target detection data is determined based on the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data, including: for each target attribute, matching the attribute value of the target attribute of the first detection data with the attribute value of the target attribute of the target detection data to obtain a fourth matching result; when the fourth matching result indicates that the attribute value of each target attribute in the first detection data is the same as the attribute value in the target detection data, determining the security detection result of the target detection data based on the security detection result of the first detection data; when the fourth matching result indicates that the attribute value of at least one target attribute in the first detection data is different from the attribute value in the target detection data, using the target sub-channel corresponding to the target attribute set in the target detection channel to detect the target detection data to obtain the security detection result of the target detection data.

[0012] Furthermore, after determining the security detection result of the target detection data, the method also includes: when the security detection result indicates that the target detection data hits a rule, determining that there is a security threat in the target detection data, and generating an alarm message based on the security detection result; and sending the alarm message to the target object.

[0013] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a rule-based security detection device is provided, which includes: an acquisition unit, which is used to acquire target detection data and determine the behavior type of the target detection data; a first determination unit, which is used to determine the detection channel that matches the behavior type of the target detection data among multiple detection channels as the target detection channel, wherein different detection channels are constructed according to rules corresponding to different behavior types; a query unit, which is used to query whether there is a detection result of the first detection data in a preset storage space, wherein the first detection data is data obtained by detecting a target sub-channel in the target detection channel, and each target attribute in the target attribute set corresponding to the target sub-channel belongs to the attribute of the target detection data; a second determination unit, which is used to determine the security detection result of the target detection data according to the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data when the detection result of the first detection data exists.

[0014] Furthermore, the device also includes: a first classification unit, used to classify the preset multiple rules according to the behavior type detected by the rules before determining the detection channel in the multiple detection channels that matches the behavior type of the target detection data as the target detection channel, so as to obtain a rule set corresponding to each behavior type; a second classification unit, used to classify the rule set corresponding to each behavior type according to the attribute set detected by the rules, so as to obtain rule subsets corresponding to different attribute sets under the rule set; a first construction unit, used to construct the multiple detection channels based on multiple first mapping relationships, and to construct multiple sub-channels of each of the detection channels based on multiple second mapping relationships, wherein the first mapping relationship represents the mapping relationship between the rule set and the behavior type detected by the rule, and the second mapping relationship represents the mapping relationship between the rule subset and the attribute set under the rule set.

[0015] Furthermore, the device also includes: a storage unit, which is used to detect the attribute value of each target attribute of the first detection data according to the rules corresponding to the target sub-channel in the absence of the detection result of the first detection data, obtain the security detection result of the target detection data, and store the security detection result of the target detection data in the preset storage space.

[0016] Furthermore, the device also includes: a third determination unit, used to determine, for each sub-channel, an attribute set corresponding to the sub-channel; a processing unit, used to perform target processing on multiple attributes included in the attribute set to obtain a first string, wherein the target processing includes at least one of the following: concatenation, hash calculation; a first generation unit, used to generate a second string based on the attribute value of at least one attribute involved in the rule corresponding to the attribute set corresponding to the sub-channel; and a third construction unit, used to generate a mapping relationship between the attribute set corresponding to the sub-channel and the rule corresponding to the sub-channel based on the first string and the second string.

[0017] Further, the query unit is used to: match all attributes of the target detection data with attribute sets corresponding to each sub-channel of the target detection channel to obtain a second matching result; when the second matching result indicates that there is a matching attribute set, determine the sub-channel corresponding to the matching attribute set as the target sub-channel; and query whether there is the first detection data in the preset storage space that has obtained the detection result through the rule detection corresponding to the target sub-channel.

[0018] Further, the second determination unit includes: a matching subunit, used to match the attribute value of the target attribute of the first detection data with the attribute value of the target attribute of the target detection data for each target attribute to obtain a fourth matching result; a determination subunit, used to determine the security detection result of the target detection data based on the security detection result of the first detection data when the fourth matching result indicates that the attribute value of each target attribute in the first detection data is the same as the attribute value in the target detection data; and a detection subunit, used to detect the target detection data using the target sub-channel corresponding to the target attribute set in the target detection channel to obtain the security detection result of the target detection data when the fourth matching result indicates that the attribute value of at least one target attribute in the first detection data is different from the attribute value in the target detection data.

[0019] Furthermore, the device also includes: a second generating unit, which is used to determine that there is a security threat to the target detection data after determining the security detection result of the target detection data, and generate an alarm message based on the security detection result when the security detection result indicates that the target detection data hits a rule; and a sending unit, which is used to send the alarm message to the target object.

[0020] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements any one of the above-mentioned rule-based security detection methods, and which, when executed by a processor, implements the steps of the rule-based security detection method described in each embodiment of the present application.

[0021] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes stored computer instructions, wherein when the computer instructions are executed by a processor, any one of the above-mentioned rule-based security detection methods is implemented.

[0022] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an electronic device is provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the above-mentioned rule-based security detection methods.

[0023] Through the present application, the following steps are adopted: obtaining target detection data, and determining the behavior type of the target detection data; determining a detection channel in multiple detection channels that matches the behavior type of the target detection data as a target detection channel, wherein different detection channels are constructed based on rules corresponding to different behavior types; querying whether there is a detection result of first detection data in a preset storage space, wherein the first detection data is data obtained by detecting a target sub-channel in the target detection channel, and each target attribute in a target attribute set corresponding to the target sub-channel belongs to an attribute of the target detection data; in the case where there is a detection result of the first detection data, determining a security detection result of the target detection data based on the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data, thereby solving the problem in the related art that when detecting potential security threats of terminal devices based on rules, it is necessary to match the behavior data set with each rule in the rule set one-to-one, resulting in low detection efficiency.

