Event detection method and device, storage medium and electronic equipment

Abstract

The invention discloses an event detection method and device, a storage medium and electronic equipment. The method comprises the following steps: deploying a lightweight security proxy service on terminal equipment; acquiring operation data of the terminal equipment through the lightweight security proxy service; executing an abnormal value detection operation on system log data in the operation data to determine a first detection result, and executing a decision tree detection operation on network flow data in the operation data to determine a second detection result; determining whether a target event occurs in the terminal device based on the first detection result and the second detection result; under the condition that the target event exists, an alarm message is generated according to the target event, the alarm message comprises at least one of a file path and a process path which cause the occurrence of the target event, and the file path and the process path are used for positioning the source and the influence range of the target event. The technical problem that the detection accuracy is low due to the fact that only a single event detection mode is depended on is solved.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular, to an event detection method and device, a storage medium, and an electronic device. Background Art

[0002] Traditional security operation and maintenance systems usually rely on a single event detection method, such as analyzing abnormal behavior only through system logs, or monitoring suspicious patterns in network traffic only. This single detection strategy often cannot fully cover the diversity of security threats, and is prone to missing hidden attack behaviors, resulting in low detection accuracy. Especially in a hybrid IT environment, a single detection method is difficult to adapt to the complex requirements of different operating systems and application software, increasing the risk of false positives and false negatives, and reducing the overall effectiveness of security event detection.

[0003] In summary, the related technology has a technical problem of relying on only a single event detection method, resulting in low detection accuracy.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide an event detection method and device, a storage medium, and an electronic device to at least solve the technical problem of low detection accuracy caused by relying solely on a single event detection method.

[0006] According to one aspect of an embodiment of the present application, an event detection method is provided, including: deploying a lightweight security agent service on a terminal device; collecting operation data of the terminal device through the lightweight security agent service; performing an outlier detection operation on system log data in the operation data to determine a first detection result, and performing a decision tree detection operation on network traffic data in the operation data to determine a second detection result; determining whether a target event has occurred on the terminal device based on the first detection result and the second detection result; in the event that the target event exists, generating an alarm message according to the target event, wherein the alarm message includes at least one of a file path and a process path that caused the target event to occur, and the file path and the process path are used to locate the source and impact range of the target event.

[0007] According to another aspect of an embodiment of the present application, an event detection system is also provided, including: a lightweight security agent module, used to collect operation data of a terminal device and execute instructions sent by an operation and maintenance management platform; an operation and maintenance management platform module, used to manage user access rights, handle command distribution and traffic mirroring; a log monitoring and analysis platform module, used to perform an outlier detection operation on system log data in the operation data to determine a first detection result, and perform a decision tree detection operation on network traffic data in the operation data to determine a second detection result; an automated operation and maintenance module, which performs batch script execution and automated configuration deployment on the terminal device according to system operation instructions and configuration scripts; an event detection response module, used to determine whether a target event has occurred on the terminal device based on the first detection result and the second detection result; in the event that the target event exists, an alarm message is generated according to the target event, wherein the alarm message includes at least one of a file path and a process path that cause the target event to occur, and the file path and the process path are used to locate the source and scope of influence of the target event.

[0008] According to another aspect of an embodiment of the present application, an event detection device is also provided, including: a deployment module for deploying a lightweight security agent service on a terminal device; a collection module for collecting operation data of the terminal device through the lightweight security agent service; an execution module for performing an outlier detection operation on system log data in the operation data to determine a first detection result, and performing a decision tree detection operation on network traffic data in the operation data to determine a second detection result; a determination module for determining whether a target event has occurred on the terminal device based on the first detection result and the second detection result; a generation module for generating an alarm message according to the target event when the target event exists, wherein the alarm message includes at least one of a file path and a process path that cause the target event to occur, and the file path and the process path are used to locate the source and impact range of the target event.

[0009] Optionally, the device is used to perform an outlier detection operation on the system log data in the operating data to determine a first detection result in the following manner: processing the system log data according to a long short-term memory network model to obtain a target threshold range; performing regression analysis on the system log data based on the target threshold range to determine the first detection result, and / or detecting the system log data according to a predetermined keyword dictionary to determine the first detection result, wherein the first detection result is used to indicate whether there is an abnormality in the system log data.

[0010] Optionally, the device is used to determine a second detection result by performing a decision tree detection operation on the network traffic data in the operating data in the following manner: performing an eigenvalue decomposition operation on the network traffic data to obtain a target feature vector related to the traffic behavior; using a pre-trained decision tree model to process the target feature vector to obtain similar network traffic data; clustering the similar network traffic data to obtain the second detection result, wherein the second detection result is used to indicate whether there is abnormal traffic in the network traffic data; when the network traffic data includes network captured data packets, converting the network captured data packets into image data, and performing cluster analysis on the image data to obtain the second detection result.

[0011] Optionally, the device is used to determine whether a target event has occurred on the terminal device based on the first detection result and the second detection result in the following manner, including at least one of the following: when the first detection result indicates whether there is an abnormal log in the system log data, determining that the target event has occurred on the terminal device; when the second detection result indicates that there is abnormal traffic in the network traffic data, determining that the target event has occurred on the terminal device.

[0012] Optionally, the device is used to generate an alarm message based on the target event when the target event exists in the following manner: when the target event exists, determine at least one of the file path and the process path related to the target event; determine the event type of the target event based on the file path and / or the process path; and generate the alarm message according to the event type.

[0013] Optionally, the device is also used for: when the event type is a file alarm type, controlling the operation and maintenance management platform to send monitoring instructions to the terminal device through the lightweight security agent service to obtain system environment information of the terminal device, and storing the system environment information in a log file under the alarm record directory, wherein the system environment information includes process information currently running on the terminal device.

[0014] Optionally, the device is also used to: when the event type is a process alarm type and the same historical alarm type is obtained, store the system environment information in the log file, and call the target processing script to process the target event, wherein the target processing script is used to perform a preset repair operation to repair the system error caused by the target event; when the event type is the process alarm type and the same historical alarm type is not obtained, set the reverse proxy server forwarding weight of the terminal device to 0 through the lightweight security proxy service.

[0015] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above event detection method when running.

[0016] According to another aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the above event detection method.

[0017] According to another aspect of the embodiments of the present application, there is further provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the event detection method through the computer program.

