Behavior portrait generation method and device and storage medium

Abstract

The invention provides a behavior portrait generation method and apparatus, and a storage medium. The method comprises the steps of obtaining multi-source heterogeneous data; determining different types of security entities according to the multi-source heterogeneous data and the target fields corresponding to the different types of entities, and extracting behaviors and / or relationships corresponding to the different types of security entities; and according to the behaviors and / or relationships corresponding to the different types of security entities, generating behavior portraits of the different types of security entities. According to the method, different types of security entities and entity behaviors can be extracted from the multi-source heterogeneous data according to the target field, the data is extracted from the perspective of different types of security entities, the data value is effectively precipitated, the behavior portraits of different types of security entities are generated, and when security analysis is carried out, the security analysis efficiency is improved. Security analysts can obtain needed information through the security entity behavior portraits, and the security analysis efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of computers, and more specifically, to a method, device and storage medium for generating a behavior profile in the field of computers. Background Art

[0002] Currently, large-scale data processing and analysis systems access extremely large amounts of network traffic and security data, which can reach tens or even hundreds of TB of traffic and other data per day, containing a large amount of valuable information.

[0003] Conventional analysis methods are based on security device alarms or log analysis alarms. They only extract identifiable threats from the data, and the value of the data cannot be accumulated. This not only wastes the value of the data, but also affects the effectiveness of future security analysis.

[0004] In addition, when the existing data processing and analysis system accesses a large amount of security data, all the data is accumulated in different security logs. When conducting security analysis, if the security analyst wants to obtain the behavior or relationship of a certain entity, he needs to search for information related to the entity one by one from the log. The operation is cumbersome and the security analysis efficiency is poor. Summary of the invention

[0005] The present application provides a method, device and storage medium for generating a behavior profile. Through this method, the value of data is effectively precipitated and the efficiency of security analysis can be improved.

[0006] In a first aspect, a method for generating a behavioral portrait is provided, the method comprising: acquiring multi-source heterogeneous data; determining different types of security entities based on target fields corresponding to the multi-source heterogeneous data and different types of security entities, and extracting behaviors and / or relationships of different types of security entities; generating behavioral portraits of different types of security entities based on the behaviors and / or relationships of different types of security entities.

[0007] In the above technical solution, different types of security entities and behaviors and / or relationships of security entities are extracted from multi-source heterogeneous data according to the target field. From the perspective of different types of security entities, the behaviors and / or relationships of security entities are extracted, and the data value is effectively precipitated, which is conducive to generating high-value behavioral portraits to provide high-value references for subsequent security analysis. In addition, behavioral portraits of different types of security entities are generated in the above technical solution, so that when performing security analysis, different types of security entities can be analyzed based on the behavioral portraits of different types of security entities. The required information can be obtained through the behavioral portraits of security entities, avoiding the need to search for information related to the security entity one by one from the security log when obtaining the behavior or relationship of a certain security entity, which is conducive to improving the efficiency of security analysis.

[0008] In combination with the first aspect, in some possible implementations, different types of security entities include any combination of the following: host-type entities, IP-type entities, domain name-type entities, and file-type entities.

[0009] In combination with the first aspect and the above implementations, in some possible implementations, when different types of security entities include host-type entities, the behaviors and / or relationships of the host-type entities include any combination of the following:

[0010] Process creation behavior on the host, process injection behavior on the host, registry operation behavior on the host, sensitive file operation behavior on the host, scheduled task operation behavior on the host, service operation behavior on the host, script operation behavior on the host, user login behavior on the host, access relationship between the host and IP, access relationship between the host and domain name, access relationship between the host and port, distribution relationship of IP used by the host;

[0011] In the case where the different types of security entities include IP-type entities, the behaviors and / or relationships of the IP-type entities include any combination of the following:

[0012] The behavior of IP accessing ports, the access relationship between IP and domain name, the access relationship between IPs, the distribution relationship of network events initiated by IP, the distribution relationship of network events received by IP, the distribution relationship of ports used by IP, the access relationship between IP and host, the behavior of IP transferring files, and the distribution relationship of ports bound by IP; in the case where different types of security entities include domain name entities, the behavior and / or relationship of domain name entities include any combination of the following:

[0013] The host distribution relationship of accessing domain names, the process distribution relationship of requesting domain names, and the access relationship between domain names and ports;

[0014] In the case where the different types of security entities include document-type entities, the behaviors and / or relationships of the document-type entities include any combination of the following:

[0015] The process startup behavior corresponding to the file, the process operation behavior corresponding to the file, the registry operation file behavior, the sensitive file operation behavior, the distribution relationship of the file on the host, the distribution relationship of the file on the IP, the access relationship of the file to the IP, and the access relationship of the file to the domain name.

[0016] In the above technical solution, common security entities in security analysis are divided into four categories: host, IP, domain name, and file, and multiple behaviors and / or relationships are designed for each entity. That is, which behaviors and / or relationships should each security entity pay attention to in order to most efficiently help security analysts discover hidden threats, and then form an overall cognition, realizing the effective association and integration of data.

[0017] In combination with the first aspect and the above implementation manner, in some possible implementation manners, each behavior and / or relationship of different types of security entities corresponds to multiple target fields, and extracting behaviors and / or relationships corresponding to different types of security entities includes: determining grouping conditions corresponding to behaviors and / or relationships of different types of security entities according to the multiple target fields corresponding to each behavior and / or relationship;

[0018] According to the grouping conditions, multi-source heterogeneous data are aggregated according to the preset time window to obtain the behaviors and / or relationships of different types of security entities.

[0019] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, after generating behavioral portraits of different types of security entities, the method also includes: storing behavioral portraits of different types of security entities; when a request to query the behavioral portrait of a security entity is detected, displaying the stored behavioral portrait according to the request.

[0020] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, after generating behavioral portraits of different types of security entities, the method also includes: when an attack element is detected, determining the security entity corresponding to the attack element; searching for the behavioral portrait of the security entity corresponding to the attack element among the generated behavioral portraits of different types of security entities; and determining the attack path of the attack element based on the behavioral portrait of the security entity corresponding to the attack element.