[0024] By classifying the rule set according to different behavior types, multiple detection channels are constructed, which can direct the target detection data to the corresponding detection channel according to the behavior type during rule detection, avoiding unnecessary matching with irrelevant rules, and significantly improving the efficiency and accuracy of rule matching. At the same time, by querying the detection result of the first detection data with the same attribute as the target detection data in the preset storage space, and determining the security detection result of the target detection data based on the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data, it is possible to avoid repeated detection of data with the same detection attribute set, greatly saving computing resources and time, improving the overall detection performance, and being able to well support high-concurrency detection environments. Even if millions of behavior data are generated every day in a terminal cluster, it is possible to effectively process and detect massive data through fast behavior type and attribute matching, avoiding performance bottlenecks and efficiency reductions caused by excessive data volume, achieving the effect of improving the security of terminal devices, and further achieving the effect of enhancing the security and stability of enterprise systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0026] Figure 1 is a flow chart of a rule-based security detection method provided according to Embodiment 1 of the present application;

[0027] Figure 2 is a schematic diagram of an optional rule-based security detection system provided according to Embodiment 1 of the present application;

[0028] Figure 3 is a schematic diagram of a rule-based safety detection device provided according to Embodiment 2 of the present application;

[0029] Figure 4 It is a schematic diagram of a rule-based security detection electronic device provided according to Embodiment 5 of the present application. DETAILED DESCRIPTION

[0030] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0031] It should be noted that the user information (including but not limited to user device information, user personal information, collected data, used data, generated data, processed data, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, collected information, used information, generated information, processed information, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of relevant countries and regions, necessary confidentiality measures are taken, and public order and good morals are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0032] It should be noted that this application provides users with corresponding operation entrances for them to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0033] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] Embodiment 1

[0036] The present invention is described below in conjunction with preferred implementation steps. Figure 1 is a flow chart of a rule-based security detection method provided in Example 1 of the present application. Figure 1 As shown, the method comprises the following steps:

[0037] Step S101, acquiring target detection data and determining the behavior type of the target detection data.

[0038] In some examples, the executor of the rule-based security detection method provided by the present application can be a rule-based security detection system. For example, the system can be composed of three key modules: a rule preprocessing module, a rule engine module, and a result cache module. Each module plays a specific role in the overall architecture of the system, and together completes high-performance detection of terminal behavior data. Through the collaborative work of these three modules, fast and accurate detection of terminal behavior data is achieved, and a large amount of duplicate data can also be effectively processed, avoiding waste of resources, improving the efficiency and response speed of security detection, and enabling enterprise systems to adapt to frequently changing threats and behavior patterns in the Internet environment, providing strong technical support for protecting the security of corporate and personal terminals.

[0039] In the first embodiment, target detection data is usually collected from terminal devices (such as personal computers, servers, etc.). These data cover various system activities occurring on the terminal devices, including but not limited to process startup, network communication, file operations, registry modifications, image loading, and DNS queries, etc. Each piece of behavior data contains a series of attributes that describe the characteristics and context information of the behavior in detail, such as FileHashSha256, Name, ParentCommandLine, etc.

[0040] In order to perform accurate and fast rule detection on target detection data, it is necessary to determine the behavior type of the target detection data. For example, if the data describes the startup of a process, then its behavior type is process startup, such as process_creation; if the data records a file deletion event, then the behavior type is file deletion, such as file_delete. The behavior type can be determined based on the key attributes in the data. Attributes define the characteristics of the behavior, such as process ID, source IP address, operation timestamp, etc.

[0041] By determining the behavior type of the target detection data, the target detection data can be quickly and accurately guided to the detection logic of the relevant rules, avoiding matching with irrelevant rules. Since the number of rules that need to be matched is greatly reduced, the efficiency of detection is greatly improved.

[0042] Step S102: Determine a detection channel among multiple detection channels that matches the behavior type of the target detection data as a target detection channel, wherein different detection channels are constructed based on rules corresponding to different behavior types.

[0043] In the first embodiment of the present invention, when a target detection data is received by the rule engine module, it is first necessary to determine the behavior type of the data. Multiple detection channels are constructed inside the rule engine module, and each detection channel is used to specifically process a certain type of behavior data, that is, each channel contains all the rules corresponding to the specific behavior type. For example, the detection channel of type `process_creation` contains all the detection rules related to process startup. If the behavior type of the target detection data is consistent with the behavior type corresponding to detection channel A among the multiple detection channels, the above-mentioned first matching result is determined based on detection channel A.

[0044] By matching the behavior type of target detection data with the pre-built detection channel, preliminary classification of data and preliminary identification of abnormal behavior are achieved, laying the foundation for subsequent more refined detection and alarm response, making the detection process more efficient and able to adapt to the massive behavioral data generated on terminal devices.

[0045] Step S103, querying whether there is a detection result of the first detection data in the preset storage space, wherein the first detection data is data obtained by detecting the target sub-channel in the target detection channel, and each target attribute in the target attribute set corresponding to the target sub-channel belongs to the attribute of the target detection data.

[0046] Here, the preset storage space is, for example, a cache, or other designated storage area.

[0047] In the first embodiment of the present invention, if the detection result of the first detection data having the same attribute as the target detection data is found in the cache, this result can be used directly without repeating the rule matching of the target detection data. This reuse process greatly saves computing resources and improves detection efficiency, because for data with the same attribute, the detection result is usually consistent, and there is no need to execute the detection logic again. On the contrary, if the detection result that fully matches the target detection data attribute is not found in the cache, the rule engine module will execute the detection logic on demand, that is, the target detection data is matched with multiple sub-channels under the target detection channel to determine whether there is abnormal behavior or security threat. The detection result is then persistently stored in the cache for subsequent query use.

[0048] By storing and reusing the detected test results through the result cache module, repeated detection of similar or duplicate data is avoided, thereby significantly improving the system's response speed and resource utilization. This method is particularly effective for common periodic tasks on terminal devices, behavioral data of similar applications, etc., which can greatly reduce the computational burden during detection and ensure that the system can still maintain high performance and low latency when processing large amounts of data.

[0049] Step S104: when there is a detection result of the first detection data, determine the security detection result of the target detection data according to the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data.

[0050] In step S104, when the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data are the same, the security detection result of the target detection data can be determined according to the detection result of the first detection data in the preset storage space.

[0051] For example, when the detection result of the first detection data indicates that the first detection data hits any rule of the target sub-channel, the security detection result of the target detection data is determined as a security threat existing in the target detection data.

[0052] For another example, when the detection result of the first detection data indicates that the first detection data does not hit any rule of the target sub-channel, the security detection result of the target detection data is determined to be that there is no security threat to the target detection data.

[0053] In this way, for two different data with the same behavior type, if the two data have the same attributes and the same attribute values, the detection results of the data that have been detected in the two data can be used to determine the detection results of the data that have not been detected in the two data, which can avoid unnecessary repeated calculations and effectively improve data detection efficiency.

[0054] In the first embodiment, when the rule engine module searches the preset storage space for the detection result of the first detection data having the same detection attribute as the target detection data, it is necessary to compare whether the attribute value of the target attribute of the first detection data is the same as the attribute value of the target attribute of the target detection data. These attribute values ​​include but are not limited to at least one of the following: process path, command line parameters, source IP and target port of the network connection, path of the file operation, etc.

[0055] If the attribute value of the target attribute of the first detection data is exactly the same as the attribute value of the target attribute of the target detection data, this means that the detection results of the two will also be the same, so that the detection result of the first detection data can be directly extracted from the preset storage space and used as the safety detection result of the target detection data, without the need to re-execute the rule matching, saving computing resources and time. If the attribute value of the target attribute is not completely consistent, the rule engine module will match the attribute of the target detection data based on the attribute set corresponding to the multiple sub-channels under the detection channel, and obtain the safety detection result of the target detection data based on the matching result.

