Alarm signal analysis method and device, electronic equipment and storage medium

Abstract

The invention provides an alarm signal analysis method and apparatus, an electronic device and a storage medium. The method comprises the steps of obtaining a traffic alarm signal and process chain information of a plurality of terminal process chains; based on the traffic alarm signal and the process chain information of each terminal process chain, determining a target terminal process chain associated with the traffic alarm signal and a target process triggering the traffic alarm signal in the target terminal process chain from a plurality of terminal process chains; determining a process type of a target process in the target terminal process chain, wherein the process type is a normal process or an abnormal process; according to the process type of the target process, the authenticity of the flow alarm signal is determined, and the authenticity of the flow alarm signal indicates that the flow alarm signal is a false alarm or a real alarm. Through the method, the authenticity of the flow alarm signal can be determined by combining the flow alarm signal with the terminal process chain information, so that false alarms are reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an analysis method, device, electronic device and storage medium for an alarm signal. Background Art

[0002] Traffic monitoring is an important component in network security and system management, which can help administrators detect abnormal activities in the network, such as DDoS attacks, malware communications, etc. Traffic alarm signals are usually generated by network monitoring tools and are triggered when traffic exceeds preset thresholds or other abnormal behaviors are detected. However, in actual applications, traffic alarm signals may be false positives. Summary of the invention

[0003] In view of the above problems, the present application provides an alarm signal analysis method, device, electronic device and storage medium, which can combine the traffic alarm signal and terminal process chain information to determine the authenticity of the traffic alarm signal, thereby reducing false alarms.

[0004] The embodiment of the present application is implemented by adopting the following technical solutions:

[0005] In the first aspect, an embodiment of the present application provides an alarm signal analysis method, the method comprising: obtaining a traffic alarm signal and process chain information of multiple terminal process chains; based on the traffic alarm signal and the process chain information of each of the terminal process chains, determining a target terminal process chain associated with the traffic alarm signal and a target process in the target terminal process chain that triggers the traffic alarm signal from multiple terminal process chains; determining a process type of a target process in the target terminal process chain, the process type being a normal process or an abnormal process; determining the authenticity of the traffic alarm signal based on the process type of the target process, the authenticity of the traffic alarm signal indicating whether the traffic alarm signal is a false alarm or a true alarm.

[0006] In a second aspect, an embodiment of the present application provides an alarm signal analysis device, the device comprising: a data acquisition module, used to acquire a traffic alarm signal and multiple terminal process chains; a correlation determination module, used to determine a target terminal process chain associated with the traffic alarm signal and a target process in the target terminal process chain that triggers the traffic alarm signal from multiple terminal process chains; a process type determination module, used to determine the process type of the target process in the target terminal process chain, the process type being a normal process or an abnormal process; a signal authenticity determination module, used to determine the authenticity of the traffic alarm signal based on the process type of the target process, the authenticity of the traffic alarm signal indicating whether the traffic alarm signal is a false alarm or a true alarm.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the above-mentioned alarm signal analysis method.

[0008] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program code, and the program code can be called by a processor to execute the above-mentioned alarm signal analysis method.

[0009] The alarm signal analysis method, device, electronic device and storage medium provided in the embodiments of the present application obtain a flow alarm signal and process chain information of multiple terminal process chains; based on the flow alarm signal and the process chain information of each of the terminal process chains, determine the target terminal process chain associated with the flow alarm signal and the target process in the target terminal process chain that triggers the flow alarm signal from the multiple terminal process chains; determine the process type of the target process in the target terminal process chain, wherein the process type is a normal process or an abnormal process; according to the process type of the target process, determine the authenticity of the flow alarm signal, and the authenticity of the flow alarm signal indicates whether the flow alarm signal is a false alarm or a true alarm.

[0010] Through the above method, it is possible to first locate the target process that triggers the alarm signal by combining the traffic alarm signal and the terminal process chain information. Furthermore, the authenticity of the traffic alarm signal can be determined by determining whether the process type of the target process is a normal process or an abnormal process, thereby reducing false alarms of traffic alarm signals and avoiding the need to process false alarm traffic alarm signals, resulting in a waste of resources and time, thereby improving the processing efficiency of real traffic alarm signals.

