A detection method, device, equipment and readable storage medium

Abstract

The present application relates to the field of security technology, and specifically to a detection method, apparatus, device and readable storage medium, the method comprising: obtaining the alarm data of the target program from the detection engine, and converting the alarm data into a current behavior feature vector; obtaining the historical behavior of the target program from the application behavior database, and constructing a historical behavior feature vector using the historical behavior; and performing misjudgment detection on the alarm data based on the comparison result of the current behavior feature vector and the historical behavior feature vector. Technical effect of the present application: constructing the program historical behavior pattern uses vector features, and the comparison is also based on feature vectors, which can reduce the program's memory overhead and improve efficiency compared to string text comparison. Based on the program's historical behavior pattern, it is possible to effectively identify whether the current behavior feature vector corresponding to the current alarm data belongs to an abnormal situation, which can effectively improve the accuracy of secondary detection and reduce false positives.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to a detection method, device, equipment and readable storage medium. Background Art

[0002] During the use of devices such as office computers, some illegal behaviors will occur. These behaviors are detected and recorded by terminal detection response software such as antivirus software. The behavior will then be traced to its source. This process will form a program behavior link, which records the calling relationship between programs and file operations. The link data will be standardized and become an alarm. The alarm will be sent to the server for secondary detection to further determine the degree of harm of the alarm.

[0003] The most common way to detect supply chain attacks is to perform anomaly detection based on statistical features. This solution requires maintaining a large cache at the coding level and relies on manual extraction of text features to write corresponding rules to detect abnormal behavior. Due to the limitation of cache size and the particularity of text features, the number of false positives detected is very high, and a large amount of manpower is required to review the alarms.

[0004] In summary, how to effectively improve the accuracy of secondary detection of alarms and other issues are technical problems that technical personnel in this field urgently need to solve. Summary of the invention

[0005] The purpose of this application is to provide a detection method, device, equipment and readable storage medium, which can improve the accuracy of alarm secondary detection and reduce false alarms.

[0006] In order to solve the above technical problems, this application provides the following technical solutions:

[0007] A detection method comprising:

[0008] Acquire the target program's warning data from the detection engine, and convert the warning data into a current behavior feature vector;

[0009] Acquire the historical behavior of the target program from an application behavior database, and construct a historical behavior feature vector using the historical behavior;

[0010] Based on the comparison result of the current behavior feature vector and the historical behavior feature vector, misjudgment detection is performed on the alarm data.

[0011] Preferably, based on the comparison result of the current behavior feature vector and the historical behavior feature vector, misjudgment detection is performed on the alarm data, including:

[0012] Calculating the similarity between the current behavior feature vector and the historical behavior feature vector;

[0013] If the similarity is less than the abnormal threshold, it is determined that the alarm data is accurate;

[0014] If the similarity is greater than or equal to the abnormal threshold, it is determined that the alarm data is erroneous.

[0015] Preferably, after determining that the alarm data is wrong, the method further includes:

[0016] Add 1 to the white count of the target program;

[0017] When the whitelist count is greater than the whitelist threshold, the target program is added to the whitelist of the detection engine.

[0018] Preferably, the method further comprises constructing the application behavior database, wherein the constructing the application behavior database comprises:

[0019] Acquire application behavior data, and construct a behavior triple corresponding to the application behavior; wherein the behavior triple includes a parent node, a behavior, and a child node;

[0020] The parent node, the behavior and the child node are stored in a database table of an application behavior database according to their types.

[0021] Preferably, the parent node, the behavior and the child node are stored in a database table of an application behavior database according to their types, including:

[0022] The parent node, the behavior and the child node are stored in a database table of an intermediate database according to their types;

[0023] The newly added data of the intermediate database is periodically written into the application behavior database.

[0024] Preferably, it also includes:

[0025] Determining the popularity of different program behaviors using the intermediate database;

[0026] Comparing the popularity of the different program behaviors with a popularity threshold, and determining a target program behavior whose popularity is greater than the popularity threshold;

[0027] The updating of the target program behavior is suspended in the intermediate database, and the data content corresponding to the target program behavior in the intermediate database is deleted.