[0056] Through this mechanism, the rule engine module can identify and reuse existing detection results, especially for those behavioral data with high repetitiveness and consistent attribute values, such as common system service startups on terminals, network connections with fixed IP addresses, etc., avoiding unnecessary repeated calculations and significantly improving detection efficiency and system response speed. This method is particularly effective when processing large amounts of terminal behavior data, helping to maximize the use of system resources while ensuring security detection results.

[0057] In summary, the rule-based security detection method provided in Example 1 of the present application constructs multiple detection channels by classifying the rule set according to different behavior types, and can direct the target detection data to the corresponding detection channel according to the behavior type during rule detection, avoiding unnecessary matching with irrelevant rules, and significantly improving the efficiency and accuracy of rule matching. At the same time, by querying the detection result of the first detection data with the same attribute as the target detection data in the preset storage space, and determining the security detection result of the target detection data based on the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data, it is possible to avoid repeated detection of data with the same detection attribute set, greatly saving computing resources and time, improving the overall detection performance, and well supporting high-concurrency detection environments. Even if millions of behavior data are generated every day in the terminal cluster, it can effectively process and detect massive data through fast behavior type and attribute matching, avoiding performance bottlenecks and efficiency reduction caused by excessive data volume, achieving the effect of improving the security of terminal devices, and further achieving the effect of enhancing the security and stability of enterprise systems.

[0058] Optionally, in the rule-based security detection method provided in Example 1 of the present application, before determining a detection channel in multiple detection channels that matches the behavior type of target detection data as the target detection channel, the above method also includes: classifying multiple preset rules according to the behavior type detected by the rule to obtain a rule set corresponding to each behavior type; for the rule set corresponding to each behavior type, classifying the rule set according to the attribute set detected by the rule to obtain rule subsets under the rule set corresponding to different attribute sets; constructing multiple detection channels based on multiple first mapping relationships, and constructing multiple sub-channels of each detection channel based on multiple second mapping relationships, wherein the first mapping relationship represents the mapping relationship between the rule set and the behavior type detected by the rule, and the second mapping relationship represents the mapping relationship between the rule subset and the attribute set under the rule set.

[0059] In the first embodiment, the rule preprocessing module parses and classifies the preset behavior detection rule set (i.e., the preset rule set mentioned above). Each rule in the rule set has a specifically defined behavior type (such as process startup, network connection, file modification, etc.), and the rule preprocessing module determines different rule sets according to different behavior types to form multiple rule sets, and the rules in each rule set belong to a corresponding behavior type.

[0060] For each rule set in the multiple rule sets, the rule preprocessing module further refines the classification and reclassifies each rule set according to the attributes contained in the rules (for example, process path, source IP address, target port, etc.) to obtain multiple rule subsets under each rule set.

[0061] It should be noted that the first mapping relationship describes the mapping between the behavior type and the rule set, that is, the rule corresponding to a certain behavior type. Based on the first mapping relationship, a corresponding detection channel can be constructed, and each detection channel specifically processes the terminal behavior data matching a specific behavior type.

[0062] The second mapping relationship describes the mapping relationship between the rule set and the rule subset, that is, further classifying the rules containing different attributes under a specific behavior type. Based on the second mapping relationship, multiple sub-channels under the detection channel are constructed to detect terminal behavior data with more specific attribute combinations.

[0063] By constructing detection channels and sub-channels, efficient detection of terminal behavior data (i.e., the target detection data mentioned above) is achieved. When a target detection data is received, the detection channel it should enter is first determined based on its behavior type, and then the sub-channel it should enter is determined based on the specific attributes in the target detection data. This process effectively reduces redundancy in data processing and improves the pertinence and efficiency of detection.

[0064] In summary, this technical solution builds an efficient and detailed detection channel system through multi-level rule classification and mapping, enabling the rule engine module to perform security detection on massive behavioral data more quickly with less computing resource consumption, while ensuring the accuracy and reliability of detection. This solution is particularly suitable for scenarios with large amounts of terminal data and complex and changeable behavior patterns, and can significantly improve the performance of security detection.

[0065] After the second mapping relationship is constructed, the rule preprocessing module will further establish a first mapping relationship. The first mapping relationship connects the behavior type corresponding to each type of rule subset and multiple second mapping relationships under this type of rule. For example, if the rule subset related to the process startup behavior includes multiple second mapping relationships for attributes such as `Image`, `ParentImage`, and `CommandLine`, then a first mapping relationship is established between the rule subset related to the process startup behavior and multiple second mapping relationships for attributes such as `Image`, `ParentImage`, and `CommandLine`.

[0066] Through the above-mentioned mapping construction process, multiple first mapping relationships are obtained, each of which clearly points out the mapping between a certain behavior type and the attributes and attribute values ​​of all relevant rules under this type, so that when the rule engine module processes terminal behavior data, it can quickly locate the relevant detection rules according to the data type, thereby speeding up the detection speed and reducing resource consumption.

[0067] By building a multi-level mapping relationship in the preprocessing stage, the rule engine module can quickly and efficiently match rules and data in the actual detection stage, avoiding unnecessary full rule matching in traditional detection methods, thereby greatly improving the detection performance and resource utilization efficiency of the terminal behavior rule engine. When faced with massive data input, this mapping mechanism can ensure that the system maintains a high detection speed and accuracy, providing strong technical support for terminal security protection.

[0068] In an optional embodiment, the rule preprocessing module will classify the preset rule set according to the behavior type of the rule to form multiple rule sets. For example, if the rule involves process startup behavior, it is classified into the category of "process startup". Next, for each rule set, the attributes contained in the rule (such as process path, command line parameters, IP address, etc.) are further analyzed, and the rules are reclassified according to these attributes to obtain multiple rule subsets under each rule set. For example, a rule involving process startup and command line parameter detection will be classified into a rule subset based on the two attributes of "process path" and "command line parameters".

[0069] Then, the rule preprocessing module constructs a first-layer Map structure, where the key of the first-layer Map structure is the behavior type (such as "process_creation" represents process startup), and the value of the first-layer Map structure is another second-layer Map structure, which is used to store the rule classification related to the behavior type. For each behavior type, the rule preprocessing module constructs a second-layer Map structure, where the key of the second-layer Map structure is the unique identifier of the detection attribute set, and the value of the second-layer Map structure is a set (Set), which contains all rules that match the unique identifier of the attribute set, that is, all second-class rules.

