Behavior analysis-based unknown threat detection method and system

Abstract

The invention discloses an unknown threat detection method and system based on behavior analysis, and relates to the technical field of artificial intelligence, and the method comprises the steps: obtaining a resource access record of an important service in a preset time from a pre-designated network device; calculating a comprehensive index of the resource access record based on the basic distribution probability index, the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R and the source address distribution set S; if the comprehensive index is greater than a preset threshold value, determining that the access is a real attack threat, and generating an endogenous attack detection signature rule to expand a threat detection range so as to determine a related attack source; according to the method, the attack signature closures corresponding to the related attack sources are calculated, all potential attack sources are obtained through the attack signature closures, the potential attack sources serve as unknown threat detection results, and the problem that real attack threats cannot be accurately recognized in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and particularly to a method and system for detecting unknown threats based on behavior analysis. Background Art

[0002] In the field of security operations, the detection of various threats is crucial for ensuring network security. Traditional detection methods are mostly based on signatures or signature combinations. However, even if these signatures are updated daily, it is difficult to cover all attack scenarios. Although methods such as user entity behavior analysis (UEBA) can detect anomalies to a certain extent, establishing a behavior baseline requires a long time to collect normal behavior data and uses machine learning to depict the normal activity range, and the process has a significant lag. For example, some software default models need to learn for more than two weeks. During this period, the user's network may have been breached but not detected, and such methods are prone to generating a large number of false alarms, causing security analysts to spend a lot of energy dealing with false alarms and unable to focus on real threats. Therefore, there is an urgent need for a method for detecting unknown threats that can respond quickly, accurately detect attacks, and effectively reduce the false alarm rate. Summary of the Invention

[0003] In view of this, the present invention proposes a method and system for detecting unknown threats based on behavior analysis, which can achieve rapid response, accurate detection of attacks, and effectively reduce the false alarm rate of attack detection.

[0004] To achieve the above object, the present invention provides the following technical solutions: A method for detecting unknown threats based on behavior analysis, comprising: Obtaining resource access records of important services within a preset time from a pre-specified network device, partitioning the resource access records to obtain a basic resource access distribution set D, a request parameter and request data distribution set A, a response data distribution set R, and a source address distribution set S; Calculating a basic distribution probability index of the resource access records; Calculating a comprehensive index of the resource access records based on the basic distribution probability index, the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S; If the comprehensive index is greater than a preset threshold, determining that the access is a real attack threat, generating an endogenous attack detection signature rule to expand the threat detection range to determine relevant attack sources; Calculating an attack signature closure corresponding to the relevant attack sources, obtaining all potential attack sources through the attack signature closure, and using the potential attack sources as the result of the unknown threat detection.

[0005] Based on the above technical solutions, the present invention can also be improved as follows: Optionally, partitioning the resource access records to obtain a basic resource access distribution set D, a request parameter and request data distribution set A, a response data distribution set R, and a source address distribution set S includes: Removing the top-level resource access records from the resource access records, and constructing the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S based on the remaining resource access records. The set element scales of the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S are the same; After constructing the basic resource access distribution set D based on the remaining resource access records, it further includes: Partitioning the basic resource access distribution set D into h sets based on the depth of the resource access record path. The size of each set does not exceed |D|, and {|Di|} is a poset that gradually decreases according to i. .

[0006] Optionally, after constructing the request parameter and request data distribution set A and the response data distribution set R based on the remaining resource access records, it includes: Performing word segmentation on the content in the request parameter and request data distribution set A and the response data distribution set R, removing redundant information, and retaining all the word segmentation results; Calculating the probability that the resource access record d appears in all the word segmentation results after word segmentation in the request parameter and request data distribution set A through formula (1); Formula (1); In the formula, is the probability that the resource access record d appears in all the word segmentation results after word segmentation in the request parameter and request data distribution set A, is the statistical word The number of times it appears in all the word segmentation results after word segmentation in the request parameter and request data distribution set A, is the number of words in the word segmentation result, is the total number of words in all the word segmentation results after word segmentation of the request parameter and request data distribution set A; Calculating the probability that the resource access record d appears in all the word segmentation results after word segmentation in the response data distribution set R through formula (2); Formula (2); In the formula, is the probability that the resource access record d appears in all the word segmentation results after word segmentation in the response data distribution set R, For counting the number of times a word appears in all word segmentation results after word segmentation of the response data distribution set R, where is the number of words in the word segmentation result, and is the total number of words in all word segmentation results after word segmentation of the response data distribution set R.

