Server intrusion detection method, device, medium and equipment

Abstract

The present application provides a server intrusion detection method, apparatus, medium and equipment, which relates to the field of server intrusion detection technology, including: collecting the operation information of the server to be detected at each preset collection time point; performing feature extraction to obtain an initial feature data list; obtaining a correlation coefficient vector based on the historical feature data matrix and server status labels corresponding to the historical feature data of the server to be detected; obtaining a target operation feature vector based on the correlation coefficient vector and the initial operation feature data list; and determining whether the server to be detected is currently invaded based on the target operation feature vector and the server status classification model. The present application effectively improves the detection accuracy, reduces the false alarm and missed alarm rates, and accurately judges intrusions. It can also discover new and complex attacks from the feature level, making up for the shortcomings of traditional methods in dealing with new and complex attacks.

Description

Technical Field

[0001] The present application relates to the technical field of server intrusion detection, and in particular to a server intrusion detection method, apparatus, medium and equipment. Background Art

[0002] With the rapid development of information technology, servers play a vital role in the business operations of enterprises and organizations. Servers store and process vast amounts of critical data. Once compromised, they can lead to serious consequences such as data leakage, system failure, and business interruption, causing significant financial losses and reputational damage to enterprises. Therefore, server intrusion detection technology has become a research hotspot in the field of network security.

[0003] Currently, traditional server intrusion detection methods are primarily based on signature matching and anomaly detection. Signature matching methods rely on a known attack signature library, identifying intrusion behaviors by comparing collected server data with patterns in the signature library. However, this approach is often ineffective against new and unknown attack methods. Hackers are constantly innovating their attack methods, making it difficult for new attack signatures to be included in the signature library in a timely manner.

[0004] Anomaly detection methods build a model of normal server behavior and compare real-time monitored data with this model. When the deviation exceeds a certain threshold, it is identified as an intrusion. However, this method has a high false positive rate because the server's operating status is affected by various factors, such as changes in resource usage during peak business hours and system upgrades. These normal fluctuations may be mistaken for intrusions. Furthermore, this method has difficulty effectively identifying complex, slowly penetrating attacks, as these attacks may remain within the fluctuation range of normal behavior for a long time, making them difficult to detect.

[0005] Furthermore, most existing intrusion detection methods focus solely on a single type of data, such as analyzing system logs or network traffic, failing to fully leverage the relationships between the various data types generated during server operation. However, server operation is a complex system, and different types of data (such as system logs, network traffic, and system performance) reflect the server's operational status from different perspectives. Comprehensive analysis of this data can provide a more comprehensive and accurate assessment of server intrusion.

[0006] To sum up, the existing server intrusion detection technology has shortcomings in facing new attacks, complex attack scenarios and multi-source data fusion analysis. There is an urgent need for an intrusion detection method that is more efficient, accurate and can comprehensively utilize multiple data to improve the security and stability of the server. Summary of the Invention

[0007] In response to the above technical problems, the present application provides a server intrusion detection method, apparatus, medium and equipment, which at least partially solve the problems existing in the prior art.

[0008] In a first aspect of the present application, a server intrusion detection method is provided, the method comprising:

[0009] At each preset collection time point, the operating information of the server to be tested is collected; wherein the operating information includes: system log information, network traffic information and system performance information;

[0010] Perform feature extraction of key rules mining on system log information and network traffic information, and perform time series feature extraction on system performance information to obtain an initial feature data list; wherein the initial feature data list includes a number of initial operation feature data; each initial operation feature data has a corresponding operation feature;

[0011] Obtaining a correlation coefficient vector based on a historical feature data matrix corresponding to historical feature data of the server to be detected and a server status label; wherein the historical feature data matrix includes a plurality of historical data samples; each historical data sample has corresponding historical feature data; each historical feature data has a corresponding operating feature; and the correlation coefficient vector is used to describe the correlation coefficient between each operating feature and the server status label;

[0012] Obtain the target operation characteristic vector according to the correlation coefficient vector and the initial operation characteristic data list;

[0013] Determine whether the server to be detected is currently invaded based on the target operation feature vector and server status classification model.