[0018] In an embodiment of the present application, a lightweight security agent service is deployed on a terminal device; operating data of the terminal device is collected through the lightweight security agent service; an outlier detection operation is performed on the system log data in the operating data to determine a first detection result, and a decision tree detection operation is performed on the network traffic data in the operating data to determine a second detection result; based on the first detection result and the second detection result, it is determined whether a target event has occurred on the terminal device; in the event of the target event, an alarm message is generated according to the target event, wherein the alarm message includes at least one of the file path and the process path that caused the target event to occur, and the file path and the process path are used to locate the source and scope of influence of the target event. By integrating multi-dimensional data detection and intelligent analysis, the purpose of improving the accuracy of event detection and the response speed is achieved, thereby achieving the technical effect of comprehensive and efficient security event monitoring and alarm, and further solving the technical problem of low detection accuracy due to relying solely on a single event detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a schematic diagram of an application environment of an optional event detection method according to an embodiment of the present application;

[0021] Figure 2 is a flow chart of an optional event detection method according to an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of an optional event detection method according to an embodiment of the present application;

[0023] Figure 4 is a schematic diagram of another optional event detection method according to an embodiment of the present application;

[0024] Figure 5 is a schematic diagram of another optional event detection method according to an embodiment of the present application;

[0025] Figure 6 is a schematic structural diagram of an optional event detection device according to an embodiment of the present application;

[0026] Figure 7 is a schematic diagram of the structure of an optional event detection product according to an embodiment of the present application;

[0027] Figure 8 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] The present application is described below in conjunction with embodiments:

[0031] According to one aspect of an embodiment of the present application, an event detection method is provided. Optionally, in this embodiment, the event detection method can be applied to Figure 1In the hardware environment composed of the server 101 and the terminal device 103 shown in FIG. Figure 1 As shown, the server 101 is connected to the terminal 103 via a network, and can be used to provide services for the terminal device or an application 107 installed on the terminal device. The application can be a video application, an instant messaging application, a browser application, an educational application, a game application, etc. A database 105 may be set up on the server or independently of the server to provide data storage services for the server 101, for example, a game data storage server. The above-mentioned network may include, but is not limited to, a wired network and a wireless network, wherein the wired network includes, for example, a local area network, a metropolitan area network, and a wide area network; the wireless network includes, for example, Bluetooth, WIFI, and other networks that implement wireless communication; the terminal device 103 may be a terminal configured with an application program, and may include, but is not limited to, at least one of the following: a mobile phone (such as an Android phone, an iOS phone, etc.), a laptop computer, a tablet computer, a PDA, a MID (Mobile Internet Devices), a PAD, a desktop computer, a smart TV, an intelligent voice interaction device, a smart home appliance, a vehicle-mounted terminal, an aircraft, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a mixed reality (MR) terminal, and other computer devices; the above-mentioned server may be a single server, a server cluster consisting of multiple servers, or a cloud server.

[0032] Combination Figure 1 As shown, the above event detection method can be executed by an electronic device, which can be a terminal device or a server. The above event detection method can be implemented by the terminal device or the server respectively, or by the terminal device and the server together.

[0033] The above is only an example and is not specifically limited in this embodiment.

[0034] Optionally, as an optional implementation, as Figure 2 As shown, the above event detection method includes:

[0035] S202, deploying a lightweight security proxy service on the terminal device;

[0036] S204, collecting operation data of the terminal device through a lightweight security agent service;

[0037] Optionally, in the embodiment of the present application, the above-mentioned lightweight security proxy service refers to a service module running on the terminal device, which is responsible for collecting and analyzing system logs, network traffic and operation status information, including but not limited to CPU usage, memory usage, file system activity, network connection status, etc. The service module is compact in design, occupies few resources, can run stably for a long time, and will not have a significant impact on the normal operation of the terminal device.

[0038] It should be noted that the deployment of the above-mentioned lightweight security proxy service can flexibly adapt to different terminal devices, whether it is a physical server, a virtual machine or a container environment, or even an edge computing node, and this application does not limit this.

[0039] In addition, the types of running data collected can also be expanded according to actual needs, such as system call records, inter-process communication conditions, etc., to meet more complex security monitoring needs. The operation mode and data collection frequency of the service module are also configurable and can be adjusted according to the performance and security policy of the terminal device to balance the monitoring effect and resource consumption. In an embodiment of the present application, when the system resource utilization rate reaches a threshold, the lightweight security agent service can also automatically adjust its operating state to reduce the impact on the terminal device and ensure the continuity of security monitoring and the stability of system performance.

[0040] S206, performing an outlier detection operation on the system log data in the operation data to determine a first detection result, and performing a decision tree detection operation on the network traffic data in the operation data to determine a second detection result;

[0041] Optionally, in an embodiment of the present application, the above-mentioned system log data refers to various record information generated by the terminal device during operation, including but not limited to the system log, application log, security log, etc. of the operating system, which records information such as device status, user activity, system events, etc., and is one of the important data sources for detecting abnormal behavior.

[0042] The above-mentioned outlier detection operation performed on the system log data refers to identifying those log records that are significantly different from the normal operating mode through statistical analysis, machine learning or data mining technology, so as to determine whether there is a potential security threat or abnormal behavior. In the embodiment of the present application, a keyword dictionary can be constructed to detect special keywords, and LSTM can be used to predict log trends and set threshold ranges to generate a first detection result, which reflects the abnormal conditions in the system log.

[0043] Optionally, in an embodiment of the present application, the above-mentioned network traffic data refers to the data packet information generated by the terminal device during the network communication process, including but not limited to the source address, destination address, protocol type, port number, data packet size, etc. of the data packet. The decision tree detection operation of the network traffic data refers to analyzing the traffic characteristics using a decision tree algorithm to identify abnormal patterns in the network traffic, such as abnormal traffic size, non-standard protocol usage, high frequency of specific port access, etc., so as to determine the second detection result. By decomposing the network traffic data into multiple feature values ​​and using multiple decision tree models for combined analysis, it is possible to more accurately determine whether the network behavior is abnormal.

[0044] It should be noted that the specific implementation methods of the above-mentioned outlier detection and decision tree detection can be diversified. For example, outlier detection can adopt multiple methods such as statistical-based anomaly detection, machine learning-based anomaly detection or rule-based anomaly detection, and the decision tree detection operation can also use different decision tree algorithms, such as ID3, C4.5, CART, etc., or combine with other machine learning models, such as support vector machine (SVM), neural network, etc., to perform more complex traffic analysis.

[0045] In addition, parameters such as the execution frequency of detection operations, the granularity of data collection, and the cycle of model training can also be adjusted according to actual scenarios and needs, and this application does not limit this.

[0046] S208, determining whether a target event occurs on the terminal device based on the first detection result and the second detection result;

[0047] S210, when a target event exists, generating an alarm message according to the target event, wherein the alarm message includes at least one of a file path and a process path that cause the target event to occur, and the file path and the process path are used to locate the source and impact scope of the target event.

