Data detection method and device, electronic equipment and storage medium
By collecting and classifying container behavior data in real time, conducting behavior baseline learning and detection, the false positives and blind spots of static rule detection solutions in cloud-native environments are solved, and more efficient security detection is achieved.
Patent Information
- Application Number
- CN202411829824.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-12
- Publication Date
- 2025-04-18
AI Technical Summary
In the prior art, data detection schemes based on static rules cannot be effectively adapted in a dynamic cloud-native environment, resulting in a large number of false alarms and security detection blind spots, which in turn causes immeasurable losses to users.
By collecting container behavior data in real time within the preset period when container creation is completed, classifying the data in service business types based on spatial naming identification, conducting behavior baseline learning to determine behavior baseline data, and performing data detection on the current container behavior data, there is no need to configure static rules on the container.
This greatly reduces the number of false alarms, effectively avoids the blind spots of security detection, and ensures user safety.
Smart Images
Figure CN119848828A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present invention relate to the field of computer security technology, and in particular to a data detection method, device, electronic device and storage medium. Background Art
[0002] With the widespread adoption of cloud-native technologies, containerized applications are becoming more and more common in cloud computing. However, while containerized applications provide flexibility and scalability, they also bring security challenges, especially in monitoring and detecting abnormal behavior data.
[0003] In the prior art, static rules configured on containers are used to detect anomalies in behavioral data within containers. Traditional data detection solutions based on static rules cannot adapt to the dynamic cloud-native environment and often lead to a large number of false alarms, especially in scenarios with frequent updates and deployments. These false alarms lead to blind spots in security detection and can easily cause immeasurable losses to users. Summary of the invention
[0004] In view of this, in order to effectively alleviate the technical problem that false alarms exist in data detection schemes using static rules, resulting in blind spots in security detection and easily causing immeasurable losses to users, the embodiments of the present invention provide a data detection method, device, electronic device and storage medium.
[0005] In a first aspect, an embodiment of the present invention provides a method for data detection, the method comprising:
[0006] Collecting container behavior data of the container in real time within a preset period after the container is created, and obtaining a spatial naming identifier for each container behavior data;
[0007] Classify multiple container behavior data into service business types based on space naming identifiers;
[0008] For each service business type: conduct behavior baseline learning based on the container behavior data corresponding to the service business type to determine the behavior baseline data; wherein the behavior baseline data is the minimum benchmark data for evaluating that the container behavior data is normal;
[0009] The current container behavior data of the container is obtained, and data detection is performed on the behavior baseline data of the service business type corresponding to the current container behavior data.
[0010] In a possible implementation, multiple container behavior data are classified into service business types based on space naming identifiers, including:
[0011] Querying the service business type corresponding to the space naming identifier from the service business type query table; wherein the service business type query table stores the correspondence between the space naming identifier and the service business type;
[0012] The plurality of container behavior data are classified into service business types according to the correspondence between the space naming identifier and the service business type.
[0013] In a possible implementation, the behavior baseline learning is performed based on the container behavior data corresponding to the service business type to determine the behavior baseline data, including:
[0014] The container behavior data corresponding to the service business type is input into a pre-trained baseline learning model to obtain behavior baseline data; wherein the baseline learning model is a classification model.
[0015] In a possible implementation, data detection is performed on behavior baseline data of a service business type corresponding to current container behavior data, including:
[0016] Determine the data deviation value between the current container behavior data and the behavior baseline data;
[0017] Determine the data behavior score according to the data deviation value;
[0018] The current container behavior data is tested based on the data behavior score and the data source information of the current container behavior data.
[0019] In a possible implementation, the behavior baseline data includes process behavior baseline data, file behavior baseline data, and network behavior baseline data;
[0020] Determine the data deviation value between the current container behavior data and the behavior baseline data, including:
[0021] Obtain process behavior data, file behavior data, and network behavior data from current container behavior data;
[0022] Determining a first data deviation value based on the process behavior data and the process behavior baseline data;
[0023] Determine a second data deviation value based on the file behavior data and the file behavior baseline data;
[0024] A third data deviation value is determined based on the network behavior data and the network behavior baseline data.
