Host process monitoring method

Abstract

The invention relates to the technical field of computer system monitoring, and discloses a host process monitoring method which comprises the following steps: S1, multi-modal acquisition: acquiring process resources, behavior data and interaction relationships; s2, performing feature processing: performing normalization, time sequence modeling and interactive extraction; s3, behavior modeling: modeling a time sequence and an interaction graph to describe behaviors; s4, anomaly detection: identifying anomalies by time sequence and graph embedding and confrontation methods; s5, safety response: executing blocking, resource limiting and isolation measures; and S6, adaptive optimization: dynamically optimizing the model and the strategy by feeding back. Through file system analysis and network flow capture, process static information, dynamic behaviors and interaction relations are comprehensively collected, full life cycle data coverage is achieved, resource occupation is optimized in combination with a dynamic sampling strategy, efficient operation is achieved while data comprehensiveness and timeliness are improved, and the system performance is improved. And the balance between efficient operation and low resource consumption is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer system monitoring, in particular to a method for monitoring a host process. Background Art

[0002] Host process monitoring is a method used to track and analyze running processes in the host operating system. Its purpose is to understand the use of system resources, process behavior patterns and their impact on system performance in real time. Through process monitoring, system administrators and operation and maintenance personnel can identify abnormal behaviors during operation, optimize system resource allocation, and improve the security and stability of the host. Typical host process monitoring functions include collecting resource indicators such as CPU, memory, I / O and network traffic, capturing the system calls and network interaction behaviors of the process, and analyzing and displaying the running status. Although existing host process monitoring technologies have played an important role in many aspects, with the complexity of the host environment and the diversification of threats, traditional monitoring methods may gradually become incapable of meeting the requirements in actual use.

[0003] First, existing technologies often only focus on a single dimension in data collection, which makes it difficult to cover the entire life cycle of a process. At the same time, the fixed sampling frequency cannot dynamically adapt to the system load, resulting in wasted resources when the load is low, and the inability to obtain key data in a timely manner when the load is high. In addition, the resource overhead of traditional collection methods is high, and it is difficult to maintain efficient operation in an environment with limited resources;

[0004] Second, existing monitoring methods lack the ability to comprehensively model the multi-dimensional behavior of host processes. Most of them only focus on a single behavior pattern (such as resource usage), ignoring the implicit associations and dependencies between processes. Single time series modeling methods also have difficulty capturing both short-term dynamic changes and long-term trends, limiting the accuracy and coverage of anomaly detection, especially in complex multi-process interaction scenarios.

[0005] Furthermore, existing anomaly detection methods usually rely on fixed rules and predefined thresholds, and can only identify known abnormal patterns, but are insufficient in detecting complex unknown threats (such as zero-day attacks). Due to the lack of multimodal and dynamic detection mechanisms, traditional methods are difficult to capture complex abnormal behaviors from multiple dimensions, especially when dealing with interaction anomalies and new malicious behaviors;

[0006] Finally, traditional security response mechanisms are mainly based on static rules and passive responses, which cannot flexibly adapt to different abnormal levels, have low response efficiency, and cannot promptly block high-risk operations. In addition, system call blacklists are usually static and lack real-time update capabilities, which cannot quickly respond to emerging threats and easily lead to threat spread and system damage. Summary of the invention

[0007] In view of the shortcomings of the prior art, the present invention provides a method for host process monitoring, which solves the problems of incomplete data collection, inaccurate anomaly detection, difficulty in dealing with unknown threats and low security response efficiency in traditional monitoring methods.

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions: A method for monitoring a host process comprises the following steps:

[0009] S1. Multimodal data collection: collect process resource indicators, behavior data, and process interaction relationships in the host operating environment;

[0010] S2, feature extraction and preprocessing: normalization, time series modeling and interactive feature extraction of the collected data;

[0011] S3, Multi-level behavior modeling: Based on time series modeling and process interaction graph modeling, multi-dimensional characterization of the host process behavior;

[0012] S4. Multimodal anomaly detection: Identify abnormal behaviors through temporal anomaly detection, graph embedding anomaly detection, and generative adversarial anomaly detection;

[0013] S5, Multi-level security response and protection: Take real-time blocking, resource usage restriction and isolation measures based on detected abnormal behaviors;

[0014] S6. Feedback and adaptive optimization: Dynamically adjust the detection model and response strategy based on user feedback.