[0048] Optionally, in an embodiment of the present application, the above-mentioned first detection result and second detection result refer to the analysis conclusions obtained after performing outlier detection on system log data and decision tree detection on network traffic data, including but not limited to abnormal log records appearing on terminal devices, abnormal patterns in network behavior, and possible potential security threats.

[0049] Exemplarily, when a target event exists, an alarm message is generated, which includes specific information that caused the target event to occur, such as at least one of a file path and a process path. The file path refers to the file location of the abnormal behavior or security event, and the process path points to the running process that triggered the event.

[0050] It should be noted that the generation method and content of the above-mentioned alarm messages can be adjusted according to the nature and severity of the target event. For example, for high-risk events, the alarm information can be more detailed, including a specific description of the event, the risk level, and recommended response measures; while for lower-risk anomalies, only basic file or process information may be required. The system can also automatically send messages to different operation and maintenance teams or individuals based on the priority of the alarm to ensure that important events can be handled in a timely manner. In addition, the sending channel of the alarm message is also configurable, and can be sent through various methods such as email, text message, system notification, etc., which is not limited in this application.

[0051] In an exemplary embodiment, an enterprise data center application scenario is used as an example. The data center has a large number of servers that need to be monitored and managed in real time. First, a lightweight security agent service is deployed on each server. This service is responsible for continuously observing and collecting server operation data, including system log data and network traffic data.

[0052] Next, during the operation of the server, the lightweight security agent service regularly collects system log data, such as system startup records, user login attempts, file access history, process activity information, etc. This data is then transmitted to the log monitoring and analysis platform, the core component of the security operation and maintenance system, for outlier detection operations. Based on historical data and preset anomaly detection models, the analysis platform can identify log records that do not conform to normal behavior patterns and determine the first detection result, that is, the security status at the system log level.

[0053] At the same time, the lightweight security proxy service also collects network traffic data from the server, including the source address, destination address, protocol type, packet size, frequency, etc. of the data packet. The network traffic data is passed to the operation and maintenance management platform, and the traffic characteristics are analyzed through the decision tree model to determine whether there are abnormal network communication behaviors, such as large amounts of data transmission, use of non-standard protocols, high-frequency access to specific ports, etc., so as to determine the second detection result, that is, the security status at the network traffic level.

[0054] Then, based on the first and second detection results, the security operation and maintenance system comprehensively evaluates whether the target event has occurred on the server, such as malware infection, unauthorized access, data leakage and other security issues. If the target event is detected, the system will generate a detailed alarm message based on the nature and scope of the event. For example, if the system log detects that a suspicious file is frequently accessed, the alarm message will include the path of the file to help the operation and maintenance personnel quickly locate the problem file; if the network traffic detection finds an abnormal data packet, the alarm message will provide the process path that triggered the event, making it easier to trace the source of the network behavior.

[0055] Furthermore, the generation of an alarm message not only includes the specific information of the event, but also can include the risk level of the event, recommended response measures, etc., so that operation and maintenance personnel can take prompt action to limit the scope of the impact of the event.

[0056] In general, through the deployment of lightweight security agent services and data collection, outlier detection and decision tree detection operations, as well as target event judgment and alarm message generation based on these results, enterprises can build an efficient and intelligent security operation and maintenance system to effectively protect the servers in the data center from security threats.

[0057] Through the embodiments of the present application, a lightweight security agent service is deployed on a terminal device; the operation data of the terminal device is collected through the lightweight security agent service; an outlier detection operation is performed on the system log data in the operation data to determine a first detection result, and a decision tree detection operation is performed on the network traffic data in the operation data to determine a second detection result; based on the first detection result and the second detection result, it is determined whether a target event has occurred on the terminal device; in the case of the existence of the target event, an alarm message is generated according to the target event, wherein the alarm message includes the file path that caused the target event to occur, at least one of the process path, and the file path and the process path are used to locate the source and scope of influence of the target event. By integrating multi-dimensional data detection and intelligent analysis, the purpose of improving the accuracy of event detection and the response speed is achieved, thereby achieving the technical effect of comprehensive and efficient security event monitoring and alarm, and further solving the technical problem of low detection accuracy due to reliance on a single event detection method.

[0058] As an optional scheme, the above-mentioned outlier detection operation is performed on the system log data in the above-mentioned operation data to determine the first detection result, including: processing the above-mentioned system log data according to the long short-term memory network model to obtain the target threshold range; performing regression analysis on the above-mentioned system log data based on the above-mentioned target threshold range to determine the above-mentioned first detection result, and / or, detecting the above-mentioned system log data according to a predetermined keyword dictionary to determine the above-mentioned first detection result, wherein the above-mentioned first detection result is used to indicate whether the above-mentioned system log data has an abnormality.

[0059] Optionally, in an embodiment of the present application, the long short-term memory network model refers to a deep learning model applied to time series data processing, including but not limited to LSTM (Long Short-Term Memory) network, which can capture long-term dependencies in data and is suitable for the analysis of sequence data such as system logs. The keyword dictionary refers to a predefined set of vocabulary related to security events, including but not limited to "error", "failed", "warning", etc., which is used to quickly screen potential anomalies in system logs.

[0060] It should be noted that the above-mentioned outlier detection operation can be implemented through a variety of technologies, such as statistical methods, machine learning models, data mining technology, etc., and this application does not limit this. The processing method of the above-mentioned system log data can also be diversified, such as using a time sliding window statistical method combined with LSTM for prediction, or using keyword matching combined with a rule engine for real-time monitoring. The selection of specific technical solutions should be based on the characteristics of the log data and the needs of security detection.

[0061] In an exemplary embodiment, after the system log data is collected by the lightweight security agent service, the operation and maintenance management platform inputs the log data into the long short-term memory network model, which is trained to predict the fluctuation range of the log data under normal operation, that is, the target threshold range. Once the actual data of the system log exceeds the preset threshold, it is regarded as an anomaly, triggering the generation of the first detection result. At the same time, the system will also quickly screen the log data through the keyword dictionary. If a log entry containing a high-risk keyword is found, the first detection result will be immediately generated, indicating the existence of a security anomaly.

[0062] Through the embodiments of the present application, a combination of long short-term memory network model processing system log data and keyword dictionary detection is adopted to achieve efficient identification and positioning of abnormal behaviors in system log data, thereby achieving the purpose of reducing security risks and improving operation and maintenance efficiency, and ensuring the safe and stable operation of terminal devices.