[0007] Optionally, the basic distribution probability index of the computing resource access record includes: Calculating the basic distribution probability index of the resource access record d through formula (3); Formula (3); In the formula, is the basic distribution probability index of the resource access record d, is the real weight vector, is a column vector, is the resource access distribution probability of the resource access record d at the i-th layer of resource access, i = 1,..., h. If the resource access depth of the record d is less than h, then the corresponding .

[0008] Optionally, calculating the comprehensive index of the resource access record based on the basic distribution probability index, the basic resource access distribution set D, the request parameters, the request data distribution set A, the response data distribution set R, and the source address distribution set S includes: Calculating the comprehensive index of the resource access record d through formula (4); Formula (4); In the formula, is the comprehensive index of the resource access record d, is the weight for the basic resource access distribution, is the weight for the source address distribution, is the probability of the resource access record d in the source address distribution set S, is the weight for the request parameters and the request data distribution, is the probability of the resource access record d appearing in all word segmentation results after word segmentation of the request parameter and request data distribution set A, is the adjustment coefficient, is the weight for the response data distribution, is the probability of the resource access record d appearing in all word segmentation results after word segmentation of the response data distribution set R.

[0009] Optionally, calculating the attack signature closure corresponding to the relevant attack source includes: Obtain the relevant attack suspicious addresses and relevant attack suspicious payloads corresponding to the relevant attack sources, add the relevant attack suspicious addresses and relevant attack suspicious payloads to the attack signature closure set and the attack source address closure set respectively, search for relevant attack IP addresses through attack features, and add the newly added relevant attack IP addresses to the attack signature closure set until the scale of the set elements in both the attack signature closure set and the attack source address closure set no longer grows.

[0010] Optionally, after the step of obtaining all potential attack sources through the attack signature closure found by searching for the relevant attack source, it includes: Construct an endogenous attack detection signature rule and endogenous threat intelligence based on the attack signature closure and the attack source address closure to expand the intrusion detection signature rule and the threat intelligence indicator library.

[0011] An unknown threat detection system based on behavior analysis, including: A set construction module, configured to obtain the resource access records of important services within a preset time from a pre-specified network device, divide the resource access records to obtain a basic resource access distribution set D, a request parameter and request data distribution set A, a response data distribution set R, and a source address distribution set S; A basic distribution probability index calculation module, configured to calculate the basic distribution probability index of the resource access records; A comprehensive index calculation module, configured to calculate the comprehensive index of the resource access records based on the basic distribution probability index, the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S; A relevant attack source determination module, configured to determine that the access is a real attack threat if the comprehensive index is greater than a preset threshold, generate an endogenous attack detection signature rule to expand the threat detection range, and determine the relevant attack source; A potential attack source acquisition module, configured to calculate the attack signature closure corresponding to the relevant attack source, obtain all potential attack sources through the attack signature closure, and use the potential attack sources as the result of the unknown threat detection.

[0012] An electronic device, including a memory, a processor, and a computer program stored on the memory and running on the processor, where the processor implements the steps of the method when executing the computer program.

[0013] A non-transitory computer-readable storage medium, on which a computer program is stored, and the computer program implements the steps of the method when executed by a processor.