[0028] Preferably, storing the parent node, the behavior and the child node in a database table of an intermediate database according to their types respectively includes:

[0029] Storing the parent node in a first database table associated with the process;

[0030] storing the behavior in a second database table associated with the behavior relationship;

[0031] Determine the object of the operation of the said behavior;

[0032] Determining a target third database table matching the operation object from a plurality of third database tables;

[0033] Storing the child node in the target third database table;

[0034] The database table includes a first database table, a second database table and a plurality of third database tables.

[0035] A detection device, comprising:

[0036] A current vector acquisition module is used to obtain the warning data of the target program from the detection engine and convert the warning data into a current behavior feature vector;

[0037] A historical vector acquisition module, used to acquire the historical behavior of the target program from the application behavior database, and construct a historical behavior feature vector using the historical behavior;

[0038] The alarm review module is used to perform misjudgment detection on the alarm data based on the comparison result of the current behavior feature vector and the historical behavior feature vector.

[0039] An electronic device, comprising:

[0040] Memory for storing computer programs;

[0041] A processor is used to implement the steps of the above detection method when executing the computer program.

[0042] A readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above detection method are implemented.

[0043] By applying the method provided in the embodiment of the present application, the alarm data of the target program is obtained from the detection engine, and the alarm data is converted into a current behavior feature vector; the historical behavior of the target program is obtained from the application behavior database, and the historical behavior is used to construct a historical behavior feature vector; based on the comparison results of the current behavior feature vector and the historical behavior feature vector, the alarm data is detected for misjudgment.

[0044] Technical effect of the present application: In the present application, after obtaining the alarm data of the target program from the detection engine, the alarm data is first converted into a current behavior feature vector. The historical behavior of the target program is obtained from the application behavior database, and a historical behavior feature vector is constructed based on the historical behavior. By comparing the current behavior feature vector with the historical behavior feature vector, the comparison result between the current alarm data and the historical behavior of the target program can be obtained, so that the alarm data can be misjudged and detected based on the comparison result. It can be seen that the construction of the program historical behavior pattern uses vector features, and the comparison is also based on the feature vector. Compared with the string text comparison, it can reduce the program's memory overhead and improve efficiency. Based on the program's historical behavior pattern, it can effectively identify whether the current behavior feature vector corresponding to the current alarm data belongs to an abnormal situation, which can effectively improve the accuracy of the secondary detection and reduce false positives.

[0045] Correspondingly, the embodiments of the present application also provide detection devices, equipment and readable storage media corresponding to the above-mentioned detection method, which have the above-mentioned technical effects and are not repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 This is a flow chart of an implementation of a detection method in an embodiment of the present application;

[0048] Figure 2 A schematic diagram of building an application behavior database in an embodiment of the present application;

[0049] Figure 3 This is a schematic diagram of a specific implementation of a detection method in an embodiment of the present application;

[0050] Figure 4 This is a schematic diagram of the structure of a detection device in an embodiment of the present application;

[0051] Figure 5 This is a schematic diagram of the structure of an electronic device in an embodiment of the present application;

[0052] Figure 6 This is a schematic diagram of the specific structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0054] Please refer to Figure 1 , Figure 1 This is a flow chart of a detection method in an embodiment of the present application, the method comprising the following steps:

[0055] S101. Acquire alarm data of a target program from a detection engine, and convert the alarm data into a current behavior feature vector.

[0056] The detection engine may be specifically an engine capable of generating alarms, and the detection engine is not specifically limited in this embodiment. For example, the alarm data is stored in a message queue, such as pulsar, kafka, etc., and when the information is consumed, the alarm data needs to be deserialized and then converted into a feature vector representation. In this embodiment, the vector obtained by converting the alarm data is called the current behavior feature vector.

[0057] In addition, in actual applications, the alarm data can be filtered and screened through the program name list provided by security experts.

