Abnormal recognition method and device, computer equipment and storage medium

Abstract

The invention relates to an exception identification method and device, computer equipment and a storage medium, and relates to the technical field of network security. The method comprises the steps of performing operation simulation on a to-be-detected program based on a pre-generated virtual environment to obtain program activity data and communication session data generated in the operation process of the to-be-detected program; the program activity data is business data generated when the to-be-detected program is executed; the communication session data is data generated when the to-be-detected program establishes communication with the network object; determining a plurality of first statistical data corresponding to the program activity data, and determining a plurality of second statistical data based on the communication session data and an accessible list corresponding to the communication authority of the to-be-detected program; and determining an exception identification result of the to-be-detected program based on the first statistical data, the second statistical data and an exception threshold corresponding to the communication authority of the to-be-detected program. By adopting the method, the accuracy of abnormal recognition can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an anomaly identification method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] Network construction is used to meet a variety of business needs. There are artificially designed codes and programs in cyberspace, and they communicate automatically through codes and programs to complete the execution process of the required business. However, criminals attack cyberspace through harmful behaviors with high concealment and public hazards in cyberspace, causing threats to cyberspace.

[0003] At present, threats to cyberspace are becoming more covert, becoming more and more dense, and detection and evidence collection are becoming more and more difficult. In related technologies, terminal detection and evidence collection technology can be used to detect and analyze network traffic data in cyberspace. However, after abnormal traffic is detected, anti-forensic detection self-destruction, payload fileless operation, and escape technology will be activated, resulting in insufficient accuracy in anomaly identification. Summary of the invention

[0004] Based on this, it is necessary to provide an anomaly identification method, apparatus, computer device, computer-readable storage medium and computer program product that can improve the accuracy of anomaly identification in order to address the above technical problems.

[0005] In a first aspect, the present application provides an abnormality identification method. The method comprises:

[0006] Based on the pre-generated virtual environment, the program to be detected is run simulated to obtain the program activity data and communication session data generated by the program to be detected during the running process; the program activity data is the business data generated when the program to be detected is executed; the communication session data is the data generated when the program to be detected establishes communication with the network object;

[0007] Determine a plurality of first statistical data corresponding to the program activity data, and determine a plurality of second statistical data based on the communication session data and an accessible list corresponding to the communication permission of the program to be detected;

[0008] Based on the first statistical data, the second statistical data, and an abnormality threshold corresponding to the communication authority of the program to be detected, an abnormality identification result of the program to be detected is determined.

[0009] In one embodiment, the operation simulation of the program to be detected based on the pre-generated virtual environment to obtain the program activity data and communication session data generated during the operation of the program to be detected includes:

[0010] Running the program to be detected in a pre-generated virtual environment, and obtaining network traffic data and behavior logs of the program to be detected generated during the running of the program to be detected through a hidden interface of the virtual environment;

[0011] Parsing the network traffic data to determine program activity data of the program to be detected and each network object;

[0012] The behavior log is parsed to obtain communication session data between the program to be detected and each of the network objects; the communication session data includes data interaction records generated during the operation of the program to be detected; the data interaction records include access records between the program to be detected and each of the network objects; the network objects include programs and websites.

[0013] In one embodiment, based on the communication session data and the accessible list corresponding to the communication permission of the program to be detected, a plurality of second statistical data are determined, including:

[0014] Determining an actual access list corresponding to the program to be detected based on the data interaction record in the communication session data;

[0015] Determine the number of network objects that exist in the actual access list and do not exist in the accessible list corresponding to the communication permission of the program to be detected as the second statistical data;

[0016] For the network objects that exist in the actual access list and in the accessible list, the access time, access frequency, access duration and communication traffic between the program to be detected and the network objects are determined as the second statistical data.

[0017] In one embodiment, the method further comprises:

[0018] Determine the program permission range of each of the network objects and the program to be detected in the accessible list, and the data interaction record between the program to be detected and each of the network objects in the actual access list;

[0019] The number of interaction operations exceeding the program authority range in the data interaction record is determined as the second statistical data.

[0020] In one embodiment, determining the abnormality identification result of the program to be detected based on the first statistical data, the second statistical data, and the abnormality threshold corresponding to the communication authority of the program to be detected includes:

[0021] If a first number of the first statistical data satisfies a first abnormality threshold corresponding to the communication authority, and a second number of the second statistical data satisfies a second abnormality threshold corresponding to the communication authority, determining that the abnormality identification result of the program to be detected is abnormal;

[0022] The abnormal threshold is determined based on a threshold template corresponding to each statistical data and the communication authority of the program to be detected, and the threshold template contains the abnormal thresholds corresponding to each statistical data at different communication abnormality levels.

[0023] In one embodiment, after determining the abnormality identification result of the program to be detected, the method further includes:

[0024] In the case where the program to be detected is determined to be an abnormal program based on the abnormal identification result, the communication authority corresponding to the abnormal program is updated to obtain an updated abnormal program.

[0025] In one embodiment, updating the communication authority corresponding to the abnormal program to obtain an updated abnormal program includes:

[0026] Determine that the first statistical data satisfies the corresponding first abnormality threshold, and the second statistical data satisfies the corresponding second abnormality threshold, as target statistical data;

[0027] Determining the communication anomaly level corresponding to each of the target statistical data according to the threshold template corresponding to each of the target statistical data;

[0028] Determining the update authority level corresponding to the abnormal program according to the communication abnormality level corresponding to each of the target statistical data;

[0029] Based on the updated authority level, the communication authority level corresponding to the communication authority of the abnormal program is updated to obtain an updated abnormal program.

[0030] In a second aspect, the present application also provides an abnormality identification device. The device comprises:

[0031] A first data determination module is used to perform a running simulation on the program to be detected based on a pre-generated virtual environment to obtain program activity data and communication session data generated during the running of the program to be detected; the program activity data is the business data generated when the program to be detected is executed; the communication session data is the data generated when the program to be detected establishes communication with a network object;

[0032] A second data determination module, configured to determine a plurality of first statistical data corresponding to the program activity data, and to determine a plurality of second statistical data based on the communication session data and an accessible list corresponding to the communication authority of the program to be detected;

[0033] The anomaly identification module is used to determine an anomaly identification result of the program to be detected based on the first statistical data, the second statistical data, and an anomaly threshold corresponding to the communication authority of the program to be detected.