[0014] The present invention has the following advantages: In the unknown threat detection method based on behavior analysis in the present invention, the resource access records are partitioned and analyzed from multiple dimensions. By calculating the basic distribution probability index and the comprehensive index, the real attack threats can be identified more accurately, and the unknown threats that are difficult to discover by traditional methods can be effectively detected. Once an attack threat is determined, the endogenous threat intelligence can be quickly generated to block the attack source address, and the further development of the attack behavior can be timely prevented, reducing the damage to important services. By generating the endogenous attack detection signature rules, the threat detection scope is expanded, the recognition ability of similar attacks is enhanced, and the security of the entire network is improved. By searching the attack signature closure to obtain all potential attack sources, the potential risks can be comprehensively investigated, preventive measures can be taken in advance, and the subsequent possible attacks can be avoided.

[0015] Therefore, the unknown threat detection method based on behavior analysis in the present invention forms a complete security protection system from detection, blocking to expanding the detection scope and mining potential threats, providing all-round protection for important services and network environments. Brief Description of the Drawings

[0016] For purposes of illustration and not limitation, the present invention will now be described in conjunction with the embodiments and drawings of the present invention, wherein: Figure 1 It is a schematic flow chart of the unknown threat detection method based on behavior analysis in the embodiment of the present invention; Figure 2 It is a schematic diagram of the main components of the unknown threat detection system based on behavior analysis in the embodiment of the present invention; Figure 3 It is a schematic diagram of the entity structure of the electronic device provided by the present invention. Detailed Embodiments

[0017] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0018] It should be noted that in the description of the present invention and the above-mentioned drawings, terms such as "first", "second", etc. are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so as to implement the embodiments of the present invention described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device comprising a series of steps or units does not necessarily limit to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0019] It should be noted that, without conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The embodiments of the present invention will be described in detail below with reference to the drawings.

[0020] Figure 1 It is a schematic flow chart of the unknown threat detection method based on behavior analysis in the embodiments of the present invention, as Figure 1 shown, the unknown threat detection method based on behavior analysis provided by the embodiments of the present invention includes the following steps S101 to S105.

[0021] S101, obtain the resource access records of important services within a preset time from a pre-specified network device, divide the resource access records, and obtain a basic resource access distribution set D, a request parameter and request data distribution set A, a response data distribution set R, and a source address distribution set S.

[0022] Obtain the resource access records of all resources of important services within a preset time (usually one day) from relevant network devices, including the resource access record path, request parameters, request data, and response data; Remove the top-level resource access records from the resource access records, and construct the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S based on the remaining resource access records. The set elements of the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S have the same scale; divide the basic resource access distribution set D into h sets based on the depth of the resource access record path.

[0023] Remove the records of accessing top-level resources, and construct the basic resource access distribution set D based on the remaining resource access records. The total number of its records is |D|. According to the number of resources in the access records, divide it into h sets according to the depth of the resource access record path, which are D1,..., Dh respectively. The size of each set does not exceed |D|, and {|Di|} is a poset that gradually decreases with i according to the actual situation, because the depths of the records of accessing resources are not all the same, that is ; there are intersections between these sets, that is, the records in the Dh set will appear in the set in turn. If the depth of a certain resource access record path does not reach h, it will appear in the set.