[0058] S102: Obtain the historical behavior of the target program from the application behavior database, and construct a historical behavior feature vector using the historical behavior.

[0059] The application behavior database stores application behavior data.

[0060] The application behavior database may specifically be a ClickHouse database, or other databases with better query capabilities.

[0061] Among them, ClickHouse is an open source column-based database management system used to process large-scale data analysis and real-time queries. It has high performance and scalability and can meet the needs of large-scale data processing.

[0062] According to the application behavior data stored in ClickHouse, the historical behavior of the target program is extracted, the historical behavior of the target program is classified, and a vector representation is constructed for each type of behavior. The feature vector construction method includes but is not limited to using BERT to vectorize the string text. For example, if there are ten types of behavior, ten historical behavior feature vectors are constructed, and the types of behavior features of the program can also be identified. When comparing the historical behavior feature vector with the current behavior feature vector, in this way, only the subgraph (a historical behavior feature vector) containing the behavior type of the current detection object can be filtered out from the historical behavior feature vector, and there is no need to compare the historical behavior feature vectors corresponding to all behavior types with the current behavior feature vector.

[0063] In a specific implementation of the present application, building an application behavior database includes:

[0064] Acquire application behavior data and construct a behavior triplet corresponding to the application behavior; wherein the behavior triplet includes a parent node, a behavior, and a child node;

[0065] The parent node, behavior and child node are stored in the database table of the application behavior database according to their types.

[0066] For ease of description, the above steps are combined for explanation below.

[0067] Since program behavior data is not graphed data, it is structured and divided into database tables of the process, file, registry, domain name, etc. for storage.

[0068] Specifically, the program behavior relationship can be extracted from the application data to construct a behavior triple (parent node, behavior, child node) pattern. Specifically, the triple can be in the form of parent node-relationship->child node, for example, (1) Process-FileCreate->File; (2) Process-DnsRequest->DnsName; (3) Process-SchTaskCreate->ScheduleJob.

[0069] The parent node must be a process type node, so the first element of the triple is stored in the database table associated with the process. The child node may be of multiple types. When storing the child node, it needs to be stored in the database table associated with the corresponding object. For example, if the child node is a file type node, it is stored in the database table associated with the file. If the child node is a registry, it is stored in the database table managed by the registry. The second element, behavior, is defined as the relationship between the parent and child nodes and is stored in the database table associated with the behavior relationship.

[0070] In a specific implementation of this application, please refer to Figure 2 , data processing behavior can also be improved based on a two-layer data storage solution, where the first layer is the intermediate database and the second layer is the application behavior database. That is, the parent node, behavior and child node are stored in the database table of the application behavior database according to the type, including:

[0071] Store parent nodes, behaviors and child nodes in the database table of the intermediate database according to their types;

[0072] Regularly write the new data in the intermediate database to the application behavior database.

[0073] For ease of description, the above steps are combined for explanation below.

[0074] MongoDB: An open source, cross-platform document database that uses a non-relational database design to provide high-performance, high-availability, and scalable database solutions. It supports dynamic query, indexing, load balancing, and replication, and is suitable for large-scale data storage and high-concurrency access.

[0075] The following describes the two-layer data storage solution in this embodiment, taking MongoDB as the intermediate database and ClickHouse as the application behavior database.

[0076] The two-layer data storage solution specifically includes: the first layer of data is stored in MongoDB to meet the performance requirements of data updates, and the second layer of data is persistently stored in ClickHouse. When the amount of data stored in the database reaches a certain scale, supply chain attack detection can be performed by building program historical behavior patterns, and auxiliary information such as the behavior whitelist and popularity of the alarm program can be provided to the alarm researchers to improve their judgment efficiency. In addition, a process behavior whitelist can be built, which can be used as a means for the detection engine to detect false alarms, greatly reducing the false alarm rate of the detection engine.