[0011] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 It is a schematic diagram of an application scenario of an alarm signal analysis method provided in an embodiment of the present application.

[0014] Figure 2It is a flowchart of an alarm signal analysis method provided in an embodiment of the present application.

[0015] Figure 3 yes Figure 2 Schematic diagram of the process of step S120.

[0016] Figure 4 yes Figure 2 Schematic diagram of the process of step S130.

[0017] Figure 5 This is another flowchart of an alarm signal analysis method provided in an embodiment of the present application.

[0018] Figure 6 It is a connection block diagram of an alarm signal analysis device provided in an embodiment of the present application.

[0019] Figure 7 It is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0021] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0022] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0023] like Figure 1 , Figure 1An application scenario diagram of an alarm signal analysis method provided in an embodiment of the present application, the method can be applied to a server, the server is deployed with a security analysis platform, such as an XDR platform (Extended Detection and Response), an NGSOC platform (Next Generation Security Operations Center) or a SIEM (Security Information and Event Management) platform, the above-mentioned security analysis platform is only illustrative, as long as it can collect, monitor and analyze logs, event data, network traffic, etc. from various sources to detect and analyze potential security threats. In this embodiment, it mainly refers to the ability to receive traffic alarm signals, and receive process chain information of terminal process chains uploaded by different terminal devices to analyze whether the traffic alarm signal is a false alarm. That is, the server can be associated with multiple terminal devices to receive terminal process chains uploaded by multiple terminal devices. The server can also be connected to a traffic monitoring device to receive a traffic alarm signal generated by the traffic monitoring device when abnormal traffic is detected. The traffic detection device can be any device that is equipped with an intrusion detection system, a traffic analysis tool, or a security information and event management system, etc., which can detect malicious traffic or other traffic that does not comply with security policies.

[0024] Among them, the traffic alarm signal refers to the alarm signal generated when the traffic detection device detects that the network traffic is abnormal network traffic, and the traffic alarm signal includes the alarm time range, address information (such as IP address and port number), protocol, and attribute classification, etc., wherein the alarm time range indicates the time period when the corresponding abnormal network traffic is detected by the traffic detection device, and the address information includes the IP address and port number of the abnormal network traffic corresponding to the traffic alarm signal, wherein the IP address can include the source address (the IP address of the party initiating the traffic) and the destination address (the IP address of the party receiving the traffic) of the abnormal network traffic, and the port number includes the source port number and the destination port number. The port number can be used to accurately locate the process corresponding to the abnormal network traffic in one step; the protocol refers to the protocol method adopted by the network traffic during the transmission process, and the attribute classification refers to the abnormal nature of the network traffic, such as malware propagation, DDoS attack, data leakage, etc.

[0025] The terminal process chain refers to a series of sub-processes started in an initial process after an initial process is started on the terminal device during the operation of the terminal device. Since each sub-process inherits from the initial process and forms a hierarchical structure with the initial process, it is a process chain. When one process starts another process, the latter is called a sub-process of the former, and a hierarchical structure (i.e., a chain) is formed between the initial process and the sub-process. Take accessing a page through the browser of a terminal device as an example. First, a resource manager process is started on the terminal device. When the user needs to access the browser, the user can trigger the browser control. The terminal device can create a browser process (e.g., the first browser process) in response to the triggering operation. Thereafter, if another page is to be displayed in the browser, the terminal device can create another browser process (e.g., the second browser process) in response to the page tag triggered by the user. At this time, the second browser process is a sub-process of the first browser process, and the first browser process and the second browser process are used to form a process chain.

[0026] It is worth mentioning that when a terminal device creates multiple processes during the operation of an application, the process names of the multiple processes may be the same, but the corresponding process IDs are different. For example, when a user opens multiple tabs, the browser may create a separate process for each tab. Although these processes are all browser processes (i.e., the process names are the same), each process has a different identifier (i.e., the process IDs are different), so that each process can run independently and does not affect each other.

[0027] The process chain information of the terminal process chain may include the process information of each process on the terminal process chain. The process information of the process may specifically include process ID, process name, process path, parent process ID, process start time and other process attributes that are helpful in identifying and tracking the process data: the process information of the process may also include the behavior of the process, such as file access, process creation (the behavior of creating a child process), network access or command execution, etc.

