Behavior detection method, device, electronic device, storage medium and program product

Abstract

The embodiments of the present application provide a behavior detection method, device, electronic device, computer-readable storage medium and computer program product, which relate to the field of attack behavior detection technology. The method includes: collecting the target behavior of the target terminal, obtaining a behavior sequence to be detected, comparing the behavior sequence to be detected with a malicious sequence sample in a malicious sequence sample set, and determining whether the behavior sequence to be detected is a malicious sequence. The malicious sequence sample set contains multiple malicious sequence samples, and each malicious sequence sample is a behavior sequence corresponding to the malicious behavior. The embodiments of the present application realize the detection of unknown or potential threat behaviors through known malicious behaviors, improve the detection rate of malicious behaviors, and ensure the accuracy of attack behavior judgment.

Description

Technical Field

[0001] The present application relates to the technical field of attack behavior detection. Specifically, the present application relates to a behavior detection method, device, electronic device, computer-readable storage medium and computer program product. Background Art

[0002] With the continuous development of computer science and technology, more attention has been paid to network security issues. How to accurately detect attack behaviors is an urgent problem to be solved. Terminal behavior detection and response EDR products have the ability to collect various specific behaviors such as processes, files, networks, etc. on the host. However, after analyzing the collected behaviors, it is impossible to make malicious judgments and it is easy to make false alarms. Therefore, a method is needed to improve the detection rate and reduce the false alarm rate.

[0003] The current attack behavior detection method analyzes the collected data, files, and processes, sets a baseline for normal behavior, and identifies abnormal behaviors that deviate from the baseline, thereby detecting attack behaviors. However, this method has a high misjudgment rate and is not accurate enough. Summary of the invention

[0004] The embodiments of the present application provide a behavior detection method, device, electronic device, computer-readable storage medium and computer program product, which aim to solve the technical problems of high misjudgment rate and low accuracy of existing attack behavior detection.

[0005] In a first aspect, a behavior detection method is provided, the method comprising:

[0006] Collect the target behavior of the target terminal to obtain the behavior sequence to be detected;

[0007] The behavior sequence to be detected is compared with the malicious sequence samples in the malicious sequence sample set to determine whether the behavior sequence to be detected is a malicious sequence; the malicious sequence sample set includes multiple malicious sequence samples, and each malicious sequence sample is a behavior sequence corresponding to the malicious behavior.

[0008] Optionally, before comparing the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set, the following steps are further included:

[0009] Obtaining an attack activity sample; the attack activity sample includes a plurality of sample attack steps arranged in a predetermined order;

[0010] According to the predetermined sequence, the attack activity samples are converted into malicious sequence samples.

[0011] Optionally, the attack activity sample is converted into a malicious sequence sample according to a predetermined sequence, including:

[0012] According to a predetermined sequence, each sample attack step in the attack activity sample is mapped into a corresponding sample behavior feature to obtain an attack activity sample behavior chain;

[0013] Convert the attack activity sample behavior chain into a malicious sequence sample.

[0014] Optionally, each sample attack step in the attack activity sample is mapped into a corresponding sample behavior feature according to a predetermined order to obtain an attack activity sample behavior chain, including:

[0015] Mapping each sample attack step in the attack activity sample into the corresponding sample behavior feature;

[0016] Arrange the behavior features of each sample according to a predetermined order to obtain the attack activity sample behavior chain.

[0017] Optionally, convert the attack activity sample behavior chain into a malicious sequence sample, including:

[0018] Analyze and process the behavior characteristics of each sample in the attack activity sample behavior chain to obtain the corresponding sample attack behavior;

[0019] Arrange the attack behaviors of each sample according to a predetermined order to obtain a malicious sequence sample.

[0020] Optionally, comparing the behavior sequence to be detected with malicious sequence samples in a malicious sequence sample set to determine whether the behavior sequence to be detected is a malicious sequence includes:

[0021] Compare the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity;

[0022] If the target similarity is greater than or equal to the preset threshold, the behavior sequence to be detected is determined to be a malicious sequence.

[0023] Optionally, the behavior sequence to be detected is compared with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity, including:

[0024] Dividing the behavior sequence to be detected by a predetermined window value to obtain corresponding behavior sequence segments to be detected;

[0025] Divide the malicious sequence samples according to the predetermined window value to obtain the corresponding malicious sequence segments;

[0026] Compare each behavior sequence segment to be detected with the corresponding malicious sequence segment segment by segment to obtain the target similarity.

[0027] Optionally, the behavior sequence to be detected is compared with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity, including:

[0028] Clustering each target behavior in the behavior sequence to be detected to obtain a first clustering result;

[0029] Clustering the attack behaviors of each sample in the malicious sequence samples from the same source to obtain a second clustering result;

[0030] Based on the first clustering result and the second clustering result, the target similarity is obtained.

[0031] Optionally, obtaining target similarity based on the first clustering result and the second clustering result includes:

[0032] Compare the first clustering result with the second clustering result to determine matching cluster center points;

[0033] The cluster center points are compared with the predetermined key behaviors to obtain the target similarity.

[0034] In a second aspect, a behavior detection device is provided, the device comprising:

[0035] A collection module is used to collect target behaviors of the target terminal and obtain a sequence of behaviors to be detected;

[0036] The comparison module is used to compare the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine whether the behavior sequence to be detected is a malicious sequence; the malicious sequence sample set contains multiple malicious sequence samples, and each malicious sequence sample is a behavior sequence corresponding to the malicious behavior.

[0037] In a third aspect, an electronic device is provided, the electronic device comprising:

[0038] A memory, a processor, and a computer program stored in the memory, characterized in that the processor executes the computer program to implement the steps of any method in the first aspect of the present application.

[0039] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, characterized in that when the computer program is executed by a processor, the behavior detection method shown in any one of the first aspects of the present application is implemented.

[0040] In a fifth aspect, a computer program product is provided, comprising a computer program, characterized in that when the computer program is executed by a processor, the steps of any one of the methods in the first aspect of the present application are implemented.

[0041] The beneficial effects of the technical solution provided by the embodiment of the present application are:

[0042] The behavior detection method provided in the present application collects the target behavior of the target terminal, analyzes it to obtain the behavior sequence to be detected, compares the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set, determines whether the behavior sequence to be detected is a malicious sequence based on the comparison, and detects multiple behaviors generated on the terminal through known malicious attack sequences. It can accurately detect threatening malicious behaviors, improve the accuracy of malicious behavior detection, reduce misjudgments and missed judgments, and increase the detection rate of malicious behaviors.