[0015] Preferably, in step S1, the collection includes the following steps:

[0016] a. Use the extended Berkeley packet filter to dynamically capture the system call behavior, disk I / O operations, and network connections of the host process;

[0017] b. Collect static information and resource usage of the process by parsing the host's process file system;

[0018] c. Capture the real-time network traffic data of the process through Netfilter and libpcap.

[0019] Preferably, in the step S2, the interactive feature extraction extracts statistical features of mean, standard deviation, and autocorrelation coefficient based on a fixed time window, and constructs a behavior vector as follows:

[0020] v t =[CPU t ,Mem t ,I / O t ,Net t ,SysCall t ]

[0021] It is used to describe the behavior of a process.

[0022] Preferably, in step S2, the sequential modeling includes the following steps:

[0023] a. Use the ARIMA model to predict the resource usage trend of the process:

[0024] X t =φ1X t-1 +φ2X t-2 +…+φ p X t-p +∈ t

[0025] Among them, X t are the resource usage value and behavior value at time t;

[0026] b. Use LSTM network to model nonlinear dependencies, where the hidden state update formula is:

[0027] h t =σ(W h h t-1 +W x x t +b h )

[0028] Among them, h t is the hidden state of the LSTM network at time t, indicating the model’s memory of the current moment, W h is the weight matrix of the hidden state and the previous hidden state in the LSTM model, W x Define the prediction error for the weight matrix of the input and current hidden state in the LSTM model, and determine whether it is abnormal based on the size of the error.

[0029] Preferably, in step S3, process interaction diagram modeling includes:

[0030] Construct a process interaction graph, where nodes represent host processes and edges represent communication relationships between processes;

[0031] Define the node feature as the behavior vector and the edge weight as the interaction strength:

[0032] w ij =α·IO ij +β·Net ij

[0033] Among them, α and β are weight coefficients, which represent the relative importance of I / O and network interaction respectively;

[0034] Use graph neural networks to embed graph structures:

[0035]

[0036] Among them, α ij represents the attention weight.

[0037] Preferably, in step S4, the timing anomaly detection is implemented by the following steps:

[0038] a. Define the degree of abnormality based on time series data:

[0039]

[0040] Among them, σ t is the standard deviation of the prediction error;

[0041] b. Use LSTM-Autoencoder to reconstruct the behavior vector and calculate the reconstruction error:

[0042]

[0043] If R t >σ t , it is judged as abnormal.

[0044] Preferably, in step S4, graph embedding anomaly detection is implemented by the following steps:

[0045] a. Use the Isolation Forest algorithm to detect isolated points embedded in graph nodes, and its anomaly score is:

[0046]

[0047] Where E(h(v)) represents the path length of node v, and c(n) is the normalization coefficient;

[0048] b. Calculate the similarity of anomaly propagation paths through subgraph matching:

[0049]

[0050] Among them, Sim(G,G′) is the similarity between two graphs G and G′, which is calculated as the ratio of common edges to total edges.

[0051] Preferably, in step S4, generating adversarial anomaly detection is achieved by the following steps:

[0052] a. Use the generative adversarial network model to generate normal behavior samples, and the training loss function is:

[0053]

[0054] Among them, D is the discriminator and G is the generator;

[0055] b. Distinguish normal behavior from abnormal behavior through the discriminator output value.

[0056] Preferably, in the step S5, the real-time blocking, resource usage restriction and isolation measures are specifically as follows:

[0057] a. Use eBPF to intercept high-risk system calls of abnormal processes:

[0058]

[0059] b. Record logs and send alerts for low-risk abnormal behaviors, and terminate processes and isolate hosts for high-risk abnormal behaviors.

[0060] Preferably, the step S6 further comprises the following steps:

[0061] a. Collect false positives and false negatives and update training samples;

[0062] b. Dynamically adjust detection thresholds and rule engine configurations to adapt to changes in the host environment;

[0063] c. Automatically generate anomaly detection rules and add them to the rule base.