[0063] As an optional scheme, the above-mentioned decision tree detection operation is performed on the network traffic data in the above-mentioned operation data to determine the second detection result, including: performing an eigenvalue decomposition operation on the above-mentioned network traffic data to obtain a target feature vector related to the traffic behavior; using a pre-trained decision tree model to process the above-mentioned target feature vector to obtain similar network traffic data; clustering the above-mentioned similar network traffic data to obtain the above-mentioned second detection result, wherein the above-mentioned second detection result is used to indicate whether there is abnormal traffic in the above-mentioned network traffic data; in the case that the above-mentioned network traffic data includes network captured data packets, the above-mentioned network captured data packets are converted into image data, and cluster analysis is performed on the above-mentioned image data to obtain the above-mentioned second detection result.

[0064] Optionally, in an embodiment of the present application, the above-mentioned network traffic data refers to the data information generated by the terminal device in the network communication, including but not limited to the source address, destination address, protocol type, packet size, timestamp, etc. The above-mentioned eigenvalue decomposition operation is to convert the network traffic data into multiple numerical values ​​that describe its behavioral characteristics, and the target feature vector is a collection of these features, which can systematically reflect the characteristics of the network traffic. The above-mentioned pre-trained decision tree model is used to identify abnormal network behavior. By analyzing the target feature vector, network traffic data similar to known abnormal patterns can be found. Cluster analysis is to further group similar network traffic data on the basis of similar network traffic data, so that the data in each group has a high degree of similarity, so as to detect whether there is an abnormal traffic pattern.

[0065] It should be noted that there are many methods for processing and analyzing network traffic data, such as support vector machine (SVM), neural network (NN), random forest (RF), etc., which are not limited in this application. Eigenvalue decomposition can be based on different traffic indicators, and the specific algorithms of decision tree model and cluster analysis can also be selected according to actual needs.

[0066] In an exemplary embodiment, a lightweight security agent service continuously monitors network traffic on a terminal device, collects detailed network data and performs eigenvalue decomposition to generate a target feature vector. The operation and maintenance management platform then processes these feature vectors using a pre-trained decision tree model to identify network traffic data similar to known abnormal patterns. Further, similar traffic is grouped through cluster analysis to determine whether there is abnormal traffic behavior. If the network traffic data contains network capture data packets (pcap packets), the data packets are converted into image data, and additional cluster analysis is performed using image processing technology to detect anomalies in the network in a more intuitive way.

[0067] Through the embodiments of the present application, network traffic data is detected by means of eigenvalue decomposition, decision tree model processing and cluster analysis, which realizes the precise identification and early warning of abnormal behavior in the network traffic of terminal devices, achieves the purpose of real-time monitoring of network status and protecting the system from network threats, and effectively improves the security and efficiency of overall operation and maintenance.

[0068] As an optional scheme, the above-mentioned determination of whether the target event has occurred in the above-mentioned terminal device based on the above-mentioned first detection result and the above-mentioned second detection result includes at least one of the following: when the above-mentioned first detection result indicates whether there is an abnormal log in the above-mentioned system log data, it is determined that the above-mentioned target event has occurred in the above-mentioned terminal device; when the above-mentioned second detection result indicates that there is abnormal traffic in the above-mentioned network traffic data, it is determined that the above-mentioned target event has occurred in the above-mentioned terminal device.

[0069] Optionally, in an embodiment of the present application, the above-mentioned first detection result refers to the analysis conclusion obtained after performing an outlier detection operation on the system log data, indicating whether the system log data contains abnormal behavior or signs of security incidents; the above-mentioned second detection result refers to the network activity security status determined after performing a decision tree detection operation on the network traffic data, determining whether there is abnormal traffic in the network traffic data.

[0070] It should be noted that the logic for determining whether a target event has occurred on a terminal device can be adjusted according to specific application scenarios and security policies, and this application does not limit this.

[0071] For example, the system may be set to trigger an incident response only when both the first detection result and the second detection result indicate an abnormality, or it may adopt a more cautious strategy and initiate the incident investigation process even if only one result indicates an abnormality.

[0072] In an exemplary embodiment, after receiving the operation data returned by the lightweight security agent service, the security operation and maintenance system first processes the system log data and the network flow data to generate a first detection result and a second detection result. If the first detection result indicates that an abnormal log entry has appeared in the system log data, or the second detection result confirms that there is abnormal flow in the network flow data, the system will immediately determine that the terminal device may have suffered a target event, such as malware infection, unauthorized access or data leakage. Subsequently, the system will initiate the corresponding event processing process, including generating an alarm message, triggering security policy adjustment or initiating an emergency response plan, etc., to quickly isolate and resolve security issues.

[0073] Through the embodiment of the present application, a two-layer protection method of performing outlier detection on system log data and decision tree detection on network traffic data is adopted, which realizes timely detection and early warning of terminal device security incidents, and achieves the purpose of improving the overall security protection capability of the system and reducing the impact of security threats.

[0074] As an optional scheme, the above-mentioned generating an alarm message according to the target event when the target event exists includes: when the target event exists, determining at least one of the file path and the process path related to the target event; determining the event type of the target event based on the file path and / or the process path; and generating the alarm message according to the event type.

[0075] Optionally, in the embodiment of the present application, the above target event refers to any behavior or abnormal situation detected on the terminal device that is inconsistent with the security policy, including but not limited to malware infection, unauthorized access attempts, network attacks, etc. The above file path and process path refer to the specific location information related to the target event on the terminal device. The file path points to the file that may contain malicious code, and the process path points to the process that performs abnormal operations.

[0076] In an exemplary embodiment, when the lightweight security agent service detects a target event on a terminal device, such as an abnormal file access pattern or suspicious network traffic, the operation and maintenance management platform immediately analyzes the event details to determine the file path or process path related to the target event. Further, the event type is determined based on the path information.

[0077] For example, if the file path matches the characteristics of known malware, the event type may be defined as "malware infection". Subsequently, the system generates a detailed alert message according to the event type, including the event description, timestamp, specific information about the file or process that triggered the event, and recommended countermeasures. The alert message will be notified to operation and maintenance personnel and system administrators in a timely manner through multiple channels, such as interactive platforms, email systems, and SMS services, to ensure a quick response.

[0078] Through the embodiments of the present application, an event type determination mechanism based on file path and process path is adopted to achieve refined early warning of security incidents, achieve the purpose of improving response efficiency and reducing the impact of incidents, and provide important technical support for building a stable and secure operation and maintenance environment.

[0079] As an optional solution, the above method also includes: when the above event type is a file alarm type, controlling the operation and maintenance management platform to send monitoring instructions to the above terminal device through the above lightweight security agent service to obtain the system environment information of the above terminal device, and storing the above system environment information in the log file under the alarm record directory, wherein the above system environment information includes the process information currently running on the above terminal device.