[0025] In a possible implementation, determining the data behavior score according to the data deviation value includes:
[0026] The data behavior score is determined based on the first data deviation value, the preset behavior weight value, the second data deviation value, the preset file behavior weight value, the third data deviation value, the preset network behavior weight value and the preset initial value.
[0027] In a possible implementation, performing data detection on the current container behavior data based on the data behavior score and the data source information of the current container behavior data includes:
[0028] Determine whether the data behavior score exceeds the preset alarm threshold corresponding to the service business type;
[0029] When it is determined that the data behavior score does not exceed the preset alarm threshold, determining whether the data source information is the preset data source information;
[0030] In the case where it is determined that the data source information is not the preset data source information, detecting that the current container behavior data is abnormal data;
[0031] When it is determined that the data behavior score exceeds a preset alarm threshold, or when it is determined that the data source information is preset data source information, the current container behavior data is detected as normal data.
[0032] In one possible implementation, the method further includes:
[0033] When it is detected that the current container behavior data is normal data, the current container behavior data is added to the whitelist.
[0034] In one possible implementation, the method further includes:
[0035] When the current container behavior data is detected to be abnormal data, an abnormal response operation is generated; wherein the abnormal response operation at least includes: a blocking operation, an alarm operation and an isolation operation.
[0036] In a second aspect, an embodiment of the present invention provides a data detection device, the device comprising:
[0037] An acquisition module, used to collect container behavior data of the container in real time within a preset period after the container is created, and obtain a spatial naming identifier of each container behavior data;
[0038] A classification module, used to classify multiple container behavior data into service business types based on space naming identifiers;
[0039] A determination module is used for: for each service business type: performing behavior baseline learning based on the container behavior data corresponding to the service business type, and determining the behavior baseline data; wherein the behavior baseline data is the minimum benchmark data for evaluating that the container behavior data is normal;
[0040] The detection module is used to obtain the current container behavior data of the container and perform data detection on the behavior baseline data of the service business type corresponding to the current container behavior data.
[0041] In a third aspect, an embodiment of the present invention provides an electronic device, which includes: a processor and a memory, the processor is used to execute a data detection program stored in the memory to implement the above-mentioned data detection method.
[0042] In a fourth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned data detection method.
[0043] The data detection method, device, electronic device and storage medium provided by the embodiments of the present invention include: collecting the container behavior data of the container in real time within a preset time period after the container is created, and obtaining the spatial naming identifier of each container behavior data; classifying multiple container behavior data into service business types based on the spatial naming identifier; for each service business type: performing behavior baseline learning based on the container behavior data corresponding to the service business type, and determining the behavior baseline data; obtaining the current container behavior data of the container, and performing data detection on the behavior baseline data of the service business type corresponding to the current container behavior data. In the above technical solution, data detection can be achieved without configuring static rules on the container. Compared with the prior art, this method greatly reduces the number of false alarms, effectively avoids the occurrence of security detection blind spots, and thus ensures user safety. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] Figure 1 A flow chart of an embodiment of a data detection method provided by an embodiment of the present invention;
[0045] Figure 2 A flow chart of another data detection method provided by an embodiment of the present invention;
[0046] Figure 3 A block diagram of an embodiment of a data detection device provided by an embodiment of the present invention;
[0047] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0049] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.
[0050] The present invention provides a method for data detection. Figure 1 , Figure 1 A flow chart of an embodiment of a data detection method provided by an embodiment of the present invention. Figure 1 The process shown may include the following steps:
[0051] Step 101, collecting container behavior data of the container in real time within a preset period after the container is created, and obtaining a spatial naming identifier of each container behavior data;
[0052] The above-mentioned preset time period can be set to 5 days, 7 days, 9 days, etc., which is not limited here. It is considered to be safer at the beginning of container creation. Therefore, the container behavior data within this period is collected for subsequent behavior baseline learning to obtain behavior baseline data that can be used to evaluate whether the container behavior data is abnormal.
[0053] In actual application, the collection of container behavior data can be achieved through the eBPF (Extended Berkeley Packet Filter) script program deployed on the container, where the container behavior data includes network traffic data, system call data and process data.