[0077] Supply chain attacks: a malicious attack targeting weaknesses or loopholes in the supply chain. The supply chain refers to the entire process of a product or service from the supplier of raw materials to the end user, including production, transportation, distribution and other links. Attackers use links or participants in the supply chain to carry out attacks by implanting malware, tampering with data or destroying systems.

[0078] Application behavior data carries terminal identification information, which can be cached to count the popularity of the behavior. Considering memory usage and query performance, you can choose to use the Redis memory database.

[0079] It should be noted that MongoDB, an intermediate database built as an application behavior database, is not the final state of program behavior. It is mainly designed for popularity updates. Therefore, in actual applications, a scheduled task can be designed to regularly scan the data in the MongoDB database and write the newly added data to ClickHouse. Before the scheduled task is triggered, the data stored in ClickHouse is considered to be the final state of the current program behavior.

[0080] In a specific implementation of the present application, it also includes:

[0081] Using an intermediate database, determine the popularity of different program behaviors;

[0082] Compare the popularity of different program behaviors with the popularity threshold, and determine the target program behavior whose popularity is greater than the popularity threshold;

[0083] The updating of the target program behavior is suspended in the intermediate database, and the data content corresponding to the target program behavior in the intermediate database is deleted.

[0084] For ease of description, the above steps are combined for explanation below.

[0085] Among them, popularity: describes how many different terminals a certain behavior of a program has appeared on, and is used to measure the universality of the program behavior.

[0086] Considering that popularity will continue to increase as the prevalence of program behavior on the terminal increases, the popularity value stored in the database needs to be updated frequently. MongoDB has good data update performance, so MongoDB is selected as the intermediate database. Of course, in actual applications, other databases with good data update performance can also be selected as intermediate databases.

[0087] Considering that popularity will continue to increase as the prevalence of program behavior on the terminal increases, the popularity value stored in the database needs to be updated frequently. MongoDB has good data update performance, so MongDB is selected as the intermediate database.

[0088] From the first time a behavior occurs on a terminal, the popularity will start to accumulate from 1. If the behavior is observed to occur frequently on different terminals within a short period of time, it is considered that there is no problem with the behavior and no further updates are required. In this regard, in actual applications, a maximum popularity threshold can be set (such as 10,000. Of course, it can be set to other values ​​in actual applications, and examples are not given here). After exceeding this value, the popularity will no longer be updated. When the data in MongoDB is no longer updated, it will be cleared to prevent large memory usage from causing database performance degradation.

[0089] In a specific implementation of the present application, the parent node, behavior and child node are stored in a database table of the intermediate database according to type, including:

[0090] storing the parent node in a first database table associated with the process;

[0091] storing the behavior in a second database table associated with the behavior relationship;

[0092] Determine the object of the action;

[0093] Determining a target third database table matching the operation object from among the plurality of third database tables;

[0094] Store the child node into the target third database table;

[0095] The database tables include a first database table, a second database table and a plurality of third database tables.

[0096] That is to say, the first, second and third are only used to distinguish different database tables. The first database table corresponds to the storage process, the second database table corresponds to the storage behavior, and the third database table corresponds to the storage object that bears the behavior. The same database table can be stored in the intermediate database and the application database. The database table in the intermediate database can be updated at a high frequency based on the capture and structured processing of application behavior data. The data in the application database can be based on a fixed frequency, and new data can be regularly pulled from the intermediate database for synchronous storage.

[0097] S103: Based on the comparison result of the current behavior feature vector and the historical behavior feature vector, perform misjudgment detection on the alarm data.

[0098] Please refer to Figure 3 The historical behavior feature vector is the historical behavior pattern of the general normal behavior of the target program. Therefore, the current behavior feature vector can be compared with the historical behavior feature vector to verify whether the current behavior feature vector is abnormal based on the historical behavior pattern. If the current behavior feature vector is abnormal, it means that the alarm data corresponding to the current behavior feature vector is accurate; if the current behavior feature vector is normal, it means that the high-level data corresponding to the current behavior feature vector is wrong. In this way, based on the comparison results of the two, the alarm data can be misjudged.