[0014] Optionally, feature extraction for key rule mining of system log information includes:

[0015] Converting system log information into a log transaction set; wherein the log transaction set includes a plurality of log transactions; each log transaction has a corresponding event list and a first preset time window; each event list includes a plurality of events; and the time corresponding to each event is within the range of the first preset time window of the corresponding log transaction;

[0016] According to the preset minimum support and minimum confidence thresholds, a combination of log events with a co-occurrence count greater than a preset co-occurrence count is obtained, and a number of association rules are generated;

[0017] According to the support, confidence and lift of each association rule, a target association rule is determined among several association rules for feature extraction; each association rule has an association degree score; the target association rule is the association rule with the highest association degree score; the association degree score is positively correlated with the support, confidence and lift.

[0018] Optionally, feature extraction for key rule mining of network traffic information includes:

[0019] Obtain several intermediate traffic pairs; each intermediate traffic pair consists of two servers; each intermediate traffic pair includes a server to be detected; each intermediate traffic pair has a corresponding IP address information pair and port information pair; the source IP address or destination IP address of each intermediate traffic pair is the IP address of the server to be detected; the source port number or destination port number of each intermediate traffic pair is the port number of any port of the server to be detected;

[0020] At least one target flow pair is obtained based on flow correlations of the plurality of intermediate flow pairs within a second preset time window; wherein the flow correlation of the target flow pair is greater than a preset flow correlation threshold; and the flow correlation includes IP flow correlation and port flow correlation;

[0021] According to the IP address and port number corresponding to each target flow, a network flow association graph is obtained; wherein each IP address and each port number is a node;

[0022] Perform feature extraction on network traffic correlation graph.

[0023] Optionally, time series feature extraction is performed on the system performance information, including:

[0024] According to the system performance information, several time series curves are obtained;

[0025] Fitting several time series curves according to the polynomial function to obtain the coefficients corresponding to the polynomial function;

[0026] Feature extraction is performed on the coefficients corresponding to the time series curve and the polynomial function.

[0027] Optionally, a target operation feature vector is obtained according to the correlation coefficient vector and the initial operation feature data list, including:

[0028] Sort each initial operation feature corresponding to the initial operation feature data list according to the corresponding average correlation coefficient according to the correlation coefficient vector;

[0029] A preset number of initial operation features are determined as target operation features to obtain a target operation feature vector.

[0030] Optionally, at each preset collection time point, after collecting the operation information of the server to be detected, the method further includes:

[0031] Preprocess the operation information.

[0032] Optionally, after determining whether the server to be detected is currently invaded based on the target running feature vector and the server status classification model, the method further includes:

[0033] When an intrusion event is detected, an alarm message is generated and sent to the target display device.

[0034] In a second aspect of the present application, a server intrusion detection device is provided, comprising:

[0035] A collection unit is used to collect the operation information of the server to be detected at each preset collection time point; wherein the operation information includes: system log information, network traffic information and system performance information;

[0036] An extraction unit is used to perform feature extraction for key rule mining on system log information and network traffic information, and to perform time series feature extraction on system performance information, to obtain an initial feature data list; wherein the initial feature data list includes a plurality of initial operation feature data; each initial operation feature data has a corresponding operation feature;

[0037] A vector acquisition unit is configured to obtain a correlation coefficient vector based on a historical feature data matrix corresponding to historical feature data of the server to be detected and a server status label; wherein the historical feature data matrix includes a plurality of historical data samples; each historical data sample has corresponding historical feature data; each historical feature data has a corresponding operating feature; and the correlation coefficient vector is configured to describe a correlation coefficient between each operating feature and the server status label;

[0038] a target vector determination unit, configured to obtain a target operation characteristic vector according to the correlation coefficient vector and the initial operation characteristic data list;

[0039] The intrusion determination unit is used to determine whether the server to be detected is currently invaded based on the target operation feature vector and the server status classification model.