[0034] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method described in the first aspect are implemented.

[0035] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0036] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0037] The above-mentioned abnormality identification method, device, computer equipment, storage medium and computer program product, through a pre-generated virtual environment, simulates the operation of the program to be detected. The program to be detected can establish communication with each network object and interact with each network object to generate business data corresponding to the program to be detected. Based on this, the identification and monitoring device can obtain the program activity data and communication session data generated by the program to be detected during operation. The various data in the program activity data and the communication session data are counted respectively to obtain multiple first statistical data and multiple second statistical data. Each statistical data can represent part of the operation characteristics of the program to be detected. A large number of behavioral characteristics of the program to be detected can be obtained through multiple statistical data. Afterwards, according to the abnormal threshold corresponding to the communication authority of the program to be detected, the correlation between the first statistical data, the second statistical data and the abnormal threshold is determined, and the abnormal identification result corresponding to the program to be detected is determined through the correlation. The virtual environment of the identification monitoring device can bypass the anti-detection strategy of the abnormal program through the background interface, and only obtains the program activity data and communication session data generated during the running of the program to be detected, as well as the first statistical data and the second statistical data corresponding to the program activity data and the communication session data respectively. By analyzing the first statistical data and the second statistical data, the data volume and recognition complexity of abnormal identification can be reduced, and the abnormal traffic of the program to be detected can be prevented from being detected and taking self-destruction, escape and other behaviors, thereby identifying abnormal traffic and abnormal programs and improving the accuracy of abnormal identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 An application environment diagram of an abnormality identification method in an embodiment;

[0040] Figure 2 A schematic diagram of a flow chart of an abnormality identification method in one embodiment;

[0041] Figure 3 A schematic diagram of an identification monitoring device in one embodiment;

[0042] Figure 4 is a schematic diagram of an abnormality identification system in one embodiment;

[0043] Figure 5 is a schematic diagram of a data monitoring module in one embodiment;

[0044] Figure 6 is a structural block diagram of an abnormality identification device in an embodiment;

[0045] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0047] The abnormality identification method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the device terminal 102 communicates with the identification and monitoring device 104 through a network or a communication line. The identification and monitoring device 104 can generate a virtual environment for the device terminal 102 to run the program to be detected. The device terminal 102 can run the program to be detected in the virtual environment, and the identification and monitoring device 104 can monitor the program activity data and communication session data generated by the running of the program to be detected. After a preset time period, the identification and monitoring device 104 determines a plurality of first statistical data and a plurality of second statistical data corresponding to the program activity data and the communication session data, respectively, and determines whether there is an abnormality in the statistical data, whether there is an abnormality in the traffic data, and whether there is an abnormality in the program to be detected according to the abnormal threshold of the communication authority of the program to be detected. The identification and monitoring device 104 can be connected to a public network and access network objects in the public network.

[0048] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The identification and monitoring device 104 may be implemented using an independent server device or a server cluster consisting of multiple cloud servers.

[0049] In an exemplary embodiment, Figure 2 As shown, a method for identifying anomalies is provided, which is applied to Figure 1 The identification monitoring device 104 in the example is used as an example to illustrate, including the following steps S202 to S206. Among them:

[0050] Step S202 , based on the pre-generated virtual environment, the program to be detected is simulated for operation, and program activity data and communication session data generated during the operation of the program to be detected are obtained.

[0051] Among them, the virtual environment is used to independently execute the program to be detected to avoid interaction between the program to be detected and programs in other device terminals; the program activity data is the business data generated when the program to be detected is executed; the communication session data is the data generated when the program to be detected establishes communication with the network object.

[0052] Specifically, the identification and monitoring device can generate at least one independent virtual environment after being turned on, and each virtual environment can be used to simulate at least one program to be detected; the program to be detected in the virtual environment can come from one or more device terminals. The device terminal sends the program to be detected to the virtual environment of the identification and monitoring device through a communication connection, and the program to be detected relies on the virtual environment to run. The identification and monitoring device can monitor the running process of the program to be detected, and the program to be detected will establish a communication connection with multiple network objects when running, and generate communication session data between the program to be detected and each network object. After establishing the communication connection, the program to be detected will initiate a service request to the network object, thereby sending or receiving service data to the network object, and processing the service data.

[0053] Step S204, determining a plurality of first statistical data corresponding to the program activity data, and determining a plurality of second statistical data based on the communication session data and an accessible list corresponding to the communication authority of the program to be detected.

[0054] The first statistical data is the statistical data of various quantifiable data in the program activity data, such as the amount of data requested for business data within a preset time period, the number of requests, the amount of data sent, and the average request interval. The second statistical data is the statistical value corresponding to the network objects in the communication session data that have differences in the accessible list corresponding to the communication permissions of the program to be detected. For example, the statistical value can be a variety of quantitative data between the network object and the program to be detected.

[0055] Specifically, the identification monitoring device can be based on the attribute values ​​of the program activity data, such as the request time when the program to be detected initiates a request for the business data of the network object, the number of requests within a preset time period, etc.; the reception time when the program to be detected actually obtains the business data, the amount of received data, etc.; and the generation time corresponding to the network object generating the business data, and the amount of data sent by the network object to the program to be detected. In addition, the program to be detected will also send data to the network object, and there is also an amount of data sent by the program to be detected. The identification monitoring device can identify the operations experienced by each business data in the program to be detected, such as storage address, generation operation, deletion operation, upload operation and download operation, etc., and can use the number of operations of each business data as part of the first statistical data.

[0056] Step S206: determining an abnormality identification result of the program to be detected based on the first statistical data, the second statistical data, and an abnormality threshold corresponding to the communication authority of the program to be detected.