[0021] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, the attack path of the attack element is determined according to the behavior portrait of the security entity corresponding to the attack element, including: searching for the security entity carrying the attack element according to the behavior portrait of the security entity corresponding to the attack element; if multiple security entities carrying the attack element are found, determining the time when the attack element appears in each security entity according to the behavior portrait of each security entity found; and determining the attack path of the attack element according to the time when the attack element appears in each security entity.

[0022] In the above technical solution, when an attack element is discovered, the complete attack behavior can be linked together and the attack path can be restored through the entity behavior portrait of the attack element, helping security analysts to quickly trace the known attack behaviors and perceive the complete attack surface.

[0023] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, after determining the time when the attack element appears in each security entity, the method also includes: determining the security entity that first carries the attack element among multiple security entities that carry the attack element based on the time when the attack element appears in each security entity; searching for the behavior portrait of the security entity that first carries the attack element among the generated behavior portraits of different types of security entities; and determining the malicious entities visited by the security entity that first carries the attack element based on the behavior portrait of the security entity that first carries the attack element, wherein the malicious entities include any one of malicious files, malicious domain names, malicious hosts, and malicious IPs.

[0024] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, after determining the malicious entity that was first visited by the security entity carrying the attack element, the method also includes: searching for the behavior portrait of the malicious entity among the generated behavior portraits of different types of security entities; based on the behavior portrait of the malicious entity, checking the security entities associated with the malicious entity, and locating the assets attacked by the attack element in the associated security entities.

[0025] In summary, the method for generating a behavior portrait provided by the embodiment of the present application can extract different types of security entities and the behaviors and / or relationships of security entities from multi-source heterogeneous data according to the target field, extract the behaviors and / or relationships of security entities from the perspective of different types of security entities, and effectively precipitate the data value, which is conducive to generating high-value behavior portraits to provide high-value references for subsequent security analysis. In addition, the above technical solution generates behavior portraits of different types of security entities, so that when performing security analysis, different types of security entities can be analyzed based on the behavior portraits of different types of security entities. The required information can be obtained through the behavior portraits of security entities, avoiding the problem of searching for information related to the security entity one by one from the security log when obtaining the behavior or relationship of a certain security entity, which is conducive to improving the efficiency of security analysis. In addition, the generated behavior portraits of different types of security entities are stored, and the behavior portraits of the corresponding security entities are displayed according to the request for querying the behavior portraits of the security entities, which is convenient for security analysts to perform security analysis and improves human-computer interactivity. When an attack element is discovered, the entity behavior portrait of the attack element can be used to connect the complete attack behavior and restore the attack path, helping security analysts to quickly trace the known attack behaviors and perceive the complete attack surface, further improving the efficiency of security analysis.

[0026] In a second aspect, a device for generating a behavior profile is provided, the device comprising:

[0027] An acquisition module is used to acquire multi-source heterogeneous data; a determination module is used to determine different types of security entities based on the target fields corresponding to the multi-source heterogeneous data and different types of entities, and to extract the behaviors and / or relationships corresponding to different types of security entities; a generation module is used to generate behavioral portraits of different types of security entities based on the behaviors and / or relationships corresponding to different types of security entities.

[0028] In conjunction with the second aspect, in some possible implementations, different types of security entities include any combination of the following: host-type entities, IP-type entities, domain name-type entities, and file-type entities.

[0029] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, when different types of security entities include host-type entities, the behaviors and / or relationships of the host-type entities include any combination of the following: process creation behavior on the host, process injection behavior on the host, registry operation behavior on the host, sensitive file operation behavior on the host, scheduled task operation behavior on the host, service operation behavior on the host, script operation behavior on the host, user login behavior on the host, access relationship between the host and the IP, access relationship between the host and the domain name, access relationship between the host and the port, and distribution relationship of IPs used by the host; when different types of security entities include IP-type entities, the behaviors and / or relationships of the IP-type entities include any combination of the following: behavior of IP accessing the port, access relationship between the IP and the domain name, access relationship between IPs, The distribution relationship of network events initiated by IP, the distribution relationship of network events received by IP, the distribution relationship of ports used by IP, the access relationship between IP and host, the behavior of IP transferring files, and the distribution relationship of ports bound to IP; when different types of security entities include domain name entities, the behavior and / or relationship of domain name entities include any combination of the following: the distribution relationship of hosts accessing domain names, the distribution relationship of processes requesting domain names, and the access relationship between domain names and ports; when different types of security entities include file entities, the behavior and / or relationship of file entities include any combination of the following: the process startup behavior corresponding to the file, the process operation behavior corresponding to the file, the registry operation file behavior, the sensitive file operation behavior, the distribution relationship of files on the host, the distribution relationship of files on the IP, the access relationship of files to IPs, and the access relationship of files to domain names.

[0030] In combination with the second aspect, in some possible implementations, the determination module is also used to: determine the grouping conditions corresponding to the behaviors and / or relationships of different types of security entities based on multiple target fields corresponding to each behavior and / or relationship; and aggregate the multi-source heterogeneous data according to a preset time window based on the grouping conditions to obtain the behaviors and / or relationships of different types of security entities.

[0031] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the device also includes: a storage module for storing behavioral portraits of different types of security entities; and a display module for displaying the stored behavioral portrait according to the request when a request for querying the behavioral portrait of the security entity is detected.

[0032] In combination with the second aspect and the above implementations, in some possible implementations, the determination module is further used to: when an attack element is detected, determine a security entity corresponding to the attack element.

[0033] In combination with the second aspect and the above implementation, in some possible implementations, the device further includes: a search module, configured to search for a behavior profile of a security entity corresponding to an attack element in the generated behavior profiles of different types of security entities;

[0034] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the determination module is also used to: determine the attack path of the attack element according to the behavior portrait of the security entity corresponding to the attack element.

[0035] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the search module is also used to: search for the security entity carrying the attack element according to the behavior portrait of the security entity corresponding to the attack element; the determination module is also used to: if multiple security entities carrying the attack element are found, determine the time when the attack element appears in each security entity according to the behavior portrait of each security entity found; determine the attack path of the attack element according to the time when the attack element appears in each security entity.