[0064] The present invention provides a method for monitoring a host process, which has the following beneficial effects:

[0065] 1. The present invention realizes the comprehensive collection of static information, dynamic behavior and interaction relationship of the process by parsing the file system and capturing the network traffic. At the same time, multimodal data collection covers the whole life cycle information of the host process, which significantly improves the comprehensiveness and timeliness of the data. In addition, through the dynamic sampling strategy, the sampling frequency can be adjusted according to the system resource usage, the monitoring resource occupation is optimized, and the system achieves a balance between efficient operation and low resource consumption.

[0066] 2. The present invention comprehensively describes the single-dimensional behavior and multi-dimensional interaction pattern of the host process through the combination of time series modeling and process interaction graph modeling. Time series modeling uses ARIMA and LSTM networks to predict the resource usage and system call patterns of the process, capturing short-term dynamic changes and long-term trends; process interaction graph modeling learns the implicit associations between processes through graph neural networks, revealing the complex dependencies between processes. This multi-level modeling method can analyze the process status from both the individual behavior and overall relationship levels, greatly improving the accuracy and coverage of anomaly detection.

[0067] 3. The present invention achieves dual coverage of known patterns and unknown patterns through time-series-based detection, graph embedding-based detection and generative adversarial anomaly detection. Time-series-based detection captures abnormal fluctuations in resource usage and call patterns, graph embedding-based detection discovers inter-process interaction anomalies, and the GAN model can identify zero-day threats and unknown anomalies, thereby improving the detection and adaptability to complex abnormal behaviors.

[0068] 4. The present invention adopts a dynamic multi-level security response mechanism, which enables it to take different response measures according to the abnormality level, ranging from logging, limiting resource usage to real-time blocking or isolating the host. The system call interception implemented by eBPF can block high-risk operations at the millisecond level and minimize the spread of threats. At the same time, it can also dynamically maintain the system call blacklist in real time and respond quickly to new threats at runtime. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 The figure is a flow chart of the method steps of the present invention. DETAILED DESCRIPTION

[0070] The following will be combined with the drawings in the specification of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0071] Embodiment 1: Technical solution of the present invention

[0072] Please refer to the attached Figure 1 , an embodiment of the present invention provides a method for monitoring a host process, comprising the following steps:

[0073] S1. Multimodal data collection: collect process resource indicators, behavior data, and process interaction relationships in the host operating environment;

[0074] S2, feature extraction and preprocessing: normalization, time series modeling and interactive feature extraction of the collected data;

[0075] S3, Multi-level behavior modeling: Based on time series modeling and process interaction graph modeling, multi-dimensional characterization of the host process behavior;

[0076] S4. Multimodal anomaly detection: Identify abnormal behaviors through temporal anomaly detection, graph embedding anomaly detection, and generative adversarial anomaly detection;

[0077] S5, Multi-level security response and protection: Take real-time blocking, resource usage restriction and isolation measures based on detected abnormal behaviors;

[0078] S6, Feedback and Adaptive Optimization: Dynamically adjust the detection model and response strategy based on user feedback;

[0079] In step S1, the collection includes the following steps:

[0080] a. Use the extended Berkeley packet filter to dynamically capture the system call behavior, disk I / O operations, and network connections of the host process;

[0081] b. Collect static information and resource usage of the process by parsing the host's process file system;

[0082] c. Capture real-time network traffic data of the process through Netfilter and libpcap;

[0083] In step S2, the interactive feature extraction extracts the statistical features of mean, standard deviation, and autocorrelation coefficient based on a fixed time window, and constructs the behavior vector as follows:

[0084] v t =[CPU t ,Mem t ,I / O t ,Net t ,SysCall t ]

[0085] It is used to describe process behavior;

[0086] In step S2, sequential modeling includes the following steps:

[0087] a. Use the ARIMA model to predict the resource usage trend of the process:

[0088] X t =φ1X t-1 +φ2X t-2 +…+φ p X t-p +∈ t

[0089] Among them, X t are the resource usage value and behavior value at time t;

[0090] b. Use LSTM network to model nonlinear dependencies, where the hidden state update formula is:

