Fine-grained real-time intrusion detection method and system based on diffusion model

Abstract

The application discloses a fine-grained real-time intrusion detection method and system based on a diffusion model, which comprises the following steps: collecting data at a thread level by using eBPF for fine-grained data collection; converting irregular system logs into regular integer data through preprocessing to adapt to the kernel space; constructing a fine-grained real-time intrusion detection model and training the model in the user space, wherein the model is formed by introducing a diffusion model based on a ResNet model; collecting system logs in the user space, and transmitting the data to the kernel space model for detection by using shared memory; the shared memory area is a lock-free circular buffer with atomic index updating, and a log collector writes log entries after preprocessing in the shared memory area for direct access by an intrusion detection engine; and after the model is retrained with new data in the user space, updated parameters are transmitted to the kernel space by using eBPF pin map.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a fine-grained real-time intrusion detection method and system based on a diffusion model. BACKGROUND

[0002] Existing intrusion detection methods often run in user space and can only use coarse-grained data in the user space, such as data packets, login or authorization logs, etc. These intrusion detection methods cannot capture fine-grained system behaviors. For example, in an SSH brute-force attack, a traditional intrusion detection method uses the system auth.log or auditd log and can only record that the / usr / sbin / sshd program is executed and whether the password is accepted by the system, and cannot discover the information flow between system threads in the attack process, such as security_socket_connect, setregid, setreuid, etc. Coarse-grained data is easily confused with normal behaviors and can easily lead to a large number of false positives. In network space security, when multiple processes simultaneously access shared resources (for example, configuration files or temporary files), resource access competition conditions occur, which enables an attacker to implement an intrusion. For example, in a time-of-check-to-time-of-use (TOCTOU) attack, an attacker uses a short interval between resource state verification (for example, permission check) and actual use to damage a system. These millisecond-level attacks bring great challenges to an intrusion detection system (IDS). First, a traditional coarse-grained IDS cannot capture intermediate states and can only record surface authorization success and other “legitimate access” events, which leads to an inability to discover attack behaviors in a timely manner. Second, normal high-concurrency operations (for example, cloud computing) often appear in a competition mode, which leads to a large number of false positives of these coarse-grained IDSs running in the user space. Therefore, it is necessary to design an intrusion detection system that can observe more fine-grained information in the execution process of a program or command and can track system thread behaviors in real time.

[0003] eBPF (extended Berkeley Packet Filter) is a revolutionary kernel technology that originated from the traditional BPF (Berkeley Packet Filter) packet filtering mechanism, but has evolved into a general-purpose kernel execution engine. Traditional BPF was proposed in 1992 and is mainly used for network packet filtering; while eBPF was introduced into the Linux kernel by Alexei Starovoitov in 2014 and has been significantly enhanced since version 4.x, supporting a variety of functions such as system audit tracking in addition to network packet filtering. The core breakthrough of eBPF is its sandboxed execution environment, which allows users to safely inject custom logic into kernel privileged execution flows without modifying kernel source code or compiling kernel modules. Therefore, eBPF can perform fine-grained observation and tracking of the system, enabling the discovery of information that existing IDS cannot discover, making it very suitable for attack detection. This feature makes it a very popular kernel technology for modern Linux systems, with disruptive value in cloud-native, network security, and performance analysis.

[0004] The diffusion model is inspired by non-equilibrium statistical physics in thermodynamics, particularly the random diffusion process of microscopic particles in a medium due to molecular thermal collisions described by Brownian Motion. This model abstracts data generation as a reversible thermodynamic evolution: in the forward phase, it simulates the principle of entropy increase in a closed system by gradually injecting Gaussian noise (analogous to molecular thermal disturbance) to irreversibly degrade the original data distribution (low-entropy ordered state) into disordered Gaussian noise (high-entropy equilibrium state); in the reverse phase, it learns the "convection force" that reverses the diffusion process by training a deep neural network, starting from pure noise (high-entropy state), gradually canceling out noise disturbances (opposing entropy increase), and finally reconstructing low-entropy ordered samples that conform to the original data distribution. This mechanism enables the diffusion model to accurately model the probability flow in complex data distributions, making it suitable for scenarios that require high-fidelity generation of highly structured data (such as images, molecular configurations), and to some extent, addressing the challenges of traditional methods in detail restoration and distribution coverage. In machine learning or deep learning, the goal of the diffusion model is to learn the latent structure of the data set by modeling the diffusion pattern of data points in the latent space.