[0057] The program to be detected has preset communication permissions, and each communication permission corresponds to a set of abnormal thresholds. Each set of abnormal thresholds includes a threshold corresponding to each statistical data item in the first statistical data and the second statistical data.

[0058] Specifically, the identification monitoring device can determine the abnormal threshold corresponding to each statistical data according to the communication authority of the program to be detected. If the value of the statistical data does not meet the abnormal identification condition corresponding to the abnormal threshold, it can be determined that the statistical data is abnormal. The abnormal identification condition can be that the value of the statistical data is less than the abnormal threshold, the value of the statistical data is not within the range corresponding to the abnormal threshold, or the value of the statistical data is greater than the abnormal threshold, etc., which is not specifically limited in the embodiments of the present application.

[0059] If the abnormality identification result corresponding to one or more of the first statistical data and the second statistical data is abnormal, it can be determined that the abnormality identification result of the program to be detected is abnormal. In addition, for the statistical data between the program to be detected and a certain network object, the identification and detection device can determine whether the statistical data is abnormal, thereby determining that the network traffic data between the program to be detected and the network object is abnormal.

[0060] In the above-mentioned anomaly identification method, the operation of the program to be detected is simulated through a pre-generated virtual environment. The program to be detected can establish communication with each network object and interact with each network object to generate business data corresponding to the program to be detected. Based on this, the identification and monitoring device can obtain the program activity data and communication session data generated by the program to be detected during operation. The various data in the program activity data and the communication session data are counted respectively to obtain a plurality of first statistical data and a plurality of second statistical data. Each statistical data can represent part of the operation characteristics of the program to be detected, and a large number of behavioral characteristics of the program to be detected can be obtained through multiple statistical data. Afterwards, according to the abnormal threshold corresponding to the communication authority of the program to be detected, the correlation between the first statistical data, the second statistical data and the abnormal threshold is determined, and the abnormal identification result corresponding to the program to be detected is determined through the correlation. The virtual environment of the identification monitoring device can bypass the anti-detection strategy of the abnormal program through the background interface, and only obtains the program activity data and communication session data generated during the running of the program to be detected, as well as the first statistical data and the second statistical data corresponding to the program activity data and the communication session data respectively. By analyzing the first statistical data and the second statistical data, the data volume and recognition complexity of abnormal identification can be reduced, and the abnormal traffic of the program to be detected can be prevented from being detected and taking self-destruction, escape and other behaviors, thereby identifying abnormal traffic and abnormal programs and improving the accuracy of abnormal identification.

[0061] In an exemplary embodiment, the specific implementation process of the step of "based on the pre-generated virtual environment, simulating the operation of the program to be detected to obtain the program activity data and communication session data generated during the operation of the program to be detected" includes:

[0062] Run the program to be detected in a pre-generated virtual environment, and obtain the network traffic data and behavior log of the program to be detected generated during the operation of the program to be detected through the hidden interface of the virtual environment; parse the network traffic data to determine the program activity data of the program to be detected and each network object. Parse the behavior log to obtain the communication session data between the program to be detected and each network object.

[0063] The communication session data includes data interaction records generated during the operation of the program to be detected; the data interaction records include access records between the program to be detected and various network objects; and the network objects include programs and websites.

[0064] Specifically, the identification monitoring device starts a virtual environment and runs the program to be detected for a preset time period. The virtual environment is configured with a hidden interface, which does not interact with the program to be detected, and the program to be detected cannot identify the hidden interface. The hidden interface can automatically record the interaction process between the program to be detected and each network object during operation, and generate a behavior log of the program to be detected and each network object. In addition, the identification monitoring device can automatically back up the network traffic data between the program to be detected and each network object through the hidden interface.

[0065] The identification and detection device parses the network traffic data obtained from the hidden interface, determines the business data between the program to be detected and each network object, and the operation record of the business data, and merges the business data and the operation record of the business data as program activity data. The identification and monitoring device parses the behavior log obtained from the hidden interface, determines the communication session data for establishing communication between the program to be detected and each network object, and the communication session data may include the session data for starting to establish communication between the program to be detected and the network object, the session data during the communication process, and the session data for ending the communication. The identification and detection device integrates the communication session data corresponding to each network object, and can obtain the data interaction record between the program to be detected and each network object.

[0066] In this embodiment, the network flow data and behavior logs are obtained through the hidden interface of the virtual environment, and the network flow data and behavior logs are parsed respectively, so that the program activity data of the program to be detected and each network object, as well as the communication session data of the program to be detected and each network object can be obtained, which can reduce the probability that the program to be detected recognizes that the detection device is detecting, and improve the success rate of obtaining network flow data and behavior logs. In addition, the program activity data and communication session data of the program to be detected and each network object that has interacted can be accurately obtained through parsing.

[0067] In an exemplary embodiment, the specific implementation process of the step of "determining a plurality of second statistical data based on the communication session data and the accessible list corresponding to the communication permission of the program to be detected" includes:

[0068] Based on the data interaction records in the communication session data, determine the actual access list corresponding to the program to be detected; determine the number of network objects that exist in the actual access list and do not exist in the accessible list corresponding to the communication permissions of the program to be detected, which is the second statistical data; for the network objects that exist in the actual access list and in the accessible list, determine the access time, access frequency, access duration and communication traffic between the program to be detected and the network objects, which is the second statistical data.

[0069] Among them, the actual access list is the list of networks and programs accessed by the program to be detected during this operation. The accessible list can be determined by a pre-configured global whitelist and a global blacklist. All network objects in the global whitelist can be used as network objects in the accessible list, and all network objects in the global blacklist cannot be used as network objects in the accessible list. The accessible list can also include some network objects. For some network objects, if the communication authority of the program to be detected meets the authority requirements of some network objects, the part of the network objects can be entered into the accessible list. Based on this, the accessible list can be composed of a global whitelist, a global blacklist, and a list corresponding to some network objects. If there are repeated network objects in the three lists, the final accessible list is determined in the order of the global blacklist, the global whitelist, and the lists corresponding to some network objects.