[0043] Furthermore, for known attack activity samples, the sample attack steps in the attack activity samples are mapped to corresponding sample behavior features to form an attack activity sample behavior chain. The sample behavior features in the attack activity sample behavior chain are analyzed to obtain the corresponding sample attack behaviors, thereby obtaining malicious sequence samples. By converting large-grained sample attack steps into smaller-grained sample attack behaviors, the malicious sequence samples are aligned with the granularity of the behavior sequence to be detected for comparison to determine whether the behavior sequence to be detected is a malicious sequence. This can speed up the efficiency of malicious behavior detection and enhance the credibility of malicious behavior detection.

[0044] In addition, for the comparison between the behavior sequence to be detected and the malicious sequence samples, it is possible to determine whether there is malicious behavior in the behavior sequence to be detected based on the similarity. The behavior sequence to be detected and the malicious sequence samples can be divided respectively by a predetermined window value, and the divided sequence segments can be compared. The target behavior in the behavior sequence to be detected and the sample attack behavior in the malicious sequence samples can be compared by clustering to obtain the target similarity. Detection based on clustering can indicate whether there is malicious attack behavior. Comparison between sequence segments can determine whether the malicious attack behavior fits a certain attack chain. Based on these two methods, the accuracy and reliability of malicious behavior detection can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0046] Figure 1 A schematic diagram of an application scenario of a behavior detection method provided in an embodiment of the present application;

[0047] Figure 2 A flow chart of a behavior detection method provided in an embodiment of the present application;

[0048] Figure 3 A schematic diagram of a process for generating malicious sequence samples in a behavior detection method provided in an embodiment of the present application;

[0049] Figure 4A schematic diagram of a behavior sequence to be detected and a malicious sequence sample in a behavior detection method provided in an embodiment of the present application;

[0050] Figure 5 A flowchart of an example of a behavior detection method provided in an embodiment of the present application;

[0051] Figure 6 A flowchart of an example of generating a malicious sequence sample in a behavior detection method provided in an embodiment of the present application;

[0052] Figure 7 A schematic diagram of the structure of a behavior detection device provided in an embodiment of the present application;

[0053] Figure 8 A schematic diagram of the structure of an electronic device applicable to a behavior detection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The embodiments of the present application are described below in conjunction with the drawings in the present application. It should be understood that the implementation methods described below in conjunction with the drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions of the embodiments of the present application.

[0055] It will be understood by those skilled in the art that, unless specifically stated, the singular forms "one", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the terms "including" and "comprising" used in the embodiments of the present application refer to that the corresponding features can be implemented as the presented features, information, data, steps, operations, elements and / or components, but do not exclude the implementation as other features, information, data, steps, operations, elements, components and / or combinations thereof supported by the present technical field. It should be understood that when we call an element "connected" or "coupled" to another element, the one element may be directly connected or coupled to the other element, or it may refer to that the one element and the other element establish a connection relationship through an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The terms "or", "and / or", "including at least one of the following" etc. used in the present application may be interpreted as inclusive, or mean any one or any combination. For example, “including at least one of the following: A, B, C” means “any of the following: A; B; C; A and B; A and C; B and C; A and B and C” and, for example, “A, B or C” or “A, B and / or C” means “any of the following: A; B; C; A and B; A and C; B and C; A and B and C”.

[0056] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0057] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0058] First, the technical terms involved in this application are introduced and explained:

[0059] Malicious sequence: In network security, a malicious attack behavior sequence usually refers to a series of ordered attack steps taken by an attacker to achieve a certain purpose, such as data leakage, system destruction, and permission acquisition.

[0060] In the existing technology, terminal behavior detection and response EDR products have the ability to collect various specific behaviors such as processes, files, networks, etc. on the host, but after analyzing the collected behaviors, they are unable to make malicious judgments and are prone to false alarms. The current detection method analyzes the various collected data, files, and processes, sets a baseline for normal behavior, and identifies abnormal behaviors that deviate from the baseline, thereby detecting attack behaviors. However, this method has a high misjudgment rate and is not accurate enough.

[0061] The behavior detection method, device, electronic device, computer-readable storage medium and computer program product provided in the present application are intended to solve at least one of the above technical problems in the prior art.

[0062] In response to at least one of the above-mentioned technical problems or areas that need improvement in the related technology, the present application proposes a behavior detection method, device, electronic device, computer-readable storage medium and computer program product. The behavior detection method provided by the scheme collects the target behavior of the target terminal, analyzes and obtains the behavior sequence to be detected, compares the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set, and determines whether the behavior sequence to be detected is a malicious sequence based on the comparison. Through the known malicious attack sequence, multiple behaviors generated on the terminal are detected, and malicious behaviors that pose a threat can be accurately detected, which can improve the accuracy of malicious behavior detection, reduce misjudgments and missed judgments, and improve the detection rate of malicious behaviors.

[0063] Furthermore, for known attack activity samples, the sample attack steps in the attack activity samples are mapped to corresponding sample behavior features to form an attack activity sample behavior chain. The sample behavior features in the attack activity sample behavior chain are analyzed to obtain the corresponding sample attack behaviors, thereby obtaining malicious sequence samples. By converting large-grained sample attack steps into smaller-grained sample attack behaviors, the malicious sequence samples are aligned with the granularity of the behavior sequence to be detected for comparison to determine whether the behavior sequence to be detected is a malicious sequence. This can speed up the efficiency of malicious behavior detection and enhance the credibility of malicious behavior detection.

[0064] In addition, for the comparison between the behavior sequence to be detected and the malicious sequence samples, it is possible to determine whether there is malicious behavior in the behavior sequence to be detected based on the similarity. The behavior sequence to be detected and the malicious sequence samples can be divided respectively by a predetermined window value, and the divided sequence segments can be compared. The target behavior in the behavior sequence to be detected and the sample attack behavior in the malicious sequence samples can be compared by clustering to obtain the target similarity. Detection based on clustering can indicate whether there is malicious attack behavior. Comparison between sequence segments can determine whether the malicious attack behavior fits a certain attack chain. Based on these two methods, the accuracy and reliability of malicious behavior detection can be improved.