[0054] Among them, eBPF TC (Traffic Control) or XDP (eXpressData Path) is used at the network interface to collect network traffic data; by attaching eBPF probes to specific system calls (such as open, execve, etc.) to capture file, process and network related system call data; by monitoring the fork, exec and other system calls in the container, the creation and destruction information of the process in the container is collected, and the execution path and command parameters of each process and other process data are tracked.
[0055] When each container behavior data is collected based on the eBPF script program, a namespace identifier, namely a namespace ID (Identity, identity information), is attached to it for subsequent service business type classification.
[0056] Step 102, classifying the multiple container behavior data into service business types based on the space naming identifier;
[0057] In actual use, container behavior data of different service business types can be run in the same container. Since the data detection standards of different service business types are different, in this embodiment, all collected container behavior data need to be classified into service business types in order to determine which container behavior data correspond to each service business type, so as to be used for the subsequent determination of the behavior baseline data of each service business type.
[0058] Specifically, data classification can be performed by querying the service business type query table, that is, querying the service business type corresponding to the space naming identifier from the service business type query table; and classifying multiple container behavior data into service business types according to the correspondence between the space naming identifier and the service business type.
[0059] The service business type query table stores the correspondence between the space naming identifier and the service business type; for ease of understanding, as shown in Table 1, Table 1 takes the service business type including the network service business type and the database service business type as an example:
[0060] Table 1
[0061] Space naming logo Service business type 1122 / 1133 / 2134 Network service business type 1234 / 3241 / 4321 Database service business type
[0062] It should be noted that the above-listed correspondence between the space naming identifier and the service business type is only an example. The specific correspondence between the space naming identifier and the service business type can be set according to actual needs and is not limited here.
[0063] If the spatial naming identifier of container behavior data 1 is 1133, the spatial naming identifier of container behavior data 2 is 1234, the spatial naming identifier of container behavior data 3 is 1122, and the spatial naming identifier of container behavior data 4 is 3241, then it can be generally known from querying Table 1 that container behavior data 1 and container behavior data 3 are classified as network service business type data, while container behavior data 2 and container behavior data 4 are classified as database service business type data.
[0064] The specific service business type may also be other service businesses, which are not limited here.
[0065] Step 103, for each service business type: performing behavior baseline learning based on the container behavior data corresponding to the service business type to determine the behavior baseline data;
[0066] Among them, the behavior baseline data is the lowest benchmark data for evaluating whether the container behavior data is normal. It can be understood that when the container behavior data is lower than this behavior baseline data, it indicates that the container behavior data has abnormal operations that deviate from normal behavior. Conversely, it indicates that the container behavior data does not have abnormal operations that deviate from normal behavior, so as to perform data detection on whether subsequent data is abnormal.
[0067] The above-mentioned behavior baseline learning is to input the container behavior data corresponding to the service business type into a pre-trained baseline learning model to obtain the behavior baseline data.
[0068] The baseline learning model is a classification model, that is, the classification model is trained by using historical container behavior data labeled with behavior baseline data until the training reaches a training threshold or the number of training times to obtain the baseline learning model.
[0069] Step 104: obtain current container behavior data of the container, and perform data detection on behavior baseline data of the service business type corresponding to the current container behavior data.
[0070] It can be understood that after obtaining the current container behavior data, it is also necessary to first determine the service business type to which the current container behavior data belongs through the spatial naming identifier of the current container behavior data, and then analyze the current container behavior data with the behavior baseline data corresponding to the service business type to detect whether the current container behavior data is abnormal. During the data detection process, data detection can be achieved without configuring static rules on the container. This method greatly reduces the number of false alarms compared to the existing technology.
[0071] In actual application, the most recent container behavior data in the container can be collected at regular time windows (such as 5 minutes) for behavior baseline learning to dynamically adjust the behavior baseline data of each service business type. To ensure the accuracy of the behavior baseline data, some noise data (such as a large number of repeated non-critical system calls in a short period of time) can be filtered out. In addition, when the baseline is updated, ensure that the original behavior baseline data is not frequently replaced when the new data does not meet the conditions, thereby avoiding baseline drift and preventing inaccurate data detection.