[0080] Optionally, in an embodiment of the present application, the above event type refers to a label used by the security operation and maintenance system to classify the target event, and the above file alarm type is one of them, which indicates that there are abnormal behaviors or potential security issues in the files or directories on the terminal device. The operation and maintenance management platform is the core component for centralized processing and distribution of security instructions, and is responsible for executing the response process of file alarm events. The lightweight security proxy service is a front-end component on the terminal device, which is used to receive and execute instructions sent by the operation and maintenance management platform to ensure real-time acquisition of necessary system environment information.

[0081] It should be noted that the scope and frequency of obtaining system environment information can be adjusted according to specific security policies and resource consumption. In addition to the information of running processes, system environment information can also be extended to CPU usage, memory status, network connection status, etc. This application does not limit this, and aims to provide an extensible and flexible event response mechanism.

[0082] In an exemplary embodiment, when the operation and maintenance management platform receives a file alarm event, it will immediately generate a monitoring instruction and send it to the terminal device through a lightweight security agent service. After receiving the instruction, the agent service quickly collects the current system environment information of the terminal device, especially the list of running processes, including process ID, name, resource usage, etc. This information is then recorded in the log file under the alarm record directory to facilitate subsequent event analysis and auditing. Ensure that the operation and maintenance personnel can obtain a complete system environment snapshot when the file alarm occurs, so as to more accurately determine the cause and scope of the event.

[0083] Through the embodiments of the present application, a technology is adopted to automatically obtain and store system environment information after a file alarm event is triggered, thereby achieving a detailed record of the system status when the event occurs, thereby achieving the purpose of improving the accuracy of event response and facilitating the tracking and analysis of security incidents, and providing key support for building a safer and controllable operation and maintenance system.

[0084] As an optional solution, the above method also includes: when the above event type is a process alarm type and the same historical alarm type is obtained, the above system environment information is stored in the above log file, and the target processing script is called to process the above target event, wherein the above target processing script is used to execute a preset repair operation to repair the system error caused by the above target event; when the above event type is the above process alarm type and the same historical alarm type is not obtained, the reverse proxy server forwarding weight of the above terminal device is set to 0 through the above lightweight security proxy service.

[0085] Optionally, in an embodiment of the present application, the above-mentioned process alarm type refers to an anomaly or security threat associated with a process running on a terminal device detected by a security operation and maintenance system, including but not limited to the launch of an illegal process, abnormal behavior with high resource consumption, identification of known malicious behavior, etc. System environment information covers the comprehensive status of the terminal device during operation, including but not limited to CPU usage, memory usage, network connection status, and currently active processes. The target processing script is a predefined series of operating instructions designed to automatically repair or mitigate system errors caused by process alarm events, such as terminating a process, restarting a service, or adjusting the system configuration. As a front-end component on the terminal device, the lightweight security proxy service is responsible for executing instructions sent by the operation and maintenance management platform, including dynamic adjustment of the forwarding weight of the reverse proxy server.

[0086] It should be noted that the generation and execution process of the above target processing script can be customized according to actual operation and maintenance requirements and security policies, which can be a simple one-step operation or a complex multi-step process. At the same time, the adjustment strategy of the forwarding weight of the reverse proxy server should also consider the balance between business continuity and security. This application does not limit this, and aims to provide a flexible, efficient and automated event response mechanism.

[0087] In an exemplary embodiment, when the security operation and maintenance system identifies a process alarm event on a terminal device and matches the same event type through the historical alarm database, the operation and maintenance management platform will automatically execute the target processing script corresponding to the event type. Before the script is executed, the system environment information is recorded in the log file for subsequent analysis. If no matching event is found in the historical alarm database, in order to prevent the spread of potential security risks, the operation and maintenance management platform will use a lightweight security proxy service to set the reverse proxy server forwarding weight of the terminal device to 0, thereby temporarily isolating the device until manual review and processing are completed.

[0088] Through the embodiments of the present application, an intelligent response based on a historical alarm database and a dynamic adjustment strategy of the forwarding weight of the reverse proxy server are adopted to realize automatic processing and isolation of process alarm events, thereby achieving the purpose of improving security, ensuring system stability and reducing the workload of operation and maintenance personnel, and providing the necessary technical support for building a modern, intelligent operation and maintenance system.

[0089] In an exemplary embodiment, the event detection method proposed in this application can be applied to a lightweight security operation and maintenance system. Specifically, in the traditional operation and maintenance environment, servers are mainly managed manually. As the number and types of server hosts continue to increase, the operation and maintenance management system is difficult to expand and be compatible, and the maintenance cost continues to increase. At the same time, manual operation is prone to omissions, low efficiency and easy to cause safety hazards.

[0090] Based on this, the lightweight security operation and maintenance system designed and implemented by the embodiment of the present application is deployed in an isolated network environment, and the identity and authority authentication of the logged-in user is uniformly implemented, and automated operation and maintenance, centralized configuration monitoring, log management and security policies are realized. The hosts in the hybrid environment are efficiently managed to ensure consistency, improve security, and enhance the flexibility and controllability of operation and maintenance.

[0091] For example, Figure 3 is a schematic diagram of an optional event detection method according to an embodiment of the present application, such as Figure 3 As shown, the system architecture includes a lightweight security agent and a centralized management platform.

[0092] S1, lightweight security agent: deploy a lightweight security agent on each protected device, which is responsible for collecting system and network activity data, performing preliminary security analysis and processing, and executing instructions from the operation and maintenance management platform. The design of the agent emphasizes low resource usage and high efficiency, and supports multiple operating systems and platforms. The lightweight security agent can be implemented based on Python, using Python's basic library to send Linux commands and process results.

[0093] Furthermore, the security agent can be divided into the client side and the server side. The client side is used to run continuously in the system background using a loop on the host, with a sampling frequency of 10 seconds for collection. For monitoring information of more than one day, only the sampling frequency of 1 minute is saved, and it is retained for a maximum of 30 days. The python script is called through the shell of the operating system, which is divided into start, stop and status query. When the system resource utilization rate is high and the CPU utilization rate reaches 95%, the agent process will be automatically terminated. When the resource utilization rate returns to normal or is lower than 90%, the agent process will be restarted. The information collected by the agent process is broadcasted back to the server-side agent of the operation and maintenance management platform through socket programming based on the UDP protocol. The operation and maintenance management platform runs the server side of the agent, and confirms the survival status of the agent by sending heartbeat packets to the agent of the host at regular intervals. If the agent is offline for more than 5 minutes, an alarm message will be sent to the administrator, and the online status of the agent will be displayed in the system.

[0094] S2, centralized management platform: The management platform consists of three parts: interactive platform, operation and maintenance management platform and log monitoring and analysis platform. The three platform modules cooperate with each other, have efficient data processing capabilities and a friendly user interface, and support real-time monitoring and report generation.