[0040] In a third aspect of the present application, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program is stored, and the at least one instruction or at least one program is loaded and executed by a processor to implement the aforementioned server intrusion detection method.

[0041] In a fourth aspect of the present application, an electronic device is provided, comprising a processor and the above-mentioned non-transitory computer-readable storage medium.

[0042] This application has at least the following beneficial effects:

[0043] The server intrusion detection method, device, medium, and equipment provided in this application comprehensively collect system logs, network traffic, and system performance information, and perform key rule mining and time series feature extraction on them respectively. The correlation coefficient vector is derived by combining the historical feature data matrix and the server status label, and then the target operation feature vector is obtained. Finally, the intrusion situation is judged with the help of the server status classification model. This method can comprehensively characterize the server operation status from multiple dimensions, mine the key features of the data, effectively improve the detection accuracy, reduce the false alarm and missed alarm rate, accurately judge the intrusion, and discover new and complex attacks from the feature level, making up for the shortcomings of traditional methods in dealing with new and complex attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0045] Figure 1 A flow chart of a server intrusion detection method provided in an embodiment of the present application;

[0046] Figure 2 This is a structural block diagram of the server intrusion detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0048] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0049] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this application, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement an apparatus and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this apparatus and / or practice this method.

[0050] Please refer to Figure 1 As shown, an embodiment of the present application provides a server intrusion detection method, the method comprising:

[0051] S100, collecting the operation information of the server to be detected at each preset collection time point; wherein the operation information includes: system log information, network flow information and system performance information.

[0052] Specifically, multiple data collection modules are deployed on the server to be tested to collect real-time information such as system logs, network traffic data, system performance information, and user operation records. System logs include the server's operating system kernel logs (such as Linux's / var / log / kern.log), application logs (such as web server access logs and error logs), and security logs (recording user logins, permission changes, and other information). Log management systems (such as the ELK Stack, which includes Elasticsearch, Logstash, and Kibana) are used to centrally store and manage these logs for later analysis. Network traffic data is collected using packet capture tools (such as Wireshark and Tcpdump) to capture data packets from the server's network interface. Detailed network traffic information is recorded, including source and destination IP addresses, port numbers, protocol types (TCP, UDP, ICMP, etc.), packet sizes, and timestamps. System performance data is collected using system monitoring tools (such as Prometheus and Grafana) to collect real-time server performance metrics such as CPU usage, memory usage, disk I / O rate, and network bandwidth utilization. These indicators are recorded at fixed time intervals (such as every second or every minute) to form time series data. The collection of user operation records is to record various user operations on the server, such as file reading and writing, database operations, etc.

[0053] S200, performing feature extraction of key rule mining on system log information and network traffic information, and performing time series feature extraction on system performance information to obtain an initial feature data list; wherein the initial feature data list includes a number of initial operation feature data; each initial operation feature data has a corresponding operation feature.

[0054] Specifically, feature extraction for key rule mining of system log information and network traffic information includes:

[0055] Step a1, converting system log information into a log transaction set; wherein the log transaction set includes a number of log transactions; each log transaction has a corresponding event list and a first preset time window; each event list includes a number of events; and the time corresponding to each event is within the range of the first preset time window of the corresponding log transaction.

[0056] Step a2: According to the preset minimum support and minimum confidence thresholds, a combination of several log events whose co-occurrence times are greater than the preset co-occurrence number is obtained, and several association rules are generated.

[0057] In step a3, based on the support, confidence, and lift of each association rule, a target association rule is determined from among the association rules for feature extraction; wherein each association rule has an association degree score; the target association rule is the association rule with the highest association degree score; and the association degree score is positively correlated with the support, confidence, and lift.

[0058] Here, we use the Apriori algorithm to mine association rules in system logs and identify frequently co-occurring event combinations. For example, if we find that "user login" events and "file download" events frequently co-occur within a certain time interval, we use this association rule as a feature. We calculate the support, confidence, and lift of each association rule, and select the association rules with the highest credibility and practicality as target association rules.