[0091] h t =σ(W h h t-1 +W x x t +b h )

[0092] Among them, ht is the hidden state of the LSTM network at time t, indicating the model’s memory of the current moment, W h is the weight matrix of the hidden state and the previous hidden state in the LSTM model, W x Define the prediction error for the weight matrix of the input and current hidden state in the LSTM model, and determine whether it is abnormal based on the error size;

[0093] In step S3, process interaction diagram modeling includes:

[0094] Construct a process interaction graph, where nodes represent host processes and edges represent communication relationships between processes;

[0095] Define the node feature as the behavior vector and the edge weight as the interaction strength:

[0096] w ij =α·IO ij +β·Net ij

[0097] Among them, α and β are weight coefficients, which represent the relative importance of I / O and network interaction respectively;

[0098] Use graph neural networks to embed graph structures:

[0099]

[0100] Among them, α ij represents the attention weight;

[0101] In step S4, timing anomaly detection is achieved through the following steps:

[0102] a. Define the degree of abnormality based on time series data:

[0103]

[0104] Among them, σ t is the standard deviation of the prediction error;

[0105] b. Use LSTM-Autoencoder to reconstruct the behavior vector and calculate the reconstruction error:

[0106]

[0107] If R t >σ t , it is judged as abnormal;

[0108] In step S4, graph embedding anomaly detection is implemented through the following steps:

[0109] a. Use the Isolation Forest algorithm to detect isolated points embedded in graph nodes, and its anomaly score is:

[0110]

[0111] Where E(h(v)) represents the path length of node v, and c(n) is the normalization coefficient;

[0112] b. Calculate the similarity of anomaly propagation paths through subgraph matching:

[0113]

[0114] Among them, Sim(G,G′) is the similarity between two graphs G and G′, which is calculated as the ratio of common edges to total edges;

[0115] In step S4, graph embedding anomaly detection is implemented through the following steps:

[0116] a. Use the Isolation Forest algorithm to detect isolated points embedded in graph nodes, and its anomaly score is:

[0117]

[0118] Where E(h(v)) represents the path length of node v, and c(n) is the normalization coefficient;

[0119] b. Calculate the similarity of anomaly propagation paths through subgraph matching:

[0120]

[0121] Among them, Sim(G,G′) is the similarity between two graphs G and G′, which is calculated as the ratio of common edges to total edges;

[0122] In step S5, the real-time blocking, resource usage restriction and isolation measures are as follows:

[0123] a. Use eBPF to intercept high-risk system calls of abnormal processes:

[0124]

[0125] b. Log low-risk abnormal behaviors and send alerts; terminate processes and isolate hosts for high-risk abnormal behaviors;

[0126] In step S6, the following steps are further included:

[0127] a. Collect false positives and false negatives and update training samples;

[0128] b. Dynamically adjust detection thresholds and rule engine configurations to adapt to changes in the host environment;

[0129] c. Automatically generate anomaly detection rules and add them to the rule base.

[0130] Specifically, in step S1, the goal is to obtain the process behavior and interaction data involved in the host operation in real time and comprehensively, so as to provide a high-quality data foundation for subsequent behavior modeling and anomaly detection. By adopting the extended Berkeley packet filter, namely eBPF technology, the system can capture the dynamic behaviors of the process such as system calls, disk I / O operations and network interactions in the kernel state, while avoiding frequent switching between kernel state and user state, thereby greatly reducing performance overhead. In addition, by parsing the host's process file system, it is possible to supplement the acquisition of static process information, such as startup time, allocated resources and file descriptors. By capturing real-time network traffic through Netfilter or libpcap, the communication relationship between processes can be constructed, thereby forming comprehensive interaction data. This multi-dimensional and multi-modal data collection method ensures the comprehensiveness and real-time nature of process monitoring data, laying the foundation for efficient anomaly detection.

[0131] In step S2, the collected multimodal data needs to be normalized and time-series modeled to remove dimensional differences and retain time-dependent characteristics. This step extracts statistical features such as mean, standard deviation, and autocorrelation coefficient from data within a fixed time period through a sliding window to generate a feature vector that can characterize the process behavior. In addition, this step also constructs a behavior vector at each time point to describe the resource usage and call pattern of the process. This process not only simplifies the data dimension, but also improves the robustness of feature expression, providing structured data input for subsequent modeling.