[0005] The existing research compares auditd and eBPF in depth, and finds that, compared with eBPF, auditd cannot capture communication information between system processes. Some researchers point out that the existing IDS often sacrifices detection granularity to improve computing efficiency, and designs a system NODLINK for real-time detection of advanced persistent threats (APTs) based on the Steiner Tree Problem. Some researchers design a neural network detection and prevention system NN-eBPF running in the kernel space based on ebpf, which improves the detection efficiency, but still stays at the network level and only uses network packets as coarse-grained data for attack detection, which is easy to cause high false positive rate.

[0006] In the above existing technology, the main problem is the contradiction between perception granularity and computing efficiency. In order to improve the operation efficiency, the IDS running in the user space often sacrifices the detection granularity, and can only analyze the system security problem from the log after the attack is completed, and cannot find the attack evidence in real time during the attack process. Because the attack operation designs many behaviors similar to normal users, especially in large-scale distributed environments, it causes the existing IDS to produce a large number of false positives. Some methods use fine-grained data, but do not consider the real-time problem when designing the IDS system, and thus miss the short opportunity to intercept attacks, and can only be used for post-analysis forensics. SUMMARY

[0007] In view of the above problems, the present application provides a fine-grained real-time intrusion detection method and system based on a diffusion model and a storage medium, which aims to refine the perception granularity of IDS and improve the detection efficiency of IDS, and achieve real-time and efficient detection of attack behavior.

[0008] According to a first aspect of an embodiment of the present disclosure, a fine-grained real-time intrusion detection method based on a diffusion model is provided, and the method comprises the following steps:

[0009] Thread-level fine-grained data collection is performed using eBPF, and the collected data is preprocessed to convert irregular system logs into regular integer data to adapt to the kernel space;

[0010] A fine-grained real-time intrusion detection model is constructed and trained in the user space, and the fine-grained real-time intrusion detection model is formed by introducing a diffusion model based on a ResNet model;

[0011] For the system logs collected in the user space, shared memory is used to transfer data to the kernel space model for detection. The shared memory area is a lock-free circular buffer with atomic index update, and the log collector writes the preprocessed log entries in it for direct access by the intrusion detection engine;

[0012] The fine-grained real-time intrusion detection model is retrained with new data in the user space, and the updated parameters are transmitted to the kernel space model using an eBPF pin map.

[0013] The fine-grained real-time intrusion detection model and the kernel space model are consistent detection models in the user space and the kernel space, respectively.

[0014] In some embodiments, the residual connection in the ResNet model is treated as the discretization of an ordinary differential equation, corresponding to the convection process of thermodynamics, and the diffusion model is introduced by Laplacian regularization.

[0015] In some embodiments, a dynamic buffer is provided in shared memory. When new collected data is available, it is first determined whether the dynamic buffer is full. If the dynamic buffer is already full, a larger space is allocated through realloc. If the dynamic buffer is not full, the intrusion detection engine directly reads the unprocessed data from the dynamic buffer.

[0016] In some embodiments, the updated parameters are transmitted to the kernel space model using an eBPF pin map, including the following steps:

[0017] Two pin maps are defined and the corresponding indexes are set. The map being used by the intrusion detection engine is in use, and the other map is in idle state.

[0018] When the updated parameters need to be transmitted to the running kernel space model, the index of the running map indexrunning is first read, and the index of the idle map is calculated according to indexrunning , and the new parameters are updated to the map.

[0019] In some embodiments, the Laplacian matrix The specific expression is: , where is the degree matrix of the feature matrix, is the weight matrix of the feature matrix, and is the similarity between data points, calculated by the Gaussian kernel : , where is a hyperparameter that adjusts the width of the Gaussian kernel, , represent two different data samples.

[0020] In some embodiments, the data collected by eBPF includes one or more of the following: timestamp, user ID, system executed command, process ID, thread ID, return value, system call event, and command parameters.

[0021] ​In some embodiments, for the pre-processing of the collected data, the timestamp is directly converted into an integer in seconds; the user ID, process ID, thread ID, and return value are all directly converted into integers; the system executed commands and system call events are recorded by maintaining a dictionary, using the corresponding index number in the dictionary instead of the original string; the command parameters are mapped to integers using the FNV-1a hash algorithm.