[0059] In addition, feature extraction for key rule mining of network traffic information includes:

[0060] Step b1, obtain several intermediate traffic pairs; each intermediate traffic pair consists of two servers; each intermediate traffic pair contains the server to be detected; each intermediate traffic pair has a corresponding IP address information pair and port information pair; the source IP address or destination IP address of each intermediate traffic pair is the IP address of the server to be detected; the source port number or destination port number of each intermediate traffic pair is the port number of any port among several ports of the server to be detected.

[0061] Step b2: obtaining at least one target traffic pair based on traffic correlations of several intermediate traffic pairs within a second preset time window, wherein the traffic correlation of the target traffic pair is greater than a preset traffic correlation threshold; the traffic correlation includes IP traffic correlation and port traffic correlation.

[0062] Step b3: obtaining a network traffic association graph based on the IP address and port number corresponding to each target traffic; wherein each IP address and each port number is a node.

[0063] Step b4: extract features from the network traffic correlation graph.

[0064] Here, use a network packet capture tool such as Tcpdump (for Linux systems) or Wireshark (cross-platform) to capture data packets from the server network interface. You can set capture rules according to your needs, such as capturing only traffic from a specific IP address, port number, or protocol type. Analyze the network traffic correlation between different IP addresses and port numbers. By calculating the correlation coefficient of traffic data, find target traffic pairs with strong correlation. For example, calculate the traffic correlation between the source IP and destination IP, and the traffic co-variation characteristics between different port pairs. Construct a network traffic correlation graph, using IP addresses and port numbers as nodes and traffic correlation as edge weights. Extract the topological features of the graph, such as node degree, clustering coefficient, and shortest path length, as part of the feature vector.

[0065] In addition, time series feature extraction is performed on system performance information, including:

[0066] Step c1: obtaining several time series curves based on system performance information.

[0067] Step c2: fitting a plurality of time series curves according to the polynomial function to obtain coefficients corresponding to the polynomial function.

[0068] Step c3: extract features from the time series curve and the coefficients corresponding to the polynomial function.

[0069] Here, system monitoring tools such as Prometheus and Node Exporter (for Linux servers) are installed on the server. Node Exporter collects various server performance metrics, including CPU usage, memory usage, disk I / O rate, and network bandwidth utilization, and exposes these metrics via an HTTP interface. Prometheus, serving as a time series database, periodically pulls performance metric data from Node Exporter for storage. Grafana is integrated with Prometheus to create a visual dashboard that displays real-time trends in server performance metrics, making it easier for administrators to monitor server health. For the time series data of system performance metrics, a moving average method is used to calculate the average value of different time windows. This method calculates the average value of the data within a sliding window of a fixed size, reflecting both short-term and long-term trends. For example, 5-minute, 10-minute, and 30-minute moving averages are calculated to capture performance trends at different time scales. A polynomial function is fitted to the time series data, and the coefficients of the polynomial are solved using the least squares method. The slope and curvature of the polynomial curve are extracted as features to describe the rate and acceleration of change in the data. For example, a quadratic polynomial fit can reflect the quadratic variation trend of the data.

[0070] S300, obtain a correlation coefficient vector based on the historical feature data matrix and the server status label corresponding to the historical feature data of the server to be detected; wherein the historical feature data matrix includes a number of historical data samples; each historical data sample has a corresponding number of historical feature data; each historical feature data has a corresponding operating feature; the correlation coefficient vector is used to describe the correlation coefficient between each operating feature and the server status label.

[0071] S400 , obtaining a target operation feature vector according to the correlation coefficient vector and the initial operation feature data list.

[0072] Among them, according to the correlation coefficient vector and the initial operation characteristic data list, the target operation characteristic vector is obtained, including:

[0073] Step d1, sorting each corresponding initial operation feature in the initial operation feature data list according to the corresponding average correlation coefficient based on the correlation coefficient vector;

[0074] Step d2: determining a preset number of initial operation features as target operation features to obtain a target operation feature vector.