[0132] In step S3, the dynamic behavior of the host process is comprehensively characterized by combining time series modeling and process interaction graph modeling. In time series modeling, the ARIMA model is used to model linear dependencies, and the LSTM network is combined to capture nonlinear dynamic change characteristics to predict the future behavior pattern of the process. In process interaction graph modeling, a directed graph with nodes as processes and edges as interaction relationships is constructed, and the resource dependency and communication behavior of the process are described by combining node features and edge weights. By embedding the interaction graph with graph neural network (GNN), implicit associations and interaction relationship features between processes can be extracted.

[0133] In step S4, a multi-level detection method based on time series, graph embedding, and generative adversarial network (GAN) is used to identify abnormal behaviors from different dimensions. The time series detection method can effectively capture short-term abnormal fluctuations in process resource usage or call patterns; the graph embedding-based detection method finds potential abnormal propagation paths between processes by identifying isolated points and abnormal subgraphs in the process interaction graph; the GAN-based detection method detects unknown potential anomalies by generating normal behavior samples and comparing them with actual behaviors. This multimodal detection method utilizes the complementarity of multi-dimensional features and multiple detection mechanisms, significantly improving the comprehensiveness and accuracy of anomaly detection.

[0134] In step S5, the protection strategy is dynamically adjusted according to the results of anomaly detection. For low-risk threats, only logs are recorded and alerts are sent; for medium-risk threats, the resource usage of the process is restricted to prevent it from affecting the stability of the system; for high-risk threats, system call interception is implemented through eBPF to prevent malicious operations, and the process is terminated or the host is isolated as needed. This step also implements real-time behavior blocking function, which can intercept malicious call operations in time by dynamically maintaining the system call blacklist. This multi-level response mechanism achieves optimal protection of system resources while ensuring timely handling of abnormal behaviors.

[0135] In step S6, the training data set of the detection model is dynamically updated by collecting false positives and false negatives annotated by users, thereby improving the model's adaptability to complex environments. In addition, this step combines active learning methods to automatically adjust the threshold and rule configuration of anomaly detection according to real-time environmental changes, and generates new anomaly detection rules to add to the rule base, ensuring that the system can continue to evolve and optimize.

[0136] Example 2: Efficient host monitoring in resource optimization scenario

[0137] Implementation steps:

[0138] Kernel-level system call data collection is implemented through eBPF, and the sampling frequency is adjusted in combination with the dynamic sampling mechanism.

[0139] Build low- and high-frequency sampling modes with real-time resource usage monitoring (CPU, memory, I / O).

[0140] Perform batch analysis on low-frequency sampled data and real-time detection on high-frequency sampled data, combined with the ARIMA model to generate a behavioral baseline.

[0141] Only abnormal behaviors of high-frequency sampled data are accurately detected to avoid unnecessary data processing.

[0142] It achieves global monitoring of host processes while using low resources, and adjusts sampling strategies through real-time feedback.

[0143] Summarize:

[0144] This embodiment demonstrates that in an environment with limited resources, the present invention effectively balances monitoring performance and system overhead through a dynamic sampling mechanism, so that host process monitoring still has high accuracy and efficiency in low-resource scenarios.

[0145] Example 3: Multi-host collaborative monitoring in a distributed system

[0146] Implementation steps:

[0147] The host process monitoring system of the present invention is independently deployed on each host in the distributed system to collect process behavior data of each host.

[0148] Aggregate process interaction data of all hosts through a distributed message queue (such as Kafka).

[0149] Construct a global process interaction graph across hosts, with nodes representing processes and edges representing cross-host communication relationships.

[0150] Graph neural networks are used to model global graphs and extract implicit interaction patterns in distributed environments.

[0151] Detect cross-host abnormal behaviors, such as abnormal communications, abnormal traffic, and malicious propagation paths, and synchronously enforce security policies through a centralized response system.