[0028] See also Figure 2 , the method comprising:

[0029] Step S110: Obtain a traffic alarm signal and process chain information of multiple terminal process chains.

[0030] Among them, the method for obtaining the traffic alarm signal can be to receive the traffic alarm signal uploaded by the traffic detection device. In some scenarios, if the security analysis platform deployed on the server can monitor the network traffic, the method for obtaining the traffic alarm signal can also be to obtain the real-time network traffic, and detect the obtained network traffic according to the preset rules or algorithms. If abnormal traffic is detected, a traffic alarm signal for the abnormal traffic is generated.

[0031] The method of obtaining the process chain information of the terminal process chain may be to receive the process chain information of the terminal process chain reported by the security agent or monitoring tool on the terminal device. Alternatively, the server may periodically send an information reporting request to the terminal device, so that the terminal device sends the process chain information of the terminal process chain to the server in response to the information reporting request.

[0032] Step S120: Based on the traffic alarm signal and the process chain information of each of the terminal process chains, determine a target terminal process chain associated with the traffic alarm signal and a target process in the target terminal process chain that triggers the traffic alarm signal from multiple terminal process chains.

[0033] In one possible implementation, the traffic alarm signal includes data packet information, and the above-mentioned step S120 may be to search for process information including the data packet information from process chain information of multiple terminal process chains based on the data packet information in the traffic alarm signal, determine the process corresponding to the process information as the target process that triggers the traffic alarm signal, and determine the terminal process chain corresponding to the process chain information where the process information is located as the target terminal process chain.

[0034] In another possible implementation, if the triggering scenario of the traffic alarm signal is an access scenario, the traffic alarm signal includes file information, and the process chain information of the terminal process chain also includes file information accessed by each process in the terminal process chain; the above step S120 can also be: if the triggering scenario of the traffic alarm signal is an access scenario, based on the file information in the traffic alarm signal and the file information accessed by each process in the multiple process chains, determine the target process from the processes in the multiple process chains, and the file information accessed by the target process is the same as the file information in the traffic alarm signal.

[0035] Among them, the access scenario refers to the existence of a process that performs access behavior on a file system or network resource.

[0036] For example, if the traffic alarm signal carries a sensitive configuration file, such as / etc / sensitive.conf, all currently running processes will be checked and their respective file access records will be compared to obtain the target process, such as process A, which has accessed the above sensitive configuration file. It is worth mentioning that if it is determined that process A is a known and trusted service process, then this may just be a normal operation; on the contrary, if it is determined to be an unknown or unauthorized process, immediate measures need to be taken to prevent potential security threats.

[0037] By matching the file information mentioned in the traffic alarm signal with the file records actually accessed by each process, processes that may be involved in abnormal behavior can be identified more accurately, thereby reducing the false alarm rate to ensure that truly problematic processes are not overlooked.

[0038] Taking into account that certain types of attacks may use legitimate programs to conceal their illegal purposes, such as using command line tools to execute malicious scripts, in another possible implementation method, if the triggering scenario of the traffic alarm signal is a command execution scenario, the traffic alarm signal includes an execution command, and the process chain information of the target terminal process chain also includes the execution commands of each process in the terminal process chain; the above-mentioned step S120 can also be: if the triggering scenario of the traffic alarm signal is a command execution scenario, according to the execution command in the traffic alarm signal and the execution commands of each process in the multiple process chains, determine the target process from the processes in the multiple process chains, and the execution command of the target process is the same as the execution command in the traffic alarm signal.

[0039] The command execution scenario refers to a process executing certain specific commands.

[0040] For example, if the traffic alarm signal indicates a dangerous command rm-rf / tmp / *, which is used to delete all files in the temporary directory, by starting to check the execution commands of each process (such as historical command records), it can be finally locked to the target process (such as process B) that executed the above dangerous command. It is worth mentioning that, later, the authenticity and legitimacy of the command execution can be evaluated by checking the identity information of process B (such as user ID), source IP address and other context clues. If process B is a normal cleanup command initiated by an administrator account, no additional intervention is required; but if it is initiated by an untrusted source, the connection should be cut off immediately and the emergency response procedure should be initiated.