[0075] Historical feature data is used to obtain the relationship between each initial operating feature in the initial operating feature data list and the server status label. This allows the operator to select operating features with higher weights (larger average correlation coefficients), i.e., those with greater importance in determining server status, from the initial operating feature data list. This ultimately results in a target operating feature vector. The correlation coefficient can be calculated using the Pearson correlation coefficient.

[0076] Server status tags include normal and intrusion status tags, meaning historical data includes normal and abnormal conditions, respectively. The normal status tag indicates that the server is free of intrusion threats and operating as expected and normally. This is typically represented by the value "0." In a normal state, server operations and data interactions conform to common usage patterns and business rules. For example, in system logs, user logins and operations follow established permissions and processes, with no unusual failed login attempts or privilege escalation. For example, legitimate users log in to the server normally during business hours and perform routine operations such as file reads and data queries. In terms of network traffic, the volume, source and destination addresses, and protocol usage are all within normal ranges. For example, the server maintains stable, business-compliant communications with known legitimate clients, avoiding large-scale, abnormal port scans or DDoS-style traffic spikes. In terms of system performance, performance indicators such as CPU utilization, memory utilization, and disk I / O remain within reasonable ranges, without sudden, drastic fluctuations. For example, during business peak periods, the server's CPU usage will increase, but it will not exceed the server's capacity, and the fluctuation trend is predictable.

[0077] The intrusion status label indicates that the server is suffering or has suffered a malicious attack or illegal intrusion. It is generally represented by the value "1". The intrusion status may manifest in the following situations: In terms of system logs: there are a large number of failed login records, which may be an attacker trying to brute force the password; abnormal file creation, modification or deletion operations, especially sensitive files; abnormal process startup or permission changes, etc. In terms of network traffic: abnormal port scanning behavior occurs, and a large number of data packets are sent from unknown IP addresses to multiple ports of the server; DDoS attacks cause a sharp increase in network traffic, and the server bandwidth is heavily occupied, affecting normal services; there are abnormal remote connection requests, which may be an attacker trying to remotely control the server. In terms of system performance indicators: CPU or memory usage suddenly increases significantly and remains high, which may be a malicious program consuming system resources; abnormal disk I / O is frequent, which may be an attacker stealing data or implanting malware.

[0078] S500: Determine whether the server to be detected is currently invaded based on the target operation feature vector and the server status classification model.

[0079] Specifically, a large amount of historical data is collected, including data from normal operations and various known intrusion scenarios. The data is divided into training, validation, and test sets according to a specific ratio. The selected neural network model is trained using the training set. During training, cross-validation is employed to continuously adjust the model's hyperparameters, such as the learning rate, number of layers, and number of nodes, to improve its accuracy and generalization. The validation set is used to evaluate the model during training, and the model is further optimized based on the evaluation results. Finally, the optimized model is subjected to a final performance test using the test set to ensure that it can accurately identify various intrusion behaviors.

[0080] In an exemplary embodiment of the present application, at each preset collection time point, after collecting the operating information of the server to be detected, the method further includes:

[0081] Preprocess the operation information.

[0082] Specifically, data cleaning algorithms are used to remove duplicate, erroneous, and incomplete records from the collected data.

[0083] In an exemplary embodiment of the present application, after determining whether the server to be detected is currently invaded based on the target operation feature vector and the server status classification model, the method further includes:

[0084] When an intrusion event is detected, an alarm message is generated and sent to the target display device.

[0085] Specifically, when the model detects an intrusion, the alarm generation module generates detailed alarm content based on a pre-set template and collected relevant information. This information is then sent to relevant personnel via SMS gateway interfaces, email servers, and instant messaging software APIs. Simultaneously, the alarm is displayed on the server management interface via pop-up windows or flashing icons.

[0086] Verify the alarm response process: Simulate various server intrusion scenarios in a lab environment, such as SQL injection attacks and DDoS traffic attacks. Observe whether the system can promptly detect intrusions and send alarms. Receiving alarms follow the pre-defined alarm response process to verify the effectiveness and feasibility of emergency response measures. Through multiple simulation tests, we continuously optimize the alarm response process and related measures to ensure rapid and effective responses to server intrusion incidents in real-world applications.