[0065] The following describes several exemplary embodiments to illustrate the technical solutions of the embodiments of the present application and the technical effects produced by the technical solutions of the present application. It should be noted that the following embodiments can refer to, draw on or combine with each other, and the same terms, similar features and similar implementation steps in different embodiments will not be described repeatedly.

[0066] Figure 1 A schematic diagram of an application scenario of the behavior detection method provided in an embodiment of the present application, wherein the application environment may include a terminal 101 or a server that can perform the above-mentioned behavior detection method.

[0067] Specifically, the terminal 101 collects the target behavior of the target terminal, obtains the behavior sequence to be detected, compares the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set, and determines whether the behavior sequence to be detected is a malicious sequence. The malicious sequence sample set includes multiple malicious sequence samples, each of which is a behavior sequence corresponding to the malicious behavior.

[0068] The above application scenario is only an example and does not limit the application scenario of the behavior detection method of the present application.

[0069] Technicians in this technical field can understand that the terminal can be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a laptop computer, a digital broadcast receiver, a MID (Mobile Internet Devices), a PDA (Personal Digital Assistant), a desktop computer, a smart home appliance, a vehicle-mounted terminal (such as a vehicle-mounted navigation terminal, a vehicle-mounted computer, etc.), a smart speaker, a smart watch, etc. The terminal and the server can be directly or indirectly connected via wired or wireless communication, but is not limited to this.

[0070] The server may include a server installed with a computer capable of processing database operations. The server may be an independent physical server, or a server cluster or distributed system consisting of multiple physical servers. It may also be a cloud server or server cluster that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, etc. The specific requirements can also be determined based on the actual application scenario requirements, which are not limited here.

[0071] In some possible implementations, taking the execution subject as a behavior detection system as an example, the present application embodiment provides a behavior detection method, such as Figure 2 As shown, the following steps may be included:

[0072] S210, collecting target behaviors of the target terminal to obtain a sequence of behaviors to be detected.

[0073] Among them, the target behavior includes various specific behaviors such as processes, files, networks, etc.; the target behavior can be all behaviors collected from multiple dimensions such as the same source and destination network address, the same host, a certain time period, the same sample, etc., and can be attack behaviors from the same attack source.

[0074] Specifically, the target behaviors of the target terminal are collected and analyzed to obtain the correlation between the behaviors. These behaviors are correlated to obtain a sequence of behaviors to be detected. There may be multiple sequences of behaviors to be detected.

[0075] In the specific implementation process, behavioral data can be collected through terminal behavior detection and response EDR. EDR deploys a lightweight agent program on the terminal device to collect system calls, file operations, network traffic, log records, memory activity and other data in real time, monitor and analyze the behavior of users and applications, and establish a normal activity baseline. It can identify and respond to abnormal behavior that deviates from the baseline, effectively detect and defend against potential network security threats. Combined with the behavior detection method in this application, it can more comprehensively detect behavioral anomalies and improve the recognition rate of malicious behavior.

[0076] S220, comparing the behavior sequence to be detected with malicious sequence samples in the malicious sequence sample set to determine whether the behavior sequence to be detected is a malicious sequence.

[0077] Among them, the malicious sequence sample set contains multiple malicious sequence samples, and each malicious sequence sample is a behavior sequence corresponding to a malicious behavior.

[0078] Specifically, the behavior sequence to be detected is compared with the malicious sequence samples in the malicious sequence sample set, that is, each target behavior in the behavior sequence to be detected is compared with each malicious behavior in the malicious sequence sample, so as to determine whether each target behavior has potential attack tendencies. If there are behaviors with attack tendencies, the behavior sequence to be detected is a malicious sequence.

[0079] During the specific implementation process, the behavior sequence to be detected can be matched with the malicious sequence samples in the malicious sequence sample set. If the match is successful, the behavior sequence to be detected is considered to be a malicious sequence. If the match fails, it can be considered that the behavior sequence to be detected currently has no attack tendency, and the behavior data of the terminal can continue to be collected. The conditions for a successful match may include that the proportion of the matched behavior in the sequence is greater than a preset matching threshold, or that the match is considered to be successful as long as there is a matching behavior. The specific conditions can be adjusted according to the attack behavior detection requirements required by the terminal.

[0080] In some possible implementations, such as Figure 3 As shown, the above method also includes:

[0081] S310, obtaining attack activity samples.

[0082] The attack activity sample includes multiple sample attack steps arranged in a predetermined order.

[0083] Specifically, the attack activity samples are known attack activities, which are generally in the form of relatively abstract text reports. Such attack activities need to be converted into a form that can be compared with the behaviors collected by the terminal to facilitate comparison of the behavior sequences, thereby determining whether the behavior sequence to be detected is a malicious sequence.

[0084] In the specific implementation process, the attack activity sample may include attack activities from multiple attack sources, each attack source may correspond to multiple attack activity sequences, and multiple attack activity sequences corresponding to the same attack source may be taken as a group. When it is necessary to determine the similarity through comparison, the attack behaviors in the same group may be clustered and compared with the behavior sequences to be detected in groups. When a large number of behavior sequences to be detected need to be processed, the efficiency of behavior detection is accelerated, and it is quickly determined whether the behavior sequence to be detected is a malicious sequence.

[0085] S320, converting the attack activity samples into malicious sequence samples according to a predetermined sequence.

[0086] Specifically, the granularity of the acquired attack activity samples is not aligned with that of the behavior sequence to be detected, making them difficult to compare. The attack activity samples need to be converted into sequences of corresponding forms. After mapping the sample attack steps in the attack activity samples, the content and number of the sample attack steps may change. The mapped behaviors need to be sorted and connected according to a predetermined order to be converted into corresponding malicious sequence samples.

[0087] During the specific implementation process, each sample attack step in the attack activity sample can be mapped to the steps of ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) to obtain the corresponding technical kill chain, and each step of the technical kill chain is converted into a step that can be obtained by the terminal to generate a malicious sequence sample. Among them, ATT&CK is a structured list that summarizes the behavior of known attackers into tactics and techniques, and can convert abstract step language into more standard behavioral steps, thereby obtaining malicious sequence samples that can be recognized by the terminal, which can improve the performance of the behavioral testing method of this application.