[0024] Establish the request parameter and request data distribution set A, and the scale of the set elements is |A|. At this time, |A| = |D|; for the response records, they are no longer divided according to the depth of the resource access record path, and the content in the request parameter and request data distribution set A is tokenized, and the request fixed identifiers (such as HTTP request header identifiers, etc.), various stop words, date and time, etc. are removed. For the sake of fast processing, the embedding positions before the words are not considered, and only all the tokenization results are retained; Establish the response data distribution set R, and the scale of the set elements is |R|. At this time, |R| = |D|; for the response records, they are also no longer divided according to the depth of the resource access record path, and the content in the response data distribution set R is tokenized, and the response fixed identifiers (such as HTTP response header identifiers, etc.), stop words, date and time, etc. are removed. For the sake of fast processing, the layout of the embedding positions between words is not considered, and only all the tokenization results are retained; The source address distribution set S of accessing resources, and the scale of the set elements is |S|. At this time, |S| = |D|; according to the number of accesses, obtain its distribution. In this application, the source address distribution set S of accessing resources is only used as a reference for deviation correction; After constructing the request parameter and request data distribution set A and the response data distribution set R based on the remaining resource access records, it includes: Tokenize the content in the request parameter and request data distribution set A and the response data distribution set R, remove redundant information, and retain all the tokenization results; Calculate the probability that the resource access record d appears in all the tokenization results after tokenization in the request parameter and request data distribution set A through formula (1); Formula (1); In the formula, is the probability of the resource access record d appearing in all the word segmentation results after word segmentation processing in the request parameter and the request data distribution set A, is the statistical word is the number of times the word appears in all the word segmentation results after word segmentation processing of the request parameter and the request data distribution set A, is the number of words in the word segmentation result, is the total number of words in all the word segmentation results after word segmentation processing of the request parameter and the request data distribution set A; Calculate the probability of the resource access record d appearing in all the word segmentation results after word segmentation processing in the response data distribution set R through formula (2); Formula (2); In the formula, is the probability of the resource access record d appearing in all the word segmentation results after word segmentation processing in the response data distribution set R, is the statistical word is the number of times the word appears in all the word segmentation results after word segmentation processing of the response data distribution set R, is the number of words in the word segmentation result, is the total number of words in all the word segmentation results after word segmentation processing of the response data distribution set R.

[0025] S102, calculate the basic distribution probability index of the resource access record.

[0026] Based on the principle of rarity analysis, in general network attack and defense or behavior analysis cognition, the rarer the resource that may be accessed, the more likely it is an attack, that is, it is not a normal access. However, in practice, it can be found that many resources with immediate attributes are also rarely accessed, such as accessing a specific article in a paper library or some specific news pages on a certain day. Due to different personal preferences, the rarity analysis will fail at this time and report an error alarm with an unexpected number. Therefore, this application uses a multi-layer screening comprehensive response method to determine whether it is a suspicious or even harmful behavior; Define a weight w real vector, whose dimension is h, that is, the depth, ; In addition, it is necessary to ensure that wi decreases in sequence, and calculate the resource access distribution probability of a certain layer in Di respectively to form a probability distribution set class, D={ }, According to the construction method, {| |} is also a poset. For a certain resource access record d, calculate the basic distribution probability index of the resource access record d through formula (3); Formula (3); In the formula, is the basic distribution probability index of the resource access record d, is a real weight vector, is a column vector, is the probability of the resource access distribution of the resource access record d at the i-th layer, i = 1,..., h. If the resource access depth of the record d is less than h, then the corresponding .

[0027] The basic distribution probability index is derived from the distribution probabilities of different levels of each accessed resource. It needs to be calculated for each layer, and the scalar product operation is performed on the weight index of each layer for subsequent comprehensive index calculation (and the weight should be the largest).

[0028] S103. Calculate the comprehensive index of the resource access record based on the basic distribution probability index, the basic resource access distribution set D, the request parameters, the request data distribution set A, the response data distribution set R, and the source address distribution set S.

[0029] The calculation of the comprehensive index of the resource access record based on the basic distribution probability index, the basic resource access distribution set D, the request parameters, the request data distribution set A, the response data distribution set R, and the source address distribution set S includes: Define a four-dimensional real weight vector w’, respectively for the basic resource access distribution, the source address distribution, the request parameters and the request data distribution, and the response data distribution, that is, w’ = , , , , where should account for the highest proportion, set to at least 90%; for the resource access record d, calculate the comprehensive index of the resource access record d through formula (4); Formula (4); In the formula, is the comprehensive index of the resource access record d, is the weight for the basic resource access distribution, is the weight for the source address distribution, is the probability of the resource access record d in the source address distribution set S, is the weight for the request parameters and the request data distribution, is the probability of the resource access record d in the request parameters and the request data distribution set A, is the adjustment coefficient, is the weight for the response distribution, is the probability of the resource access record d in the response data distribution set R.