[0072] The data detection method provided by the embodiment of the present invention includes: collecting the container behavior data of the container in real time within a preset time period after the container is created, and obtaining the spatial naming identifier of each container behavior data; classifying multiple container behavior data into service business types based on the spatial naming identifier; for each service business type: performing behavior baseline learning based on the container behavior data corresponding to the service business type, and determining the behavior baseline data; obtaining the current container behavior data of the container, and performing data detection on the behavior baseline data of the service business type corresponding to the current container behavior data. In the above technical solution, data detection can be achieved without configuring static rules on the container. Compared with the existing technology, this method greatly reduces the number of false alarms, effectively avoids the occurrence of security detection blind spots, and thus ensures user safety.
[0073] like Figure 2 As shown, as an optional implementation, as in the above method, step 104 performs data detection on the behavior baseline data of the service business type corresponding to the current container behavior data, including the following steps:
[0074] Step 201, determining the data deviation value between the current container behavior data and the behavior baseline data;
[0075] The above-mentioned behavior baseline data includes process behavior baseline data, file behavior baseline data and network behavior baseline data; for example, the process behavior baseline data for network service business types allows running nginx and php-fpm, a total of 2 processes, the file behavior baseline data only allows access to the directories / var / www / html / and / var / log / nginx / , a total of 2 file paths, and the network behavior baseline data only listens to port 80, port 443 and outbound access API whitelist ports (such as 10.0.0.1), a total of 3 network ports. The process behavior baseline data for database service business types only allows running nginx, a total of 1 process, the file behavior baseline data only allows access to the directory / var / www / html / , a total of 1 file path, and the network behavior baseline data only listens to port 80 and outbound access API whitelist ports (such as 10.0.0.1), a total of 2 network ports.
[0076] Then, when determining the data deviation value, it is necessary to determine the data deviation value corresponding to each behavior baseline data, that is, obtain the process behavior data, file behavior data and network behavior data from the current container behavior data; determine the first data deviation value based on the process behavior data and the process behavior baseline data; determine the second data deviation value based on the file behavior data and the file behavior baseline data; determine the third data deviation value based on the network behavior data and the network behavior baseline data.
[0077] Continuing with the previous example, if the current container behavior data contains 3 process behavior data, 6 file behavior data, and 4 network behavior data, and the current container behavior data belongs to network service business type data, then the first data deviation value between the process behavior data and the process behavior baseline data is 3-2=1, the second data deviation value between the file behavior data and the file behavior baseline data is 6-2=4, and the third data deviation value between the network behavior data and the network behavior baseline data is 4-3=1.
[0078] If the current container behavior data belongs to the data of the database service business type, then the first data deviation value is 3-1=2, the second data deviation value is 6-1=5, and the third data deviation value is 4-2=2.
[0079] Step 202, determining the data behavior score according to the data deviation value;
[0080] The data behavior score is a quantitative indicator used to characterize the degree of abnormality of the current container behavior data. It can be understood that the lower the data behavior score, the higher the degree of abnormality of the current container behavior data. Conversely, the higher the data behavior score, the lower the degree of abnormality of the current container behavior data.
[0081] The specific data behavior score determination process is: determine the data behavior score based on the first data deviation value, the preset behavior weight value, the second data deviation value, the preset file behavior weight value, the third data deviation value, the preset network behavior weight value and the preset initial value.
[0082] The above data behavior score calculation formula is: data behavior score = preset initial value - (process deduction score + file deduction score + network deduction score);
[0083] Among them, process deduction = preset behavior weight value * (first data deviation value / process behavior baseline data) * 100; file deduction = preset file behavior weight value * (second data deviation value / file behavior baseline data) * 100; network deduction = preset network behavior weight value * (third data deviation value / network behavior baseline data) * 100.
[0084] Step 203: Perform data detection on the current container behavior data based on the data behavior score and the data source information of the current container behavior data.
[0085] The specific data detection process can be achieved through steps A1 to A4:
[0086] Step A1, determining whether the data behavior score exceeds a preset alarm threshold corresponding to the service business type;
[0087] In actual application, the preset alarm thresholds corresponding to different service business types are all different. For example, the preset alarm threshold of the network service business type is 70 points, and the preset alarm threshold of the database service business type is 80 points.