[0088] In some possible implementations, the above steps convert the attack activity sample into a malicious sequence sample according to a predetermined order, including:

[0089] According to a predetermined sequence, each sample attack step in the attack activity sample is mapped into a corresponding sample behavior feature to obtain an attack activity sample behavior chain;

[0090] Convert the attack activity sample behavior chain into a malicious sequence sample.

[0091] The predetermined sequence may be obtained based on the sequence of the original attack activity samples.

[0092] Specifically, each sample attack step in the attack activity sample is mapped into a corresponding sample behavior feature. One sample attack step can be mapped to one or more sample behavior features. Therefore, it is necessary to re-sort the mapped sample behavior features based on a predetermined order to obtain the attack activity sample behavior chain, and then convert the attack activity sample behavior chain into a malicious sequence sample.

[0093] In the specific implementation process, the ATT&CK framework can be used to map the sample attack steps into corresponding sample behavior features. Each sample attack step in the attack activity sample can be described by one or more attack techniques in this framework. For example, the step of "sending an attachment containing malicious code to the target organization through a spear phishing attack" can be described by "T1566.001 Spear phishing attack attachment", and "the malicious code downloads the file from the remote address and obtains the malicious file of the same name by decompression" is mapped to "T1105 tool internal transmission".

[0094] In some possible implementations, in the above steps, each sample attack step in the attack activity sample is mapped to a corresponding sample behavior feature according to a predetermined order to obtain an attack activity sample behavior chain, including:

[0095] Mapping each sample attack step in the attack activity sample into the corresponding sample behavior feature;

[0096] Arrange the behavior features of each sample according to a predetermined order to obtain the attack activity sample behavior chain.

[0097] Among them, a sample attack step can be mapped to one or more sample behavior features.

[0098] Specifically, the sample attack steps in each attack activity sample are mapped to corresponding sample behavior features. The number and content of the sample behavior features may be different from the original sample attack steps. It is necessary to arrange the sample behavior features based on a predetermined order to obtain the attack activity sample behavior chain.

[0099] During the specific implementation process, after mapping each sample attack step in the attack activity sample into a corresponding sample behavior feature, the sample behavior feature can be marked based on a preset key behavior table. The sample behavior feature can be marked as highly malicious behavior, medium malicious behavior, and low malicious behavior. The key behavior can be determined in the behavior with feature marks as needed, so that when compared with the behavior sequence to be detected, judgment can be made based on these marks and the corresponding key behaviors, which can enhance the flexibility of malicious behavior detection and improve the reliability of malicious behavior detection.

[0100] In some possible implementations, the above steps of converting the attack activity sample behavior chain into a malicious sequence sample include:

[0101] Analyze and process the behavior characteristics of each sample in the attack activity sample behavior chain to obtain the corresponding sample attack behavior;

[0102] Arrange the attack behaviors of each sample according to a predetermined order to obtain a malicious sequence sample.

[0103] Among them, after being analyzed and processed, the sample behavior characteristics can correspond to one or more sample attack behaviors.

[0104] Specifically, obtain the attack activity sample behavior chain, analyze and process the sample behavior features therein, and obtain the corresponding sample attack behavior. Since one sample behavior feature can be multiple sample attack behaviors, after obtaining the sample attack behavior, the sample attack behavior needs to be rearranged in a predetermined order to obtain the corresponding malicious sequence sample.

[0105] In the specific implementation process, the sample behavior characteristics can be mapped to obtain labels such as high malicious behavior, medium malicious behavior and low malicious behavior. After the sample behavior characteristics are analyzed and processed, the corresponding sample attack behaviors are obtained, and these labels will also be transferred to the corresponding sample attack behaviors. For example, the sample behavior feature "spear phishing attack attachment" can be marked as high malicious behavior, and the converted sample attack behaviors "an email was received on the computer", "the user downloaded the attachment in the email" and "the attachment was opened through the reader" can all be marked as high malicious behavior. You can also specify a key behavior among these three sample attack behaviors, such as "the user downloaded the attachment in the email", which is used to compare with the behavior sequence to be detected to determine whether it is a malicious sequence.

[0106] In the specific implementation process, the process of converting attack activity samples into malicious sequence samples can be regarded as the process of enriching behaviors. For example, the attack activity sample consists of four steps. The sample behavior characteristics obtained by mapping may include A, B, C, and D. The sample attack behaviors obtained by conversion may include A1, A2, A3, B1, B2, C1, C2, and D1, a total of eight steps. The purpose is to obtain more detailed sample attack behaviors so that the sample attack behaviors can be collected by EDR. Sample attack behaviors may include host processes, network or file operation behaviors, commonly known as dot behaviors.

[0107] In the specific implementation process, the sample behavior characteristics need to be further analyzed and processed to obtain the corresponding sample attack behavior. For example, the granularity of "T1566.001 Spear Phishing Attack Attachment" is different from the data granularity of the collected target behavior, so this step is converted into three smaller granularity events: "An email was received on the computer", "The user downloaded the attachment in the email" and "The attachment was opened through the reader".

[0108] In some possible implementations, the step S220 compares the behavior sequence to be detected with malicious sequence samples in the malicious sequence sample set to determine whether the behavior sequence to be detected is a malicious sequence, including:

[0109] Compare the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity;

[0110] If the target similarity is greater than or equal to the preset threshold, the behavior sequence to be detected is determined to be a malicious sequence.

[0111] Specifically, the behavior sequence to be detected is compared with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity. If the target similarity meets the preset judgment condition, the behavior sequence to be detected is determined to be a malicious sequence. The step of judging based on the preset judgment condition may include determining that the behavior sequence to be detected is a malicious sequence if the target similarity is greater than or equal to a preset threshold. If there is no target similarity greater than or equal to the preset threshold, the target similarities corresponding to the behavior to be detected can be sorted from large to small, and the malicious sequence sample corresponding to the frontmost similarity is displayed to the user. Combined with the user's feedback on the sequence, it is determined whether the behavior sequence to be detected is a malicious sequence, which can effectively reduce the misjudgment rate and missed judgment rate of malicious sequences and improve the accuracy of malicious behavior detection.