[0041] By using the above method to monitor and compare execution commands, potential threats hidden behind the process can be effectively discovered, and the accuracy of judging the authenticity of the alarm can be improved.

[0042] In another possible implementation, the traffic alarm signal may include an alarm time range and address information, and the process chain information of the terminal process chain includes the process start time point and address information of each process in the terminal process chain; according to the alarm time range and the alarm address information, the target terminal process chain associated with the traffic alarm signal and the target process in the target terminal process chain are determined from multiple terminal process chains, and the target process is a process whose process start time point is within the alarm time range, whose address information matches the alarm address information and which triggers the traffic alarm signal.

[0043] Since the traffic alarm signal contains the alarm time range, this means that any process is considered suspicious only if its startup time point falls within the alarm time range. By utilizing the alarm time range restriction, the number of processes that need to be further checked is greatly reduced, and efficiency is improved, because not all processes need to be reviewed, but only those that are started within the alarm time period. The traffic alarm signal also contains address information, which makes it possible to further narrow the search scope and focus only on processes whose address information matches the alarm address information.

[0044] Based on this, see Figure 3 , the above step S120 specifically includes:

[0045] Step S121: selecting a candidate terminal process chain from a plurality of terminal process chains according to the alarm time range, wherein there is a first process in the candidate terminal process chain whose process start time point is within the alarm time range.

[0046] By selecting candidate terminal process chains based on the alarm time range, processes that are not within the alarm time range can be quickly excluded, thereby focusing on processes that are more likely to be related to traffic alarm signals, which can greatly reduce the number of processes that need further analysis. This not only improves the analysis efficiency of traffic alarm signals, but also reduces unnecessary computing overhead during the processing process.

[0047] Step S122: determining a target terminal process chain associated with the traffic alarm signal from the candidate terminal process chains according to the alarm address information and the address information of the first process in the candidate terminal process chain.

[0048] The address information of the first process in the target terminal process chain matches the alarm address information.

[0049] The first process whose address information matches the alarm address information is further screened out in the candidate process chain. This step further narrows the scope of the process. The matching of address information can help the system exclude processes that are started within the alarm time but do not participate in abnormal traffic behavior.

[0050] Step S123: if the first process in the target terminal process chain is one, determine that the first process in the target terminal process chain is the target process in the target terminal process chain.

[0051] Among them, when there is only one first process that meets the conditions, it can be directly determined as the target process, and by adopting the above steps S121-S123, the target process that triggers the traffic alarm signal in the target process chain can be accurately located.

[0052] If there are multiple first processes, it is necessary to distinguish the triggering scenarios of the traffic alarm signal to determine the target process. The triggering scenarios of the above-mentioned traffic alarm signal can be access scenarios or command execution scenarios. The access scenario refers to the process performing access to the file system or network resources; the command execution scenario refers to the process executing certain specific commands.

[0053] When distinguishing between command execution scenarios and access scenarios, the triggering scenario of the traffic alarm signal is determined according to the attribute classification and preset correspondence included in the traffic alarm signal, and the preset correspondence stores multiple preset classifications and the triggering scenarios corresponding to each preset classification.

[0054] Specifically, the attribute classification of the traffic alarm signal may include any one of host detection, access risk, backdoor communication, virus infection, access to malicious files, attack exploitation, database attack exploitation, command injection, code injection, etc., which is detected by the traffic detection device.

[0055] The preset correspondence relationship stores attribute classifications corresponding to access scenarios and attribute classifications corresponding to command execution scenarios. The attribute classifications corresponding to access scenarios include host detection, access risk, backdoor communication, virus infection, and access to malicious files. The attribute classifications corresponding to command execution scenarios include attack exploitation, database attack exploitation, command injection, and code injection.

[0056] In one possible implementation, if the triggering scenario of the traffic alarm signal is an access scenario, the traffic alarm signal includes file information, and the process chain information of the target terminal process chain also includes file information accessed by each first process, the above step S120 also includes:

[0057] Step S124: If there are multiple first processes in the target terminal process chain and the triggering scenario of the traffic alarm signal is an access scenario, determine the target process from the multiple first processes based on the file information in the traffic alarm signal and the file information accessed by each of the first processes, and the file information accessed by the target process is the same as the file information in the traffic alarm signal.