[0022] According to a second aspect of the embodiments of the present disclosure, a fine-grained real-time intrusion detection system based on a diffusion model is provided, and the system comprises:

[0023] A data collection and pre-processing module is configured to collect data at a thread level in a fine-grained manner by using eBPF through a pre-set or self-defined function, and to convert irregular system logs into regular integer data through pre-processing of the collected data, so as to adapt to the kernel space;

[0024] A fine-grained real-time intrusion detection model design module is configured to construct a fine-grained real-time intrusion detection model and train the model in a user space, wherein the fine-grained real-time intrusion detection model is formed by introducing a diffusion model based on a ResNet model;

[0025] A data interaction module is configured to transmit data to a kernel space model for detection by using shared memory for system logs collected in the user space, wherein the shared memory region is a lock-free circular buffer with atomic index updating, and a log collector writes log entries that have been pre-processed in the region for direct access by an intrusion detection engine;

[0026] A model parameter updating module is configured to transmit updated parameters to the kernel space model by using eBPF pin map after the fine-grained real-time intrusion detection model is retrained in the user space with new data;

[0027] The fine-grained real-time intrusion detection model and the kernel space model are detection models with consistent structures in the user space and the kernel space, respectively.

[0028] According to a third aspect of the embodiments of the present disclosure, an electronic device is provided, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the fine-grained real-time intrusion detection method based on a diffusion model when executing the program.

[0029] According to a fourth aspect of the embodiments of the present disclosure, a non-temporary computer readable storage medium is provided, which stores computer instructions, and the instructions implement the steps of the fine-grained real-time intrusion detection method based on a diffusion model when executed by a processor.

[0030] The embodiment of the disclosure provides a fine-grained real-time intrusion detection method and system based on a diffusion model and a storage medium. In order to improve the detection efficiency of IDS while refining the perception granularity of IDS, achieve real-time and efficient detection of attack behavior, strive to discover attack behavior in time during the attack process of the system, and strive to intercept the short opportunity of attack. The present application is developed based on eBPF, which integrates data collection and detection together. First, the eBPF is used to collect the thread behavior data of the system in a fine-grained manner. In order to solve the problem that eBPF cannot support floating point operation, the log text data is converted to an integer through FNV-1a hash function and dictionary. The diffusion mechanism is introduced into the multi-layer neural network ResNet model to form a convection-diffusion model, improve the stability of the model and the adaptability to few samples. The model is trained in the user space, and the parameters are fixed after training. The parameter atomic update algorithm is designed so that the model does not need to be interrupted during the update process. Further, based on eBPF, a model with the same structure is realized in the kernel space. The fixed parameters are transmitted to the kernel space through eBPF pin map, and the real-time collected data is transmitted to the model through shared memory for detection, so that the fine-grained data is collected and synchronous detection is performed at the same time, and the problem that the perception granularity and the detection efficiency cannot be compatible is solved. Compared with the existing technology, the present application has the following beneficial effects:

[0031] 1) The present application designs an intrusion detection system capable of running in the kernel space of the system based on eBPF, which can solve the contradiction between perception granularity and detection efficiency compared with the existing intrusion detection system, and can improve the detection efficiency of the system while ensuring that the system can perceive small granularity (thread level).

[0032] 2) The present application designs a preprocessing process for system log text data, incrementally maintains COMM and EVENT dictionaries and uses corresponding indexes, and uses FNV-1a hash algorithm to map complex parameters ARGS in the log to 32-bit integer data, which meets the limitation of eBPF verifier.

[0033] 3) The present application combines ResNet and convection-diffusion model based on the similarity of structure and principle, improves the accuracy and stability of the intrusion detection model, and improves the support for fewer data sample attack categories, realizes the classification of intrusion methods while discovering intrusion behavior, and not only the normal / intrusion binary classification of the existing IDS.

[0034] 4) The present application designs shared memory for data interaction between the user space and the kernel space of the system, realizes zero-copy and real-time processing of data, does not need system context switching, and greatly reduces the calculation and storage overhead of the existing IDS in the data collection and processing process.

[0035] 5) The application relates to a parameter hot updating method, which transfers parameters from a user space to a kernel space through a pin map, defines the use and idle state of the pin map and corresponding indexes, and does not need to interrupt a model updating process, and can realize real-time and continuous updating compared with an existing method.