[0099] In a specific implementation of the present application, based on the comparison result of the current behavior feature vector and the historical behavior feature vector, misjudgment detection is performed on the alarm data, including:

[0100] Calculate the similarity between the current behavior feature vector and the historical behavior feature vector;

[0101] If the similarity is less than the abnormal threshold, the alarm data is determined to be accurate;

[0102] If the similarity is greater than or equal to the abnormal threshold, it is determined that the alarm data is wrong.

[0103] For ease of description, the above steps are combined for explanation below.

[0104] Specifically, the cosine similarity between the current behavior feature vector and the historical behavior feature vector can be calculated, and then based on the comparison between the calculated similarity and the abnormal threshold, it is determined whether the alarm data is incorrect. Among them, the abnormal threshold can be set and adjusted according to the specific accuracy requirements of the actual application scenario.

[0105] In a specific implementation manner of the present application, after determining that the alarm data is wrong, the method further includes:

[0106] Add 1 to the target program's white count;

[0107] When the whitelist count is greater than the whitelist threshold, the target program is added to the whitelist of the detection engine.

[0108] For ease of description, the above steps are combined for explanation below.

[0109] In order to reduce the false alarms of the detection engine, a whitelist can be set. In this application, after discovering that the alarm data is wrong, the whitelist count of the target program can be increased by 1. When the whitelist count is greater than the whitelist threshold, it indicates that the detection engine has falsely alarmed the target program multiple times. At this time, the target program can be added to the whitelist of the detection engine. In this way, the repeated detection of alarms corresponding to the target program can be effectively reduced.

[0110] By applying the method provided in the embodiment of the present application, the alarm data of the target program is obtained from the detection engine, and the alarm data is converted into a current behavior feature vector; the historical behavior of the target program is obtained from the application behavior database, and the historical behavior is used to construct a historical behavior feature vector; based on the comparison results of the current behavior feature vector and the historical behavior feature vector, the alarm data is detected for misjudgment.

[0111] Technical effect of the present application: In the present application, after obtaining the alarm data of the target program from the detection engine, the alarm data is first converted into a current behavior feature vector. The historical behavior of the target program is obtained from the application behavior database, and a historical behavior feature vector is constructed based on the historical behavior. By comparing the current behavior feature vector with the historical behavior feature vector, the comparison result between the current alarm data and the historical behavior of the target program can be obtained, so that the alarm data can be misjudged and detected based on the comparison result. It can be seen that the construction of the program historical behavior pattern uses vector features, and the comparison is also based on the feature vector. Compared with the string text comparison, it can reduce the program's memory overhead and improve efficiency. Based on the program's historical behavior pattern, it can effectively identify whether the current behavior feature vector corresponding to the current alarm data belongs to an abnormal situation, which can effectively improve the accuracy of the secondary detection and reduce false positives.

[0112] In order to facilitate those skilled in the art to better understand the detection method provided in the embodiments of the present application, the detection method is described in detail below in conjunction with specific application scenarios.

[0113] As can be seen from the above, this application sorts out the terminal behavior types and the corresponding behavior characteristics, and on this basis, performs structured processing on the alarm data, treating data of different behavior types as nodes and storing them in different node tables of the database, and storing the relationships between nodes in relationship tables; a two-layer data storage solution can also be designed to improve data processing performance. The first layer of data is stored in MongoDB to meet the performance requirements of data updates, and the second layer of data is persistently stored in ClickHouse. When the amount of data stored in the database reaches a certain scale, supply chain attacks can be detected by constructing historical behavior patterns of programs, and auxiliary information such as the behavior whitelist and popularity of the alarm program can be provided to alarm researchers to improve their judgment efficiency. In addition, process behavior whitelists can be used as a means for detection engines to detect false alarms, greatly reducing the false alarm rate of detection engines.

[0114] The construction of the database and the specific detection are explained one by one below.

[0115] Please refer to Figure 2 The construction process of the program application behavior database is roughly divided into the construction steps of application behavior data consumption, entity / relationship construction, popularity calculation, data storage into MongoDB, and scheduled tasks to write data into ClickHouse.