[0070] Finally, the constructed two-layer Map structure (including the first-layer Map structure and the second-layer Map structure) will be persistently stored so that it can be quickly found and referenced in the subsequent terminal behavior data detection process. This storage method supports efficient retrieval and data processing, which is the key to achieving high-performance detection.

[0071] For example, suppose there is a rule `Detection_A` that focuses on process startup, and specifically detects `Image` (the full path of the process), `ParentImage` (the full path of the parent process), and `CommandLine` (command line parameters). The rule `Detection_A` will first be classified into the rule subset of the behavior type "process startup" (`process_creation`). Then, since the rule `Detection_A` focuses on the three attributes `Image`, `ParentImage`, and `CommandLine`, its attribute set unique identifier may be constructed as "`Image-ParentImage-CommandLine`". This attribute set unique identifier will be used as the key of the second-level Map structure, and the rule `Detection_A` itself will be added to the Set collection associated with the key.

[0072] By building a two-layer map structure, the rule engine module can quickly locate the most relevant rule set based on the behavior type and detection attribute set of the data when detecting terminal behavior data, thereby significantly improving detection efficiency and reducing resource consumption.

[0073] Optionally, in the rule-based security detection method provided in Example 1 of the present application, in the absence of detection results of the first detection data, the attribute value of each target attribute of the first detection data is detected according to each rule corresponding to the target sub-channel to obtain the security detection result of the target detection data, and the security detection result of the target detection data is stored in a preset storage space.

[0074] In the first embodiment of the present invention, in the absence of detection results of the first detection data, the attribute value of each target attribute of the first detection data is detected according to the rules corresponding to the target sub-channel, and the security detection results of the target detection data are stored in a preset storage space, and then reused for other subsequent data to be detected that have the same behavior type, the same attributes and the same attribute values ​​according to the security detection results of the target detection data, thereby achieving the effect of improving detection efficiency.

[0075] Optionally, in the rule-based security detection method provided in Example 1 of the present application, the above method also includes: for each sub-channel, determining the attribute set corresponding to the sub-channel; performing target processing on multiple attributes contained in the attribute set to obtain a first string, wherein the target processing includes at least one of the following: concatenation, hash calculation; generating a second string based on the attribute value of at least one attribute involved in the rule corresponding to the attribute set corresponding to the sub-channel; based on the first string and the second string, generating a mapping relationship between the attribute set corresponding to the sub-channel and the rule corresponding to the sub-channel.

[0076] In the first embodiment, the rule preprocessing module identifies multiple detection attributes involved in the rule subset. These attributes are key information used in the rule definition to match specific terminal behavior data. For example, in the rule for detecting process startup behavior, attributes such as `Image` (process path), `ParentImage` (parent process path) and `CommandLine` (command line parameters) may be involved.

[0077] Then, target processing is performed on multiple attributes included in the rule subset to generate the first string. Target processing can be to concatenate the attribute names in a fixed order, or to perform hash calculation on the attribute names of multiple attributes to obtain a hash value as the first string, so as to create a unique identification string for this group of attributes, which is convenient for subsequent retrieval and matching. For example, the three attributes of `Image`, `ParentImage`, and `CommandLine` may be processed as "Image_ParentImage_CommandLine" or the hash value may be calculated as the first string.

[0078] Secondly, a second string is generated based on the attribute values ​​of multiple attributes in the rule subset. The attribute values ​​of multiple attributes in the rule can also be processed by splicing to obtain a second string representing the specific attribute value combination of the rule. For example, if a rule focuses on the process path of `C:\Windows\System32\svchost.exe`, the parent process path is `C:\AppData\Roaming\`, and the command line parameter is `-k`, then these attribute values ​​may be processed as "C:\Windows\System32\svchost.exe_C:\AppData\Roaming\_k".

[0079] Finally, a fourth mapping relationship is generated based on the first character string (identifier of the attribute set) and the second character string (attribute value combination). The fourth mapping relationship associates the attribute set with a specific rule attribute value combination, so that when detecting terminal behavior data, the detection rules related to the target detection data can be quickly located according to the attributes of the target detection data, avoiding the traversal of the entire rule set and improving the detection efficiency.

[0080] Optionally, in the rule-based security detection method provided in Example 1 of the present application, querying whether there is a detection result of the first detection data in the preset storage space includes: matching all attributes of the target detection data with the attribute sets corresponding to each sub-channel of the target detection channel to obtain a second matching result; when the second matching result indicates that there is a matching attribute set, determining the sub-channel corresponding to the matching attribute set as the target sub-channel; and querying whether there is the first detection data in the preset storage space that has obtained the detection result through the rule detection corresponding to the target sub-channel.

[0081] In the first embodiment of the present invention, in the process of querying the preset storage space through the rule engine module to determine whether there is a detection result of the first detection data having the same attribute set as the target detection data (i.e., there is no historical detection record that completely matches the attributes of the current data), the rule engine module will match all the attributes of the target detection data (such as process path, command line parameters, IP address, etc.) with the attribute sets corresponding to each of the multiple sub-channels under the constructed detection channel, and determine whether there is a target sub-channel in the multiple sub-channels, that is, match all the attributes of the target detection data with multiple second mapping relationships under the behavior type of the target detection data. Then, the preset storage space is queried to determine whether there is the first detection data that has obtained the detection result through the rule detection corresponding to the target sub-channel.

[0082] The rule engine module will find all second mapping relationships that match the attribute set of the target detection data (composed of multiple attributes contained therein) to obtain the above-mentioned second matching result. In other words, if all attributes contained in the target detection data are consistent with all attributes involved in a rule under the behavior type of the target detection data, then the second mapping relationship corresponding to this rule will be included in the second matching result.

[0083] Optionally, in the rule-based security detection method provided in the first embodiment of the present application, after querying whether there is a detection result of the first detection data in the preset storage space, the above method further includes: in the case where there is no detection result of the first detection data, the target detection data is detected using the rule of the target sub-channel corresponding to the target attribute set in the target detection channel to obtain a security detection result of the target detection data. For example, the attribute value of the attribute belonging to the target attribute set of the target detection data can be matched with the rule corresponding to the target sub-channel to obtain a third matching result; when the third matching result indicates that there is a matching rule, the risk of the target detection data is determined as a security detection result.

[0084] In the first embodiment, when there is no detection result of the first detection data in the preset storage space, a more in-depth accurate matching will be continued. This step compares the attribute value of each target attribute of the target detection data with the rule attribute value of the target sub-channel corresponding to the target attribute set, that is, checks whether the attribute value of the target detection data matches the attribute value defined in the rule to ensure whether the target detection data hits the rule.