[0036] It should be understood that the foregoing general description and the following detailed description are only examples and explanatory, and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0037] The accompanying drawings incorporated in and forming a part of the specification illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the application;

[0038] Figure 1 is a schematic diagram of a fine-grained real-time intrusion detection method based on a diffusion model in an embodiment of the application;

[0039] Figure 2 is a logic diagram of a shared memory design in an embodiment of the application;

[0040] Figure 3 is a structure diagram of a fine-grained real-time intrusion detection system based on a diffusion model in an embodiment of the application;

[0041] Figure 4 is a schematic diagram of an electronic device in an embodiment of the application. DETAILED DESCRIPTION

[0042] The application will be further described below in conjunction with the drawings and embodiments. It should be understood that the specific embodiments described herein are only for explaining the application, and not for limiting the application. In addition, it should be noted that only the parts related to the application are shown in the drawings, and not all the structures.

[0043] Before the example embodiments are discussed in more detail, it should be mentioned that some of the example embodiments are described as processes or methods depicted as flow charts. Although the steps of the processes are depicted in a sequential order, many of the steps can be performed in parallel, concurrently or at the same time. In addition, the order of the steps can be re-arranged. The processes can be terminated when their operations are completed, but can also have additional steps not included in the figure. The processes can correspond to methods, functions, procedures, subroutines, subprograms, etc.

[0044] eBPF can dive into the kernel, observe and trace what the kernel is doing, and a single event or simple command in user space can see detailed system call and parameter information in the kernel, which is very valuable for system analysis and intrusion detection. Since the verifier needs to be verified frequently to ensure system security, eBPF still has limitations such as instruction number and loop number at this stage, and it is relatively difficult to develop a detection system based on eBPF. However, eBPF can combine data collection and analysis into one, alleviating the contradiction between perception granularity and computing efficiency. Therefore, an embodiment based on eBPF designs a fine-grained real-time intrusion detection method based on a diffusion model. In other words, the present application is based on network attack and defense and operating system knowledge, and uses eBPF to develop an intrusion detection system running in the system kernel. Considering that many attacks cannot be defined by rules, neural networks are further used to distinguish complex attack methods.

[0045] The embodiments of the fine-grained real-time intrusion detection method, system and storage medium based on the diffusion model are provided as follows:

[0046] As shown in Figure 1 A fine-grained real-time intrusion detection method based on a diffusion model includes the following steps:

[0047] (1) Collect data at the thread level using eBPF, and convert irregular system logs to regular integer data through preprocessing to adapt to the kernel space;

[0048] (2) Construct a fine-grained real-time intrusion detection model and train it in the user space, wherein the fine-grained real-time intrusion detection model is formed by introducing a diffusion model based on a ResNet model;

[0049] (3) For the system logs collected in the user space, use shared memory to transfer data to the kernel space model for detection, the shared memory area is a lock-free circular buffer with atomic index update, and the log collector writes the preprocessed log entries in it for direct access by the intrusion detection engine;

[0050] (4) After the fine-grained real-time intrusion detection model is retrained in the user space with new data, use eBPF pinmap to transfer the updated parameters to the kernel space model;

[0051] The fine-grained real-time intrusion detection model and the kernel space model are consistent detection models in the user space and the kernel space, respectively.

[0052] Specifically, the data collected by eBPF includes one or more of timestamp, user ID, system executed command, process ID, thread ID, return value, system call event and command parameter.

[0053] Specifically, for the pre-processing of the collected data, the timestamp is directly converted into an integer calculated in seconds; the user ID, process ID, thread ID, and return value are all directly converted into integers; the system-executed commands and system call events are recorded by maintaining a dictionary, using the corresponding index number in the dictionary instead of the original string; the command parameters are mapped to integers using the FNV-1a hash algorithm.

[0054] In some specific embodiments, in order to track and collect system information in real time, eBPF is used to perform thread-level fine-grained data collection with preset and custom functions. In the preferred embodiment, the preset functions are: bpf_get_current_pid_tgid(), bpf_get_current_comm(); the custom functions are: SEC("kprobe / do_sys_openat2"), SEC("uprobe / path / to / bin:function_name"). Since eBPF runs in the system kernel, it can track system events and achieve efficient and fine-grained data collection tasks. After collecting the data, certain pre-processing is needed to adapt to the kernel environment. The collected data characteristics include the timestamp (TIME), user ID (UID), system-executed command (COMM), process ID (PID), thread ID (TID), return value (RET), system call event (EVENT), and command argument (ARGS). The timestamp needs to be converted into an integer calculated in seconds, which can be directly calculated. UID, PID, TID, and RET can be directly converted into integers. COMM, EVENT, and ARGS, which are character data, need further processing. For COMM and EVENT, which are relatively short character data, a dictionary is maintained for recording, and the corresponding index number in the dictionary is used instead of the original string. For ARGS, the FNV-1a hash algorithm is used to map it to a 32-bit integer. If the data volume is large, it can be extended to 64 bits or even higher, and then truncated to a length not exceeding the system support according to the system bit number. Using these pre-processing methods, irregular system logs can be converted into regular integer data, making it easier for the system kernel to process.