[0087] like Figure 2 As shown, an embodiment of the present application provides a server intrusion detection device 100, which includes:

[0088] The collection unit 110 is used to collect the operation information of the server to be detected at each preset collection time point; wherein the operation information includes: system log information, network traffic information and system performance information.

[0089] The extraction unit 120 is used to perform feature extraction for key rule mining on system log information and network traffic information, and to perform time series feature extraction on system performance information to obtain an initial feature data list; wherein the initial feature data list includes a number of initial operation feature data; each initial operation feature data has a corresponding operation feature.

[0090] The vector acquisition unit 130 is used to obtain a correlation coefficient vector based on the historical feature data matrix corresponding to the historical feature data of the server to be detected and the server status label; wherein the historical feature data matrix includes a plurality of historical data samples; each historical data sample has a corresponding plurality of historical feature data; each historical feature data has a corresponding operating feature; and the correlation coefficient vector is used to describe the correlation coefficient between each operating feature and the server status label.

[0091] The target vector determining unit 140 is configured to obtain a target operation feature vector according to the correlation coefficient vector and the initial operation feature data list.

[0092] The intrusion determination unit 150 is used to determine whether the server to be detected is currently invaded based on the target operation feature vector and the server status classification model.

[0093] In an exemplary embodiment of the present application, an electronic device capable of implementing the above method is also provided.

[0094] Those skilled in the art will appreciate that various aspects of the present application can be implemented as systems, methods, or program products. Therefore, various aspects of the present application can be specifically implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, which may be collectively referred to herein as a "circuit," "module," or "system."

[0095] The electronic device according to this embodiment of the present application is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0096] The electronic device is implemented as a general-purpose computing device. Components of the electronic device may include, but are not limited to, the at least one processor, the at least one memory, and a bus connecting different system components (including the memory and the processor).

[0097] The storage stores program codes, which can be executed by the processor, so that the processor executes the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present application.

[0098] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0099] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0100] The bus may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0101] The electronic device may also communicate with one or more external devices (e.g., a keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., a router, modem, etc.). This communication may occur via an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device via a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0102] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present application.

[0103] In exemplary embodiments of the present application, a computer-readable storage medium is also provided, on which is stored a program product capable of implementing the aforementioned methods of this specification. In some possible implementations, various aspects of the present application may also be implemented in the form of a program product, which includes program code. When the program product is executed on a terminal device, the program code is used to cause the terminal device to execute the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present application.

[0104] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0105] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0106] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0107] The program code used to perform the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0108] Furthermore, the above-mentioned figures are merely illustrative of the processes included in the methods according to exemplary embodiments of the present application and are not intended to be limiting. It is readily understood that the processes illustrated in the above-mentioned figures do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0109] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiment of the application, the features and functions of two or more modules or units described above can be concretized in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0110] The above are only specific embodiments of the present application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A server intrusion detection method, characterized in that: The method comprises: At each preset collection time point, the operating information of the server to be detected is collected; wherein the operating information includes: system log information, network traffic information and system performance information; Performing feature extraction of key rule mining on the system log information and the network traffic information, and performing time series feature extraction on the system performance information to obtain an initial feature data list; wherein the initial feature data list includes a plurality of initial operation feature data; each initial operation feature data has a corresponding operation feature; Obtaining a correlation coefficient vector based on a historical feature data matrix corresponding to historical feature data of the server to be detected and a server status label; wherein the historical feature data matrix includes a plurality of historical data samples; each historical data sample has corresponding historical feature data; each historical feature data has a corresponding operating feature; and the correlation coefficient vector is used to describe the correlation coefficient between each operating feature and the server status label; Obtain the target operation characteristic vector according to the correlation coefficient vector and the initial operation characteristic data list; Determine whether the server to be detected is currently invaded based on the target operation feature vector and server status classification model.