[0070] Specifically, the identification and monitoring device can obtain data interaction records in the communication session data, determine the network objects that interact with the program to be detected, and establish an actual access list corresponding to the above network objects. The identification and detection device can obtain an accessible list corresponding to the communication authority of the program to be detected. For the actual access list and the accessible list, the identification and detection device can determine the network objects that exist in the actual access list but do not exist in the accessible list, and determine the number of these network objects as part of the second statistical data. In addition, the identification and detection device can determine that the network objects that exist in the actual access list and also exist in the accessible list are target network objects. The identification and detection device can determine the access time, access frequency, access duration and communication traffic between the program to be detected and the target network object within a preset time period based on the communication session data, as part of the second statistical data.

[0071] In this embodiment, by determining the number of network objects that exist in the actual access list but not in the accessible list, and determining the statistical value of network objects that exist in the actual access list and in the accessible list, as the second statistical data, statistical data of multiple data dimensions can be obtained, thereby increasing the comprehensiveness of the statistical data.

[0072] In an exemplary embodiment, the method also includes: determining the program authority range of each network object and the program to be detected in the accessible list, and the data interaction records between the program to be detected and each network object in the actual access list; determining the number of interaction operations that exceed the program authority range in the data interaction records as the second statistical data.

[0073] Among them, for different communication permissions, the interactive operations between the program to be detected and each network object have different program permission ranges. For example, under the first communication permission, the program to be detected can only access the business data of the network object, and cannot request and download business data. Under the second communication permission, the program to be detected cannot interact with the network object.

[0074] Specifically, the identification and detection device determines the scope of program permissions between each network object in the accessible list and the program to be detected according to the communication permissions of the program to be detected. The identification and detection device can respectively obtain the data interaction records between the program to be detected and each network object in the actual access list. The identification and monitoring device can identify the interaction operations in each pair of data interaction records that exceed the scope of program permissions corresponding to the pair of data interaction records, and record the number of interaction operations as part of the second statistical data corresponding to the pair of data interaction records.

[0075] In this embodiment, the existence of super-authority interaction operations in the data interaction record is determined through the program authority range, and the number of interaction operations is used as the second statistical data, which can further enrich the data dimension of the second statistical data and increase the comprehensiveness of the data.

[0076] In an exemplary embodiment, the specific implementation process of the step of “determining the abnormality identification result of the program to be detected based on the first statistical data, the second statistical data, and the abnormality threshold corresponding to the communication authority of the program to be detected” includes:

[0077] If a first quantity of first statistical data satisfies a first abnormality threshold corresponding to the communication authority, and a second quantity of second statistical data satisfies a second abnormality threshold corresponding to the communication authority, it is determined that the abnormality identification result of the program to be detected is abnormal.

[0078] The abnormal threshold is determined based on the threshold template corresponding to each statistical data and the communication authority of the program to be detected. The threshold template contains the abnormal thresholds corresponding to each statistical data under different communication abnormality levels. For example, the communication abnormality level is divided into ten levels, the communication authority of the program to be detected is the first authority, and the communication normal level of the first authority is one to five, then it can be determined that the communication abnormality level corresponding to the first authority is six to ten.

[0079] Specifically, for multiple first statistical data, the identification and detection device can determine the first abnormality threshold corresponding to each first statistical data under the communication authority according to the communication abnormality level corresponding to the communication authority and the threshold template; similarly, for multiple second statistical data, the identification and detection device can determine the second abnormality threshold corresponding to each second statistical data under the communication authority according to the communication abnormality level corresponding to the communication authority and the threshold template.

[0080] Determine whether each first statistical data satisfies the corresponding first abnormality threshold, and obtain the number of first statistical data that satisfies the first abnormality threshold corresponding to the first statistical data; determine whether each second statistical data satisfies the second abnormality threshold corresponding to the second statistical data, and obtain the number of second statistical data that satisfies the corresponding second abnormality threshold. When the number of first statistical data is greater than or equal to the first number, and the number of second statistical data is greater than or equal to the second number, it can be determined that the abnormality identification result of the program to be detected is abnormal. The first number and the second number can be configured according to user needs.

[0081] Optionally, for a certain first statistical data or second statistical data, there may be multiple first abnormal thresholds or second abnormal thresholds under the communication authority. For example, the communication normal level of the first authority is one to five, and six to ten can be determined as the communication abnormal level, and the thresholds corresponding to six to ten can be determined in the threshold template as abnormal thresholds. Preferably, the identification monitoring device can screen among the multiple abnormal thresholds, and the abnormal threshold closest to the threshold corresponding to the normal communication level is the optimal abnormal threshold, and is used as the abnormal threshold corresponding to the statistical data.

[0082] In this embodiment, by determining the first number of first statistical data that meet the first abnormality threshold and determining the second number of second statistical data that meet the second abnormality threshold, it can be determined that the abnormality recognition result of the program to be detected is abnormal. It can determine whether there is an abnormality in the program to be detected at the multi-dimensional statistical data level and improve the recognition accuracy.

[0083] In an exemplary embodiment, after the step of “determining the abnormality identification result of the program to be detected”, the method further includes:

[0084] When it is determined that the program to be detected is an abnormal program based on the abnormality identification result, the communication authority corresponding to the abnormal program is updated to obtain an updated abnormal program.

[0085] Specifically, if the abnormal identification result is that the program to be detected is an abnormal program, the current communication authority of the abnormal program can be updated to obtain the abnormal program with updated communication authority. At this time, the abnormal program will not be able to perform interactive operations outside the scope of the communication authority.

[0086] In this embodiment, by adjusting the communication authority of abnormal programs, the device terminal can be protected from being invaded by abnormal programs, thereby increasing network security.