[0152] Summarize:

[0153] This embodiment verifies the applicability of the present invention in distributed systems, especially in multi-host collaborative monitoring and process interaction analysis, and is capable of detecting distributed abnormal behaviors in complex environments and responding in a timely manner.

[0154] Example 4: Zero-day threat detection in a security-sensitive environment

[0155] Implementation steps:

[0156] The present invention is deployed in a security-sensitive environment to collect resource usage, system calls and network connection data of the host process in real time.

[0157] A generative adversarial network (GAN) is used to model normal behavior samples and combined with a discriminator to identify abnormal behavior.

[0158] For possible zero-day threats, the generator and discriminator of the GAN model are updated in real time to cope with new threat patterns.

[0159] Cooperate with the system call interception function of eBPF to block malicious calls and record relevant logs when high-risk exceptions are determined.

[0160] The feedback mechanism is used to record newly detected abnormal behaviors and add them to the training dataset to optimize the GAN model.

[0161] Summarize:

[0162] This embodiment verifies the ability of the present invention to detect and protect against unknown threats (such as zero-day vulnerabilities) in security-sensitive environments, especially in generative adversarial learning and real-time response, which can significantly improve the security of the system.

[0163] Example 5: Adaptive optimization in long-term operation scenarios

[0164] Implementation steps:

[0165] Deploy a host process monitoring system to continuously collect host operation data and perform behavior modeling.

[0166] Record abnormal behaviors detected during operation, including false positives and false negatives.

[0167] The anomaly detection model is regularly annotated through user feedback to form a new training data set.

[0168] Combined with active learning methods, the detection model and rule configuration are dynamically adjusted according to changes in the host operating environment.

[0169] The thresholds and strategies of anomaly detection are continuously updated through an adaptive optimization mechanism to ensure the high efficiency of the system in long-term operation.

[0170] Summarize:

[0171] This embodiment verifies the adaptive capability of the present invention in long-term operation scenarios, especially in terms of active learning and dynamic optimization, which enables the system to maintain stable monitoring and protection effects in a dynamic environment.

[0172] Summary

[0173] Example 1 verifies the overall feasibility and superiority of the technical solution of the present invention, and is suitable for complex dynamic environments.

[0174] Example 2 highlights the efficiency of the dynamic sampling mechanism and effectively improves system performance in resource optimization scenarios.

[0175] Example 3 expands the scope of application of the present invention and verifies its capability in distributed multi-host collaborative monitoring.

[0176] Example 4 focuses on security-sensitive scenarios and demonstrates the ability to detect and protect against zero-day threats and unknown anomalies.

[0177] Embodiment 5 aims at the long-term operation scenario, and verifies the continuous capability of the present invention in adaptive optimization through feedback and active learning mechanism.

[0178] In summary, the technical solution of the present invention has extremely high flexibility, scalability and practical value, and can meet the host process monitoring needs in a variety of complex scenarios.

[0179] Comparative experiment:

[0180] Experiment 1: Comparison of data collection efficiency and system overhead

[0181] Purpose:

[0182] The advantages of the present invention in data collection efficiency and resource overhead are verified, and the superiority of the dynamic sampling mechanism and multi-modal collection capability is reflected.

[0183] Existing technical solutions:

[0184] The static collection method based on traditional file system analysis is selected, with the following main features:

[0185] Data collection method: Collect resource usage and status data of host processes by periodically polling the process file system.

[0186] Sampling mechanism: Fixed sampling frequency, which cannot be adjusted according to system load.

[0187] Collection content: limited to CPU utilization, memory usage, I / O read / write volume, and network traffic.

[0188] The scheme of the present invention:

[0189] The present invention adopts a dynamic sampling mechanism combining eBPF technology with process file parsing, and its main features are:

[0190] Data collection method: Kernel-state eBPF captures system calls, network behavior, and disk I / O, while static data is collected through the process file system.

[0191] Sampling mechanism: Dynamically adjust the sampling frequency and optimize sampling based on resource utilization.

[0192] Collection content: Multimodal collection, including system calls, inter-process interactions, and real-time resource indicators.

[0193] Experimental process design:

[0194] The existing technical solution and the solution of the present invention are respectively deployed on the same host environment (configuration is detailed in the table below).