[0085] If the rule attribute value of the second mapping relationship in the second matching result is consistent with the attribute value of the target detection data, a third matching result is generated according to the second mapping relationship in the second matching result. At the same time, it is determined whether the target detection data has a security risk or abnormal behavior according to whether there is a matching second mapping relationship in the third matching result, and the above-mentioned security detection result is obtained.

[0086] It should be noted that the rule engine module will generate a detection result of all detection rules hit by a target detection data, and determine whether the target detection data is safe based on the definitions and conditions of these rules, as well as a specific description of its security status (such as whether it is a malware activity, whether it violates the security policy, etc.). Among them, these detection results are also stored in a two-layer Map structure. The detection results only need to include the attribute names and corresponding attribute values ​​related to the target detection data, as well as the hit rule identifiers, thereby reducing the file size of the detection results. After the detection results are generated, the detection results need to be sent to the result cache module through the rule engine module. The result cache module converts the detection results into two-layer Map results for storage so that the rule engine module can query them.

[0087] The entire detection process ensures the efficiency and accuracy of detection by setting up multi-level detection channels to match the target detection data, avoiding blind matching of all rules. Instead, it first screens according to the behavior type and then accurately compares the attributes and attribute values. This process significantly improves the performance of detecting terminal behavior data, while reducing the possibility of false alarms and missed alarms, providing instant and accurate detection results for terminal security protection.

[0088] Optionally, in the rule-based security detection method provided in Example 1 of the present application, the security detection result of the target detection data is determined based on the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data, including: for each target attribute, matching the attribute value of the target attribute of the first detection data with the attribute value of the target attribute of the target detection data to obtain a fourth matching result; when the fourth matching result indicates that the attribute value of each target attribute in the first detection data is the same as the attribute value in the target detection data, determining the security detection result of the target detection data based on the security detection result of the first detection data; when the fourth matching result indicates that the attribute value of at least one target attribute in the first detection data is different from the attribute value in the target detection data, using the target sub-channel corresponding to the target attribute set in the target detection channel to detect the target detection data to obtain the security detection result of the target detection data.

[0089] In the first embodiment, when detected data having the same detection attribute as the target detection data is found in the preset storage space, and the detected data is data obtained by the detection result obtained by the target sub-channel detection in the target detection channel (i.e., the first detection data), the attribute value matching stage will be entered. The rule engine module extracts the attribute value from the first detection data, and compares it with the corresponding attribute value of the target detection data one by one to obtain a fourth matching result to verify whether the attribute values ​​of the same attribute contained in the target detection data are consistent.

[0090] Then, if the fourth matching result indicates that the attribute values ​​of the same attribute of the two data are exactly the same, then this indicates that the two data are equivalent from the detection perspective, that is, the target detection data hits the detection rule, and it is determined that the target detection data has security risks or abnormal behavior. The rule engine module will directly use the rule identifier matched by the first detection data in the previous detection to determine the security detection result of the target detection data. This is because if the attributes and attribute values ​​of the data are consistent, then their detection results under the security rule detection should also be the same, and there is no need to execute the matching process of the rule set again. This approach greatly improves the detection efficiency and avoids repeated detection of similar data, especially when there are a large number of similar events in the terminal data set, which can save a lot of computing resources.

[0091] Finally, if the fourth matching result indicates that the attribute value of the first detection data is different from the attribute value of the target detection data, this means that although the two pieces of data involve the same detection attribute, there may be differences in the specific behavior, and more detailed detection is required to determine its security status. The rule engine module will use multiple sub-channels (detection channels classified according to the detection attribute set) corresponding to the detection channel (detection channel classified according to the behavior type) to detect the target attribute of the target detection data. Each sub-channel will accurately match the target attribute and attribute value in the target detection data according to the rules corresponding to the sub-channel to determine whether the target detection data matches any known rules and obtain the above-mentioned security detection results of the target detection data.

[0092] In this embodiment, the target detection data is detected using the target sub-channel corresponding to the target attribute set in the target detection channel to obtain a security detection result of the target detection data. The attribute value of each target attribute of the first detection data can be detected according to each rule corresponding to the target sub-channel, and the security detection result of the target detection data is stored in a preset storage space. Then, the security detection result of the target detection data is reused for other subsequent data to be detected that have the same behavior type, the same attributes and the same attribute values, thereby achieving the effect of improving detection efficiency.

[0093] By utilizing the historical detection data in the preset storage space, rapid judgment of similar terminal behavior data is achieved. At the same time, when faced with differential data, detailed and accurate security detection can be performed through multi-layer detection channels, thereby ensuring the efficiency and accuracy of detection, and providing strong technical support for terminal security protection.

[0094] Optionally, in the rule-based security detection method provided in Example 1 of the present application, after determining the security detection result of the target detection data, the above method also includes: when the security detection result indicates that the target detection data hits the rule, determining that there is a security threat in the target detection data, and generating an alarm information based on the security detection result; sending the alarm information to the target object.

[0095] In the first embodiment of the present invention, after being detected by the rule engine module, the security detection result shows that the target detection data matches one or more rules in the preset rule set, that is, it hits the preset rule set, which means that there is a potential security threat or abnormal event in the target detection data. Based on the security detection result of hitting the rule set, detailed alarm information is generated. The alarm information may include: the behavior type of the target detection data, the attributes and values ​​that match the rules, the hit rule identifier and the specific content of the rule, the security threat level associated with the rule, and the application or data associated with the rule.

[0096] Then, the generated alarm information is sent to the target object. For example, the security management platform or console is used to centrally monitor and manage the security status of all terminals; members of the security response team receive alarm notifications via email, SMS or instant messaging tools; automated security response systems can automatically trigger predetermined security policies or actions based on alarm information.

[0097] Finally, the response measures formulated by the target object are received and executed. For example, the response measures may be to isolate suspicious processes to prevent them from further damaging the system or spreading malware; to block abnormal network connections to prevent data leakage or malicious network activities; to perform a deep scan of the affected system to find potential threats or vulnerabilities; to collect more log data and perform detailed analysis to determine the source and nature of the threat.

[0098] The entire process reflects a coherent security protection mechanism from the detection of terminal behavior data to the determination of security threats, and then to the formulation and execution of response measures. Through the efficient identification and alerting of the rule engine, and the rapid execution of automated response measures, the impact scope and response time of security incidents can be effectively reduced, providing a solid guarantee for the security of terminals and networks.

[0099] Optionally, in the first embodiment, a rule-based security detection system may be as follows: Figure 2 As shown. The rule-based security detection system includes a rule preprocessing module, a rule engine module and a result cache module. The rule preprocessing module is responsible for: in-depth analysis of the preset rule set, classifying the rules according to the behavior type bound to the rule (such as process startup, file operation, etc.) and the detection attribute set of the rule (such as Image path, ParentImage path, command line parameters, etc.); using a two-layer Map structure to store the rule classification results, where the key of the first layer Map structure represents the behavior data type, such as process_creation, file_delete, etc.; the key of the second layer Map structure represents the unique identifier of the detection attribute set, and its value is a set containing all rules related to the detection attribute set.