[0036] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the determination module is also used to: determine the security entity that first carries the attack element among multiple security entities that carry the attack element based on the time when the attack element appears in each security entity; search for the behavior portrait of the security entity that first carries the attack element among the generated behavior portraits of different types of security entities; determine the malicious entities visited by the security entity that first carries the attack element based on the behavior portrait of the security entity that first carries the attack element, wherein the malicious entities include any one of malicious files, malicious domain names, malicious hosts, and malicious IPs.

[0037] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the search module is also used to: search for the behavior profile of the malicious entity among the generated behavior profiles of different types of security entities; based on the behavior profile of the malicious entity, check the security entities associated with the malicious entity, and locate the assets attacked by the attacked elements in the associated security entities.

[0038] In a third aspect, an electronic device is provided, comprising a memory and a processor. The memory is used to store executable program code, and the processor is used to call and run the executable program code from the memory, so that the electronic device executes the method in the first aspect or any possible implementation of the first aspect.

[0039] In a fourth aspect, a computer program product is provided, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the method in the first aspect or any possible implementation of the first aspect.

[0040] In a fifth aspect, a computer-readable storage medium is provided, which stores a computer program code. When the computer program code runs on a computer, the computer executes the method in the above-mentioned first aspect or any possible implementation manner of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 is a schematic flow chart of a method for generating a behavior profile provided in an embodiment of the present application;

[0042] Figure 2 This is a schematic diagram of a display effect of an entity behavior portrait provided in an embodiment of the present application;

[0043] Figure 3 This is another schematic diagram of the display effect of the entity behavior portrait provided in the embodiment of the present application;

[0044] Figure 4 This is another schematic diagram of the display effect of the entity behavior portrait provided in the embodiment of the present application;

[0045] Figure 5 This is another schematic diagram of display effect of the entity behavior portrait provided in the embodiment of the present application;

[0046] Figure 6 A schematic flowchart of another method for generating a behavior profile provided in an embodiment of the present application;

[0047] Figure 7 It is a schematic flow chart of an attack path of restoring an attack element through an entity behavior profile provided by an embodiment of the present application;

[0048] Figure 8 It is a structural diagram of a device for profiling the behavior of an entity provided in an embodiment of the present application;

[0049] Fig. 9 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The technical solution in the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0051] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0052] An embodiment of the present application provides a method for generating a behavior portrait, which is applied to an electronic device. The electronic device may be a device with a behavior portrait generation function, such as a terminal or a server, and this embodiment does not specifically limit this.

[0053] Figure 1 It is a schematic flowchart of a method for generating a behavior profile provided in an embodiment of the present application.

[0054] For example, Figure 1 As shown, the method includes:

[0055] S101, acquiring multi-source heterogeneous data.

[0056] In one possible implementation, the terminal can access multi-source heterogeneous data through a data collector or sensor. The multi-source heterogeneous data may include terminal behavior logs, network traffic logs, asset and vulnerability information, threat intelligence information, and other security device logs, such as honeypots, firewalls, etc. However, the embodiment of the present application does not limit the method of obtaining multi-source heterogeneous data and the type of multi-source heterogeneous data.

[0057] S102, determining different types of security entities according to multi-source heterogeneous data and target fields corresponding to different types of entities, and extracting behaviors and / or relationships corresponding to different types of security entities.

[0058] In a possible implementation, different types of security entities include: host entities, IP entities, domain name entities, and file entities. Among them, host entities include: computer hosts, internet hosts, etc.; IP entities include source addresses, destination addresses, etc.; domain name entities include various websites, etc.; file entities include files, processes, etc.

[0059] Optionally, each type of security entity corresponds to multiple target fields, and the target fields can be used to distinguish different types of security entities. Exemplarily, the target fields corresponding to IP type entities include "source address", "destination address" and the like.

[0060] In one possible implementation, the acquired multi-source heterogeneous data stream can be screened according to the target field to obtain a data stream containing security entities, and then the security entities corresponding to the target fields can be extracted from the data stream containing the security entities, and the behaviors and / or relationships of the security entities can be extracted.

[0061] Exemplarily, real-time extraction of security entities from multi-source heterogeneous data streams may be achieved by using a streaming analysis engine technology that supports Structured Query Language (SQL)-Like rules.

[0062] Optionally, in the case where different types of security entities include host-type entities, the behaviors and / or relationships of the host-type entities include: process creation behavior on the host, process injection behavior on the host, registry operation behavior on the host, sensitive file operation behavior on the host, scheduled task operation behavior on the host, service operation behavior on the host, script operation behavior on the host, user login behavior on the host, access relationship between the host and the IP, access relationship between the host and the domain name, access relationship between the host and the port, IP distribution relationship used by the host, etc.;

[0063] Among them, the process creation behavior on the host can be understood as: the behavior of creating a new process on the host according to the need of the host operating system to execute the program or the user's request. The process injection behavior on the host can be understood as: a kind of arbitrary code execution in the address space of an independent active process, running the code in the context of another process, which will allow access to the memory, system resources, network resources and possible privilege escalation of the process. The registry operation behavior on the host may include: adding, deleting, modifying, checking and other operations on the registry on the host, the behavior of running programs on the registry on the host, etc. The sensitive file operation behavior on the host may include: writing, reading, deleting sensitive files on the host, etc. The scheduled task operation behavior on the host may include: the scheduled task running time and running commands on the host. The service operation behavior on the host may include: the service creation of scheduled tasks on the host, the service startup of applications on the host, etc. The script operation behavior on the host may include: the script running time and number on the host, etc. The user login behavior on the host may include: the name of the software on the host that the user logs in, the number of logins, etc. The access relationship between the host and the IP may include: the name, time, and number of times the host accesses the IP, etc. The access relationship between the host and the domain name may include: the name of the domain name accessed by the host, the time and number of times the domain name is accessed. The access relationship between the host and the port may include: the name of the port accessed by the host, the time and number of times the port is accessed, etc. The IP distribution relationship used by the host may include: the name of the intranet IP used by the host, the name of the extranet IP, etc.

[0064] Optionally, in the case where different types of security entities include IP-type entities, the behaviors and / or relationships of the IP-type entities include: the behavior of IP accessing ports, the access relationship between IP and domain name, the access relationship between IPs, the distribution relationship of network events initiated by IPs, the distribution relationship of network events received by IPs, the distribution relationship of ports used by IPs, the access relationship between IP and host, the behavior of IP transmitting files, the distribution relationship of ports bound to IPs, etc.