[0116] 1. Application behavior data consumption: Data is stored in message queues, such as pulsar, kafka, etc. To consume information, the application behavior data needs to be deserialized and processed to facilitate subsequent processing. This application builds the behavior pattern of common programs, so the application data can be filtered and screened through the program name list provided by security experts.

[0117] 2. Entity / relationship construction: Application behavior data itself is not graph-structured data. It is necessary to reassemble the data, extract program behavior relationships, and construct a behavior triple (parent node, behavior, child node) pattern. The parent node must be a process type node, and the first element of the triple is stored in the database table associated with the process. If the child node is a file type node, it is stored in the database table associated with the file. The second element behavior is defined as the relationship between the parent and child nodes and is stored in the database table associated with the behavior relationship.

[0118] 3. Popularity calculation: The application behavior data carries terminal identification information, which can be cached to calculate the popularity of the behavior. Considering the memory usage and query performance, choose to use the Redis memory database instead of directly using memory or using a relational database.

[0119] 4. Data storage in MongoDB: Considering that popularity will continue to increase as the prevalence of program behavior on the terminal increases, the popularity value stored in the database needs to be updated frequently. MongoDB has better data update performance, so MongoDB is selected as the intermediate database. Secondly, a maximum popularity threshold is set. After exceeding this value, the popularity will no longer be updated. When the data in MongoDB is no longer updated, it will be cleared to prevent the database performance from being degraded due to large memory usage.

[0120] 5. Data storage in ClickHouse: MongoDB is an intermediate database built as an application behavior database, which is not the final state of program behavior. It is mainly designed for popularity updates. Therefore, a scheduled task is designed to regularly scan the data in the MongoDB database and write the newly added data to ClickHouse. The data between the scheduled task triggers is considered to be the final state of the current program behavior.

[0121] Please refer to Figure 3 (The meaning of the serial numbers in the figure: 1 is process creation, 2 is network connection, 3 is file creation, 4 is registry setting, 5 is domain name access, 6 is scheduled task creation, 7 is domain name access, 8 is service creation, and 9 is process injection). Taking the xshell program as an example, the process of supply chain attack detection based on the program's historical behavior pattern is described. The steps are as follows:

[0122] 1. Constructing the program's historical behavior pattern: Based on the application behavior data stored in ClickHouse, extract the historical behavior of a specific program, classify the program's historical behavior, and construct a vector representation for each type of behavior. The feature vector construction method includes but is not limited to using BERT to vectorize string text. For example, if there are ten types of behavior, ten feature vectors are constructed, which can provide a [1 x 10] unique hot encoding to identify the types of behavior features of the program.

[0123] 2. Abnormal behavior detection: extract the current behavior feature vector of the program to be detected (i.e., the feature vector corresponding to the alarm data to be detected), calculate the cosine similarity between the current behavior feature vector and the historical behavior feature vectors of the same type as the current behavior feature vector in multiple historical behavior feature vectors, and if the similarity is lower than the threshold, the program behavior is considered abnormal, otherwise, the behavior is normal. After detecting the anomaly, the security knowledge base can be updated.

[0124] It should be noted that when calculating similarity, if the behavior type of the current program to be detected may be a subset of the program's historical behavior type, the similarity calculation needs to use one-hot encoding to extract the corresponding type of features for calculation.

[0125] 3. Whitelist construction: There will definitely be false positives in the detection engine, so after manual review, the false positive programs are whitelisted to reduce the repeated detection of such alarms.

[0126] Corresponding to the above method embodiment, the embodiment of the present application further provides a detection device, and the detection device described below and the detection method described above can be referred to each other.

[0127] See also Figure 4 As shown, the device includes the following modules:

[0128] The current vector acquisition module 101 is used to obtain the warning data of the target program from the detection engine and convert the warning data into the current behavior feature vector;

[0129] A historical vector acquisition module 102 is used to acquire the historical behavior of the target program from the application behavior database and construct a historical behavior feature vector using the historical behavior;

[0130] The alarm review module 103 is used to perform misjudgment detection on the alarm data based on the comparison result between the current behavior feature vector and the historical behavior feature vector.