[0058] Exemplarily, if the traffic alarm signal is triggered in an access scenario, the traffic alarm signal includes information about the accessed file or directory, such as the file path, file name, etc. The process information of each process in the process chain information of the target terminal process chain also records the access record of each process. If the process access record in the process information of the first process includes the file information in the traffic alarm signal, the first process can be determined to be the target process.

[0059] In another possible implementation, if the triggering scenario of the traffic alarm signal is a command execution scenario, the traffic alarm signal includes an execution command, and the process chain information of the target terminal process chain also includes the execution command of each first process; the above step S120 also includes:

[0060] Step S125: If there are multiple first processes in the process chain of the target terminal and the triggering scenario of the traffic alarm signal is a command execution scenario, a target process is determined from the multiple first processes according to the execution command in the traffic alarm signal and the execution command of each of the first processes. The execution command of the target process is the same as the execution command in the traffic alarm signal.

[0061] For example, if the traffic alarm signal shows that a process has executed the command wget http: / / XXXX.exe, the system can check all processes (first processes) that are started within the alarm time range and have matching address information to find the first process that executed the above command, and determine the first process as the target process.

[0062] Step S130: Determine the process type of the target process in the process chain of the target terminal, where the process type is a normal process or an abnormal process.

[0063] In one possible implementation, the process identifier of the target process may be matched with a preset identifier list, and the process type may be determined based on the matching result, wherein the preset identifier list may be a preset white process identifier list or a preset black process identifier list.

[0064] Exemplarily, the preset identifier list is a preset white process identifier list. If the process identifier of the target process exists in the preset white process identifier list, the process identifier of the target process matches the preset white process identifier list, and the process type of the target process is determined to be a normal process; if the process identifier of the target process does not exist in the preset white process identifier list, the process identifier of the target process does not match the preset white process identifier list, and the process type of the target process is determined to be an abnormal process.

[0065] If the preset identification list is a preset black process identification list, if the process identification of the target process exists in the preset black process identification list, the process identification of the target process matches the preset black process identification list, and the process type of the target process is determined to be an abnormal process; if the process identification of the target process does not exist in the preset black process identification list, the process identification of the target process does not match the preset black process identification list, and the process type of the target process is determined to be a normal process.

[0066] In another possible implementation, see Figure 4 , the above step S130 includes:

[0067] Step S131: Determine the triggering scenario of the traffic alarm signal according to the attribute classification and preset correspondence included in the traffic alarm signal, wherein the preset correspondence stores multiple preset classifications and triggering scenarios corresponding to each preset classification, and the triggering scenarios include access scenarios or command execution scenarios.

[0068] For the detailed description of the above step S131, please refer to the above description, which will not be repeated here.

[0069] Step S132: If the triggering scenario of the traffic alarm signal is an access scenario, the process type of the target process is determined according to a preset whitelist and the process identifier of the target process.

[0070] Among them, the preset whitelist list includes multiple whitelist process identifiers. If the multiple whitelist process identifiers include the process identifier of the target process, the process type of the target process is determined to be a normal process; if the multiple whitelist process identifiers do not include the process identifier of the target process, the process type of the target process is determined to be an abnormal process.

[0071] Taking into account the access scenarios, the applications that can access files are usually browsers, content interaction platforms, and movie players, based on this, the preset whitelist list can include process identifiers of multiple browser processes, multiple content interaction application processes, movie player processes, DNS server processes (Domain Name System, domain name system), and other processes that can actively access.

[0072] By adopting a preset whitelist in an access scenario, the process type of the target process can be quickly distinguished, so as to quickly determine the security of the target process that triggers the traffic alarm signal in the access scenario.

[0073] Step S133: If the triggering scenario is a command execution scenario, the process type of the target process is determined according to a preset blacklist and the process identifier of the target process.

[0074] Among them, the preset blacklist list includes multiple blacklist process identifiers. If the multiple blacklist process identifiers include the process identifier of the target process, the process type of the target process is determined to be an abnormal process; if the multiple blacklist process identifiers do not include the process identifier of the target process, the process type of the target process is determined to be a normal process.