[0065] Among them, the behavior of IP accessing the port may include: the name, time, number of times the IP accesses the port, etc. The access relationship between IP and domain name may include: the name of the domain name accessed by IP, the time and number of times the domain name is accessed, etc. The distribution relationship of network events initiated by IP may include: the identification, time, number of times the network event is initiated by IP, and the danger level of the network event, etc. The distribution relationship of network events received by IP may include: the identification, time, number of times the network event is received by IP, etc. The distribution relationship of ports used by IP may include: the name of the port used by IP, the number of times the IP uses the port, etc. The access relationship between IP and host may include: the name of the host visited by IP, the time and number of times the host is visited, etc. The behavior of IP transferring files may include: the time when IP transfers files, the destination object of IP transferring files, etc. The distribution relationship of ports bound to IP may include: the name, time, number of times the IP is bound to ports, etc.

[0066] Optionally, when different types of security entities include domain name entities, the behaviors and / or relationships of the domain name entities include: host distribution relationships of accessing domain names, process distribution relationships of requesting domain names, access relationships between domain names and ports, etc.

[0067] The host distribution relationship of accessing a domain name may include: the host name of the accessing domain name, the host identifier of the accessing domain name, etc. The process distribution relationship of requesting a domain name may include: the process name of the requesting domain name, the time when the process requests the domain name, etc. The access relationship between a domain name and a port may include: the name, time, number of times the domain name accesses the port, etc.

[0068] Optionally, when different types of security entities include file-type entities, the behaviors and / or relationships of the file-type entities include: process startup behavior corresponding to the file, process operation behavior corresponding to the file, registry operation file behavior, sensitive file operation behavior, distribution relationship of files on the host, distribution relationship of files on the IP, access relationship of files to IPs, and access relationship of files to domain names, etc.

[0069] Among them, the process startup behavior corresponding to the file may include: the time and number of times the process corresponding to the file is started. The process operation behavior corresponding to the file may include: the time when the process corresponding to the file is created, the time and number of times the process corresponding to the file is switched. The registry operation file behavior may include: the time and number of times the registry opens the file. The sensitive file operation behavior may include: the domain name and IP address accessed by sensitive files. The distribution relationship of files on the host may include: the time and number of times the file appears on the host, the name of the host where the file appears, that is, on which hosts the file appears, etc. The distribution relationship of files on IP may include: the name of the file transmitted by IP, the time when the file is transmitted by IP, etc. The access relationship of files to IP may include: the name of the IP address accessed by the file, the time of accessing the IP, etc. The access relationship of files to domain names may include: the name of the domain name accessed by the file, the time and number of times the domain name is accessed, etc.

[0070] In this embodiment, common security entities in security analysis are divided into four categories: host, IP, domain name, and file, and multiple behaviors and / or relationships are designed for each entity. That is, which behaviors and / or relationships should each security entity pay attention to in order to most efficiently help security analysts discover hidden threats, thereby forming an overall cognition and realizing effective association and integration of data.

[0071] In one possible implementation, each behavior and / or relationship of a security entity corresponds to multiple target fields. Extracting the behaviors and / or relationships corresponding to the different types of security entities in S102 may include: determining grouping conditions corresponding to the behaviors and / or relationships of the different types of security entities based on the multiple target fields corresponding to each behavior and / or relationship; and aggregating the multi-source heterogeneous data according to a preset time window based on the grouping conditions to obtain the behaviors and / or relationships of the different types of security entities.

[0072] For example, the multiple target fields corresponding to the behaviors and / or relationships of each type of security entity can be used as grouping conditions, and the multi-source heterogeneous data can be aggregated according to the preset time window to extract the behaviors and / or relationships corresponding to the different types of security entities. The preset time window can be a rolling time window or a sliding time window, and the duration corresponding to the preset time window can be set according to actual needs, which can be 1 hour, 30 minutes or other durations, and the embodiments of the present application do not limit this.

[0073] In one possible implementation, the terminal may use multiple target fields corresponding to each security entity behavior and / or relationship as grouping conditions according to a preset time window, and count the behaviors and / or relationships of the security entities in the preset time window through a count aggregation function.

[0074] For example, taking the extraction of access relations between IPs as an example, the source address and the destination address are used as grouping conditions, and counts are performed in hourly time windows. The counting result can express the number of times a source address accesses a destination address within a certain hourly time period.

[0075] Optionally, before extracting different types of security entities and entity behaviors, data cleansing may be performed on the acquired multi-source heterogeneous data.

[0076] S103, generating behavior profiles of different types of security entities according to behaviors and / or relationships corresponding to different types of security entities.

[0077] The behavior profiles of different types of security entities include the basic information of each security entity and the behavior and / or relationship of each security entity, so that the required information can be obtained through the security entity behavior profile, avoiding the need to search for information related to the security entity one by one from the security log when obtaining the behavior or relationship of a certain security entity. The basic information of the security entity includes: the name and identification of the security entity.

[0078] Exemplarily, the behavior profile of a host-type entity includes the identification of each host, the IP used, and the time and number of times the host accesses a certain domain name.

[0079] Through the above implementation, the terminal can extract different types of security entities and behaviors and / or relationships of security entities from multi-source heterogeneous data according to the target field, and extract the behaviors and / or relationships of security entities from the perspective of different types of security entities. The data value is effectively precipitated, which is conducive to generating high-value behavioral portraits to provide high-value references for subsequent security analysis. In addition, the above technical solution generates behavioral portraits of different types of security entities, so that when performing security analysis, different types of security entities can be analyzed based on the behavioral portraits of different types of security entities. The required information can be obtained through the behavioral portraits of security entities, avoiding the problem of searching for information related to a security entity one by one from the security log when obtaining the behavior or relationship of a certain security entity, which is conducive to improving the efficiency of security analysis.

[0080] Optionally, after generating the behavior profile of the security entity, the method may further include:

[0081] Store behavioral profiles of different types of security entities; when a request to query the behavioral profile of a security entity is detected, display the stored behavioral profile based on the request.