[0100] The rule engine module is responsible for: building a two-layer detection channel based on a two-layer Map structure. The first layer of detection channels (i.e., the detection channels mentioned above) are based on the behavior data type, and the second layer of detection channels are based on the unique identifier of the detection attribute set, forming a one-to-many parent-child relationship structure; when the target detection data reaches the rule engine module, the corresponding detection channel is selected by the behavior type, and then the corresponding second layer of detection channel (i.e., the sub-channel mentioned above) is selected for detection according to the detection attributes of the target detection data; before data detection, the result cache module is queried to find out whether data with the same detection attribute set has been detected before. If so, the values ​​of the detection attributes will be compared to see if they are exactly the same; if they are the same, the previous detection results are used directly to avoid repeated detection.

[0101] The result cache module is responsible for: storing the detection results passed by the rule engine module, also using a two-layer Map structure for storage; supporting deduplication of stored detection results, by defining a Hash algorithm based on the detection attribute value to ensure that there are no duplicate detection results in the detection result set; providing detection results to the rule engine module, and the rule engine module searches the result cache module for the detection results of a specific type of data and detection attribute set to determine whether re-detection is needed, which helps to improve detection efficiency and reduce resource consumption.

[0102] These three modules work together to achieve high performance and high efficiency in terminal behavior data detection. The rule preprocessing module classifies and optimizes the rule set, the rule engine module is responsible for data detection and efficient matching, and the result cache module further reduces repeated detection through storage and query mechanisms, achieving rapid response and processing of data, and jointly improving the overall performance of the terminal behavior rule engine.

[0103] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0104] Embodiment 2

[0105] The second embodiment of the present application also provides a rule-based security detection device. It should be noted that the rule-based security detection device of the second embodiment of the present application can be used to execute the rule-based security detection method provided in the first embodiment of the present application. The rule-based security detection device provided in the second embodiment of the present application is introduced below.

[0106] Figure 3 Schematic diagram of a rule-based security detection device according to Embodiment 2 of the present application. Figure 3As shown, the device includes: an acquisition unit 301, a first determination unit 302, a query unit 303 and a second determination unit 304.

[0107] Specifically, the acquisition unit 301 is used to acquire target detection data and determine the behavior type of the target detection data.

[0108] The first determination unit 302 is used to determine a detection channel that matches the behavior type of the target detection data among the multiple detection channels as the target detection channel, wherein the multiple detection channels are constructed according to rules corresponding to different behavior types.

[0109] The query unit 303 is used to query whether there is a detection result of the first detection data in the preset storage space, wherein the first detection data is data obtained by detecting the detection result of the target sub-channel in the target detection channel, and each target attribute in the target attribute set corresponding to the target sub-channel belongs to the attribute of the target detection data.

[0110] The second determining unit 304 is configured to determine the security detection result of the target detection data according to the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data when the detection result of the first detection data exists.

[0111] The rule-based security detection device provided in Example 2 of the present application constructs multiple detection channels by classifying the rule set according to different behavior types, and can direct the target detection data to the corresponding detection channel according to the behavior type during rule detection, avoiding unnecessary matching with irrelevant rules, and significantly improving the efficiency and accuracy of rule matching. At the same time, by querying the detection result of the first detection data with the same attribute as the target detection data in the preset storage space, and determining the security detection result of the target detection data based on the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data, it is possible to avoid repeated detection of data with the same detection attribute set, greatly saving computing resources and time, improving the overall detection performance, and well supporting high-concurrency detection environments. Even if millions of behavior data are generated every day in a terminal cluster, it is possible to effectively process and detect massive data through fast behavior type and attribute matching, avoiding performance bottlenecks and efficiency reductions caused by excessive data volume, achieving the effect of improving the security of terminal devices, and further achieving the effect of enhancing the security and stability of enterprise systems.

[0112] Optionally, in the rule-based security detection device provided in Example 2 of the present application, the above-mentioned device also includes: a first classification unit, which is used to classify the preset multiple rules according to the behavior type detected by the rule before determining the detection channel in the multiple detection channels that matches the behavior type of the target detection data as the target detection channel, so as to obtain a rule set corresponding to each behavior type; a second classification unit, which is used to classify the rule set corresponding to each behavior type according to the attribute set detected by the rule, so as to obtain rule subsets under the rule set corresponding to different attribute sets; a first construction unit, which is used to construct multiple detection channels based on multiple first mapping relationships, and to construct multiple sub-channels of each detection channel based on multiple second mapping relationships, wherein the first mapping relationship represents the mapping relationship between the rule set and the behavior type detected by the rule, and the second mapping relationship represents the mapping relationship between the rule subset and the attribute set under the rule set.

[0113] Optionally, in the rule-based security detection device provided in Example 2 of the present application, the above-mentioned device also includes: a storage unit, which is used to detect the attribute value of each target attribute of the first detection data according to each rule corresponding to the target sub-channel in the absence of detection results of the first detection data, to obtain a security detection result of the target detection data, and store the security detection result of the target detection data in a preset storage space.

[0114] Optionally, in the rule-based security detection device provided in Example 2 of the present application, the above-mentioned device also includes: a third determination unit, used to determine, for each sub-channel, an attribute set corresponding to the sub-channel; a processing unit, used to perform target processing on multiple attributes included in the attribute set to obtain a first string, wherein the target processing includes at least one of the following: concatenation, hash calculation; a first generation unit, used to generate a second string based on the attribute value of at least one attribute involved in the rule corresponding to the attribute set corresponding to the sub-channel; a third construction unit, used to generate a mapping relationship between the attribute set corresponding to the sub-channel and the rule corresponding to the sub-channel based on the first string and the second string.

[0115] Optionally, in the rule-based security detection device provided in Example 2 of the present application, the query unit 302 is used to: match all attributes of the target detection data with the attribute sets corresponding to each sub-channel of the target detection channel to obtain a second matching result; when the second matching result indicates that there is a matching attribute set, determine the sub-channel corresponding to the matching attribute set as the target sub-channel; and query whether there is first detection data in the preset storage space that has obtained a detection result through rule detection corresponding to the target sub-channel.