[0112] In the specific implementation process, two methods can be used for comparison: the sliding window n-gram method and the clustering method. The two methods can be used alone to determine the similarity or combined to determine the similarity. If the clustering method alone determines that it is a malicious sequence, it means that there is malicious attack behavior, but it is not necessarily on the same attack chain. Both methods believe that the sequence to be detected is a malicious sequence, which means that it is a malicious attack and the confidence level of matching an attack kill chain is high. Using the two methods to compare and determine whether the behavior sequence to be detected is a malicious sequence can improve the accuracy and credibility of malicious sequence detection.

[0113] In the specific implementation process, the behavior sequence to be detected and the corresponding malicious sequence samples can be as follows Figure 4As shown, the target behaviors collected by the terminal may include email reception, file attachment downloading, process creation, web page Web access, file downloading, file decompression, file creation, loading library files and dumping memory, etc. The left side of the figure is a corresponding behavior sequence to be detected generated based on the association relationship (i.e., the dot behavior chain shown in the figure), and the right side of the figure is a malicious sequence sample corresponding to the behavior sequence to be detected. The malicious sequence sample is converted based on the included attack behavior chain (i.e., the dot behavior converted from the included attack behavior chain shown in the figure). The malicious sequence sample after conversion may also include email reception, email attachment downloading, process creation, web page Web access, file downloading, file decompression, file creation, loading library files and dumping memory. It can be seen from the figure that the behavior sequence to be detected (i.e., the dot behavior chain shown in the figure) is highly similar to the malicious sequence sample (i.e., the dot behavior converted from the attack behavior chain shown in the figure), so it can be preliminarily judged that the behavior sequence to be detected is a malicious sequence, and it can be judged based on the similarity later.

[0114] In some possible implementations, the above steps of comparing the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity include:

[0115] Dividing the behavior sequence to be detected by a predetermined window value to obtain corresponding behavior sequence segments to be detected;

[0116] Divide the malicious sequence samples according to the predetermined window value to obtain the corresponding malicious sequence segments;

[0117] Compare each behavior sequence segment to be detected with the corresponding malicious sequence segment segment by segment to obtain the target similarity.

[0118] The predetermined window value may be obtained in advance based on malicious sequence samples, and each malicious sequence sample includes a corresponding predetermined window value.

[0119] Specifically, a predetermined window value corresponding to the malicious sequence sample can be obtained, the behavior sequence to be detected is divided according to the predetermined window value to obtain the corresponding behavior sequence segments to be detected, the corresponding malicious sequence sample is divided according to the predetermined window value to obtain the corresponding malicious sequence segments, and each behavior sequence segment to be detected is compared with each corresponding malicious sequence segment segment by segment to obtain the target similarity.

[0120] In a specific implementation process, the above method can be implemented using a sliding window n-gram. For example, the sequence to be detected includes 1, 2, 3, 4, 5 and 6, and the predetermined window value is set to 3. Then the behavior sequence segments to be detected after division may include: 123, 234, 345 and 456, and the malicious sequence samples may include 1, 2, 3, 6, 8 and 9. The divided malicious sequence segments may include: 123, 236, 368 and 689. 123, 234, 345 and 456 and 123, 236, 368 and 689 are compared segment by segment to determine the target similarity between them.

[0121] In the specific implementation process, when calculating the similarity between each behavior sequence segment to be detected and the corresponding malicious sequence segment, the methods that can be used include: cosine similarity, Jaccard similarity and other methods that can obtain the similarity between sequence segments.

[0122] In some possible implementations, the above steps of comparing the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity include:

[0123] Clustering each target behavior in the behavior sequence to be detected to obtain a first clustering result;

[0124] Clustering the attack behaviors of each sample in the malicious sequence samples from the same source to obtain a second clustering result;

[0125] Based on the first clustering result and the second clustering result, the target similarity is obtained.

[0126] The clustering object is the hash behavior; the sample attack behaviors from the same source may be sample attack behaviors from the same attack source within a period of time, or sample attack behaviors belonging to the same type of attack.

[0127] Specifically, each target behavior in the behavior sequence to be detected is obtained, and the target behaviors are clustered to obtain a first clustering result. The malicious sequence samples can come from multiple attack sources. The sample attack behaviors from the same source are grouped as the same group, and the sample attack behaviors in the group are clustered to obtain a second clustering result. The first clustering result is compared with the second clustering result to obtain the corresponding target similarity. The sample attack behaviors from the same source can be quickly located according to the source of the target behavior, thereby speeding up the comparison progress and improving the similarity acquisition rate.

[0128] In the specific implementation process, the Jaccard coefficient, Rand index, mutual information and other methods can be used to determine the target similarity between two clustering results. The similarity between the two clustering results is measured by calculating the inclusion relationship, similarity and shared information between the two clustering results. The specific method to be selected depends on the actual needs. A more flexible method to obtain the target similarity can improve the accuracy of the functional detection method.

[0129] In some possible implementations, obtaining the target similarity based on the first clustering result and the second clustering result in the above steps includes:

[0130] Compare the first clustering result with the second clustering result to determine matching cluster center points;

[0131] The cluster center points are compared with the predetermined key behaviors to obtain the target similarity.

[0132] The clustering result may include multiple clusters, each cluster may include a corresponding cluster center point, and the comparison of the clustering results is the comparison of the cluster center points; the predetermined key behavior is pre-set in the malicious sequence sample.

[0133] Specifically, the first clustering result and the second clustering result are compared, that is, each cluster center point in the clustering result is compared to determine whether there is a matching cluster center point. If so, the proportion of the matching cluster center points in the second clustering result is calculated, and the similarity between the cluster center points and the predetermined key behaviors is determined to obtain the target similarity, wherein matching can mean being the same or the similarity is greater than a preset threshold. The greater the proportion of matching cluster center points, the more corresponding key behaviors, the greater the similarity, and the greater the credibility of determining it as a malicious sequence.

[0134] In the specific implementation process, for the case where the behavior sequence to be detected is incomplete or the behavior chain corresponding to the malicious sequence sample is incomplete, the coverage rate of the key single point annotation behavior can be compared. Usually, a network attack organization will have multiple attack activities, which may be hundreds or more when converted into sample behavior features and sample attack behaviors. For example, the sample attack behaviors of the malicious sequence samples from the same attack organization are clustered, and the cluster centers are 1, 3, 4, 5, and 9, and 3 and 5 are key points. For the target behavior in the behavior sequence to be detected, all target behaviors collected from multiple dimensions such as the same source and destination network address, the same host, a certain time period, and the same sample within the unit are clustered, and the cluster centers are 3, 5, 9, and 10. It can be determined that 3, 5, and 9 are matching cluster centers, and the proportion of matching cluster centers is 3 / 5=60%, and the matching cluster centers contain key points, then the corresponding target similarity can be determined.