[0195] Set different sampling frequencies (low frequency: 5 seconds / time; medium frequency: 1 second / time; high frequency: 0.1 second / time).

[0196] Measure acquisition efficiency (data processing latency) and system resource consumption (CPU usage, memory usage).

[0197] Test performance under simulated high load environment (CPU>80%, network I / O peak).

[0198] Experimental parameters:

[0199]

[0200]

[0201] Experimental data table:

[0202]

[0203] Experimental results analysis:

[0204] Collection delay: The eBPF technology of the present invention significantly reduces the collection delay, especially at high-frequency sampling.

[0205] Resource usage: The dynamic sampling mechanism of the present invention significantly reduces CPU and memory usage in high-load scenarios.

[0206] Data coverage: The multimodal acquisition technology of the present invention increases the data coverage to 99%, which is much higher than the existing technology.

[0207] Experiment 2: Comparison of anomaly detection accuracy and response timeliness

[0208] Purpose:

[0209] The advantages of the present invention in anomaly detection accuracy, response timeliness and adaptability to zero-day threats are verified.

[0210] Existing technical solutions:

[0211] The anomaly detection method based on fixed rules is selected, and its main features are:

[0212] Detection method: Based on predefined static rules (such as resource thresholds, frequent calls, etc.).

[0213] Detection scope: limited to known resource usage anomalies (such as high CPU or I / O load).

[0214] Response mechanism: Simple logging and abnormal process termination based on rule triggering.

[0215] The scheme of the present invention:

[0216] The present invention adopts multi-modal anomaly detection combined with a multi-level security response mechanism, and its main features are:

[0217] Detection method: Combining time series analysis, graph embedding anomaly detection and generative adversarial network (GAN) detection.

[0218] Detection scope: Covers known anomalies and unknown threats (such as zero-day attacks).

[0219] Response mechanism: hierarchical processing based on detection results (including logging, resource limitation, and real-time blocking).

[0220] Experimental process design:

[0221] Build known abnormal scenarios (such as high resource usage) and zero-day threat scenarios (simulating unknown malicious behavior).

[0222] The existing technology and the method of the present invention are run in the same environment to detect abnormal processes and record:

[0223] Detection accuracy (TPR / FPR).

[0224] Detection latency (time from trigger to response).

[0225] Response effect (whether abnormal behavior is effectively blocked).

[0226] Test the detection performance under various load conditions (low, medium, and high). Experimental parameters:

[0227]

[0228] Experimental data table:

[0229]

[0230]

[0231] Experimental results analysis:

[0232] Detection accuracy: In known anomaly detection, the accuracy of the present invention is improved by 5% to 10%, and is significantly higher than the existing technology in zero-day threat detection.

[0233] Detection delay: The present invention reduces detection delay (up to 76%) through multimodal anomaly detection.

[0234] Response effect: The multi-level safety response mechanism of the present invention makes the response success rate as high as 95%, which is better than the 75% to 85% of the prior art.

[0235] Conclusion: The present invention is superior to existing technologies in terms of detection range, accuracy and response timeliness, especially in dealing with zero-day threats and high-load scenarios.

[0236] Summarize:

[0237] Experiment 1 verifies the optimization effect of the present invention in terms of data collection efficiency and resource overhead.

[0238] Experiment 2 verifies the significant advantages of the present invention in terms of anomaly detection range, detection accuracy and response timeliness.

[0239] Experimental results show that the present invention is superior to the existing technologies in terms of performance, adaptability and security, especially in high-load and unknown threat scenarios, which fully demonstrates its technological innovation and practical value.

[0240] Conclusion: The present invention is significantly superior to the existing technology in terms of collection efficiency, system overhead and data comprehensiveness.

[0241] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for monitoring a host process, characterized in that: The following steps are involved: S1. Multimodal data collection: collect process resource indicators, behavior data, and process interaction relationships in the host operating environment; S2, feature extraction and preprocessing: normalization, time series modeling and interactive feature extraction of the collected data; S3, Multi-level behavior modeling: Based on time series modeling and process interaction graph modeling, multi-dimensional characterization of the host process behavior; S4. Multimodal anomaly detection: Identify abnormal behaviors through temporal anomaly detection, graph embedding anomaly detection, and generative adversarial anomaly detection; S5, Multi-level security response and protection: Take real-time blocking, resource usage restriction and isolation measures based on detected abnormal behaviors; S6. Feedback and adaptive optimization: Dynamically adjust the detection model and response strategy based on user feedback.