[0082] In one possible implementation, after generating a behavioral portrait of a security entity, the terminal can store the behavioral portraits of different types of security entities in a target storage layer according to the type of security entity, and when receiving a request to query the behavioral portrait of a security entity, the behavioral portrait of the security entity in the storage layer is displayed.

[0083] Optionally, the request for querying the security behavior portrait may include the name of the target security entity to be queried. The terminal searches for and displays the behavior portrait of the target security entity based on the name of the target security entity included in the request.

[0084] Exemplary, reference Figure 2 After detecting a request to query the behavior profile of a host entity, the behavior profile of the host entity is displayed. The behavior profile of the host entity includes: the host name, host identifier, operating system, and threat level information obtained based on security alerts.

[0085] Furthermore, when a request to query the behavior profile of a target host is detected, the behavior profile of the target host can be displayed. Figure 3 , a request to query the behavior profile of host 5GC98N is detected, and a page of the behavior profile of host 5GC98N is further displayed. Among them, the behavior profile of host 5GC98N includes information such as the name, identification, asset details, relationship network, behavior, process tree, and operation history of host 5GC98N. Optionally, the relationship network of the host includes files on the host, intranet access relationships, extranet access relationships, domain name access relationships, etc. Taking the files or processes on the host as an example, the hash, name, number on the host, and time of appearance on the host of each file or process are displayed.

[0086] When a request to query the host process tree is detected, the process behavior on the host is displayed. For example, to display the process creation behavior on the host, refer to Figure 4 The terminal searches for the process creation behavior of the host in the stored behavior profile and further displays the processes created on the host, where the processes created on the host include normal processes and malicious processes.

[0087] In a possible implementation, when displaying the processes created on the host, the terminal can mark the malicious processes according to the obtained security warning information, so as to facilitate security analysts to quickly locate the malicious process behaviors occurring on the host.

[0088] In another possible implementation, the security analyst can query the required process creation behavior through the query interface provided by the backend. Exemplarily, the process creation behavior can be screened by "process path" and "process ID".

[0089] It should be understood that "process path" and "process ID" are only a method of filtering process behavior provided in the embodiment of the present application. In actual applications, other fields can also be used to filter the behavior and / or relationship of other security entities. The embodiment of the present application does not limit this.

[0090] Optionally, when it is detected that the user clicks the "Show only alarm-related processes" control, the stored process creation behaviors are filtered to display only alarm-related processes, such as displaying Figure 4 Through the process tree, security analysts can quickly locate malicious process behaviors that have occurred on the host, quickly locate the process family of the malware, and conduct the next step of source tracing analysis. For example, when it is detected that the security analyst clicks on a process, the terminal can quickly drill down the data, obtain the security alert corresponding to the process and display it, which is convenient for security analysts to conduct false alarm analysis.

[0091] Exemplary, reference Figure 5 When the terminal detects the operation of clicking a process, it searches for the alarm information corresponding to the process in the obtained security log alarm information, and further displays the alarm information corresponding to the process. The alarm information corresponding to the process includes the start time, end time, alarm level, alarm name, and associated events of the process.

[0092] Through the above implementation method, the terminal can display the behavior portrait of the corresponding security entity according to the request for querying the behavior portrait of the security entity, which is convenient for security analysts to perform security analysis and improves human-computer interactivity.

[0093] Figure 6 It is a schematic flowchart of another method for generating a behavior profile provided in an embodiment of the present application.

[0094] Exemplarily, the method includes:

[0095] S601: Acquire multi-source heterogeneous data.

[0096] The multi-source heterogeneous data may include: terminal behavior logs, network traffic logs, honeypot logs, firewall logs, asset / vulnerability information, threat intelligence information, etc. The present application embodiment does not limit this.

[0097] S602: Entity portrait streaming calculation.

[0098] Optionally, S602 may include the following steps:

[0099] S603: Data cleaning.

[0100] Data cleaning is to filter out and remove duplicate and redundant data, complete missing data, correct or delete erroneous data, and finally organize it into data that can be further processed and used.

[0101] After receiving the multi-source heterogeneous data, the terminal cleans the accessed multi-source heterogeneous data to obtain standardized data so as to extract entities and behaviors and / or relationships of the entities.

[0102] S604: Entity extraction.

[0103] In a possible implementation, after obtaining the standardized data, the terminal can extract the security entity from the standardized data according to the target field. For a specific method of extracting the security entity, refer to the above description of Figure 1 The relevant description will not be repeated here.

[0104] S605: Entity behavior and / or relationship aggregation.

[0105] In a possible implementation, after obtaining the standardized data, the terminal can filter the standardized data according to the target field to obtain the data containing the security entity, and then use multiple target fields as grouping conditions to aggregate the data containing the security entity to obtain the behavior and / or relationship of the security entity. The specific method of extracting the behavior and / or relationship can refer to the above Figure 1 The relevant description will not be repeated here.

[0106] S606: Entity portrait update.

[0107] In one possible implementation, the terminal may generate behavior profiles of different types of security entities based on behaviors and / or relationships corresponding to different types of security entities.

[0108] The behavior profiles of different types of security entities include basic information of each security entity and the behavior and / or relationship of each security entity, etc. The basic information of the security entity includes: the name and identification of the security entity, etc.

[0109] Through the above implementation, the terminal can extract different types of security entities and behaviors and / or relationships of security entities from multi-source heterogeneous data according to the target field, and extract the behaviors and / or relationships of security entities from the perspective of different types of security entities. The data value is effectively precipitated, which is conducive to generating high-value behavioral portraits to provide high-value references for subsequent security analysis. In addition, the above technical solution generates behavioral portraits of different types of security entities, so that when performing security analysis, different types of security entities can be analyzed based on the behavioral portraits of different types of security entities. The required information can be obtained through the behavioral portraits of security entities, avoiding the problem of searching for information related to a security entity one by one from the security log when obtaining the behavior or relationship of a certain security entity, which is conducive to improving the efficiency of security analysis.

[0110] Optionally, after obtaining the entity behavior portrait, the following steps may also be included:

[0111] S607: Interactive display of entity portraits.

[0112] In one possible implementation, after generating the behavior portrait of the security entity, the terminal may also store the behavior portraits of different types of security entities, and display the behavior portraits of different types of security entities when a request to query the behavior portrait of the security entity is detected.