[0095] Specifically, users access the security operation and maintenance system through the interactive platform. The operation and maintenance management platform is the core of the security operation and maintenance system. As the hub of system information exchange, it not only processes commands but also forwards data. The log monitoring and analysis platform is used to analyze the collected information and detailed information of the logs.

[0096] For example, Figure 4 is a schematic diagram of another optional event detection method according to an embodiment of the present application, such as Figure 4 As shown:

[0097] S1, Interactive Platform: The interactive platform directly interacts with the operation and maintenance personnel, receives the user's operation and maintenance input, and displays the functional output of the security operation and maintenance system, including user information permissions, host information visualization, and operation and maintenance history. The operation and maintenance personnel enter the username and password on the operation and maintenance host to log in, and use the mobile phone number for two-factor authentication to enter the security operation and maintenance system. The homepage of the interactive platform will display the list of managed hosts according to the user's permissions. When you need to log in to a specific host, since the password has been collected and managed by the platform, you only need to select the username to log in. If a two-person review mechanism is configured, when clicking on login, a high-authority person needs to enter his or her username and instant token (updated every 30 seconds) to confirm that the operation is legal before logging in normally. The interactive platform does not need to be restricted to logging in within the intranet, and can satisfy logins within the intranet, the Internet, and the operation and maintenance computer room.

[0098] S2, Operation and Maintenance Management Platform: The operation and maintenance management platform handles the actual functions of host operation and maintenance, including specific operations such as host login, file upload, and execution of automated operation and maintenance scripts. The interactive platform only sends requests. In order to meet various access requests, it is not appropriate to involve specific business logic. Identity authentication and authorization verification are all implemented through the operation and maintenance management platform. In addition to collecting the collected data sent back by the agent, the traffic mirror is forwarded to the log monitoring platform for more comprehensive detection and analysis. The operation and maintenance management platform verifies and checks the configuration scripts that need to be executed to increase the security of configuration operation.

[0099] S3, log monitoring and analysis platform: The log monitoring and analysis platform aggregates data from various security agents through bypass monitoring to conduct comprehensive security analysis, event detection and response. The collected data of the host is recorded in the form of logs. When it needs to be displayed, the logs are converted into charts using Python and sent to the interactive platform. Only text information is saved in the backend to reduce file storage pressure. When a high-risk event is detected, information will also be sent to the interactive platform and automatically pushed to the administrator's mailbox and SMS platform.

[0100] For example, Figure 5 is a schematic diagram of another optional event detection method according to an embodiment of the present application, such as Figure 5 As shown, it includes four functions: automated operation and maintenance management, security policy management, event detection and response, and log management.

[0101] S1, Automated Operation and Maintenance Management: The interactive platform collects command sets and applies them to the operation and maintenance management platform, distributes the commands to the corresponding lightweight security agent and executes the user's uploaded instructions. Batch script execution: For the written shell and other operation and maintenance scripts, they are pushed to the host that needs to be executed through the lightweight security agent, and the scripts are executed in batches to achieve automated operation and maintenance.

[0102] S2, automated configuration deployment: For managed hosts, they are divided into groups according to the host type, and unified configuration management is performed for hosts of the same type. If changes are required, the configuration is first verified to confirm its legitimacy. The deployment script commands are preliminarily checked by matching common commands with regular expressions. By continuously improving the regular expression database and adding descriptive tags to the expressions, the encoder is used to embed and abstract the regular expressions, and then the decoder is used to establish a mapping with the tags. Contrastive learning is used to cluster commands with similar semantics in order to obtain better abstract results. When the model converges, a meta-expression for generating inspection commands is obtained to adapt to more variable configuration information. When the configuration command passes the code check, it is sent to the lightweight security agent to implement batch consistency changes.

[0103] Furthermore, for the specific execution of scripts and automated configurations, users are first required to create an operation script. After the script is written, it can be applied for release, and the estimated use time is long-term or short-term (for example, 1 month). The configuration items are written in yaml, and the template program is used to read yaml to directly generate the configuration execution code. The release process includes local review and process review. Local review is manually judged by highly authorized operation and maintenance personnel for rapid approval in emergency situations. Process review includes machine review and manual review. First, the above-mentioned regular expression and machine learning check command are used to perform a preliminary analysis of the script to determine whether the command is legal and whether there are high-risk operations. Then, according to the initially set personnel review process, the superior leader reviews it step by step. After the review is passed, the script can be executed. When the script is no longer used, you can apply to go offline.

[0104] S3, security policy management: The interactive platform collects configuration information, sends it to the operation and maintenance management platform for unified configuration, and pushes it to the lightweight security agent to complete the configuration. Policy definition: allows administrators to define and configure security policies, including access control, data protection, network isolation, etc. Policy application: automatically applies security policies to all protected devices and systems to ensure consistency and effectiveness.

[0105] S4, event detection and response: lightweight security agent completes data collection and sends it to the operation and maintenance management platform at regular intervals. After the log monitoring and analysis platform obtains the data, it analyzes and detects the traffic. Anomaly detection: Detect abnormal activities by analyzing system logs, network traffic and behavior patterns. Use machine learning algorithms for behavior analysis to identify potential security threats. For log analysis, it is mainly carried out by outlier detection. Since the collected hosts are mainly serialized time series numbers, a threshold range can be generated for the expected log results according to LSTM, and regression analysis can be performed on the data. When the collected data deviates significantly from the threshold, an alarm is issued. For command execution logs, special keywords are detected and alarmed by building a keyword dictionary. For network traffic, it is mainly analyzed by decision trees. First, the traffic is decomposed by eigenvalues, and then multiple decision trees are combined to dynamically calculate the weight of each decision tree, cluster similar traffic, and analyze whether there is abnormal traffic in the traffic. For pcap packets, it can also be converted into images, and the contents of the payload can be analyzed and clustered to determine whether there is unreasonable traffic.

[0106] S5, automatic response: configure the automatic response mechanism. When a security event is detected, the log monitoring and analysis platform automatically pushes alarm information to the interactive platform, including the alarm content and the located file path or process path. The alarm information is displayed in the display interface in the form of a notification, and emails and text messages are sent to the host operation and maintenance personnel and system administrators. The alarm information is sent to the operation and maintenance management platform at the same time. The operation and maintenance management platform adopts different processing procedures for file alarms and process alarms. For file alarms, the operation and maintenance management platform pushes instructions to the agent to query the running processes, CPU memory and other environmental information in the system and record them in the log file under the alarm record directory, which is convenient for subsequent event analysis and location. If the alarm information is that there is a dangerous process, in addition to recording the basic information of the current host, the alarm is automatically processed by keyword matching. If the same alarm can be matched in the operation manual, the script is directly used for process processing; if the corresponding historical alarm information cannot be matched, the operation and maintenance management platform will set the nginx forwarding weight of the dangerous host to 0 through the agent to prevent the risk on the dangerous host from spreading to other hosts. After that, the operation and maintenance personnel will manually process it and enter the process into the operation manual. Each time a new process alarm is processed, it is entered into the operation manual to form a processing script, and the host forwarding and network disconnection operations are avoided as much as possible to reduce the impact on other processes on the host.