[0131] Using the device provided in the embodiment of the present application, the alarm data of the target program is obtained from the detection engine, and the alarm data is converted into a current behavior feature vector; the historical behavior of the target program is obtained from the application behavior database, and the historical behavior is used to construct a historical behavior feature vector; based on the comparison results of the current behavior feature vector and the historical behavior feature vector, the alarm data is detected for misjudgment.

[0132] Technical effect of the present application: In the present application, after obtaining the alarm data of the target program from the detection engine, the alarm data is first converted into a current behavior feature vector. The historical behavior of the target program is obtained from the application behavior database, and a historical behavior feature vector is constructed based on the historical behavior. By comparing the current behavior feature vector with the historical behavior feature vector, the comparison result between the current alarm data and the historical behavior of the target program can be obtained, so that the alarm data can be misjudged and detected based on the comparison result. It can be seen that the construction of the program historical behavior pattern uses vector features, and the comparison is also based on the feature vector. Compared with the string text comparison, it can reduce the program's memory overhead and improve efficiency. Based on the program's historical behavior pattern, it can effectively identify whether the current behavior feature vector corresponding to the current alarm data belongs to an abnormal situation, which can effectively improve the accuracy of the secondary detection and reduce false positives.

[0133] In a specific implementation of the present application, the alarm review module is specifically used to calculate the similarity between the current behavior feature vector and the historical behavior feature vector;

[0134] If the similarity is less than the abnormal threshold, the alarm data is determined to be accurate;

[0135] If the similarity is greater than or equal to the abnormal threshold, it is determined that the alarm data is wrong.

[0136] In a specific implementation of the present application, it also includes:

[0137] The whitelist module is used to increase the whitelist count of the target program by 1 after determining that the alarm data is wrong;

[0138] When the whitelist count is greater than the whitelist threshold, the target program is added to the whitelist of the detection engine.

[0139] In a specific implementation of the present application, it also includes: a database construction module for constructing an application behavior database, specifically including:

[0140] Acquire application behavior data and construct a behavior triplet corresponding to the application behavior; wherein the behavior triplet includes a parent node, a behavior, and a child node;

[0141] The parent node, behavior and child node are stored in the database table of the application behavior database according to their types.

[0142] In a specific implementation of the present application, the database construction module is specifically used to store the parent node, the behavior and the child node in a database table of the intermediate database according to the type;

[0143] Regularly write the new data in the intermediate database to the application behavior database.

[0144] In a specific implementation of the present application, it also includes:

[0145] Using an intermediate database, determine the popularity of different program behaviors;

[0146] A popularity processing module, used to compare the popularity of different program behaviors with a popularity threshold, and determine a target program behavior whose popularity is greater than the popularity threshold;

[0147] The updating of the target program behavior is suspended in the intermediate database, and the data content corresponding to the target program behavior in the intermediate database is deleted.

[0148] In a specific implementation of the present application, the database construction module is specifically used to store the parent node in a first database table associated with the process;

[0149] storing the behavior in a second database table associated with the behavior relationship;

[0150] Determine the object of the action;

[0151] Determining a target third database table matching the operation object from among the plurality of third database tables;

[0152] Store the child node into the target third database table;

[0153] The database tables include a first database table, a second database table and a plurality of third database tables.

[0154] Corresponding to the above method embodiment, the embodiment of the present application further provides an electronic device. The electronic device described below and the detection method described above can refer to each other.

[0155] See also Figure 5 As shown, the electronic device includes:

[0156] A memory 332, for storing computer programs;

[0157] The processor 322 is used to implement the steps of the detection method of the above method embodiment when executing the computer program.