[0075] Considering the command execution scenario, the process used to execute the command can usually directly execute system commands or scripts instead of starting an application or service. Command execution scenarios are often related to commands executed directly at the system level, rather than just starting a web application or service. Process identifiers such as Java applications, PHP applications, and CGI / Tomcat applications are more related to web services and application servers and are not used for direct command execution. Therefore, in one possible implementation of the present application, the preset blacklist list includes Java application process identifiers, PHP application process identifiers, and CGI / Tomcat application process identifiers.

[0076] By adopting a preset blacklist in a command execution scenario, the process type of the target process can be quickly distinguished, so as to quickly determine the security of the target process that triggers the traffic alarm signal in an access scenario.

[0077] Step S140: Determine the authenticity of the traffic alarm signal according to the process type of the target process, the authenticity of the traffic alarm signal indicating whether the traffic alarm signal is a false alarm or a true alarm.

[0078] If the process type of the target process is a normal process, the flow alarm signal is determined to be a false alarm signal; if the process type of the target process is an abnormal process, the flow alarm signal is determined to be a true alarm.

[0079] By adopting the alarm signal analysis method of the present application, based on the traffic alarm signal and the process chain information of each of the terminal process chains, the target terminal process chain associated with the traffic alarm signal and the target process that triggers the traffic alarm signal in the target terminal process chain are determined from multiple terminal process chains. It is possible to first locate the target process that triggers the alarm signal by combining the traffic alarm signal and the terminal process chain information. Furthermore, the authenticity of the traffic alarm signal is determined by determining whether the process type of the target process is a normal process or an abnormal process, thereby reducing false alarms of traffic alarm signals and avoiding the need to process false alarm traffic alarm signals, which leads to a waste of resources and time, thereby improving the processing efficiency of real traffic alarm signals.

[0080] like Figure 5As shown, by adopting the above method of the present application, after obtaining the flow alarm signal, i.e., the process chain information of multiple terminal process chains, it is possible to establish an association between the flow alarm signal and the target process in the target terminal process chain in the multiple terminal process chains based on the flow alarm signal and the process chain information of each of the terminal process chains. The target process is the process that triggers the flow alarm signal in the target terminal process chain. Thereafter, it is possible to determine whether the process type of the target process is an abnormal process based on whether the process type of the target process is normal. If the process type of the target process is abnormal, it is determined that the flow alarm signal is a false alarm. If the process type of the target process is abnormal, it is determined that the flow alarm signal is true. By adopting the above method, it is possible to solve the problem in the related art that when a flow alarm signal is detected, the process that triggers the flow alarm signal on the client side cannot be located, resulting in a large number of false alarms in some scenarios.

[0081] like Figure 6 As shown, an alarm signal analysis device 200 provided in an embodiment of the present application is shown, which is applied to a server. The alarm signal analysis device 200 includes a data acquisition module 210, a correlation determination module 220, a process type determination module 230, and a signal authenticity determination module 240. The data acquisition module 210 is used to acquire a flow alarm signal and multiple terminal process chains; the correlation determination module 220 is used to determine a target terminal process chain associated with the flow alarm signal and a target process in the target terminal process chain that triggers the flow alarm signal from multiple terminal process chains; the process type determination module 230 is used to determine the process type of the target process in the target terminal process chain, and the process type is a normal process or an abnormal process; the signal authenticity determination module 240 is used to determine the authenticity of the flow alarm signal according to the process type of the target process, and the authenticity of the flow alarm signal indicates whether the flow alarm signal is a false alarm or a true alarm.

[0082] In one possible implementation, the process type determination module 230 includes a scenario determination submodule and a first type determination submodule; the scenario determination submodule is used to determine the triggering scenario of the traffic alarm signal based on the attribute classification and preset correspondence included in the traffic alarm signal, wherein the preset correspondence stores multiple preset classifications and triggering scenarios corresponding to each preset classification, and the triggering scenarios include access scenarios or command execution scenarios; the first type determination submodule is used to determine the process type of the target process based on a preset whitelist list and the process identifier of the target process when the triggering scenario of the traffic alarm signal is an access scenario; wherein the preset whitelist list includes multiple whitelist process identifiers, and if the multiple whitelist process identifiers include the process identifier of the target process, the process type of the target process is determined to be a normal process; if the multiple whitelist process identifiers do not include the process identifier of the target process, the process type of the target process is determined to be an abnormal process.