[0135] In the above embodiment, the target behavior of the target terminal is collected and analyzed to obtain a behavior sequence to be detected, and the behavior sequence to be detected is compared with the malicious sequence samples in the malicious sequence sample set. Based on the comparison, it is determined whether the behavior sequence to be detected is a malicious sequence. Through the known malicious attack sequence, multiple behaviors generated on the detection terminal can be detected accurately, and malicious behaviors that pose a threat can be detected. The accuracy of malicious behavior detection can be improved, misjudgment and missed judgment can be reduced, and the detection rate of malicious behavior can be improved.

[0136] Furthermore, for known attack activity samples, the sample attack steps in the attack activity samples are mapped to corresponding sample behavior features to form an attack activity sample behavior chain. The sample behavior features in the attack activity sample behavior chain are analyzed to obtain the corresponding sample attack behaviors, thereby obtaining malicious sequence samples. By converting large-grained sample attack steps into smaller-grained sample attack behaviors, the malicious sequence samples are aligned with the granularity of the behavior sequence to be detected for comparison to determine whether the behavior sequence to be detected is a malicious sequence. This can speed up the efficiency of malicious behavior detection and enhance the credibility of malicious behavior detection.

[0137] In addition, for the comparison between the behavior sequence to be detected and the malicious sequence samples, it is possible to determine whether there is malicious behavior in the behavior sequence to be detected based on the similarity. The behavior sequence to be detected and the malicious sequence samples can be divided respectively by a predetermined window value, and the divided sequence segments can be compared. The target behavior in the behavior sequence to be detected and the sample attack behavior in the malicious sequence samples can be compared by clustering to obtain the target similarity. Detection based on clustering can indicate whether there is malicious attack behavior. Comparison between sequence segments can determine whether the malicious attack behavior fits a certain attack chain. Based on these two methods, the accuracy and reliability of malicious behavior detection can be improved.

[0138] In one example, the behavior detection method of the present application, such as Figure 5 As shown, it may include:

[0139] Collect the target behavior of the target terminal to obtain the behavior sequence to be detected;

[0140] Obtain malicious sequence samples from a malicious sequence sample set;

[0141] Dividing the behavior sequence to be detected by a predetermined window value to obtain corresponding behavior sequence segments to be detected; dividing the malicious sequence sample by a predetermined window value to obtain corresponding malicious sequence segments; comparing each behavior sequence segment to be detected with each corresponding malicious sequence segment segment by segment to obtain a first similarity;

[0142] Clustering each target behavior in the behavior sequence to be detected to obtain a first clustering result; clustering each sample attack behavior in the malicious sequence sample from the same source to obtain a second clustering result; comparing the first clustering result with the second clustering result to determine a matching cluster center point; comparing the cluster center point with a predetermined key behavior to obtain a second similarity;

[0143] Determining a corresponding target similarity based on the first similarity and the second similarity;

[0144] Determine whether the target similarity is greater than or equal to a preset threshold;

[0145] If the target similarity is greater than or equal to the preset threshold, the behavior sequence to be detected is determined to be a malicious sequence;

[0146] If the target similarity is less than the preset threshold, the behavior sequence to be detected is not a malicious sequence.

[0147] Among them, the method of obtaining malicious sequence samples is as follows: Figure 6 As shown, it may include:

[0148] Obtain samples of attack activities;

[0149] Mapping each sample attack step in the attack activity sample into the corresponding sample behavior feature;

[0150] Arrange the behavior features of each sample according to a predetermined order to obtain the behavior chain of the attack activity sample;

[0151] Analyze and process the behavior characteristics of each sample in the attack activity sample behavior chain to obtain the corresponding sample attack behavior;

[0152] Arrange the attack behaviors of each sample according to a predetermined order to obtain a malicious sequence sample.

[0153] The above-mentioned behavior detection method collects the target behavior of the target terminal, analyzes it to obtain the behavior sequence to be detected, compares the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set, determines whether the behavior sequence to be detected is a malicious sequence based on the comparison, and detects multiple behaviors generated on the terminal through known malicious attack sequences. It can accurately detect threatening malicious behaviors, improve the accuracy of malicious behavior detection, reduce misjudgments and missed judgments, and increase the detection rate of malicious behaviors.

[0154] Furthermore, for known attack activity samples, the sample attack steps in the attack activity samples are mapped to corresponding sample behavior features to form an attack activity sample behavior chain. The sample behavior features in the attack activity sample behavior chain are analyzed to obtain the corresponding sample attack behaviors, thereby obtaining malicious sequence samples. By converting large-grained sample attack steps into smaller-grained sample attack behaviors, the malicious sequence samples are aligned with the granularity of the behavior sequence to be detected for comparison to determine whether the behavior sequence to be detected is a malicious sequence. This can speed up the efficiency of malicious behavior detection and enhance the credibility of malicious behavior detection.

[0155] In addition, for the comparison between the behavior sequence to be detected and the malicious sequence samples, it is possible to determine whether there is malicious behavior in the behavior sequence to be detected based on the similarity. The behavior sequence to be detected and the malicious sequence samples can be divided respectively by a predetermined window value, and the divided sequence segments can be compared. The target behavior in the behavior sequence to be detected and the sample attack behavior in the malicious sequence samples can be compared by clustering to obtain the target similarity. Detection based on clustering can indicate whether there is malicious attack behavior. Comparison between sequence segments can determine whether the malicious attack behavior fits a certain attack chain. Based on these two methods, the accuracy and reliability of malicious behavior detection can be improved.

[0156] The present application embodiment provides a behavior detection device, such as Figure 7 As shown, the behavior detection device 70 may include: a collection module 710 and a comparison module 720, wherein:

[0157] The collection module 710 is used to collect the target behavior of the target terminal and obtain a sequence of behaviors to be detected;

[0158] The comparison module 720 is used to compare the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine whether the behavior sequence to be detected is a malicious sequence; the malicious sequence sample set includes multiple malicious sequence samples, each of which is a behavior sequence corresponding to a malicious behavior.