[0158] For details, please refer to Figure 6 , Figure 6A schematic diagram of the specific structure of an electronic device provided for this embodiment, which may have relatively large differences due to different configurations or performances, may include one or more processors (central processing units, CPU) (for example, one or more processors) and a memory 332, and the memory 332 stores one or more computer programs 342 or data 344. Among them, the memory 332 can be a temporary storage or a permanent storage. The program stored in the memory 332 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data processing device. Furthermore, the processor 322 can be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the electronic device 301.

[0159] The electronic device 301 may further include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input and output interfaces 358 , and / or one or more operating systems 341 .

[0160] The steps in the detection method described above can be implemented by the structure of an electronic device.

[0161] Corresponding to the above method embodiment, the embodiment of the present application further provides a readable storage medium. The readable storage medium described below and the detection method described above can refer to each other.

[0162] A readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the detection method of the above method embodiment are implemented.

[0163] The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or other readable storage medium that can store program codes.

[0164] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0165] Those skilled in the art may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0166] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0167] Finally, it should be noted that, in this article, relationships such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms include, include or any other variations are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0168] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A detection method, characterized in that: include: Acquire the target program's warning data from the detection engine, and convert the warning data into a current behavior feature vector; Acquire the historical behavior of the target program from an application behavior database, and construct a historical behavior feature vector using the historical behavior; Based on the comparison result of the current behavior feature vector and the historical behavior feature vector, misjudgment detection is performed on the alarm data.

2. The method according to claim 1, characterized in that Based on the comparison result of the current behavior feature vector and the historical behavior feature vector, misjudgment detection is performed on the alarm data, including: Calculating the similarity between the current behavior feature vector and the historical behavior feature vector; If the similarity is less than the abnormal threshold, it is determined that the alarm data is accurate; If the similarity is greater than or equal to the abnormal threshold, it is determined that the alarm data is erroneous.

3. The method according to claim 2, characterized in that After determining that the alarm data is wrong, the method further includes: Add 1 to the white count of the target program; When the whitelist count is greater than the whitelist threshold, the target program is added to the whitelist of the detection engine.

4. The method according to any one of claims 1 to 3, characterized in that: The application behavior database is constructed, wherein the construction of the application behavior database comprises: Acquire application behavior data, and construct a behavior triple corresponding to the application behavior; wherein the behavior triple includes a parent node, a behavior, and a child node; The parent node, the behavior and the child node are stored in a database table of an application behavior database according to their types.

5. The method according to claim 4, characterized in that The parent node, the behavior and the child node are stored in a database table of an application behavior database according to their types, including: The parent node, the behavior and the child node are stored in a database table of an intermediate database according to their types; The newly added data of the intermediate database is periodically written into the application behavior database.

6. The method according to claim 5, characterized in that Also includes: Determining the popularity of different program behaviors using the intermediate database; Comparing the popularity of the different program behaviors with a popularity threshold, and determining a target program behavior whose popularity is greater than the popularity threshold; The updating of the target program behavior is suspended in the intermediate database, and the data content corresponding to the target program behavior in the intermediate database is deleted.

7. The method according to claim 4, characterized in that The parent node, the behavior, and the child node are stored in a database table of an intermediate database according to their types, including: Storing the parent node in a first database table associated with the process; storing the behavior in a second database table associated with the behavior relationship; Determine the object of the operation of the said behavior; Determining a target third database table matching the operation object from a plurality of third database tables; Storing the child node in the target third database table; The database table includes a first database table, a second database table and a plurality of third database tables.

8. A detection device, characterized in that: include: A current vector acquisition module is used to obtain the warning data of the target program from the detection engine and convert the warning data into a current behavior feature vector; A historical vector acquisition module, used to acquire the historical behavior of the target program from the application behavior database, and construct a historical behavior feature vector using the historical behavior; The alarm review module is used to perform misjudgment detection on the alarm data based on the comparison result of the current behavior feature vector and the historical behavior feature vector.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the detection method according to any one of claims 1 to 7 when executing the computer program.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the detection method according to any one of claims 1 to 7 are implemented.

Images