[0107] S6, Log Management: The log monitoring and analysis platform categorizes and organizes all processed information and displays it on the interactive platform. Log collection and analysis: Centrally collect and analyze logs from various devices to generate detailed security reports and trend analysis. Including host login frequency, risk operation information, and display the security of the host in the form of data to facilitate better management of the host. Data text visualization is achieved through Python and visualization libraries. Log storage and archiving: Provide a secure log storage and archiving mechanism to support long-term storage and query of logs. Record and store the host's operation information to facilitate the future audit of previous operations through log archives to trace back specific operation steps, restore the scene where the problem occurred, and solve the problem faster.

[0108] In general, the embodiments of the present application realize efficient data processing, adopt efficient data processing and storage technology, use memory database and distributed computing to improve the response speed and processing power of the system. And data encryption is performed: the transmitted and stored data is encrypted to ensure the confidentiality and integrity of the data. Lightweight security agents and management platforms are designed to optimize resource usage and ensure that the system can run normally even in a low-resource environment. And load balancing is taken into account: the system bottleneck is mainly in the operation and maintenance management platform. By isolating the display platform from the operation and maintenance management platform, the load of the operation and maintenance management platform is reduced. At the same time, multiple hosts are configured to form the operation and maintenance management platform to ensure efficient and stable operation of the system.

[0109] In addition, the traffic data is combined with machine learning models and outlier detection to determine whether there is abnormal traffic. At the same time, the log files are matched with keywords and an alarm dictionary is designed, such as error, failed and other keywords. A simple and intuitive user interface is also provided to facilitate administrators to configure, monitor and view reports. Through visualization functions such as charts and dashboards, administrators can quickly understand the security situation and operation and maintenance status.

[0110] Through the embodiments of this application, a lightweight security agent and an optimized data processing mechanism are used to significantly reduce the occupation of system resources, reduce hardware investment and operation and maintenance costs; it also integrates functions such as event detection and response, vulnerability management, security policy management and log management, which can meet the comprehensive needs of modern information systems for security and operation and maintenance management; and it focuses on simplifying the deployment and maintenance process, so that administrators only need to perform a small amount of configuration to achieve comprehensive security protection. The use of automatic response mechanisms and efficient data processing capabilities enables the system to quickly respond to security threats and reduce potential security risks.

[0111] It is understandable that in the specific implementation of this application, related data such as user information is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0112] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0113] According to another aspect of the embodiments of the present application, an event detection device for implementing the above event detection method is also provided. Figure 6 As shown, the device comprises:

[0114] A deployment module 602, used to deploy a lightweight security proxy service on a terminal device;

[0115] The collection module 604 is used to collect the operation data of the terminal device through a lightweight security agent service;

[0116] An execution module 606 is used to perform an outlier detection operation on the system log data in the operation data to determine a first detection result, and to perform a decision tree detection operation on the network traffic data in the operation data to determine a second detection result;

[0117] A determination module 608, configured to determine whether a target event occurs on the terminal device based on the first detection result and the second detection result;

[0118] The generation module 610 is used to generate an alarm message according to the target event when the target event exists, wherein the alarm message includes at least one of the file path and process path that caused the target event to occur, and the file path and process path are used to locate the source and impact scope of the target event.

[0119] As an optional solution, the above-mentioned device is used to perform an outlier detection operation on the system log data in the running data to determine a first detection result in the following manner: processing the system log data according to the long short-term memory network model to obtain a target threshold range; performing regression analysis on the system log data based on the target threshold range to determine the first detection result, and / or detecting the system log data according to a predetermined keyword dictionary to determine the first detection result, wherein the first detection result is used to indicate whether there is an abnormality in the system log data.

[0120] As an optional solution, the above-mentioned device is used to determine the second detection result by performing a decision tree detection operation on the network traffic data in the running data in the following manner: performing an eigenvalue decomposition operation on the network traffic data to obtain a target feature vector related to the traffic behavior; using a pre-trained decision tree model to process the target feature vector to obtain similar network traffic data; clustering the similar network traffic data to obtain a second detection result, wherein the second detection result is used to indicate whether there is abnormal traffic in the network traffic data; when the network traffic data includes network captured data packets, converting the network captured data packets into image data, performing cluster analysis on the image data, and obtaining a second detection result.

[0121] As an optional scheme, the above-mentioned device is used to determine whether the target event has occurred in the terminal device based on the first detection result and the second detection result in the following manner, including at least one of the following: when the first detection result indicates whether there is an abnormal log in the system log data, it is determined that the target event has occurred in the terminal device; when the second detection result indicates that there is abnormal traffic in the network traffic data, it is determined that the target event has occurred in the terminal device.

[0122] As an optional solution, the above-mentioned device is used to generate an alarm message based on the target event when the target event exists in the following manner: when the target event exists, determine at least one of the file path and process path related to the target event; determine the event type of the target event based on the file path and / or process path; and generate an alarm message according to the event type.

[0123] As an optional solution, the above-mentioned device is also used to: when the event type is a file alarm type, control the operation and maintenance management platform to send monitoring instructions to the terminal device through a lightweight security agent service to obtain the system environment information of the terminal device, and store the system environment information in a log file under the alarm record directory, wherein the system environment information includes the process information currently running on the terminal device.

[0124] As an optional solution, the above-mentioned device is also used to: when the event type is a process alarm type and the same historical alarm type is obtained, the system environment information is stored in a log file, and the target processing script is called to process the target event, wherein the target processing script is used to execute a preset repair operation to repair the system error caused by the target event; when the event type is a process alarm type and the same historical alarm type is not obtained, the reverse proxy server forwarding weight of the terminal device is set to 0 through a lightweight security proxy service.

[0125] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0126] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0127] According to one aspect of the present application, a computer program product is provided. The computer program product includes a computer program.

[0128] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0129] Figure 7 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0130] It should be noted that Figure 7 The computer system 700 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0131] like Figure 7 As shown, the computer system 700 includes a central processing unit 701 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 702 (ROM) or the program loaded from the storage part 708 to the random access memory 703 (RAM). Various programs and data required for system operation are also stored in the random access memory 703. The central processing unit 701, the read-only memory 702 and the random access memory 703 are connected to each other through a bus 704. An input / output interface 705 (Input / Output interface, i.e., I / O interface) is also connected to the bus 704.