[0088] Step A2, when it is determined that the data behavior score does not exceed the preset alarm threshold, determining whether the data source information is the preset data source information;
[0089] When the data behavior score does not exceed the preset alarm threshold, it means that there are security risks in the current container behavior data. In order to further determine whether it is caused by malicious behavior, it is necessary to further determine whether the data source information of the current container behavior data is the preset data source information. The preset data source information is preset information that characterizes that the data is from a normal source. For example, the preset data source information is business update information or test information.
[0090] The data source information can be obtained by parsing the current container behavior data.
[0091] Step A3, when it is determined that the data source information is not the preset data source information, detecting that the current container behavior data is abnormal data;
[0092] When the data source information of the current container behavior data is not the preset data source information, it means that the current container behavior data is behavior data generated by malicious behavior rather than behavior data caused by business update or test. Therefore, the current container behavior data is detected as abnormal data.
[0093] Step A4: when it is determined that the data behavior score exceeds the preset alarm threshold, or when it is determined that the data source information is the preset data source information, the current container behavior data is detected as normal data.
[0094] When the data behavior score exceeds the preset alarm threshold, it means that there is no security risk in the current container behavior data, or when the data source information of the current container behavior data is the preset data source information, it means that the current container behavior data is behavior data caused by business updates or tests. Therefore, the current container behavior data is detected to be normal data.
[0095] In actual application, when it is monitored that the current container behavior data is normal data, the current container behavior data can be added to the whitelist, so that when the current container behavior data is obtained again in the future, the current container behavior data can be determined to be normal data without performing the data detection process of this application, thereby effectively improving the data detection rate.
[0096] Furthermore, when the current container behavior data is detected to be abnormal data, an abnormal response operation is generated to timely discover and respond to abnormal data operation.
[0097] Among them, the abnormal response operation includes at least: blocking operation, alarm operation and isolation operation, among which the blocking operation is the operation of blocking the external connection of the container, the alarm operation is the operation of sending alarm information to the security personnel to prompt the security personnel to take corresponding measures to deal with the data abnormality, and the isolation operation is the operation of isolating the container for further behavior review. Real-time blocking and response to data abnormalities can timely maintain data security.
[0098] See also Figure 3 , is a block diagram of an embodiment of a data detection device provided by an embodiment of the present invention. Figure 3 As shown, the device comprises:
[0099] The acquisition module 301 is used to collect the container behavior data of the container in real time within a preset period after the container is created, and obtain the spatial naming identifier of each container behavior data;
[0100] A classification module 302, configured to classify the plurality of container behavior data into service business types based on the space naming identifier;
[0101] The determination module 303 is used for: for each service business type: performing behavior baseline learning based on the container behavior data corresponding to the service business type to determine the behavior baseline data; wherein the behavior baseline data is the minimum benchmark data for evaluating that the container behavior data is normal;
[0102] The detection module 304 is used to obtain current container behavior data of the container, and perform data detection on behavior baseline data of the service business type corresponding to the current container behavior data.
[0103] The data detection device provided by the embodiment of the present invention includes: collecting the container behavior data of the container in real time within a preset time period after the container is created, and obtaining the spatial naming identifier of each container behavior data; classifying multiple container behavior data into service business types based on the spatial naming identifier; for each service business type: performing behavior baseline learning based on the container behavior data corresponding to the service business type, and determining the behavior baseline data; obtaining the current container behavior data of the container, and performing data detection on the behavior baseline data of the service business type corresponding to the current container behavior data. In the above technical solution, data detection can be achieved without configuring static rules on the container. Compared with the existing technology, this method greatly reduces the number of false alarms, effectively avoids the occurrence of security detection blind spots, and thus ensures user safety.
[0104] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, Figure 4The electronic device 1200 shown includes: at least one processor 1201, a memory 1202, at least one network interface 1204 and other user interfaces 1203. The various components in the electronic device 1200 are coupled together via a bus system 1205. It is understood that the bus system 1205 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 1205 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 1205 is not described in detail. Figure 4 Various buses are labeled as bus system 1205.