[0055] The residual connection in the ResNet model is regarded as the discretization of an ordinary differential equation, corresponding to the convection process of thermodynamics, and the diffusion model is introduced by Laplace regularization.

[0056] Specifically, the intrusion detection model introduces a diffusion model based on the traditional ResNet model to form a multi-classification intrusion detection model, which can classify the attack types based on the discovery of attacks.

[0057] In a general ResNet, the input The feature matrix of the k-th residual block is The nonlinear connection between network layers can be seen as a function The function has parameters Each residual block can be written as:

[0058] (1)

[0059] At time , the heat diffusion process formula for input is:

[0060] (2)

[0061] Where is the Laplacian matrix, and a negative sign is used here because the Laplacian operator is usually used to describe the process of heat diffusion from high concentration to low concentration. Discretization of formula (2) can be obtained:

[0062] (3)

[0063] In ResNet, evolution and change are generated by residual blocks, so the evolution process at each can be mapped to a residual block, and formula (3) can be written as:

[0064] (4)

[0065] Where is the diffusion step, , is the maximum value of the Laplacian matrix .

[0066] The residual connection in ResNet can be seen as the discretization of ordinary differential equations, corresponding to the convection process of heat dynamics, while the diffusion process can be introduced by Laplacian regularization. It can be found by observing formula (4) and formula (1) that formula (4) and formula (1) are very similar in structure, only the parameters are different. Therefore, the diffusion layer can be easily combined with ResNet, and the development of ResNet based on diffusion model in user space or kernel space does not require additional design, only the calculation and storage of the Laplacian matrix. The Laplacian matrix is calculated by the following formula:

[0067] (5)

[0068] Where is the degree matrix of the feature matrix, is the weight matrix of the feature matrix, and is the similarity between data points, which is calculated by the Gaussian kernel:

[0069] (6)

[0070] wherein, , denote two different data samples, is a hyperparameter that adjusts the width of the Gaussian kernel and is manually determined by the training process. In order to improve the calculation efficiency, the detection model with the same structure as the user space is developed in the kernel based on eBPF. Since eBPF does not support floating-point operation, in order to enable the detection model in the kernel space to run normally, it is necessary to convert the floating-point number to an integer, that is, to multiply and expand. After expansion, the numerical error of the floating-point number itself will be magnified. In order to avoid the numerical error causing the Laplacian matrix to be asymmetric and to ensure the effectiveness of the Laplacian matrix, the feature weight matrix is further symmetrically normalized:

[0071] (7)

[0072] (8)

[0073] A dynamic buffer is provided in the shared memory. When new collected data is available, it is first determined whether the dynamic buffer is full. If the dynamic buffer is already full, a larger space is allocated through realloc; if it is not full, the intrusion detection engine directly reads the unprocessed data from the dynamic buffer.

[0074] Specifically, since the steps of log collection, model training, etc. are completed in the system user space, while real-time intrusion detection is completed in the system kernel space, the present application involves the interaction of data and model parameters between the system user space and the kernel space.

[0075] For the collected system logs, the present application uses shared memory to deliver data to the kernel space for detection. The shared memory region is designed as a lock-free circular buffer with atomic index update, and the log collector writes preprocessed log entries in it, and the detection engine directly accesses these entries without system call intervention, avoiding unnecessary overhead of traditional application kernel context switching, realizing zero-copy and further improving the efficiency of the intrusion detection system. Compared with data collection, intrusion detection involves more calculations and instructions, resulting in a small time difference between the two. In order to avoid data loss, the present application further implements a dynamic buffer in the shared memory. For example, Figure 2As shown, when new collected data arrives, first determine whether the dynamic buffer is full, if the dynamic buffer has been full, then need to allocate more space through realloc. If not full, the intrusion detection engine directly reads the unprocessed data from the dynamic buffer. Since different logs are of different lengths, the difference is large, in order to ensure the integrity of the read log, the application adds a terminator '\0' at the end of each complete log. The read and write pointers read_index and write_index are designed to read and write the buffer. For the data collector, when data needs to be written to the buffer, determine whether write_index+data_len<=buffer_size, if true, write to the buffer, otherwise the log is too long, block the current log, and calculate the next write pointer next_write=(write_index+data_len)%buffer_size. For the detection engine, when reading data, first calculate the data chunk size data_chunk = min(available_data, buffer_size), if the log terminator '\0' is found, read the complete log, otherwise splice the incomplete data chunk, until a complete log is read. Shared memory provides high-performance inter-process communication for log collection and detection engine, and constitutes the data highway of IDS. The architecture establishes a direct memory mapping channel, supports zero-copy data transmission between user space fine-grained log collection and kernel space intrusion detection module, bypasses the traditional kernel subsystem and serialization overhead.