[0087] In an exemplary embodiment, the specific implementation process of the step of "updating the communication authority corresponding to the abnormal program to obtain the updated abnormal program" includes:

[0088] Determine that the first statistical data satisfies the corresponding first abnormality threshold, and the second statistical data satisfies the corresponding second abnormality threshold, as target statistical data; determine the communication abnormality level corresponding to each target statistical data according to the threshold template corresponding to each target statistical data; determine the update authority level corresponding to the abnormal program according to the communication abnormality level corresponding to each target statistical data; based on the update authority level, update the communication authority level corresponding to the communication authority of the abnormal program to obtain an updated abnormal program.

[0089] Specifically, the identification monitoring device can determine all statistical data whose first statistical data satisfies the corresponding first abnormal threshold, and all statistical data whose second statistical data satisfies the corresponding second abnormal threshold, and determine them as target statistical data. The target statistical data are all statistical data that meet the abnormal threshold. Based on this, for each target statistical data, the identification detection device can determine the communication abnormality level corresponding to the current target statistical data according to the communication abnormality level in the threshold template and the abnormal threshold of each communication abnormality level. For example, the value of the target statistical data is 100, and its corresponding abnormal threshold is 50, and the target statistical data is greater than the corresponding abnormal threshold. At this time, the communication abnormality level of the statistical data in the threshold template is divided into: [50, 5 levels], [60, 6 levels]......[100, 10 levels], then it can be determined that the communication abnormality level corresponding to the target statistical data is 10 levels.

[0090] Afterwards, the communication authority level corresponding to the communication authority of the abnormal program is determined, and the level difference between the communication authority level and the communication abnormality level is determined to be determined as the initial update level. After obtaining the initial update level corresponding to each target statistical data, the initial update levels corresponding to multiple target statistical data are weighted and summed to obtain the update authority level corresponding to the abnormal program. Among them, each different target statistical data is assigned a different weight. The identification monitoring device updates the communication authority level of the abnormal program according to the update authority level to obtain an updated abnormal program.

[0091] In this embodiment, by determining the target statistical data and the communication anomaly level corresponding to the target statistical data, the level difference between the communication anomaly level and the communication authority level can be determined, and the update authority level can be determined based on the level difference. Finally, the communication authority level of the abnormal program is updated by updating the authority level, so that the communication authority of the abnormal program can be accurately adjusted to improve the security of the network.

[0092] The specific implementation process of the above-mentioned abnormality identification method is described in detail below in conjunction with a specific embodiment. Figure 3As shown, the identification and detection device may include multiple network interfaces and data interfaces, which may be connected to a public network through the network interface and may be connected to a device terminal through the data interface. Specifically, the identification and monitoring device is connected to the device terminal through a data cable, and at the same time, the network cable of the device terminal is inserted into the network interface of the identification and monitoring device, thereby establishing a communication connection. There is an abnormality identification system in the identification and detection device, and the abnormality identification system may establish a corresponding virtual environment for the program to be detected, and extract the program activity data and communication session data of the program to be detected. Afterwards, the preset abnormality identification setting is matched through the storage space of the identification and monitoring device, and the program activity data and communication session data obtained by the device are monitored according to the abnormality identification setting. The abnormality identification setting is the entire judgment strategy for determining the abnormality identification result through statistical data and abnormal thresholds in the above method.

[0093] like Figure 4 As shown, the abnormality identification system may include a communication forwarding module, an independent communication module, a data monitoring module, a virtual operation module, an abnormality threshold setting module, an authority level change module, an interaction trajectory analysis module and an identification and judgment module.

[0094] Among them, the communication forwarding module is used to connect the Ethernet physical segment to forward network communication data; the independent communication module is used to connect to the adapted terminal device or server by wired or wireless means; the data monitoring module is used to obtain the network traffic data and the program behavior log within the set time range, and extract the business data from the network traffic data and the data interaction record from the behavior log respectively; the virtual operation module is used to generate a virtual operation environment, and when the program is running, the program to be monitored will be run in the operation environment, and the data will be sent and received in the operation environment; the abnormal threshold setting module is used to set the monitoring threshold for the statistical data obtained by the data monitoring module, and when one or more of the data reaches an abnormal value, the abnormal threshold setting module will generate a monitoring threshold. When the abnormal threshold is reached, the communication abnormality level of the program is judged according to the level corresponding to the abnormal threshold, and the corresponding action instructions are executed; the permission change module is used to upgrade or downgrade the permissions of the source program of the abnormal data and the program that interacts within the set time period according to the judgment result of the abnormal threshold setting module; the interaction trajectory analysis module is used to analyze the behavior log obtained by the data monitoring module to determine whether the communication behavior of the program exceeds the authority or exceeds the list of programs that usually interact; the identification and judgment module is used to identify and determine the abnormal communication behavior of the program, and judge and find the initiator of the abnormal communication; identify abnormal communication behavior, form a monitoring log, control the communication permission of the abnormal program, and record the abnormal identification results.

[0095] In one example, if Figure 5As shown, the data monitoring module also includes: a sending and receiving behavior monitoring unit, an access list unit, an access monitoring unit, a flow monitoring unit and a behavior track recording unit.

[0096] Specifically, the sending and receiving behavior monitoring unit is used to monitor the communication data sending and receiving behavior and the activity data sending and receiving behavior of the program running; the access list unit is used to establish a white list and a black list for data interaction access, wherein the data interaction list includes a list of programs that interact with the program, a list of websites for network access and response, and the scope of program permissions for sending and receiving instructions to each other; the access monitoring unit is used to monitor access records based on the data interaction list data established by the access list unit, and the records include access time, access frequency, access duration, communication type and communication traffic; the traffic monitoring unit is used to monitor the communication traffic data between one or more programs and their interactive programs, and determine whether the traffic data is abnormal; the behavior trajectory recording unit is used to obtain the operation log of the program's business data, including occupying files, generating files, deleting files, uploading or downloading data.

[0097] In one example, the data monitoring module extracts network traffic data and session data and data interaction lists from behavior logs in the following specific steps:

[0098] S1.1: The virtual operation module creates a virtual environment consistent with the terminal system, including the corresponding operating system, hardware resources, and dependent libraries and interfaces required for program operation, and loads the program to be tested into the virtual environment and starts it to simulate its behavior in the real system.