[0113] S608: Entity portrait query.

[0114] Optionally, security analysts can perform entity portrait queries through the interface provided by the backend.

[0115] For example, when a security analyst queries the behavior portrait of a host-type security entity through an interface provided by the backend, the terminal detects the request to query the host-type entity, and in response to the request, searches for and displays the behavior portrait of the host-type entity in the stored entity behavior portrait. The behavior portrait of the host-type entity includes the host name, host identifier, operating system, and threat level information obtained based on security alerts.

[0116] Optionally, when a security analyst queries a behavior portrait of a target host entity through a backend interface, the terminal detects the request to query the target host entity, and in response to the request, searches for and displays the behavior portrait of the target host in the stored host entity behavior portraits.

[0117] Among them, the entity behavior portrait of the target host may include information such as name, identification, asset details, relationship network, behavior, process tree, operation history, etc.

[0118] S609: aggregate display of host process tree.

[0119] Optionally, when a security analyst queries the process tree of a target host class entity through a back-end interface, the terminal detects the request to query the process tree of the target host entity, and in response to the request, searches for the process behavior of the target host in the stored target host entity behavior portrait and displays it comprehensively.

[0120] Among them, the processes of the target host include normal processes and malicious processes. The terminal can mark the malicious processes according to the security alarm information, which is convenient for security analysts to quickly locate the malicious process behavior on the target host.

[0121] S610: Drill down data.

[0122] Optionally, when a security analyst clicks on a malicious process, the terminal can quickly drill down to obtain the warning information of the malicious process from the security warning information and display it so that the security analyst can conduct false alarm analysis. The warning information corresponding to the process includes the start time, end time, warning level, warning name, and related events of the process.

[0123] Through the above implementation method, the terminal can display the behavior portrait of the corresponding security entity according to different requests for querying the behavior portrait of the security entity, which is convenient for security analysts to perform security analysis and improves human-computer interactivity.

[0124] In actual applications, when an attack element is detected, the attack path can be restored based on the behavior profile of the attack element. Figure 7 Describe the process of restoring the attack path.

[0125] Figure 7 It is a schematic flowchart of an attack path for restoring attack elements through security entity behavior profiling provided in an embodiment of the present application.

[0126] Exemplarily, the method includes:

[0127] S701: When an attack element is detected, determine a security entity corresponding to the attack element.

[0128] Optionally, the attack element may be a malicious file, a malicious domain name, a malicious IP, etc., which is not limited in the embodiments of the present application.

[0129] For example, assume the following attack scenario: an attacker uses a weak password to compromise an application server located on the external network and implants a Trojan virus. A staff member uses a work computer to access the application server and is infected with the Trojan virus. The staff member uses the work computer to access the internal network, and the Trojan virus attempts to attack the domain control server. The hacker moves laterally in the internal network through the machine infected with the Trojan virus to infect another server. The infected server connects to the external host and triggers an alarm.

[0130] When a trigger alarm is detected, it can be determined that there is an attack behavior, so that the attack element can be determined to be the above-mentioned Trojan virus, which is presented as the hash value of the file. In this case, the security entity corresponding to the attack element determined by the terminal is the file hash security entity that carries the above-mentioned Trojan virus. In this embodiment, the file-type security entity can include the above-mentioned file hash security entity.

[0131] S702: Search the generated behavior portraits of the different types of security entities for the behavior portrait of the security entity corresponding to the attack element.

[0132] Optionally, when the attack element is a malicious file, the entity behavior portrait of the malicious file is searched in the generated behavior portrait of the security entity. When the attack element is a malicious domain name, the entity behavior portrait of the malicious domain name is searched in the generated behavior portrait of the security entity.

[0133] Exemplarily, after the terminal determines the file hash security entity corresponding to the Trojan virus based on the security warning information, the behavior portrait of the file hash security entity can be searched in the generated security entity behavior portrait.

[0134] S703: Determine the attack path of the attack element according to the behavior profile of the security entity corresponding to the attack element.

[0135] Among them, the attack path can be understood as the path taken by the attack element to attack the asset.

[0136] Optionally, the behavior profile of the security entity corresponding to the attack element may include the time and number of times the attack element accesses the domain name, IP, and file. The terminal can determine the attack path of the attack element based on the time when the attack element accesses the domain name, IP, and file.

[0137] In a possible implementation, S703 may be implemented as follows: according to the behavior profile of the security entity corresponding to the attack element, find the security entity carrying the attack element. If there are multiple security entities carrying the attack element found, determine the time when the attack element appears in each security entity according to the behavior profile of each security entity, and determine the attack path of the attack element.

[0138] For example, assuming that the attack element is a Trojan virus in the above attack scenario, the terminal can view the IP and domain name carrying the Trojan virus through the behavior portrait of the file hash security entity carrying the Trojan virus, and further search for the behavior portrait of the security entity carrying the IP and domain name of the Trojan virus, so as to determine the time when the Trojan virus appears on the IP and domain name, and determine the attack path of the Trojan virus according to the time sequence of appearance.

[0139] In a possible implementation, after determining the time when the attack element appears in each security entity according to the behavior portrait of each security entity, it may also include: determining the security entity that first carries the attack element according to the time when the attack element appears in each security entity. Among the generated behavior portraits of different types of security entities, find the behavior portrait of the security entity that first carries the attack element. Based on the behavior portrait of the security entity that first carries the attack element, determine the malicious entities that the security entity that first carries the attack element has visited. Among them, the malicious entity includes any one of a malicious file, a malicious domain name, a malicious host, and a malicious IP.

[0140] Optionally, the terminal may determine the security entity that first carries the attack element according to the order in which the attack element appears on each security entity. For example, in the above attack scenario, the terminal may determine the host that is first infected by the Trojan virus according to the order in which the Trojan virus appears on each host.

[0141] In one possible implementation, the behavior profile of the security entity that first carries the attack element includes the access relationship of the security entity, for example, the access relationship between the security entity and the host, the access relationship between the security entity and the domain name, etc. The terminal can determine the malicious entities that the security entity has accessed based on these access relationships.

[0142] Exemplarily, after the terminal determines the host that first carries the malicious file, it can use the host's behavior profile to view the malicious domain names or malicious IPs visited by the host, thereby locating the attacker, who may include the above-mentioned malicious domain names or malicious IPs.