[0076] The updated parameters are passed to the kernel space model using the eBPF pin map, including the following steps:

[0077] Two pin maps are defined, and the corresponding indexes are set. The map used by the intrusion detection engine is in use, and the other map is in idle state.

[0078] When the updated parameters need to be passed to the running kernel space model, first read the running map index indexrunning, calculate the index of the idle map according to indexrunning , and update the new parameters to the map of .

[0079] Specifically, in addition to data, the parameters required by the diffusion model also need to be passed from the system user space to the kernel space. If the intrusion detection model is interrupted during the parameter update process, the system will face an unprotected threat. To solve this problem, the present application adopts a parameter hot update method to perform atomic update on the parameters, and uses eBPF pin map to pass the parameters to the system kernel. First, two pin maps are defined, corresponding to indexes 0 and 1. The map being used by the intrusion detection engine is in use, and the other map is in idle state. After the model is retrained with new data in the user space, the updated parameters need to be passed to the running kernel model. At this time, the index of the running map is read first, and the index of the idle map is calculated: , represents the modulo operation, that is, the remainder of one number divided by another number (such as 1 mod 2 = 1), and the new parameters are updated to the map of The entire update process does not need to interrupt the intrusion detection engine, but only involves the reading and writing of pin maps. Therefore, the embodiment of the present application can run continuously in real time online. It should be noted that the pin map ("pin map") is a data structure of eBPF, which is used for data interaction between the kernel space and the user space.

[0080] The present application proposes a fine-grained real-time intrusion detection method based on a diffusion model, which can detect in real time while tracking detailed information such as system thread behavior, thereby alleviating the contradiction between the perception granularity and the calculation efficiency of the existing IDS. Attack detection is performed while collecting data in real time, which requires solving the data reading and writing and caching problems; deploying the model trained in the user space to the kernel space needs to adapt to the limitations of eBPF; to ensure the continuous and stable operation of the model, the problem of real-time parameter update without interrupting the detection model needs to be solved.

[0081] Another embodiment is used to illustrate a fine-grained real-time intrusion detection system based on a diffusion model, as shown in Figure 3 The system 300 comprises:

[0082] A data collection and preprocessing module 310 is configured to collect data at a thread level in a fine-grained manner by using a preset or self-defined function through eBPF, and convert irregular system logs into regular integer data through preprocessing, so as to adapt to the kernel space;

[0083] A fine-grained real-time intrusion detection model design module 320 is configured to construct a fine-grained real-time intrusion detection model and train the model in the user space, wherein the fine-grained real-time intrusion detection model is formed by introducing a diffusion model based on a ResNet model;

[0084] The data interaction module 330 is configured to transmit data to the kernel space model for detection by using shared memory for system logs collected in the user space, the shared memory region is a lock-free circular buffer with atomic index update, and the log collector writes preprocessed log entries in the shared memory region for direct access by the intrusion detection engine.

[0085] The model parameter updating module 340 is configured to transmit updated parameters to the kernel space model by using eBPF pin map after the fine-grained real-time intrusion detection model is retrained with new data in the user space.

[0086] The fine-grained real-time intrusion detection model and the kernel space model are detection models with the same structure in the user space and the kernel space, respectively.

[0087] In addition to the above modules, the system 300 can also include other components, however, since these components are irrelevant to the content of the embodiments of the present disclosure, the illustration and description thereof are omitted here.

[0088] The other specific working processes of the fine-grained real-time intrusion detection system 300 based on the diffusion model are described with reference to the above description of the fine-grained real-time intrusion detection method based on the diffusion model, and will not be described here.