[0116] Optionally, in the rule-based security detection device provided in Example 2 of the present application, the above-mentioned second determination unit 304 includes: a matching subunit, used to match the attribute value of the target attribute of the first detection data with the attribute value of the target attribute of the target detection data for each target attribute, to obtain a fourth matching result; a determination subunit, used to determine the security detection result of the target detection data based on the security detection result of the first detection data when the fourth matching result indicates that the attribute value of each target attribute in the first detection data is the same as the attribute value in the target detection data; a detection subunit, used to detect the target detection data using the target sub-channel corresponding to the target attribute set in the target detection channel when the fourth matching result indicates that the attribute value of at least one target attribute in the first detection data is different from the attribute value in the target detection data, to obtain the security detection result of the target detection data.

[0117] Optionally, in the rule-based security detection device provided in Example 2 of the present application, the above-mentioned device also includes: a second generating unit, which is used to determine that there is a security threat in the target detection data after determining the security detection result of the target detection data, and generate an alarm information based on the security detection result when the security detection result indicates that the target detection data hits the rule; and a sending unit, which is used to send the alarm information to the target object.

[0118] The rule-based security detection device includes a processor and a memory. The above-mentioned acquisition unit 301, first determination unit 302, query unit 303 and second determination unit 304 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to implement corresponding functions.

[0119] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the detection efficiency can be improved by adjusting the kernel parameters.

[0120] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0121] Embodiment 3 of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a rule-based security detection method is implemented.

[0122] A fourth embodiment of the present invention provides a processor, which is used to run a program, wherein a rule-based security detection method is executed when the program is running.

[0123] like Figure 4As shown, embodiment 5 of the present invention provides an electronic device, the device includes a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: acquiring target detection data, and determining the behavior type of the target detection data; determining a detection channel in a plurality of detection channels that matches the behavior type of the target detection data as a target detection channel, wherein different detection channels are constructed based on rules corresponding to different behavior types; querying whether there is a detection result of first detection data in a preset storage space, wherein the first detection data is data obtained by detecting a target sub-channel in the target detection channel, and each target attribute in a target attribute set corresponding to the target sub-channel belongs to an attribute of the target detection data; in the case where there is a detection result of the first detection data, determining a security detection result of the target detection data based on the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data.

[0124] When the processor executes the program, the following steps are also implemented: before determining the detection channel in multiple detection channels that matches the behavior type of the target detection data as the target detection channel, the above method also includes: classifying multiple preset rules according to the behavior type detected by the rule to obtain a rule set corresponding to each behavior type; for the rule set corresponding to each behavior type, classifying the rule set according to the attribute set detected by the rule to obtain rule subsets corresponding to different attribute sets under the rule set; constructing multiple detection channels based on multiple first mapping relationships, and constructing multiple sub-channels of each detection channel based on multiple second mapping relationships, wherein the first mapping relationship represents the mapping relationship between the rule set and the behavior type detected by the rule, and the second mapping relationship represents the mapping relationship between the rule subset and the attribute set under the rule set.

[0125] When the processor executes the program, the following steps are also implemented: in the absence of detection results of the first detection data, the attribute value of each target attribute of the first detection data is detected according to the rules corresponding to the target sub-channel to obtain a security detection result of the target detection data, and the security detection result of the target detection data is stored in a preset storage space.

[0126] When the processor executes the program, the following steps are also implemented: for each sub-channel, determining the attribute set corresponding to the sub-channel; performing target processing on multiple attributes included in the attribute set to obtain a first character string, wherein the target processing includes at least one of the following: concatenation, hash calculation; generating a second character string based on the attribute value of at least one attribute involved in the rule corresponding to the attribute set corresponding to the sub-channel; and generating a mapping relationship between the attribute set corresponding to the sub-channel and the rule corresponding to the sub-channel based on the first character string and the second character string.

[0127] When the processor executes the program, the following steps are also implemented: querying whether there is a detection result of the first detection data in the preset storage space, including: matching all attributes of the target detection data with the attribute sets corresponding to each sub-channel of the target detection channel to obtain a second matching result; when the second matching result indicates that there is a matching attribute set, determining the sub-channel corresponding to the matching attribute set as the target sub-channel; querying whether there is the first detection data in the preset storage space that has obtained the detection result through the rule detection corresponding to the target sub-channel.

[0128] When the processor executes the program, the following steps are also implemented: determining the security detection result of the target detection data based on the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data, including: for each target attribute, matching the attribute value of the target attribute of the first detection data with the attribute value of the target attribute of the target detection data to obtain a fourth matching result; when the fourth matching result indicates that the attribute value of each target attribute in the first detection data is the same as the attribute value in the target detection data, determining the security detection result of the target detection data based on the security detection result of the first detection data; when the fourth matching result indicates that the attribute value of at least one target attribute in the first detection data is different from the attribute value in the target detection data, using the target sub-channel corresponding to the target attribute set in the target detection channel to detect the target detection data to obtain the security detection result of the target detection data.

[0129] When the processor executes the program, the following steps are also implemented: after determining the security detection result of the target detection data, the above method also includes: when the security detection result indicates that the target detection data hits the rule, determining that there is a security threat in the target detection data, and generating an alarm information based on the security detection result; sending the alarm information to the target object.

[0130] The device in this article can be various network security devices, such as a firewall.

[0131] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: obtaining target detection data and determining a behavior type of the target detection data; determining a detection channel that matches the behavior type of the target detection data among multiple detection channels as a target detection channel, wherein different detection channels are constructed based on rules corresponding to different behavior types; querying whether there is a detection result of first detection data in a preset storage space, wherein the first detection data is data obtained by detecting a target sub-channel in the target detection channel, and each target attribute in a target attribute set corresponding to the target sub-channel belongs to an attribute of the target detection data; in the case where there is a detection result of the first detection data, determining a security detection result of the target detection data based on an attribute value of each target attribute of the first detection data and an attribute value of each target attribute of the target detection data.

[0132] When executed on a data processing device, it is also suitable for executing a program that is initialized with the following method steps: before determining a detection channel in multiple detection channels that matches the behavior type of target detection data as the target detection channel, the above method also includes: classifying multiple preset rules according to the behavior type detected by the rule to obtain a rule set corresponding to each behavior type; for the rule set corresponding to each behavior type, classifying the rule set according to the attribute set detected by the rule to obtain rule subsets under the rule set that correspond to different attribute sets; constructing multiple detection channels based on multiple first mapping relationships, and constructing multiple sub-channels of each detection channel based on multiple second mapping relationships, wherein the first mapping relationship represents the mapping relationship between the rule set and the behavior type detected by the rule, and the second mapping relationship represents the mapping relationship between the rule subset and the attribute set under the rule set.

[0133] When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: in the absence of a detection result of the first detection data, detecting the attribute value of each target attribute of the first detection data according to each rule corresponding to the target sub-channel, obtaining a security detection result of the target detection data, and storing the security detection result of the target detection data in a preset storage space.