[0159] As an optional embodiment, the device further includes a sample generating module, which is specifically used to:

[0160] Obtaining an attack activity sample; the attack activity sample includes a plurality of sample attack steps arranged in a predetermined order;

[0161] According to the predetermined sequence, the attack activity samples are converted into malicious sequence samples.

[0162] As an optional embodiment, in the device, the sample generation module is specifically used to:

[0163] According to a predetermined sequence, each sample attack step in the attack activity sample is mapped into a corresponding sample behavior feature to obtain an attack activity sample behavior chain;

[0164] Convert the attack activity sample behavior chain into a malicious sequence sample.

[0165] As an optional embodiment, in the device, the sample generation module is specifically used to:

[0166] Mapping each sample attack step in the attack activity sample into the corresponding sample behavior feature;

[0167] Arrange the behavior features of each sample according to a predetermined order to obtain the attack activity sample behavior chain.

[0168] As an optional embodiment, in the device, the sample generation module is specifically used to:

[0169] Analyze and process the behavior characteristics of each sample in the attack activity sample behavior chain to obtain the corresponding sample attack behavior;

[0170] Arrange the attack behaviors of each sample according to a predetermined order to obtain a malicious sequence sample.

[0171] As an optional embodiment, in the device, the comparison module 720 is specifically used for:

[0172] Compare the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity;

[0173] If the target similarity is greater than or equal to the preset threshold, the behavior sequence to be detected is determined to be a malicious sequence.

[0174] As an optional embodiment, in the device, the comparison module 720 is specifically used for:

[0175] Dividing the behavior sequence to be detected by a predetermined window value to obtain corresponding behavior sequence segments to be detected;

[0176] Divide the malicious sequence samples according to the predetermined window value to obtain the corresponding malicious sequence segments;

[0177] Compare each behavior sequence segment to be detected with the corresponding malicious sequence segment segment by segment to obtain the target similarity.

[0178] As an optional embodiment, in the device, the comparison module 720 is specifically used for:

[0179] Clustering each target behavior in the behavior sequence to be detected to obtain a first clustering result;

[0180] Clustering the attack behaviors of each sample in the malicious sequence samples from the same source to obtain a second clustering result;

[0181] Based on the first clustering result and the second clustering result, the target similarity is obtained.

[0182] As an optional embodiment, in the device, the comparison module 720 is specifically used for:

[0183] Compare the first clustering result with the second clustering result to determine matching cluster center points;

[0184] The cluster center points are compared with the predetermined key behaviors to obtain the target similarity.

[0185] The behavior detection device provided by the present application collects the target behavior of the target terminal, analyzes it to obtain the behavior sequence to be detected, compares the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set, determines whether the behavior sequence to be detected is a malicious sequence based on the comparison, and detects multiple behaviors generated on the terminal through known malicious attack sequences. It can accurately detect threatening malicious behaviors, improve the accuracy of malicious behavior detection, reduce misjudgments and missed judgments, and increase the detection rate of malicious behaviors.

[0186] Furthermore, for known attack activity samples, the sample attack steps in the attack activity samples are mapped to corresponding sample behavior features to form an attack activity sample behavior chain. The sample behavior features in the attack activity sample behavior chain are analyzed to obtain the corresponding sample attack behaviors, thereby obtaining malicious sequence samples. By converting large-grained sample attack steps into smaller-grained sample attack behaviors, the malicious sequence samples are aligned with the granularity of the behavior sequence to be detected for comparison to determine whether the behavior sequence to be detected is a malicious sequence. This can speed up the efficiency of malicious behavior detection and enhance the credibility of malicious behavior detection.

[0187] In addition, for the comparison between the behavior sequence to be detected and the malicious sequence samples, it is possible to determine whether there is malicious behavior in the behavior sequence to be detected based on the similarity. The behavior sequence to be detected and the malicious sequence samples can be divided respectively by a predetermined window value, and the divided sequence segments can be compared. The target behavior in the behavior sequence to be detected and the sample attack behavior in the malicious sequence samples can be compared by clustering to obtain the target similarity. Detection based on clustering can indicate whether there is malicious attack behavior. Comparison between sequence segments can determine whether the malicious attack behavior fits a certain attack chain. Based on these two methods, the accuracy and reliability of malicious behavior detection can be improved.

[0188] The device of the embodiment of the present application can execute the method provided by the embodiment of the present application, and its implementation principle is similar and has corresponding technical effects. The actions performed by each module in the device of each embodiment of the present application correspond to the steps in the method of each embodiment of the present application. For the detailed functional description of each module of the device, please refer to the description in the corresponding method shown in the previous text, which will not be repeated here.

[0189] In an embodiment of the present application, an electronic device (computer device / equipment / system) is provided, including a memory, a processor and a computer program stored in the memory, and the processor executes the above computer program to implement the steps of the method provided in any optional embodiment of the present application. Compared with the prior art, it can be achieved: by collecting the target behavior of the target terminal, analyzing and obtaining the behavior sequence to be detected, comparing the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set, and determining whether the behavior sequence to be detected is a malicious sequence based on the comparison, and detecting multiple behaviors generated on the terminal through known malicious attack sequences, it is possible to accurately detect malicious behaviors that pose a threat, improve the accuracy of malicious behavior detection, reduce misjudgments and missed judgments, and improve the detection rate of malicious behaviors.

[0190] Furthermore, for known attack activity samples, the sample attack steps in the attack activity samples are mapped to corresponding sample behavior features to form an attack activity sample behavior chain. The sample behavior features in the attack activity sample behavior chain are analyzed to obtain the corresponding sample attack behaviors, thereby obtaining malicious sequence samples. By converting large-grained sample attack steps into smaller-grained sample attack behaviors, the malicious sequence samples are aligned with the granularity of the behavior sequence to be detected for comparison to determine whether the behavior sequence to be detected is a malicious sequence. This can speed up the efficiency of malicious behavior detection and enhance the credibility of malicious behavior detection.

[0191] In addition, for the comparison between the behavior sequence to be detected and the malicious sequence samples, it is possible to determine whether there is malicious behavior in the behavior sequence to be detected based on the similarity. The behavior sequence to be detected and the malicious sequence samples can be divided respectively by a predetermined window value, and the divided sequence segments can be compared. The target behavior in the behavior sequence to be detected and the sample attack behavior in the malicious sequence samples can be compared by clustering to obtain the target similarity. Detection based on clustering can indicate whether there is malicious attack behavior. Comparison between sequence segments can determine whether the malicious attack behavior fits a certain attack chain. Based on these two methods, the accuracy and reliability of malicious behavior detection can be improved.