[0105] The user interface 1203 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).
[0106] It can be understood that the memory 1202 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus random access memory (DRRAM). The memory 1202 described herein is intended to include, but is not limited to, these and any other suitable types of memory.
[0107] In some embodiments, the memory 1202 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 12021 and an application program 12022 .
[0108] The operating system 12021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 12022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 12022.
[0109] In the embodiment of the present invention, by calling the program or instruction stored in the memory 1202, specifically, the program or instruction stored in the application 12022, the processor 1201 is used to execute the method steps provided by each method embodiment, for example, including:
[0110] Collecting container behavior data of the container in real time within a preset period after the container is created, and obtaining a spatial naming identifier for each container behavior data;
[0111] Classify multiple container behavior data into service business types based on space naming identifiers;
[0112] For each service business type: conduct behavior baseline learning based on the container behavior data corresponding to the service business type to determine the behavior baseline data; wherein the behavior baseline data is the minimum benchmark data for evaluating that the container behavior data is normal;
[0113] The current container behavior data of the container is obtained, and data detection is performed on the behavior baseline data of the service business type corresponding to the current container behavior data.
[0114] In a possible implementation, multiple container behavior data are classified into service business types based on space naming identifiers, including:
[0115] Querying the service business type corresponding to the space naming identifier from the service business type query table; wherein the service business type query table stores the correspondence between the space naming identifier and the service business type;
[0116] The plurality of container behavior data are classified into service business types according to the correspondence between the space naming identifier and the service business type.
[0117] In a possible implementation, the behavior baseline learning is performed based on the container behavior data corresponding to the service business type to determine the behavior baseline data, including:
[0118] The container behavior data corresponding to the service business type is input into a pre-trained baseline learning model to obtain behavior baseline data; wherein the baseline learning model is a classification model.
[0119] In a possible implementation, data detection is performed on behavior baseline data of a service business type corresponding to current container behavior data, including:
[0120] Determine the data deviation value between the current container behavior data and the behavior baseline data;
[0121] Determine the data behavior score according to the data deviation value;
[0122] The current container behavior data is tested based on the data behavior score and the data source information of the current container behavior data.
[0123] In a possible implementation, the behavior baseline data includes process behavior baseline data, file behavior baseline data, and network behavior baseline data;
[0124] Determine the data deviation value between the current container behavior data and the behavior baseline data, including:
[0125] Obtain process behavior data, file behavior data, and network behavior data from current container behavior data;
[0126] Determining a first data deviation value based on the process behavior data and the process behavior baseline data;
[0127] Determine a second data deviation value based on the file behavior data and the file behavior baseline data;
[0128] A third data deviation value is determined based on the network behavior data and the network behavior baseline data.
[0129] In a possible implementation, determining the data behavior score according to the data deviation value includes:
[0130] The data behavior score is determined based on the first data deviation value, the preset behavior weight value, the second data deviation value, the preset file behavior weight value, the third data deviation value, the preset network behavior weight value and the preset initial value.
[0131] In a possible implementation, performing data detection on the current container behavior data based on the data behavior score and the data source information of the current container behavior data includes:
[0132] Determine whether the data behavior score exceeds the preset alarm threshold corresponding to the service business type;
[0133] When it is determined that the data behavior score does not exceed the preset alarm threshold, determining whether the data source information is the preset data source information;
[0134] In the case where it is determined that the data source information is not the preset data source information, detecting that the current container behavior data is abnormal data;
[0135] When it is determined that the data behavior score exceeds a preset alarm threshold, or when it is determined that the data source information is preset data source information, the current container behavior data is detected as normal data.
[0136] In one possible implementation, the method further includes:
[0137] When it is detected that the current container behavior data is normal data, the current container behavior data is added to the whitelist.
[0138] In one possible implementation, the method further includes:
[0139] When the current container behavior data is detected to be abnormal data, an abnormal response operation is generated; wherein the abnormal response operation at least includes: a blocking operation, an alarm operation and an isolation operation.
[0140] The method disclosed in the above embodiment of the present invention can be applied to the processor 1201, or implemented by the processor 1201. The processor 1201 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 1201. The above processor 1201 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1202, and the processor 1201 reads the information in the memory 1202 and completes the steps of the above method in combination with its hardware.