[0143] In one possible implementation, after determining the malicious entity that was first visited by the security entity carrying the attack element, it may also include: searching for the behavior profile of the malicious entity among the generated behavior profiles of different types of security entities; based on the behavior profile of the malicious entity, checking the security entities associated with the malicious entity, and locating the assets attacked by the attack element in the associated security entities.

[0144] For example, after determining the malicious domain name or malicious IP that the host has visited, the terminal uses the behavior profile of the malicious domain name or malicious IP to check other hosts or IPs that are connected to the malicious domain name or malicious IP, and locate other compromised assets. For example, other hosts or IPs that are connected to the malicious domain name or malicious IP can be understood as the above-mentioned other compromised assets.

[0145] Through the above implementation method, when an attack element is discovered, the complete attack behavior can be linked together and the attack path can be restored through the entity behavior portrait of the attack element, helping security analysts to quickly trace the known attack behaviors and perceive the complete attack surface.

[0146] In summary, the present application can extract different types of security entities and the behaviors and / or relationships of security entities from multi-source heterogeneous data according to the target field, extract the behaviors and / or relationships of security entities from the perspective of different types of security entities, and effectively precipitate the data value, which is conducive to generating high-value behavior portraits to provide high-value references for subsequent security analysis. In addition, the above technical solution generates behavior portraits of different types of security entities, so that when performing security analysis, different types of security entities can be analyzed based on the behavior portraits of different types of security entities. The required information can be obtained through the behavior portraits of security entities, avoiding the problem of searching for information related to the security entity one by one from the security log when wanting to obtain the behavior or relationship of a certain security entity, which is conducive to improving the efficiency of security analysis. In addition, the generated behavior portraits of different types of security entities are stored, and the behavior portraits of the corresponding security entities are displayed according to the request for querying the behavior portraits of the security entities, which is convenient for security analysts to perform security analysis and improves human-computer interactivity. When an attack element is discovered, the entity behavior portrait of the attack element can be used to connect the complete attack behavior and restore the attack path, helping security analysts to quickly trace the known attack behaviors and perceive the complete attack surface, further improving the efficiency of security analysis.

[0147] Figure 8 It is a structural diagram of a device for behavioral profiling of a security entity provided in an embodiment of the present application.

[0148] For example, Figure 8 As shown, the device 800 includes:

[0149] An acquisition module 801 is used to acquire multi-source heterogeneous data;

[0150] A determination module 802 is used to determine different types of security entities according to multi-source heterogeneous data and target fields corresponding to different types of entities, and to extract behaviors and / or relationships corresponding to different types of security entities;

[0151] The generation module 803 generates behavior portraits of different types of security entities according to the behaviors and / or relationships corresponding to different types of security entities.

[0152] In a possible implementation, different types of security entities include any combination of the following: host-type entities, Internet Protocol IP-type entities, domain name-type entities, and file-type entities.

[0153] In a possible implementation, when different types of security entities include host-type entities, the behaviors and / or relationships of the host-type entities include any combination of the following: process creation behavior on the host, process injection behavior on the host, registry operation behavior on the host, sensitive file operation behavior on the host, scheduled task operation behavior on the host, service operation behavior on the host, script operation behavior on the host, user login behavior on the host, access relationship between the host and the IP, access relationship between the host and the domain name, access relationship between the host and the port, and distribution relationship of IPs used by the host; When different types of security entities include IP-type entities, the behaviors and / or relationships of the IP-type entities include any combination of the following: behavior of IP accessing the port, access relationship between the IP and the domain name, access relationship between IPs, network events initiated by IPs The behaviors and / or relationships of the security entities include: the distribution relationship of the hosts that access the domain names, the distribution relationship of the processes that request the domain names, and the access relationship between the domain names and ports; the behaviors and / or relationships of the security entities include: the startup behavior of the process corresponding to the file, the operation behavior of the process corresponding to the file, the registry operation behavior, the sensitive file operation behavior, the distribution relationship of the files on the host, the distribution relationship of the files on the IP, the access relationship of the files to the IP, and the access relationship of the files to the domain names.

[0154] In one possible implementation, the determination module 802 is also used to: determine the grouping conditions corresponding to the behaviors and / or relationships of different types of security entities based on multiple target fields corresponding to each behavior and / or relationship; and aggregate multi-source heterogeneous data according to a preset time window based on the grouping conditions to obtain the behaviors and / or relationships of different types of security entities.

[0155] In one possible implementation, the device also includes: a storage module 804, which is used to store behavioral portraits of different types of security entities; and a display module 808, which is used to display the stored behavioral portrait according to the request when a request for querying the behavioral portrait of the security entity is detected.

[0156] In a possible implementation, the determination module 802 is further configured to: when an attack element is detected, determine a security entity corresponding to the attack element.

[0157] In a possible implementation, the device further includes: a search module 808, configured to search for a behavior profile of a security entity corresponding to an attack element among the generated behavior profiles of different types of security entities;

[0158] In a possible implementation, the determination module 802 is further used to determine the attack path of the attack element according to the behavior profile of the security entity corresponding to the attack element.

[0159] In one possible implementation, the search module 808 is also used to: search for the security entity carrying the attack element based on the behavior profile of the security entity corresponding to the attack element; the determination module 802 is also used to: if multiple security entities carrying the attack element are found, determine the time when the attack element appears in each security entity based on the behavior profile of each security entity found; and determine the attack path of the attack element based on the time when the attack element appears in each security entity.

[0160] In one possible implementation, the determination module 802 is also used to: determine the security entity that first carries the attack element among multiple security entities that carry the attack element based on the time when the attack element appears in each security entity; search for the behavior portrait of the security entity that first carries the attack element among the generated behavior portraits of different types of security entities; and determine the malicious entities that have been visited by the security entity that first carries the attack element based on the behavior portrait of the security entity that first carries the attack element, wherein the malicious entities include any one of malicious files, malicious domain names, malicious hosts, and malicious IP addresses.

[0161] In one possible implementation, the search module 808 is also used to: search for the behavior profile of the malicious entity among the generated behavior profiles of different types of security entities; based on the behavior profile of the malicious entity, check the security entities associated with the malicious entity, and locate the assets attacked by the attacked elements in the associated security entities.