[0192] In an alternative embodiment, an electronic device is provided, such as Figure 8 As shown, Figure 8The electronic device 8000 shown includes: a processor 8001 and a memory 8003. The processor 8001 and the memory 8003 are connected, such as through a bus 8002. Optionally, the electronic device 8000 may also include a transceiver 8004, which may be used for data interaction between the electronic device and other electronic devices, such as data transmission and / or data reception. It should be noted that in actual applications, the transceiver 8004 is not limited to one, and the structure of the electronic device 8000 does not constitute a limitation on the embodiments of the present application.

[0193] The processor 8001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 8001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0194] The bus 8002 may include a path to transmit information between the above components. The bus 8002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 8002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0195] The memory 8003 can be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage medium, other magnetic storage devices, or any other medium that can be used to carry or store computer programs and can be read by a computer, without limitation herein.

[0196] The memory 8003 is used to store the computer program for executing the embodiment of the present application, and the execution is controlled by the processor 8001. The processor 8001 is used to execute the computer program stored in the memory 8003 to implement the steps shown in the above method embodiment.

[0197] The electronic device includes, but is not limited to: a terminal or a server capable of detecting attack behaviors using the above-mentioned behavior detection method.

[0198] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps and corresponding contents of the aforementioned method embodiment can be implemented.

[0199] It should be noted that the computer-readable storage medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0200] The embodiment of the present application also provides a computer program product, including a computer program, which can implement the steps and corresponding contents of the aforementioned method embodiment when executed by a processor.

[0201] The terms "first", "second", "third", "fourth", "1", "2", etc. (if any) in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than that shown or described in the drawings.

[0202] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0203] It should be understood that, although each operation step is indicated by arrows in the flowchart of the embodiment of the present application, the implementation order of these steps is not limited to the order indicated by the arrows. Unless clearly stated herein, in some implementation scenarios of the embodiment of the present application, the implementation steps in each flowchart can be performed in other orders according to demand. In addition, some or all of the steps in each flowchart may include multiple sub-steps or multiple stages based on actual implementation scenarios. Some or all of these sub-steps or stages may be executed at the same time, and each sub-step or stage in these sub-steps or stages may also be executed at different times respectively. In different scenarios of execution time, the execution order of these sub-steps or stages may be flexibly configured according to demand, and the embodiment of the present application does not limit this.

[0204] The above is only an optional implementation method for some implementation scenarios of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the technical concept of the solution of the present application, other similar implementation methods based on the technical ideas of the present application are also within the protection scope of the embodiments of the present application.

Claims

1. A behavior detection method, characterized in that: include: Collect the target behavior of the target terminal to obtain the behavior sequence to be detected; The behavior sequence to be detected is compared with malicious sequence samples in a malicious sequence sample set to determine whether the behavior sequence to be detected is a malicious sequence; the malicious sequence sample set includes multiple malicious sequence samples, and each malicious sequence sample is a behavior sequence corresponding to a malicious behavior.

2. The behavior detection method according to claim 1, characterized in that: Before comparing the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set, the method further includes: Acquire an attack activity sample; the attack activity sample comprises a plurality of sample attack steps arranged in a predetermined order; According to the predetermined sequence, the attack activity sample is converted into the malicious sequence sample.

3. The behavior detection method according to claim 2, characterized in that: The converting the attack activity sample into the malicious sequence sample according to the predetermined sequence includes: According to the predetermined sequence, each sample attack step in the attack activity sample is mapped into a corresponding sample behavior feature to obtain an attack activity sample behavior chain; The attack activity sample behavior chain is converted into the malicious sequence sample.

4. The behavior detection method according to claim 3, characterized in that: The step of mapping each sample attack step in the attack activity sample into a corresponding sample behavior feature according to the predetermined sequence to obtain an attack activity sample behavior chain includes: Mapping each sample attack step in the attack activity sample into a corresponding sample behavior feature; Arrange the sample behavior features according to the predetermined order to obtain the attack activity sample behavior chain.

5. The behavior detection method according to claim 3, characterized in that: The converting the attack activity sample behavior chain into the malicious sequence sample includes: Analyze and process each sample behavior feature in the attack activity sample behavior chain to obtain a corresponding sample attack behavior; Arrange the sample attack behaviors according to the predetermined order to obtain the malicious sequence sample.

6. The behavior detection method according to claim 1, characterized in that: The step of comparing the behavior sequence to be detected with malicious sequence samples in a malicious sequence sample set to determine whether the behavior sequence to be detected is a malicious sequence includes: Comparing the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity; If the target similarity is greater than or equal to a preset threshold, the behavior sequence to be detected is determined to be a malicious sequence.

7. The behavior detection method according to claim 6, characterized in that: The comparing the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity includes: Dividing the behavior sequence to be detected by a predetermined window value to obtain corresponding behavior sequence segments to be detected; Dividing the malicious sequence sample according to the predetermined window value to obtain corresponding malicious sequence segments; Each behavior sequence segment to be detected is compared with each corresponding malicious sequence segment segment by segment to obtain the target similarity.

8. The behavior detection method according to claim 6, characterized in that: The comparing the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine the corresponding target similarity includes: Clustering the target behaviors in the to-be-detected behavior sequence to obtain a first clustering result; Clustering the attack behaviors of the samples in the malicious sequence samples from the same source to obtain a second clustering result; The target similarity is obtained based on the first clustering result and the second clustering result.

9. The behavior detection method according to claim 8, characterized in that: The obtaining the target similarity based on the first clustering result and the second clustering result includes: Comparing the first clustering result with the second clustering result to determine matching cluster center points; The cluster center point is compared with a predetermined key behavior to obtain the target similarity.

10. A behavior detection device, characterized in that: include: A collection module is used to collect target behaviors of the target terminal and obtain a sequence of behaviors to be detected; The comparison module is used to compare the behavior sequence to be detected with the malicious sequence samples in the malicious sequence sample set to determine whether the behavior sequence to be detected is a malicious sequence; the malicious sequence sample set includes multiple malicious sequence samples, each of which is a behavior sequence corresponding to a malicious behavior.

Images