[0141] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.
[0142] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.
[0143] The electronic device provided in this embodiment may be Figure 4 The electronic device shown in FIG. 1 may perform the following steps: Figure 1-2 All steps of the data detection method are implemented Figure 1-2 For details, please refer to the technical effect of the method for data detection shown in Figure 1-2 For the sake of brevity, the relevant description is not repeated here.
[0144] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.
[0145] When one or more programs in the storage medium can be executed by one or more processors, the above-mentioned data detection method can be implemented.
[0146] The processor is used to execute the data detection program stored in the memory to implement the steps of the following data detection method:
[0147] Collecting container behavior data of the container in real time within a preset period after the container is created, and obtaining a spatial naming identifier for each container behavior data;
[0148] Classify multiple container behavior data into service business types based on space naming identifiers;
[0149] For each service business type: conduct behavior baseline learning based on the container behavior data corresponding to the service business type to determine the behavior baseline data; wherein the behavior baseline data is the minimum benchmark data for evaluating that the container behavior data is normal;
[0150] The current container behavior data of the container is obtained, and data detection is performed on the behavior baseline data of the service business type corresponding to the current container behavior data.
[0151] In a possible implementation, multiple container behavior data are classified into service business types based on space naming identifiers, including:
[0152] Querying the service business type corresponding to the space naming identifier from the service business type query table; wherein the service business type query table stores the correspondence between the space naming identifier and the service business type;
[0153] The plurality of container behavior data are classified into service business types according to the correspondence between the space naming identifier and the service business type.
[0154] In a possible implementation, the behavior baseline learning is performed based on the container behavior data corresponding to the service business type to determine the behavior baseline data, including:
[0155] The container behavior data corresponding to the service business type is input into a pre-trained baseline learning model to obtain behavior baseline data; wherein the baseline learning model is a classification model.
[0156] In a possible implementation, data detection is performed on behavior baseline data of a service business type corresponding to current container behavior data, including:
[0157] Determine the data deviation value between the current container behavior data and the behavior baseline data;
[0158] Determine the data behavior score according to the data deviation value;
[0159] The current container behavior data is tested based on the data behavior score and the data source information of the current container behavior data.
[0160] In a possible implementation, the behavior baseline data includes process behavior baseline data, file behavior baseline data, and network behavior baseline data;
[0161] Determine the data deviation value between the current container behavior data and the behavior baseline data, including:
[0162] Obtain process behavior data, file behavior data, and network behavior data from current container behavior data;
[0163] Determining a first data deviation value based on the process behavior data and the process behavior baseline data;
[0164] Determine a second data deviation value based on the file behavior data and the file behavior baseline data;
[0165] A third data deviation value is determined based on the network behavior data and the network behavior baseline data.
[0166] In a possible implementation, determining the data behavior score according to the data deviation value includes:
[0167] The data behavior score is determined based on the first data deviation value, the preset behavior weight value, the second data deviation value, the preset file behavior weight value, the third data deviation value, the preset network behavior weight value and the preset initial value.
[0168] In a possible implementation, performing data detection on the current container behavior data based on the data behavior score and the data source information of the current container behavior data includes:
[0169] Determine whether the data behavior score exceeds the preset alarm threshold corresponding to the service business type;
[0170] When it is determined that the data behavior score does not exceed the preset alarm threshold, determining whether the data source information is the preset data source information;
[0171] In the case where it is determined that the data source information is not the preset data source information, detecting that the current container behavior data is abnormal data;
[0172] When it is determined that the data behavior score exceeds a preset alarm threshold, or when it is determined that the data source information is preset data source information, the current container behavior data is detected as normal data.
[0173] In one possible implementation, the method further includes:
[0174] When it is detected that the current container behavior data is normal data, the current container behavior data is added to the whitelist.
[0175] In one possible implementation, the method further includes:
[0176] When the current container behavior data is detected to be abnormal data, an abnormal response operation is generated; wherein the abnormal response operation at least includes: a blocking operation, an alarm operation and an isolation operation.
[0177] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.