2. A method for monitoring a host process according to claim 1, characterized in that: In the step S1, the collection includes the following steps: a. Use the extended Berkeley packet filter to dynamically capture the system call behavior, disk I / O operations, and network connections of the host process; b. Collect static information and resource usage of the process by parsing the host's process file system; c. Capture the real-time network traffic data of the process through Netfilter and libpcap.

3. A method for monitoring a host process according to claim 1, characterized in that: In the step S2, the interactive feature extraction extracts the statistical features of mean, standard deviation, and autocorrelation coefficient based on a fixed time window, and constructs the behavior vector as follows: v t =[CPU t ,Member t ,I / O t ,Net t ,SysCall t ] It is used to describe the behavior of a process.

4. A method for monitoring a host process according to claim 1, characterized in that: In the step S2, the sequential modeling includes the following steps: a. Use the ARIMA model to predict the resource usage trend of the process: X t =φ1X t-1 +φ2X t-2 +…+φ p X t-p +∈ t Among them, X t are the resource usage value and behavior value at time t; b. Use LSTM network to model nonlinear dependencies, where the hidden state update formula is: h t =σ(W h h t-1 +W x x t +b h ) Among them, h t is the hidden state of the LSTM network at time t, indicating the model’s memory of the current moment, W h is the weight matrix of the hidden state and the previous hidden state in the LSTM model, W x Define the prediction error for the weight matrix of the input and current hidden state in the LSTM model, and determine whether it is abnormal based on the size of the error.

5. A method for monitoring a host process according to claim 1, characterized in that: In the S3 step, the process interaction diagram modeling includes: Construct a process interaction graph, where nodes represent host processes and edges represent communication relationships between processes; Define the node feature as the behavior vector and the edge weight as the interaction strength: w ij =α·IO ij +b·Net ij Among them, α and β are weight coefficients, which represent the relative importance of I / O and network interaction respectively; Use graph neural networks to embed graph structures: Among them, α ij represents the attention weight.

6. A method for monitoring a host process according to claim 1, characterized in that: In step S4, timing anomaly detection is implemented by the following steps: a. Define the degree of abnormality based on time series data: Among them, σ t is the standard deviation of the prediction error; b. Use LSTM-Autoencoder to reconstruct the behavior vector and calculate the reconstruction error: If R t >σ t , it is judged as abnormal.

7. A method for monitoring a host process according to claim 1, characterized in that: In step S4, graph embedding anomaly detection is implemented by the following steps: a. Use the Isolation Forest algorithm to detect isolated points embedded in graph nodes, and its anomaly score is: Where E(h(v)) represents the path length of node v, and c(n) is the normalization coefficient; b. Calculate the similarity of anomaly propagation paths through subgraph matching: Among them, Sim(G,G′) is the similarity between two graphs G and G′, which is calculated as the ratio of common edges to total edges.

8. A method for monitoring a host process according to claim 1, characterized in that: In step S4, generating adversarial anomaly detection is achieved by the following steps: a. Use the generative adversarial network model to generate normal behavior samples, and the training loss function is: Among them, D is the discriminator and G is the generator; b. Distinguish normal behavior from abnormal behavior through the discriminator output value.

9. A method for monitoring a host process according to claim 1, characterized in that: In step S5, the real-time blocking, resource usage restriction and isolation measures are as follows: a. Use eBPF to intercept high-risk system calls of abnormal processes: b. Record logs and send alerts for low-risk abnormal behaviors, and terminate processes and isolate hosts for high-risk abnormal behaviors.

10. A method for monitoring a host process according to claim 1, characterized in that: The step S6 further comprises the following steps: a. Collect false positives and false negatives and update training samples; b. Dynamically adjust detection thresholds and rule engine configurations to adapt to changes in the host environment; c. Automatically generate anomaly detection rules and add them to the rule base.

Images