[0134] When executed on a data processing device, it is also suitable for executing an initialized program having the following method steps: for each sub-channel, determining the attribute set corresponding to the sub-channel; performing target processing on multiple attributes included in the attribute set to obtain a first character string, wherein the target processing includes at least one of the following: concatenation, hash calculation; generating a second character string based on the attribute value of at least one attribute involved in the rule corresponding to the attribute set corresponding to the sub-channel; and generating a mapping relationship between the attribute set corresponding to the sub-channel and the rule corresponding to the sub-channel based on the first character string and the second character string.

[0135] When executed on a data processing device, it is also suitable for executing a program that is initialized with the following method steps: querying whether there is a detection result of the first detection data in the preset storage space, including: matching all attributes of the target detection data with the attribute sets corresponding to each sub-channel of the target detection channel to obtain a second matching result; when the second matching result indicates that there is a matching attribute set, determining the sub-channel corresponding to the matching attribute set as the target sub-channel; querying whether there is the first detection data in the preset storage space that has obtained the detection result through the rule detection corresponding to the target sub-channel.

[0136] When executed on a data processing device, it is also suitable for executing a program initialized with the following method steps: determining a security detection result of the target detection data based on the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data, including: for each target attribute, matching the attribute value of the target attribute of the first detection data with the attribute value of the target attribute of the target detection data to obtain a fourth matching result; when the fourth matching result indicates that the attribute value of each target attribute in the first detection data is the same as the attribute value in the target detection data, determining the security detection result of the target detection data based on the security detection result of the first detection data; when the fourth matching result indicates that the attribute value of at least one target attribute in the first detection data is different from the attribute value in the target detection data, using the target sub-channel corresponding to the target attribute set in the target detection channel to detect the target detection data to obtain the security detection result of the target detection data.

[0137] When executed on a data processing device, it is also suitable for executing a program that initializes the following method steps: after determining the security detection result of the target detection data, the above method also includes: when the security detection result indicates that the target detection data hits the rule, determining that there is a security threat in the target detection data, and generating an alarm information based on the security detection result; sending the alarm information to the target object.

[0138] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0139] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0140] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0141] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0142] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0143] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0144] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0145] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0146] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0147] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A rule-based security detection method, characterized in that: include: Acquire target detection data, and determine the behavior type of the target detection data; Determine a detection channel among multiple detection channels that matches the behavior type of the target detection data as a target detection channel, wherein different detection channels are constructed according to rules corresponding to different behavior types; Querying whether there is a detection result of first detection data in the preset storage space, wherein the first detection data is data obtained by detecting a target sub-channel in the target detection channel, and each target attribute in the target attribute set corresponding to the target sub-channel belongs to the attribute of the target detection data; In the case where the detection result of the first detection data exists, the security detection result of the target detection data is determined according to the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data.

2. The method according to claim 1, characterized in that Before determining a detection channel among the multiple detection channels that matches the behavior type of the target detection data as the target detection channel, the method further includes: Classify multiple preset rules according to the behavior type detected by the rules to obtain a rule set corresponding to each behavior type; For each rule set corresponding to the behavior type, the rule set is classified according to the attribute set detected by the rule, so as to obtain rule subsets corresponding to different attribute sets under the rule set; The multiple detection channels are constructed based on multiple first mapping relationships, and the multiple sub-channels of each detection channel are constructed based on multiple second mapping relationships, wherein the first mapping relationship represents the mapping relationship between the rule set and the behavior type detected by the rule, and the second mapping relationship represents the mapping relationship between the rule subset under the rule set and the attribute set.

3. The method according to claim 1, characterized in that The method further comprises: In the absence of a detection result of the first detection data, the attribute value of each target attribute of the first detection data is detected according to the rules corresponding to the target sub-channel to obtain a security detection result of the target detection data, and the security detection result of the target detection data is stored in the preset storage space.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: For each sub-channel, determining an attribute set corresponding to the sub-channel; Performing target processing on multiple attributes included in the attribute set to obtain a first character string, wherein the target processing includes at least one of the following: concatenation and hash calculation; generating a second character string according to an attribute value of at least one attribute involved in a rule corresponding to the attribute set corresponding to the subchannel; A mapping relationship between the attribute set corresponding to the sub-channel and the rule corresponding to the sub-channel is generated according to the first character string and the second character string.

5. The method according to claim 1, characterized in that Querying whether there is a detection result of the first detection data in the preset storage space includes: Matching all attributes of the target detection data with attribute sets corresponding to each sub-channel of the target detection channel to obtain a second matching result; In a case where the second matching result indicates that there is a matching attribute set, determining the subchannel corresponding to the matching attribute set as the target subchannel; The preset storage space is queried to determine whether the first detection data having a detection result obtained through detection of a rule corresponding to the target sub-channel exists.

6. The method according to claim 1, characterized in that Determining a security detection result of the target detection data according to an attribute value of each target attribute of the first detection data and an attribute value of each target attribute of the target detection data includes: For each target attribute, matching the attribute value of the target attribute of the first detection data with the attribute value of the target attribute of the target detection data to obtain a fourth matching result; If the fourth matching result indicates that the attribute value of each of the target attributes in the first detection data is the same as the attribute value in the target detection data, determining the security detection result of the target detection data according to the security detection result of the first detection data; When the fourth matching result indicates that the attribute value of at least one of the target attributes in the first detection data is different from the attribute value in the target detection data, the target detection data is detected using the target sub-channel corresponding to the target attribute set in the target detection channel to obtain a security detection result of the target detection data.

7. The method according to claim 1, characterized in that After determining the security detection result of the target detection data, the method further includes: In the case where the security detection result indicates that the target detection data hits a rule, determining that there is a security threat in the target detection data, and generating an alarm message according to the security detection result; The warning information is sent to the target object.

8. A rule-based safety detection device, characterized in that: include: an acquisition unit, used to acquire target detection data and determine a behavior type of the target detection data; A first determining unit is used to determine a detection channel that matches the behavior type of the target detection data among the multiple detection channels as a target detection channel, wherein different detection channels are constructed according to rules corresponding to different behavior types; A query unit, configured to query whether there is a detection result of first detection data in a preset storage space, wherein the first detection data is data obtained by detecting a target sub-channel in the target detection channel, and each target attribute in a target attribute set corresponding to the target sub-channel belongs to an attribute of the target detection data; The second determination unit is used to determine the security detection result of the target detection data according to the attribute value of each target attribute of the first detection data and the attribute value of each target attribute of the target detection data when the detection result of the first detection data exists.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes stored computer instructions, wherein when the computer instructions are executed by a processor, the rule-based security detection method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the rule-based security detection method described in any one of claims 1 to 7.

Images