[0089] Another embodiment is used to illustrate that the system of the present application can also be implemented by means of Figure 4 the architecture of the computing device shown. Figure 4 The architecture of the computing device is shown. As shown in Figure 4 the computer system 410, the system bus 430, the one or more CPUs 440, the input / output 420, the memory 450, etc. The memory 450 can store various data or files used by the computer processing and / or communication and the program instructions executed by the CPU, including the program instructions of the embodiments of the fine-grained real-time intrusion detection method based on the diffusion model. Figure 4 The architecture shown is only exemplary, and when implementing different devices, the architecture Figure 4one or more components in the system. The memory 450, as a kind of computer readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the diffusion model based fine-grained real-time intrusion detection method in the embodiment of the present application (for example, the data collection and preprocessing module 310, the fine-grained real-time intrusion detection model design module 320, the data interaction module 330 and the model parameter updating module 340 in the diffusion model based fine-grained real-time intrusion detection system 300). One or more CPUs 440 execute various functional applications and data processing of the system of the present application by running the software programs, instructions and modules stored in the memory 450, that is, implement the diffusion model based fine-grained real-time intrusion detection method as described above, which includes the following steps:

[0090] Thread-level fine-grained data collection is performed by using eBPF, and the collected data is preprocessed to convert irregular system logs into regular integer data to adapt to the kernel space;

[0091] A fine-grained real-time intrusion detection model is constructed and trained in the user space, and the fine-grained real-time intrusion detection model is formed by introducing a diffusion model based on a ResNet model;

[0092] For the system logs collected in the user space, shared memory is used to deliver data to the kernel space model for detection, the shared memory area is a lock-free circular buffer with atomic index update, and the log collector writes the preprocessed log entries in it for direct access by the intrusion detection engine;

[0093] After the fine-grained real-time intrusion detection model is retrained with new data in the user space, the updated parameters are delivered to the kernel space model by using eBPF pin map;

[0094] The fine-grained real-time intrusion detection model and the kernel space model are consistent detection models in the user space and the kernel space, respectively.

[0095] Of course, the processor of the server provided in the embodiment of the present application is not limited to performing the method operations as described above, but can also perform the related operations in the diffusion model based fine-grained real-time intrusion detection method provided in any embodiment of the present application.

[0096] The memory 450 can include primarily a program storage area and a data storage area, where the program storage area can store an operating system, application programs, etc. required by at least one function; the data storage area can store data including those created through the use of the terminal, etc. Additionally, the memory 450 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid state memory device. In some examples, the memory 450 can further include a memory that is remotely located with respect to the one or more CPUs 440, and can be connected to the apparatus through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0097] The input / output 420 can be used to receive inputted digital or character information, and to generate key signal inputs related to the user settings and function controls of the apparatus. The input / output 420 can also include a display device such as a display screen, etc.

[0098] The embodiment of the present application further provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the diffusion model based fine-grained real-time intrusion detection method described in the above embodiment. The computer readable storage medium of the embodiment of the present application can adopt any combination of one or more computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination thereof. More specific examples (non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device.

[0099] The computer readable signal medium can include a data signal that is propagated in baseband or that is propagated as part of a carrier wave. Such propagated data signals can take a wide variety of forms, including but not limited to electro-magnetic signals, optical signals, or any suitable combination thereof. Computer readable signal media can also be any computer readable medium that is not a storage medium, and that can communicate, propagate or transport programming for use by or in connection with an instruction execution system, apparatus or device.

[0100] The program code contained on a storage medium can be transmitted in any suitable form, including but not limited to electrical, optical, acoustical, or any combination of these. The program code can be transmitted from a single location, from multiple locations in a single transmission, or downloaded from different locations in multiple transmissions.

[0101] In addition, other specific working processes of the non-temporary computer readable storage medium are described with reference to the above description of the embodiment of the fine-grained real-time intrusion detection method based on the diffusion model, and will not be described again.

[0102] In this document, the terms "comprise", "contain", or any other variant thereof are intended to cover a non-exclusive inclusion, so that a process, method, step that comprises a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such a process, method, step.

[0103] The above is a further detailed description of the present application in combination with specific preferred embodiments, and cannot be considered as limiting the specific implementation of the present application to these descriptions. For ordinary skilled persons in the technical field to which the present application belongs, a number of simple deductions or replacements can be made without departing from the concept of the present application, and all of them should be considered as falling within the protection scope of the present application.