[0083] In one possible implementation, the process type determination submodule also includes a second type determination submodule, which is used to determine the process type of the target process based on a preset blacklist list and the process identifier of the target process when the trigger scenario is a command execution scenario; wherein the preset blacklist list includes multiple blacklist process identifiers, and if the multiple blacklist process identifiers include the process identifier of the target process, the process type of the target process is determined to be an abnormal process; if the multiple blacklist process identifiers do not include the process identifier of the target process, the process type of the target process is determined to be a normal process.

[0084] In one possible implementation, if the triggering scenario of the traffic alarm signal is an access scenario, the traffic alarm signal includes file information, and the process chain information of the terminal process chain also includes file information accessed by each process in the terminal process chain; the correlation determination module 220 is also used to determine the target process from the processes of the multiple process chains based on the file information in the traffic alarm signal and the file information accessed by each process in the multiple process chains when the triggering scenario of the traffic alarm signal is an access scenario, and the file information accessed by the target process is the same as the file information in the traffic alarm signal.

[0085] In one possible implementation, if the triggering scenario of the traffic alarm signal is a command execution scenario, the traffic alarm signal includes an execution command, and the process chain information of the target terminal process chain also includes the execution commands of each process in the terminal process chain; the correlation determination module 220 is also used to determine the target process from the processes of the multiple process chains according to the execution command in the traffic alarm signal and the execution commands of each process in the multiple process chains when the triggering scenario of the traffic alarm signal is a command execution scenario, and the execution command of the target process is the same as the execution command in the traffic alarm signal.

[0086] In one possible implementation, the traffic alarm signal includes an alarm time range and alarm address information, and the process chain information of the terminal process chain includes the process start time point and address information of each process in the terminal process chain; the correlation determination module 220 is also used to determine the target terminal process chain associated with the traffic alarm signal and the target process in the target terminal process chain from multiple terminal process chains based on the alarm time range and the alarm address information, wherein the target process is a process whose process start time point is within the alarm time range, whose address information matches the alarm address information and which triggers the traffic alarm signal.

[0087] like Figure 7The embodiment of the present application further provides an electronic device 300, which may be a server. The electronic device 300 may include one or more processors 310, a memory 320, and one or more applications, wherein the one or more applications are stored in the memory 320 and configured to be executed by the one or more processors 310, and the one or more applications are configured to execute the above-mentioned alarm signal analysis method.

[0088] It can be understood that the processor 310 and the memory 320 are connected through a communication bus to complete the communication between them. The processor 320 can call the logic instructions in the memory 320 to execute the speech template generation method in any of the above embodiments. Exemplarily, the processor 310 can be implemented in a general CPU, a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit. ASIC), or one or more integrated circuits, etc., for executing related programs to implement the technical solution provided in this application. The memory can include ROM (Read 0nl yMemory, read-only memory), RAM (Random Access Memory, random access memory) static storage devices, dynamic storage devices, etc.

[0089] Correspondingly, an embodiment of the present application further provides a computer-readable storage medium, in which a program code is stored. The program code can be called by a processor to execute the above-mentioned alarm signal analysis method.

[0090] It can be understood that the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0091] Part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0092] The above are only preferred embodiments of the present application, and are not intended to limit the present application in any form. Although the present application has been disclosed as above with preferred embodiments, it is not intended to limit the present application. Any technical personnel in the field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present application. However, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application are still within the scope of the technical solution of the present application.

Claims

1. A method for analyzing an alarm signal, characterized in that: The method comprises: Obtain traffic alarm signals and process chain information of multiple terminal process chains; Based on the traffic alarm signal and the process chain information of each of the terminal process chains, determining a target terminal process chain associated with the traffic alarm signal and a target process in the target terminal process chain that triggers the traffic alarm signal from multiple terminal process chains; Determine a process type of a target process in the process chain of the target terminal, where the process type is a normal process or an abnormal process; The authenticity of the traffic alarm signal is determined according to the process type of the target process, and the authenticity of the traffic alarm signal indicates whether the traffic alarm signal is a false alarm or a true alarm.