[0030] The reason for using the logarithmic function (log, with the natural logarithm as the base) for the last term in formula (4) is mainly to convert the probability distribution of the response into a negative number with less impact (less than 1). is an adjustment coefficient used to control the magnitude of the last term. Generally, it is a positive real number less than 1. Its logic is that if the attack fails, most of the error pages returned are the same or similar. The higher the proportion, the more malicious it should be. Finally, a preset threshold "threshold" is set. If the comprehensive index is lower than this threshold, such as 0.01, it is determined that the access is a real attack threat. S104. If the comprehensive index is greater than the preset threshold, it is determined that the access is a real attack threat, and an endogenous attack detection signature rule is generated to expand the threat detection scope to determine the relevant attack source.

[0031] Obtain the relevant attack suspicious addresses and relevant attack suspicious payloads corresponding to the relevant attack sources, add the relevant attack suspicious addresses and relevant attack suspicious payloads to the attack signature closure set and the attack source address closure set respectively, and alternately obtain relevant records, that is, search for relevant attack IP addresses through attack features, and add the incremental IP address-related attack features to the attack signature closure until the scale of the set elements of the attack signature closure set and the attack source address closure set no longer grows.

[0032] Considering that the features of many unknown access resource records may not necessarily contain real attack payloads. For example, / Elasticsearch is only used to detect whether the target server has deployed relevant services or only for version detection. Such abnormal transmissions have less payload, or even do not provide parameters, etc. At this time, the entropy value "entropy" of the request can be calculated (because the higher the entropy value, the more and more complex the payload that may be submitted). If it is lower than a certain threshold, it can be marked as detection; the features of the entropy value source include the number of parameters, the length of parameters, the length of the submitted data, and the distribution of word segmentation, etc. S105. Calculate the attack signature closure corresponding to the relevant attack source, obtain all potential attack sources through the attack signature closure, and use the potential attack sources as the result of unknown threat detection.

[0033] After the step of discovering the attack signature closure corresponding to the relevant attack source through search and obtaining all potential attack sources through the attack signature closure, it includes: Use the attack signature closure set and the attack source address closure set as the endogenous attack detection signature rule and the endogenous threat intelligence to expand the threat intelligence indicator library and the intrusion detection signature rule.

[0034] The generated attack signature closure content and attack source address closure content are used as endogenous rules and endogenous threat intelligence indicators, added to the system and reported to the centralized security operation and management platform for distribution as future rules or intelligence indicators.

[0035] In the unknown threat detection method based on behavior analysis in the present invention, a rare behavior analysis method using multi-layer set segmentation and recursive analysis is used to divide and judge all resource access information. This process does not require sample training (unsupervised and does not rely on the learning of historical attack signatures); and during this process, the resource access information is continuously screened to remove accesses that may be misreported due to simple rare behavior analysis, reducing the possibility of misreporting as a whole; and a negative adjustment parameter for possible failure information is added as a whole, thereby further reducing the generation of misreports. In the unknown threat detection method based on behavior analysis in the present invention, a relatively simple classification method is used to distinguish possible zero-day vulnerability attacks / N-day vulnerability attacks from general application detections, so as to provide the ability of data screening for subsequent judgment, reduce the work intensity of security analysts or security operation and maintenance personnel, and speed up the discovery speed of unknown threats. In the unknown threat detection method based on behavior analysis in the present invention, once some accesses are determined to be real attack threats, an indicator of endogenous threat intelligence can be directly generated to block their attack source addresses, and an endogenous attack detection signature rule can be generated, thereby expanding the scope of threat detection. In the unknown threat detection method based on behavior analysis in the present invention, if the relevant attack source is determined, through a certain degree of search, its attack signature closure can be found, and all potential attack sources (including detections) can be obtained through the attack signature closure, thereby forming an integrated attack closure.

[0036] In the unknown threat detection method based on behavior analysis in the present invention, it is possible to detect and judge unknown threats (including zero-day vulnerability attacks) without long-term baseline learning; compared with traditional machine learning, this application consumes less computing resources and does not require the establishment of a complex parameter network, thereby reducing the requirements for various resources, including memory resources.