Claims

1. A fine-grained real-time intrusion detection method based on a diffusion model, characterized in that, The method includes the following steps: eBPF is used for thread-level fine-grained data collection. The collected data is preprocessed to convert irregular system logs into regular integer data to fit the kernel space. A fine-grained real-time intrusion detection model is constructed and trained in user space. The fine-grained real-time intrusion detection model is formed by introducing a diffusion model on the basis of the ResNet model. For system logs collected in user space, shared memory is used to transfer the data to the kernel space model for detection. The shared memory area is a lock-free circular buffer with atomic index updates. The log collector writes pre-processed log entries into it for direct access by the intrusion detection engine. After the fine-grained real-time intrusion detection model is retrained in user space with new data, the updated parameters are passed to the kernel space model using the eBPF pin map. Among them, the fine-grained real-time intrusion detection model and the kernel space model are detection models with consistent structures in user space and kernel space, respectively; The residual connections in the ResNet model are treated as discretizations of ordinary differential equations, corresponding to the convection process in thermodynamics. The diffusion model is introduced through Laplace regularization. Laplace matrix The specific expression is: ,in It is the degree matrix of the characteristic matrix. It is the weight matrix of the feature matrix, representing the similarity between data points, calculated using a Gaussian kernel. The calculation shows that: ,in It is a hyperparameter for adjusting the Gaussian kernel width. , This represents two different data samples.

2. The fine-grained real-time intrusion detection method based on a diffusion model according to claim 1, characterized in that, The shared memory contains a dynamic buffer. When new data is collected, it is first checked whether the dynamic buffer is full. If the dynamic buffer is full, more space is allocated using realloc. If it is not full, the intrusion detection engine directly reads the unprocessed data from the dynamic buffer.

3. The fine-grained real-time intrusion detection method based on a diffusion model according to claim 2, characterized in that, The updated parameters are passed to the kernel space model using the eBPF pin map, including the following steps: Define two pin maps and set corresponding indices. The map that the intrusion detection engine is using is in use, while the other map is in an idle state. When it is necessary to pass updated parameters to the running kernel space model, the running map index `indexrunning` is read first, and the index of the free map is calculated based on `indexrunning`. And update the new parameters to The map.

4. The fine-grained real-time intrusion detection method based on a diffusion model according to claim 1, characterized in that, Data collected using eBPF includes one or more of the following: timestamps, user IDs, system-executed commands, process IDs, thread IDs, return values, system call events, and command parameters.

5. The fine-grained real-time intrusion detection method based on the diffusion model according to claim 4, characterized in that, For the preprocessing of collected data, timestamps are directly converted to integers in seconds; user IDs, process IDs, thread IDs, and return values ​​are all directly forcibly converted to integers; commands executed by the system and system call events are recorded by maintaining a dictionary, and the corresponding index number in the dictionary is used to replace the original string; Command parameters are mapped to integers using the FNV-1a hash algorithm.

6. A fine-grained real-time intrusion detection system based on a diffusion model, characterized in that, The system includes: The data collection and preprocessing module is used to perform thread-level fine-grained data collection using eBPF. The collected data is preprocessed to convert irregular system logs into regular integer data to fit the kernel space. A fine-grained real-time intrusion detection model design module is used to construct a fine-grained real-time intrusion detection model and train it in user space. The fine-grained real-time intrusion detection model is formed by introducing a diffusion model on the basis of the ResNet model. The data interaction module is used to transfer system logs collected in user space to the kernel space model for detection using shared memory. The shared memory area is a lock-free circular buffer with atomic index updates. The log collector writes pre-processed log entries into it for direct access by the intrusion detection engine. The model parameter update module is used to pass the updated parameters to the kernel space model after the fine-grained real-time intrusion detection model is retrained in user space with new data, using the eBPF pin map. Among them, the fine-grained real-time intrusion detection model and the kernel space model are detection models with consistent structures in user space and kernel space, respectively; The residual connections in the ResNet model are treated as discretizations of ordinary differential equations, corresponding to the convection process in thermodynamics. The diffusion model is introduced through Laplace regularization. Laplace matrix The specific expression is: ,in It is the degree matrix of the characteristic matrix. It is the weight matrix of the feature matrix, representing the similarity between data points, calculated using a Gaussian kernel. The calculation shows that: ,in It is a hyperparameter for adjusting the Gaussian kernel width. , This represents two different data samples.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the fine-grained real-time intrusion detection method based on the diffusion model as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium, wherein computer instructions are stored on the storage medium, characterized in that, When the instructions are executed by the processor, they implement the steps of the fine-grained real-time intrusion detection method based on the diffusion model as described in any one of claims 1 to 5.

Images