[0162] Fig. 9 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0163] For example, Fig. 9 As shown, the electronic device 900 includes: a processor 901 and a memory 902, wherein an executable program code 904 is stored in a storage space 903 for storing program codes, and the processor 901 is used to call and execute the executable program code 904 to execute a method for generating a behavior profile.

[0164] In this embodiment, the electronic device can be divided into functional modules according to the above method example. For example, each functional module can be corresponded to, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0165] In the case of dividing each functional module according to each function, the electronic device may include: several modules of the exclusive part (acquisition module, determination module, generation module), etc. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0166] The electronic device provided in this embodiment is used to execute the above-mentioned method for generating a behavior portrait, and thus can achieve the same effect as the above-mentioned implementation method.

[0167] In the case of an integrated unit, the electronic device may include a processing module and a storage module. The processing module may be used to control and manage the actions of the electronic device. The storage module may be used to support the electronic device in executing mutual program codes and data.

[0168] The processing module may be a processor or a controller, which may implement or execute various exemplary logic blocks, modules and circuits disclosed in the present application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module may be a memory.

[0169] This embodiment also provides a computer-readable storage medium, in which a computer program code is stored. When the computer program code is executed on a computer, the computer executes the above-mentioned related method steps to implement a method for generating a behavior portrait in the above-mentioned embodiment.

[0170] This embodiment also provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the above-mentioned related steps to implement a method for generating a behavior portrait in the above-mentioned embodiment.

[0171] In addition, the electronic device provided in the embodiments of the present application may specifically be a chip, a component or a module, and the electronic device may include a connected processor and a memory; wherein the memory is used to store instructions, and when the electronic device is running, the processor may call and execute instructions so that the chip executes a method for generating a behavioral portrait in the above-mentioned embodiments.

[0172] Among them, the electronic device, computer-readable storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here.

[0173] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0174] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0175] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for generating a behavior profile, characterized in that: The method comprises: Acquire multi-source heterogeneous data; Determine the different types of security entities according to the target fields corresponding to the multi-source heterogeneous data and the different types of security entities, and extract the behaviors and / or relationships of the different types of security entities; Behavior profiles of the different types of security entities are generated based on the behaviors and / or relationships of the different types of security entities.

2. The method according to claim 1, characterized in that The different types of security entities include any combination of the following: host type entities, Internet Protocol IP type entities, domain name type entities, and file type entities.

3. The method according to claim 2, characterized in that In the case where the different types of security entities include the host-type entity, the behaviors and / or relationships of the host-type entity include any combination of the following: Process creation behavior on the host, process injection behavior on the host, registry operation behavior on the host, sensitive file operation behavior on the host, scheduled task operation behavior on the host, service operation behavior on the host, script operation behavior on the host, user login behavior on the host, access relationship between the host and IP, access relationship between the host and domain name, access relationship between the host and port, distribution relationship of IP used by the host; In the case where the different types of security entities include the IP type entities, the behaviors and / or relationships of the IP type entities include any combination of the following: The behavior of IP accessing ports, the access relationship between IP and domain name, the access relationship between IPs, the distribution relationship of network events initiated by IP, the distribution relationship of network events received by IP, the distribution relationship of ports used by IP, the access relationship between IP and host, the behavior of IP transferring files, and the distribution relationship of ports bound to IP; In the case where the different types of security entities include the domain name entity, the behaviors and / or relationships of the domain name entity include any combination of the following: The host distribution relationship of accessing domain names, the process distribution relationship of requesting domain names, and the access relationship between domain names and ports; In the case where the different types of security entities include the document-type entity, the behaviors and / or relationships of the document-type entity include any combination of the following: The process startup behavior corresponding to the file, the process operation behavior corresponding to the file, the registry operation file behavior, the sensitive file operation behavior, the distribution relationship of the file on the host, the distribution relationship of the file on the IP, the access relationship of the file to the IP, and the access relationship of the file to the domain name.

4. The method according to claim 1, characterized in that: Each of the behaviors and / or relationships of the different types of security entities corresponds to a plurality of target fields, and extracting the behaviors and / or relationships corresponding to the different types of security entities includes: Determining grouping conditions corresponding to the behaviors and / or relationships of the different types of security entities according to the multiple target fields corresponding to each behavior and / or relationship; According to the grouping condition, the multi-source heterogeneous data are aggregated according to a preset time window to obtain the behaviors and / or relationships of the different types of security entities.

5. The method according to any one of claims 1 to 4, characterized in that: After generating the behavior portraits of the different types of security entities, the method further includes: Storing behavioral profiles of the different types of security entities; When a request to query a behavior profile of a security entity is detected, the stored behavior profile is displayed according to the request.

6. The method according to any one of claims 1 to 4, characterized in that: After generating the behavior portraits of the different types of security entities, the method further includes: When an attack element is detected, determining a security entity corresponding to the attack element; Searching for a behavior profile of a security entity corresponding to the attack element in the generated behavior profiles of the different types of security entities; The attack path of the attack element is determined according to the behavior profile of the security entity corresponding to the attack element.

7. The method according to claim 6, characterized in that The determining the attack path of the attack element according to the behavior profile of the security entity corresponding to the attack element includes: Finding the security entity carrying the attack element according to the behavior profile of the security entity corresponding to the attack element; If multiple security entities carrying the attack element are found, determine the time when the attack element appears in each of the security entities according to the behavior profile of each of the security entities found; An attack path of the attack element is determined according to the time when the attack element appears in each of the security entities.

8. A device for generating a behavior profile, characterized in that: The device comprises: Acquisition module, used to acquire multi-source heterogeneous data; A determination module, configured to determine the different types of security entities according to the multi-source heterogeneous data and target fields corresponding to the different types of entities, and extract behaviors and / or relationships corresponding to the different types of security entities; A generation module generates behavior profiles of the different types of security entities according to the behaviors and / or relationships corresponding to the different types of security entities.

9. An electronic device, characterized in that: The electronic device comprises: A memory for storing executable program codes; A processor, configured to call and run the executable program code from the memory, so that the electronic device executes the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 is implemented.

Images