[0099] S1.2: Monitor the network activities of the program to be detected in the virtual environment in real time, collect all network traffic data entering and leaving the virtual environment, and record the program's behavior log. Based on the pre-configured communication permissions, the data monitoring module captures all data packets in the network traffic data that the program to be detected communicates with the outside world.

[0100] S1.3: Analyze the source address and destination address, transmission protocol and timestamp of the network traffic data packet to identify all session data within the preset time period, and then obtain the interaction behavior between the program to be detected and other programs or system resources from the behavior log, and record the time, target object and specific operation of each interaction behavior.

[0101] S1.4: Analyze the system calls in the behavior log, identify the time when the program to be detected initiates each network session, and compare the network connection requests recorded in the behavior log with the session data in the traffic data, and correspond the specific network communication and program behavior events. When the program interacts with network resources, the interaction information is transmitted as network traffic in the session data, and the corresponding system calls and file / resource operations are recorded in the program behavior log.

[0102] In one example, the flow monitoring unit determines whether the flow data is abnormal in the following specific steps:

[0103] S2.1: Based on the data source IP address, target IP address, port number and protocol type in each group of captured network traffic data, identify the communication relationship between the program to be detected and the external communication network object, and record the traffic data of each communication session in detail into the operation log through the behavior track recording unit.

[0104] S2.2: Use a high-pass filter to eliminate background traffic or noise traffic, retain the communication traffic between the program to be detected and each interactive object, divide the traffic data of different communication objects by session, and each group of sessions includes a complete request-response process. Summarize the total data volume of each group of conversations captured by the communication traffic data, the size and number of data packets in a single communication, and the distribution of upstream and downstream traffic, and use it as statistical data.

[0105] S2.3: The abnormal threshold setting module establishes a baseline model of communication behavior based on the normal historical communication traffic of the program to be detected. The baseline model then sets the upper and lower limits of the traffic threshold based on the average traffic, peak traffic, and frequency range baseline data of each session.

[0106] S2.4: Monitor the actual communication flow data between the program to be detected and each interactive object in real time, and compare each group of pre-processed communication flow data with a preset benchmark model to analyze whether the current flow data is within the set normal flow threshold range.

[0107] S2.5: If the total amount of traffic, frequency and duration or the change of the communication object in the traffic data exceeds the preset normal threshold, the communication traffic data is marked as abnormal. Then, the characteristics of multiple groups of abnormal communications are comprehensively analyzed through the identification and judgment module to check whether the communication behavior conforms to the known abnormal pattern.

[0108] S2.6: If multiple groups of communication behaviors exceed the preset normal traffic threshold range and have abnormal patterns, the communication is determined to be abnormal behavior, and a comprehensive judgment is made based on the program's system resource access and process activity behaviors. If the program also exhibits abnormal system operations, the communication behavior is determined to be abnormal behavior.

[0109] S2.7: The identification and judgment module determines the program that initiates abnormal communication of sending or receiving data abnormally through network connection and process tracking, and analyzes the behavior log of the program, checks its running status, called system resources, and interacted external programs or resources to verify whether it has other abnormal behaviors.

[0110] S2.7: Mark the identified abnormal communication initiator as a suspicious source program, and further track or restrict the activities of the suspicious source program. At the same time, generate a detailed exception report and notify the administrator based on the severity of the exception, and restrict the communication permissions of the program or take isolation measures.

[0111] In one example, the permission level change module upgrades or downgrades the permissions of the source program of the abnormal data and the program interacting within a set time period. The specific steps are as follows:

[0112] S3.1: The permission change module receives the judgment result of the abnormal threshold setting module, and the identification and judgment module identifies the source program of the abnormal data, and the external program that interacts with the program within a specified time period. The permission change module determines whether to upgrade or downgrade the permission according to the abnormal level of the source program and the program that interacts with it, and determines the extent of the adjustment.

[0113] S3.2: If it is a minor anomaly, the permissions will be slightly downgraded or temporarily restricted according to the preset scope. If it is a moderate anomaly, the permissions will be significantly downgraded according to the preset scope and a wider range of functions will be restricted. If it is a serious anomaly, the permissions will be fully downgraded or directly blocked, or even the program will be isolated.

[0114] S3.3: The permission change module gradually reduces the program's network access rights and the program's access rights to system resources according to the severity of the exception. It also temporarily downgrades permissions for a period of time and then restores them, or permanently downgrades permissions until the administrator intervenes, according to a set time period.

[0115] S3.4: When the system confirms that the behavior of the program to be detected has returned to normal, the permission change module gradually restores the program's access rights to local system resources according to the degree of recovery, and increases the communication frequency or allows a larger data flow.

[0116] S3.5: Record each upgrade or downgrade operation of each group of programs in the system log, and send a notification to the administrator after the permission change operation is completed to inform the administrator of the specific circumstances of the permission change. At the same time, the permission change module monitors the behavior of the program in real time after the permission adjustment to make subsequent permission adjustments.

[0117] Further, for step S3.3, network access rights specifically include limiting access to specific external IP addresses or domain names, reducing communication frequency or data transmission limit, and preventing programs from communicating with specific network interfaces or external servers. System resource access rights include reducing file system access rights, prohibiting access to sensitive files or directories, limiting access to peripherals, and limiting the priority of processes or preventing them from creating new processes.

[0118] In one example, for different device terminals, the normal state of traffic in this type of scenario can be determined according to the user type of the device terminal, and a detection threshold template corresponding to the user type under the normal state can be generated, so that the corresponding threshold template can be directly determined according to the user type in the future.

[0119] In one example, before running the program to be detected in the virtual environment, the interaction permission and network permission of the program to be detected may be initially set.

[0120] In one example, the identification monitoring device can analyze the traffic curve and fluctuations used by the program based on the data interaction list and program introduction, and determine it as abnormal when abnormal communication traffic occurs or the traffic curve fluctuates greatly.