[0132] The following components are connected to the input / output interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed so that a computer program read therefrom is installed into the storage section 708 as needed.

[0133] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processor 701, various functions defined in the system of the present application are executed.

[0134] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processor 701, various functions provided by the embodiment of the present application are performed.

[0135] According to another aspect of the embodiment of the present application, an electronic device for implementing the above event detection method is also provided. The electronic device may be Figure 1 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a terminal device as an example. Figure 8 As shown, the electronic device includes a memory 802 and a processor 804. The memory 802 stores a computer program, and the processor 804 is configured to execute the steps in any of the above method embodiments through the computer program.

[0136] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0137] Optionally, in this embodiment, the above-mentioned processor can be configured to execute the methods in each embodiment of the present application through a computer program.

[0138] Alternatively, a person skilled in the art may understand that: Figure 8 The structure shown is for illustration only. Figure 8 The structure of the electronic device is not limited. Figure 8 More or fewer components (such as network interfaces, etc.) as shown in, or with Figure 8 Different configurations are shown.

[0139] Among them, the memory 802 can be used to store software programs and modules, such as the program instructions / modules corresponding to the event detection method and device in the embodiments of the present application. The processor 804 executes various functional applications and data processing by running the software programs and modules stored in the memory 802, that is, to implement the above-mentioned event detection method. The memory 802 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 802 may further include a memory remotely located relative to the processor 804, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 802 can be specifically, but not limited to, used to store information such as operating data. As an example, such as Figure 8 As shown, the memory 802 may include but is not limited to the deployment module 602, the collection module 604, the execution module 606 and the determination module 608 in the event detection device. In addition, it may also include but is not limited to other module units in the event detection device, which will not be repeated in this example.

[0140] Optionally, the transmission device 806 is used to receive or send data via a network. Specific examples of the network may include wired networks and wireless networks. In one example, the transmission device 806 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 806 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0141] In addition, the electronic device further includes: a display 808 for displaying the alarm message; and a connection bus 810 for connecting various module components in the electronic device.

[0142] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. The nodes may form a peer-to-peer network, and any form of computing device, such as a server, terminal or other electronic device, may become a node in the blockchain system by joining the peer-to-peer network.

[0143] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the event detection method provided in various optional implementations of the above-mentioned event detection aspects.

[0144] Optionally, in this embodiment, the above-mentioned computer-readable storage medium can be configured to store data for executing the methods in various embodiments of the present application.

[0145] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0146] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0147] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for one or more electronic devices to execute all or part of the steps of the methods described in each embodiment of the present application.

[0148] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0149] In the several embodiments provided in the present application, it should be understood that the disclosed application can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0150] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0151] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0152] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An event detection method, characterized in that: include: Deploy lightweight security proxy services on terminal devices; Collecting the operation data of the terminal device through the lightweight security agent service; Performing an outlier detection operation on the system log data in the operation data to determine a first detection result, and performing a decision tree detection operation on the network traffic data in the operation data to determine a second detection result; Determine whether a target event occurs on the terminal device based on the first detection result and the second detection result; In the event that the target event exists, an alarm message is generated according to the target event, wherein the alarm message includes at least one of a file path and a process path that caused the target event to occur, and the file path and the process path are used to locate the source and impact scope of the target event.

2. The method according to claim 1, characterized in that The performing an outlier detection operation on the system log data in the operation data to determine a first detection result includes: Processing the system log data according to the long short-term memory network model to obtain a target threshold range; The system log data is subjected to regression analysis based on the target threshold range to determine the first detection result, and / or the system log data is detected according to a predetermined keyword dictionary to determine the first detection result, wherein the first detection result is used to indicate whether the system log data has an abnormality.

3. The method according to claim 1, characterized in that The step of performing a decision tree detection operation on the network traffic data in the operation data to determine a second detection result includes: Performing an eigenvalue decomposition operation on the network traffic data to obtain a target eigenvector related to the traffic behavior; Processing the target feature vector using a pre-trained decision tree model to obtain similar network traffic data; Clustering the similar network traffic data to obtain the second detection result, wherein the second detection result is used to indicate whether there is abnormal traffic in the network traffic data; In the case where the network traffic data includes network captured data packets, the network captured data packets are converted into image data, and cluster analysis is performed on the image data to obtain the second detection result.

4. The method according to any one of claims 1 to 3, characterized in that The determining whether a target event occurs on the terminal device based on the first detection result and the second detection result includes at least one of the following: In a case where the first detection result indicates whether the system log data has an abnormal log, determining that the target event has occurred on the terminal device; When the second detection result indicates that abnormal traffic exists in the network traffic data, it is determined that the target event has occurred in the terminal device.

5. The method according to claim 1, characterized in that When the target event exists, generating an alarm message according to the target event includes: In the case where the target event exists, determining at least one of the file path and the process path related to the target event; Determine the event type of the target event based on the file path and / or the process path; The warning message is generated according to the event type.

6. The method according to claim 5, characterized in that The method further comprises: When the event type is a file alarm type, the control operation and maintenance management platform sends a monitoring instruction to the terminal device through the lightweight security agent service to obtain the system environment information of the terminal device, and stores the system environment information in the log file under the alarm record directory, wherein the system environment information includes the process information currently running on the terminal device.

7. The method according to claim 5, characterized in that The method further comprises: When the event type is a process alarm type and the same historical alarm type is obtained, the system environment information is stored in the log file, and a target processing script is called to process the target event, wherein the target processing script is used to perform a preset repair operation to repair the system error caused by the target event; When the event type is the process alarm type and the same historical alarm type is not obtained, the reverse proxy server forwarding weight of the terminal device is set to 0 through the lightweight security proxy service.

8. An event detection system, characterized in that: include: Lightweight security agent module, used to collect operation data of terminal devices and execute instructions sent by the operation and maintenance management platform; The operation and maintenance management platform module is used to manage user access rights, handle command distribution and traffic mirroring; a log monitoring and analysis platform module, configured to perform an outlier detection operation on the system log data in the operation data to determine a first detection result, and perform a decision tree detection operation on the network traffic data in the operation data to determine a second detection result; The automated operation and maintenance module performs batch script execution and automated configuration deployment on the terminal devices according to system operation instructions and configuration scripts; An event detection response module, configured to determine whether a target event has occurred on the terminal device based on the first detection result and the second detection result; In the event that the target event exists, an alarm message is generated according to the target event, wherein the alarm message includes at least one of a file path and a process path that caused the target event to occur, and the file path and the process path are used to locate the source and impact scope of the target event.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein the computer program can be executed by an electronic device to perform the method described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.

11. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 7 through the computer program.

Images