[0037] Figure 2 It is a schematic diagram of the main components of the unknown threat detection system based on behavior analysis in the embodiment of the present invention. As Figure 2 shown, the unknown threat detection system 1 based on behavior analysis provided by the embodiment of the present invention includes a set construction module 10, a basic distribution probability index calculation module 20, a comprehensive index calculation module 30, a relevant attack source determination module 40, and a potential attack source acquisition module 50.

[0038] The set construction module 10 is used to obtain the resource access records of important services within a preset time from pre-specified network devices, partition the resource access records to obtain the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S; The basic distribution probability index calculation module 20 is used to calculate the basic distribution probability index of the resource access records; The comprehensive index calculation module 30 is used to calculate the comprehensive index of the resource access records based on the basic distribution probability index, the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S; The relevant attack source determination module 40 is used to, if the comprehensive index is greater than a preset threshold, determine that the access is a real attack threat, generate an endogenous attack detection signature rule to expand the threat detection range, so as to determine the relevant attack source; The potential attack source acquisition module 50 is used to calculate the attack signature closure corresponding to the relevant attack source, obtain all potential attack sources through the attack signature closure, and use the potential attack sources as the result of the unknown threat detection.

[0039] Figure 3 The schematic structural diagram of the electronic device entity provided by the embodiment of the present invention is as Figure 3 shown. The electronic device 60 includes: a processor 601 (processor), a memory 602 (memory), and a bus 603; Among them, the processor 601 and the memory 602 communicate with each other through the bus 603; The processor 601 is used to call the program instructions in the memory 602 to execute the methods provided by the above method embodiments, so as to execute the methods provided by the embodiments of the present invention.

[0040] This embodiment provides a non-transitory computer-readable storage medium. The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided by the embodiments of the present invention.

[0041] Those of ordinary skill in the art can understand that all or part of the steps for implementing the above method embodiments can be completed by hardware related to program instructions. The foregoing program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above method embodiments; and the foregoing storage medium includes: various storage media such as ROM, RAM, magnetic disk, or optical disc that can store program codes.

[0042] The above specific embodiments do not constitute a limitation on the protection scope of the present invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for detecting unknown threats based on behavior analysis, characterized in that, Including: Obtain the resource access records of important services within a preset time from a pre-specified network device, partition the resource access records to obtain a basic resource access distribution set D, a request parameter and request data distribution set A, a response data distribution set R, and a source address distribution set S; Calculate the basic distribution probability index of the resource access records; Calculate the comprehensive index of the resource access records based on the basic distribution probability index, the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S; If the comprehensive index is greater than a preset threshold, determine that the access is a real attack threat, generate an endogenous attack detection signature rule to expand the threat detection scope to determine the relevant attack sources; Calculate the attack signature closure corresponding to the relevant attack sources, obtain all potential attack sources through the attack signature closure, and use the potential attack sources as the result of the unknown threat detection.

2. The method for detecting unknown threats based on behavior analysis according to claim 1, wherein The partitioning of the resource access records to obtain the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S includes: Remove the top-level resource access records from the resource access records, and construct the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S based on the remaining resource access records. The set element scales of the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S are the same; After constructing the basic resource access distribution set D based on the remaining resource access records, it further includes: Divide the basic resource access distribution set D into h sets based on the depth of the resource access record path. The size of each set does not exceed |D|, and {|Di|} is a partially ordered set that gradually decreases according to i. .