2. The method according to claim 1, characterized in that The determining the process type of the target process in the target terminal process chain includes: Determine a triggering scenario of the traffic alarm signal according to the attribute classification and preset corresponding relationship included in the traffic alarm signal, wherein the preset corresponding relationship stores a plurality of preset classifications and triggering scenarios corresponding to each preset classification, and the triggering scenario includes an access scenario or a command execution scenario; If the triggering scenario of the traffic alarm signal is an access scenario, the process type of the target process is determined according to a preset whitelist list and the process identifier of the target process; wherein the preset whitelist list includes multiple whitelist process identifiers, and if the multiple whitelist process identifiers include the process identifier of the target process, the process type of the target process is determined to be a normal process; if the multiple whitelist process identifiers do not include the process identifier of the target process, the process type of the target process is determined to be an abnormal process.

3. The method according to claim 2, characterized in that The determining the process type of the target process in the target terminal process chain further includes: If the trigger scenario is a command execution scenario, the process type of the target process is determined according to a preset blacklist list and the process identifier of the target process; wherein the preset blacklist list includes multiple blacklist process identifiers, if the multiple blacklist process identifiers include the process identifier of the target process, the process type of the target process is determined to be an abnormal process; if the multiple blacklist process identifiers do not include the process identifier of the target process, the process type of the target process is determined to be a normal process.

4. The method according to claim 1, characterized in that If the triggering scenario of the traffic alarm signal is an access scenario, the traffic alarm signal includes file information, and the process chain information of the terminal process chain also includes file information accessed by each process in the terminal process chain; The determining, based on the traffic alarm signal and the process chain information of each of the process chains, a target terminal process chain associated with the traffic alarm signal and a target process in the target terminal process chain that triggers the traffic alarm signal from a plurality of terminal process chains, comprises: If the triggering scenario of the traffic alarm signal is an access scenario, the target process is determined from the processes in the multiple process chains based on the file information in the traffic alarm signal and the file information accessed by each process in the multiple process chains, and the file information accessed by the target process is the same as the file information in the traffic alarm signal.

5. The method according to claim 1, characterized in that If the triggering scenario of the traffic alarm signal is a command execution scenario, the traffic alarm signal includes an execution command, and the process chain information of the target terminal process chain also includes the execution commands of each process in the terminal process chain; The determining, based on the traffic alarm signal and the process chain information of each of the process chains, a target terminal process chain associated with the traffic alarm signal and a target process in the target terminal process chain that triggers the traffic alarm signal from a plurality of terminal process chains, comprises: If the triggering scenario of the traffic alarm signal is a command execution scenario, the target process is determined from the processes in the multiple process chains based on the execution command in the traffic alarm signal and the execution commands of each process in the multiple process chains, and the execution command of the target process is the same as the execution command in the traffic alarm signal.

6. The method according to claim 1, characterized in that The traffic alarm signal includes an alarm time range and alarm address information, and the process chain information of the terminal process chain includes the process start time point and address information of each process in the terminal process chain; The determining, based on the traffic alarm signal and the process chain information of each of the process chains, a target terminal process chain associated with the traffic alarm signal and a target process in the target terminal process chain that triggers the traffic alarm signal from a plurality of terminal process chains, comprises: According to the alarm time range and the alarm address information, a target terminal process chain associated with the traffic alarm signal and a target process in the target terminal process chain are determined from multiple terminal process chains, wherein the target process is a process whose process start time point is within the alarm time range, whose address information matches the alarm address information and which triggers the traffic alarm signal.

7. An analysis device for an alarm signal, characterized in that: The device comprises: A data acquisition module, used to obtain traffic alarm signals and multiple terminal process chains; A correlation determination module, used to determine a target terminal process chain associated with the traffic alarm signal and a target process in the target terminal process chain that triggers the traffic alarm signal from multiple terminal process chains; A process type determination module, used to determine the process type of the target process in the process chain of the target terminal, wherein the process type is a normal process or an abnormal process; The signal authenticity determination module is used to determine the authenticity of the flow alarm signal according to the process type of the target process, and the authenticity of the flow alarm signal indicates whether the flow alarm signal is a false alarm or a true alarm.

8. An electronic device, characterized in that: include: one or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, and the program codes can be called by a processor to execute the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.

Images