[0121] In one example, the abnormal threshold setting module, the independent communication module and the identification and judgment module are connected. The abnormal threshold setting module is used to connect to other abnormal identification systems with the same usage scenario and hardware configuration through the network, obtain the abnormal identification and abnormal monitoring settings that have been run by the abnormal identification system, and apply them to the currently used identification and monitoring device.

[0122] In one example, the interaction trajectory analysis module, the identification and judgment module and the permission change module are connected. The permission change module is used to identify abnormal programs and then set the program's interaction permissions and network permissions to narrow the program's interaction scope and prevent the spread of abnormal communications. The interaction trajectory analysis module is also used to analyze the program's interaction logs and traffic usage logs, determine the program's abnormal behavior, improve the identification standards for abnormal communications, and reset new abnormal identification methods.

[0123] This embodiment can connect to devices of different usage scenarios, different hardware configurations and different users through the identification monitoring device, and monitor them in real time. It analyzes the electromagnetic, power consumption, sound and other signals in the terminal's surrounding environment through signal acquisition, preprocessing, feature extraction and other methods to obtain distinguishable signal characteristics, and then identify the available wireless cross-domain transmission channels to improve the detection rate of cross-domain signal characteristics.

[0124] In addition, the processing power of the identification and detection device can be used to obtain program logs and conduct behavioral analysis through activity logs, so as to quickly lock the abnormal scope and identify abnormal programs. By maintaining a continuous connection, real-time monitoring and identification can be carried out to provide protection for the program operation of the device. At the same time, the list can be set to increase monitoring and identification communication.

[0125] Finally, by setting up an exception identification system, it is possible to set a method for abnormal communication identification based on the program's operating data and communication data, and quickly apply and spread this method to scenarios with similar needs, thereby lowering the usage threshold and meeting the changing needs of business scenarios. In addition, it is possible to connect to cloud servers or other terminals via wired or wireless methods to improve the efficiency of identifying abnormal communications, and to achieve efficient, fast, and multi-dimensional real-time exception identification.

[0126] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0127] Based on the same inventive concept, the embodiment of the present application also provides an abnormality identification device for implementing the abnormality identification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more abnormality identification device embodiments provided below can refer to the limitations on the abnormality identification method above, and will not be repeated here.

[0128] In an exemplary embodiment, Figure 6 As shown, an abnormality identification device 600 is provided, comprising: a first data determination module 601, a second data determination module 602 and an abnormality identification module 603, wherein:

[0129] The first data determination module is used to perform a running simulation on the program to be detected based on a pre-generated virtual environment to obtain program activity data and communication session data generated during the running of the program to be detected; the program activity data is the business data generated when the program to be detected is executed; the communication session data is the data generated when the program to be detected establishes communication with a network object;

[0130] A second data determination module, configured to determine a plurality of first statistical data corresponding to the program activity data, and to determine a plurality of second statistical data based on the communication session data and an accessible list corresponding to the communication authority of the program to be detected;

[0131] The anomaly identification module is used to determine an anomaly identification result of the program to be detected based on the first statistical data, the second statistical data, and an anomaly threshold corresponding to the communication authority of the program to be detected.

[0132] Furthermore, the first data determination module is specifically used to: run the program to be detected in a pre-generated virtual environment, and obtain the network traffic data and behavior log of the program to be detected generated during the running of the program to be detected through the hidden interface of the virtual environment; parse the network traffic data to determine the program activity data of the program to be detected and each network object; parse the behavior log to obtain the communication session data between the program to be detected and each network object; the communication session data includes the data interaction records generated during the running of the program to be detected; the data interaction records include the access records between the program to be detected and each network object; the network objects include programs and websites.

[0133] Furthermore, the second data determination module is specifically used to: determine the actual access list corresponding to the program to be detected based on the data interaction records in the communication session data; determine the number of network objects that exist in the actual access list and do not exist in the accessible list corresponding to the communication authority of the program to be detected, which is the second statistical data; for the network objects that exist in the actual access list and in the accessible list, determine the access time, access frequency, access duration and communication traffic between the program to be detected and the network objects, which is the second statistical data.

[0134] Furthermore, the second data determination module is specifically used to: determine the program authority range of each network object and the program to be detected in the accessible list, and the data interaction records between the program to be detected and each network object in the actual access list; determine the number of interactive operations that exceed the program authority range in the data interaction records as the second statistical data.

[0135] Furthermore, the anomaly identification module is specifically used to: if there are a first number of first statistical data that satisfy a first anomaly threshold corresponding to the communication authority, and there are a second number of second statistical data that satisfy a second anomaly threshold corresponding to the communication authority, then determine that the anomaly identification result of the program to be detected is abnormal; wherein the anomaly threshold is determined based on a threshold template corresponding to each statistical data and the communication authority of the program to be detected, and the threshold template contains the anomaly thresholds corresponding to each statistical data under different communication anomaly levels.

[0136] Furthermore, the device also includes a permission updating module, which is used to: when it is determined that the program to be detected is an abnormal program based on the abnormality identification result, update the communication permission corresponding to the abnormal program to obtain an updated abnormal program.

[0137] Furthermore, the authority update module is specifically used to: determine that the first statistical data satisfies the corresponding first abnormality threshold, and the second statistical data satisfies the corresponding second abnormality threshold, as target statistical data; determine the communication abnormality level corresponding to each target statistical data according to the threshold template corresponding to each target statistical data; determine the update authority level corresponding to the abnormal program according to the communication abnormality level corresponding to each target statistical data; based on the update authority level, update the communication authority level corresponding to the communication authority of the abnormal program to obtain an updated abnormal program.

[0138] Each module in the above-mentioned abnormality identification device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0139] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store abnormal identification strategies and accessible lists. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an abnormal identification method is implemented.

[0140] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0141] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the following steps are implemented:

[0142] Based on a pre-generated virtual environment, a running simulation is performed on the program to be detected to obtain program activity data and communication session data generated during the running of the program to be detected; the program activity data is the business data generated when the program to be detected is executed; the communication session data is the data generated when the program to be detected establishes communication with a network object; a plurality of first statistical data corresponding to the program activity data are determined, and a plurality of second statistical data are determined based on the communication session data and an accessible list corresponding to the communication authority of the program to be detected; based on the first statistical data, the second statistical data, and an abnormal threshold value corresponding to the communication authority of the program to be detected, an abnormal identification result of the program to be detected is determined.