3. The method for detecting unknown threats based on behavior analysis according to claim 2, wherein, After constructing the request parameter and request data distribution set A and the response data distribution set R based on the remaining resource access records, it includes: Perform word segmentation on the content in the request parameter and request data distribution set A and the response data distribution set R, remove redundant information, and retain all the word segmentation results; Calculate the probability of the resource access record d appearing in all the word segmentation results after word segmentation in the request parameter and request data distribution set A through formula (1); Formula (1); Wherein, is the probability of the resource access record d appearing in all the word segmentation results after word segmentation in the request parameter and the request data distribution set A, is the statistical word is the number of times the word appears in all the word segmentation results after word segmentation of the request parameter and the request data distribution set A, is the number of words in the word segmentation result, is the total number of words in all the word segmentation results after word segmentation of the request parameter and the request data distribution set A; Calculate the probability of the resource access record d appearing in all the word segmentation results after word segmentation in the response data distribution set R through formula (2); Formula (2); Wherein, is the probability of the occurrence of all the word segmentation results of the resource access record d after word segmentation in the response data distribution set R, is the statistical word is the number of occurrences of in all the word segmentation results of the response data distribution set R after word segmentation, is the number of words in the word segmentation result, is the total number of words in all the word segmentation results of the response data distribution set R after word segmentation.

4. The method for detecting unknown threats based on behavior analysis according to claim 3, wherein, The calculation of the basic distribution probability index of the resource access records includes: Calculate the basic distribution probability index of the resource access record d through formula (3); Formula (3); In the formula, is the basic distribution probability index of the resource access record d, is the real weight vector, is a column vector, is the resource access distribution probability of the resource access record d at the i-th layer, i = 1, ..., h. If the resource access depth of the record d is less than h, then the corresponding .

5. The method for detecting unknown threats based on behavior analysis according to claim 4, wherein, The calculation of the comprehensive index of the resource access records based on the basic distribution probability index, the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S includes: Calculate the comprehensive index of the resource access record d through formula (4); Formula (4); Wherein, is the comprehensive index of the resource access record d, is the weight for the basic resource access distribution, is the weight for the source address distribution, is the probability of the resource access record d in the source address distribution set S, is the weight for the request parameter and request data distribution, is the probability that the resource access record d appears in all the word segmentation results after word segmentation in the request parameter and request data distribution set A, is the adjustment coefficient, is the weight for the response data distribution, is the probability that the resource access record d appears in all the word segmentation results after word segmentation in the response data distribution set R.

6. The method for detecting unknown threats based on behavior analysis according to claim 1, wherein The calculation of the attack signature closure corresponding to the relevant attack sources includes: Obtain the relevant attack suspicious addresses and relevant attack suspicious payloads corresponding to the relevant attack sources, add the relevant attack suspicious addresses and relevant attack suspicious payloads to the attack signature closure set and the attack source address closure set respectively, search for relevant attack IP addresses through attack features, and add the newly added relevant attack IP addresses to the attack signature closure set until the scale of the set elements in the attack signature closure set and the attack source address closure set no longer grows.

7. The method for detecting unknown threats based on behavior analysis according to claim 6, wherein After the steps of discovering the attack signature closure corresponding to the relevant attack source through search and obtaining all potential attack sources through the attack signature closure, it includes: Construct endogenous attack detection signature rules and endogenous threat intelligence based on the attack signature closure and the attack source address closure to expand the intrusion detection signature rules and the threat intelligence indicator library.

8. A system for detecting unknown threats based on behavior analysis, characterized in that, It includes: A set construction module, which is used to obtain the resource access records of important services within a preset time from a pre-specified network device, divide the resource access records to obtain a basic resource access distribution set D, a request parameter and request data distribution set A, a response data distribution set R, and a source address distribution set S; A basic distribution probability index calculation module, which is used to calculate the basic distribution probability index of the resource access records; A comprehensive index calculation module, which is used to calculate the comprehensive index of the resource access records based on the basic distribution probability index, the basic resource access distribution set D, the request parameter and request data distribution set A, the response data distribution set R, and the source address distribution set S; A relevant attack source determination module, which is used to determine that the access is a real attack threat if the comprehensive index is greater than a preset threshold, generate an endogenous attack detection signature rule to expand the threat detection range, and determine the relevant attack source; A potential attack source acquisition module, which is used to calculate the attack signature closure corresponding to the relevant attack source, obtain all potential attack sources through the attack signature closure, and use the potential attack sources as the result of the unknown threat detection.

9. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method according to any one of claims 1 to 7.

Images