2. The server intrusion detection method according to claim 1, characterized in that: The feature extraction for key rule mining of the system log information includes: Converting system log information into a log transaction set; wherein the log transaction set includes a plurality of log transactions; each log transaction has a corresponding event list and a first preset time window; each event list includes a plurality of events; and the time corresponding to each event is within the range of the first preset time window of the corresponding log transaction; According to the preset minimum support and minimum confidence thresholds, a combination of log events with a co-occurrence count greater than a preset co-occurrence count is obtained, and a number of association rules are generated; According to the support, confidence and lift of each association rule, a target association rule is determined from among several association rules for feature extraction; wherein each association rule has an association degree score; the target association rule is the association rule with the highest association degree score; the association degree score is positively correlated with the support, confidence and lift.

3. The server intrusion detection method according to claim 1, wherein: The feature extraction for key rule mining of the network traffic information includes: Obtain several intermediate traffic pairs; each intermediate traffic pair consists of two servers; each intermediate traffic pair includes a server to be detected; each intermediate traffic pair has a corresponding IP address information pair and port information pair; the source IP address or destination IP address of each intermediate traffic pair is the IP address of the server to be detected; the source port number or destination port number of each intermediate traffic pair is the port number of any port of the server to be detected; At least one target flow pair is obtained based on flow correlations of the plurality of intermediate flow pairs within a second preset time window; wherein the flow correlation of the target flow pair is greater than a preset flow correlation threshold; the flow correlation includes IP flow correlation and port flow correlation; According to the IP address and port number corresponding to each target flow, a network flow association graph is obtained; wherein each IP address and each port number is a node; Feature extraction is performed on the network traffic association graph.

4. The server intrusion detection method according to claim 1, wherein: Extracting time series features of the system performance information includes: According to the system performance information, several time series curves are obtained; Fitting several time series curves according to the polynomial function to obtain the coefficients corresponding to the polynomial function; Feature extraction is performed on the coefficients corresponding to the time series curve and the polynomial function.

5. The server intrusion detection method according to claim 1, characterized in that: The step of obtaining a target operation feature vector based on the correlation coefficient vector and the initial operation feature data list includes: Sort each initial operation feature corresponding to the initial operation feature data list according to the corresponding average correlation coefficient according to the correlation coefficient vector; A preset number of initial operation features are determined as target operation features to obtain a target operation feature vector.

6. The server intrusion detection method according to claim 1, characterized in that: At each preset collection time point, after collecting the operation information of the server to be detected, the method further includes: Preprocessing the operation information.

7. The server intrusion detection method according to claim 1, characterized in that: After determining whether the server to be detected is currently invaded based on the target running feature vector and the server status classification model, the method further includes: When an intrusion event is detected, an alarm message is generated and sent to a target display device.

8. A server intrusion detection device, characterized in that: The device comprises: A collection unit, configured to collect the operating information of the server to be detected at each preset collection time point; wherein the operating information includes: system log information, network traffic information and system performance information; an extraction unit, configured to perform feature extraction for key rule mining on the system log information and the network traffic information, and perform time series feature extraction on the system performance information, to obtain an initial feature data list; wherein the initial feature data list includes a plurality of initial operation feature data; each initial operation feature data has a corresponding operation feature; A vector acquisition unit is configured to obtain a correlation coefficient vector based on a historical feature data matrix corresponding to historical feature data of the server to be detected and a server status label; wherein the historical feature data matrix includes a plurality of historical data samples; each historical data sample has corresponding historical feature data; each historical feature data has a corresponding operating feature; and the correlation coefficient vector is used to describe the correlation coefficient between each operating feature and the server status label; a target vector determination unit, configured to obtain a target operation characteristic vector according to the correlation coefficient vector and the initial operation characteristic data list; The intrusion determination unit is used to determine whether the server to be detected is currently invaded based on the target operation feature vector and the server status classification model.

9. A non-transitory computer-readable storage medium, characterized in that The storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: The device comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 9.

Images