[0143] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0144] Based on a pre-generated virtual environment, a running simulation is performed on the program to be detected to obtain program activity data and communication session data generated during the running of the program to be detected; the program activity data is the business data generated when the program to be detected is executed; the communication session data is the data generated when the program to be detected establishes communication with a network object; a plurality of first statistical data corresponding to the program activity data are determined, and a plurality of second statistical data are determined based on the communication session data and an accessible list corresponding to the communication authority of the program to be detected; based on the first statistical data, the second statistical data, and an abnormal threshold value corresponding to the communication authority of the program to be detected, an abnormal identification result of the program to be detected is determined.

[0145] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0146] Based on a pre-generated virtual environment, a running simulation is performed on the program to be detected to obtain program activity data and communication session data generated during the running of the program to be detected; the program activity data is the business data generated when the program to be detected is executed; the communication session data is the data generated when the program to be detected establishes communication with a network object; a plurality of first statistical data corresponding to the program activity data are determined, and a plurality of second statistical data are determined based on the communication session data and an accessible list corresponding to the communication authority of the program to be detected; based on the first statistical data, the second statistical data, and an abnormal threshold value corresponding to the communication authority of the program to be detected, an abnormal identification result of the program to be detected is determined.

[0147] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0148] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0149] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0150] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for identifying anomalies, characterized in that: Applied to identifying a monitoring device, the method comprises: Based on the pre-generated virtual environment, the program to be detected is run simulated to obtain the program activity data and communication session data generated by the program to be detected during the running process; the program activity data is the business data generated when the program to be detected is executed; the communication session data is the data generated when the program to be detected establishes communication with the network object; Determine a plurality of first statistical data corresponding to the program activity data, and determine a plurality of second statistical data based on the communication session data and an accessible list corresponding to the communication permission of the program to be detected; Based on the first statistical data, the second statistical data, and an abnormality threshold corresponding to the communication authority of the program to be detected, an abnormality identification result of the program to be detected is determined.

2. The method according to claim 1, characterized in that The step of simulating the operation of the program to be detected based on the pre-generated virtual environment to obtain program activity data and communication session data generated during the operation of the program to be detected includes: Running the program to be detected in a pre-generated virtual environment, and obtaining network traffic data and behavior logs of the program to be detected generated during the running of the program to be detected through a hidden interface of the virtual environment; Parsing the network traffic data to determine program activity data of the program to be detected and each network object; The behavior log is parsed to obtain communication session data between the program to be detected and each of the network objects; the communication session data includes data interaction records generated during the operation of the program to be detected; the data interaction records include access records between the program to be detected and each of the network objects; the network objects include programs and websites.

3. The method according to claim 2, characterized in that The determining of a plurality of second statistical data based on the communication session data and the accessible list corresponding to the communication permission of the program to be detected includes: Determining an actual access list corresponding to the program to be detected based on the data interaction record in the communication session data; Determine the number of network objects that exist in the actual access list and do not exist in the accessible list corresponding to the communication permission of the program to be detected as the second statistical data; For the network objects that exist in the actual access list and in the accessible list, the access time, access frequency, access duration and communication traffic between the program to be detected and the network objects are determined as the second statistical data.

4. The method according to claim 3, characterized in that The method further comprises: Determine the program permission range of each of the network objects and the program to be detected in the accessible list, and the data interaction record between the program to be detected and each of the network objects in the actual access list; The number of interaction operations exceeding the program authority range in the data interaction record is determined as the second statistical data.

5. The method according to claim 1, characterized in that The determining, based on the first statistical data, the second statistical data, and an abnormality threshold corresponding to the communication authority of the program to be detected, an abnormality identification result of the program to be detected includes: If a first number of the first statistical data satisfies a first abnormality threshold corresponding to the communication authority, and a second number of the second statistical data satisfies a second abnormality threshold corresponding to the communication authority, determining that the abnormality identification result of the program to be detected is abnormal; The abnormal threshold is determined based on a threshold template corresponding to each statistical data and the communication authority of the program to be detected, and the threshold template contains the abnormal thresholds corresponding to each statistical data at different communication abnormality levels.

6. The method according to claim 5, characterized in that After determining the abnormality recognition result of the program to be detected, the method further includes: In the case where it is determined that the program to be detected is an abnormal program based on the abnormal identification result, the communication authority corresponding to the abnormal program is updated to obtain an updated abnormal program.

7. The method according to claim 6, characterized in that The updating of the communication authority corresponding to the abnormal program to obtain an updated abnormal program includes: Determine that the first statistical data satisfies the corresponding first abnormality threshold, and the second statistical data satisfies the corresponding second abnormality threshold, as target statistical data; Determining the communication anomaly level corresponding to each of the target statistical data according to the threshold template corresponding to each of the target statistical data; Determining the update authority level corresponding to the abnormal program according to the communication abnormality level corresponding to each of the target statistical data; Based on the updated authority level, the communication authority level corresponding to the communication authority of the abnormal program is updated to obtain an updated abnormal program.

8. An abnormality identification device, characterized in that: The device comprises: A first data determination module is used to perform a running simulation on the program to be detected based on a pre-generated virtual environment to obtain program activity data and communication session data generated during the running of the program to be detected; the program activity data is the business data generated when the program to be detected is executed; the communication session data is the data generated when the program to be detected establishes communication with a network object; A second data determination module, configured to determine a plurality of first statistical data corresponding to the program activity data, and to determine a plurality of second statistical data based on the communication session data and an accessible list corresponding to the communication authority of the program to be detected; The anomaly identification module is used to determine an anomaly identification result of the program to be detected based on the first statistical data, the second statistical data, and an anomaly threshold corresponding to the communication authority of the program to be detected.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images