[0178] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0179] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims
1. A method for data detection, characterized in that: The method comprises: Collecting container behavior data of the container in real time within a preset period after the container is created, and obtaining a spatial naming identifier of each container behavior data; Classifying the plurality of container behavior data into service business types based on the space naming identifier; For each of the service business types: performing behavior baseline learning based on the container behavior data corresponding to the service business type to determine behavior baseline data; wherein the behavior baseline data is the minimum benchmark data for evaluating that the container behavior data is normal; Current container behavior data of the container is acquired, and data detection is performed on behavior baseline data of a service business type corresponding to the current container behavior data.
2. The method according to claim 1, characterized in that The classifying the plurality of container behavior data into service business types based on the space naming identifier includes: Querying the service business type corresponding to the space naming identifier from the service business type query table; wherein the service business type query table stores the correspondence between the space naming identifier and the service business type; The plurality of container behavior data are classified into service business types according to the correspondence between the space naming identifier and the service business type.
3. The method according to claim 1, characterized in that: The performing behavior baseline learning based on the container behavior data corresponding to the service business type to determine the behavior baseline data includes: The container behavior data corresponding to the service business type is input into a pre-trained baseline learning model to obtain behavior baseline data; wherein the baseline learning model is a classification model.
4. The method according to claim 1, characterized in that: The performing data detection on the behavior baseline data of the service business type corresponding to the current container behavior data includes: Determine a data deviation value between the current container behavior data and the behavior baseline data; Determining a data behavior score according to the data deviation value; Data detection is performed on the current container behavior data based on the data behavior score and the data source information of the current container behavior data.
5. The method according to claim 4, characterized in that in, The behavior baseline data includes process behavior baseline data, file behavior baseline data and network behavior baseline data; The determining of the data deviation value between the current container behavior data and the behavior baseline data includes: Acquire process behavior data, file behavior data, and network behavior data from the current container behavior data; determining a first data deviation value based on the process behavior data and the process behavior baseline data; Determining a second data deviation value based on the file behavior data and the file behavior baseline data; A third data deviation value is determined based on the network behavior data and the network behavior baseline data.
6. The method according to claim 5, characterized in that Determining the data behavior score according to the data deviation value includes: The data behavior score is determined based on the first data deviation value, the preset behavior weight value, the second data deviation value, the preset file behavior weight value, the third data deviation value, the preset network behavior weight value and the preset initial value.
7. The method according to claim 4, characterized in that The performing data detection on the current container behavior data based on the data behavior score and the data source information of the current container behavior data includes: Determining whether the data behavior score exceeds a preset alarm threshold corresponding to the service business type; In the case where it is determined that the data behavior score does not exceed the preset alarm threshold, determining whether the data source information is preset data source information; In the case where it is determined that the data source information is not the preset data source information, detecting that the current container behavior data is abnormal data; When it is determined that the data behavior score exceeds the preset alarm threshold, or when it is determined that the data source information is the preset data source information, the current container behavior data is detected as normal data.
8. The method according to claim 7, characterized in that The method further comprises: When it is detected that the current container behavior data is normal data, the current container behavior data is added to the whitelist.
9. The method according to claim 7, characterized in that: The method further comprises: In the case where it is detected that the current container behavior data is abnormal data, an abnormal response operation is generated; wherein the abnormal response operation at least includes: a blocking operation, an alarm operation, and an isolation operation.
10. A data detection device, characterized in that: The device comprises: An acquisition module, used to collect the container behavior data of the container in real time within a preset period after the container is created, and to obtain a spatial naming identifier of each of the container behavior data; A classification module, used to classify the plurality of container behavior data into service business types based on the space naming identifier; A determination module is used for: for each of the service business types: performing behavior baseline learning based on the container behavior data corresponding to the service business type to determine behavior baseline data; wherein the behavior baseline data is the minimum benchmark data for evaluating that the container behavior data is normal; The detection module is used to obtain current container behavior data of the container and perform data detection on behavior baseline data of a service business type corresponding to the current container behavior data.
11. An electronic device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a data detection program stored in the memory to implement the data detection method according to any one of claims 1 to 9.
12. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the data detection method according to any one of claims 1 to 9.