Behavior detection method and device, computer device and readable storage medium

Abstract

This application relates to a behavior detection method, apparatus, computer device, computer-readable storage medium, and computer program product. The method includes: acquiring client behavior, a key feature detection set, and a full feature detection set; the key feature detection set is obtained by extracting and summarizing from the full feature detection set; detecting client behavior based on the key feature detection set; if the client behavior does not contain any key features from the key feature detection set, the client behavior is determined to be normal behavior; if the client behavior contains key features from the key feature detection set, deep detection is performed on the client behavior based on each full feature detection set; if the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior. This method can improve the efficiency of client behavior detection.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and in particular to a behavior detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the development of computer security technology, the detection of abnormal terminal behavior has gradually shifted from server-side behavior detection to client-side behavior detection.

[0003] In traditional technologies, for detecting abnormal client behavior, the terminal pre-stores detection rules for client behavior. When a client generates a behavior, the terminal iterates through and matches the behavior according to the detection rules to obtain the detection result of the current client behavior. If the detection result indicates that the client behavior is abnormal, it is blocked; otherwise, it is allowed to proceed.

[0004] However, in current traditional technologies, when the concurrency of client behavior is high, the behavior detection efficiency is poor because a full traversal of detection rules is performed for each client behavior. Summary of the Invention

[0005] Therefore, it is necessary to provide a behavior detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product to address the aforementioned technical problems.

[0006] Firstly, this application provides a behavior detection method, including:

[0007] Obtain client behavior, key feature detection set, and full feature detection set; the key feature detection set is obtained by extracting and summarizing the full feature detection set.

[0008] The client behavior is detected based on the key feature detection set. If the client behavior does not contain any key features in the key feature detection set, the client behavior is determined to be normal behavior.

[0009] If the client behavior contains key features from the key feature detection set, deep detection is performed on the client behavior according to each of the full feature detection sets. If the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior.

[0010] In one embodiment, before obtaining the client behavior, the key feature detection set, and the full feature detection set, the method further includes:

[0011] Retrieve custom rules under the target standard;

[0012] The custom rules are parsed to obtain metadata and detection rules; the metadata includes a set of key feature detections, and the detection rules include a set of full feature detections.

[0013] Construct the target AC automaton based on the metadata and the detection rules.

[0014] In one embodiment, the target AC automaton includes a detection rule AC automaton and a whitening rule AC automaton, and the key feature detection set includes a first key feature detection set corresponding to the detection rule set and a second key feature detection set corresponding to the whitening rule set;

[0015] The step of constructing the target AC automaton based on the metadata and the detection rules includes:

[0016] Based on the rule type corresponding to the metadata in each of the custom rules, determine the first key feature detection set corresponding to the detection rule set and the second key feature detection set corresponding to the whitening rule set;

[0017] The detection rule AC automaton and the whitening rule AC automaton are constructed based on the first key feature detection set and the second key feature detection set, respectively.

[0018] In one embodiment, the step of detecting the client behavior based on the key feature detection set, and determining the client behavior as normal behavior if the client behavior does not contain any key features from the key feature detection set, includes:

[0019] The client behavior is detected based on the detection rule AC automaton and the key feature detection set, and the client behavior that does not contain the key features in the key feature detection set is determined as normal behavior.

[0020] In one embodiment, if the client behavior contains key features from the key feature detection set, deep detection is performed on the client behavior based on each of the full feature detection sets. If the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior. This includes:

[0021] Traverse each detection block of the full feature detection set, and match the client behavior according to the matching fields, matching content and matching conditions of each detection block to obtain the initial detection result of each detection block;

[0022] The initial detection results of each detection block are summarized to obtain the depth detection result. If the depth detection result is that the depth detection is passed, the client behavior is determined to be normal behavior. If the depth detection result is that the depth detection is failed, the client behavior is determined to be abnormal behavior.

[0023] In one embodiment, if depth detection fails, before determining that the client behavior is abnormal, the method further includes:

[0024] The client behavior is matched according to the whitelisting rule AC automaton. If the matching result is successful, the client behavior is determined to be normal behavior.

[0025] Secondly, this application also provides a behavior detection device, comprising:

[0026] The first acquisition module is used to acquire client behavior, a key feature detection set, and a full feature detection set; the key feature detection set is obtained by extracting and summarizing the full feature detection set.

[0027] The first detection module is used to detect the client behavior based on the key feature detection set. If the client behavior does not contain the key features in the key feature detection set, the client behavior is determined to be normal behavior.

[0028] The second detection module is used to perform deep detection on the client behavior according to each of the full feature detection sets if the client behavior contains key features from the key feature detection set. If the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior.

[0029] In one embodiment, the device further includes:

[0030] The second acquisition module is used to acquire custom rules under the target standard;

[0031] The parsing module is used to parse the custom rules to obtain metadata and detection rules; the metadata includes a key feature detection set, and the detection rules include a full feature detection set;

[0032] A construction module is used to construct a target AC automaton based on the metadata and the detection rules.

[0033] In one embodiment, the target AC automaton includes a detection rule AC automaton and a whitening rule AC automaton, and the key feature detection set includes a first key feature detection set corresponding to the detection rule set and a second key feature detection set corresponding to the whitening rule set;

[0034] The construction module is specifically used to determine the first key feature detection set corresponding to the detection rule set and the second key feature detection set corresponding to the whitening rule set according to the rule type corresponding to the metadata in each of the custom rules;

[0035] The detection rule AC automaton and the whitening rule AC automaton are constructed based on the first key feature detection set and the second key feature detection set, respectively.

[0036] In one embodiment, the first detection module is specifically used to detect the client behavior based on the detection rule AC automaton and the key feature detection set, and to determine the client behavior that does not contain the key features in the key feature detection set as normal behavior.

[0037] In one embodiment, the second detection module is specifically used to traverse each detection block of the full feature detection set, and match the client behavior according to the matching field, matching content and matching conditions of each detection block to obtain the initial detection result of each detection block;

[0038] The initial detection results of each detection block are summarized to obtain the depth detection result. If the depth detection result is that the depth detection is passed, the client behavior is determined to be normal behavior. If the depth detection result is that the depth detection is failed, the client behavior is determined to be abnormal behavior.

[0039] In one embodiment, the device further includes:

[0040] The matching module is used to match the client behavior according to the whitelisting rule AC automaton. If the matching result is successful, the client behavior is determined to be normal behavior.

[0041] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0042] Obtain client behavior, key feature detection set, and full feature detection set; the key feature detection set is obtained by extracting and summarizing the full feature detection set.

[0043] The client behavior is detected based on the key feature detection set. If the client behavior does not contain any key features in the key feature detection set, the client behavior is determined to be normal behavior.

[0044] If the client behavior contains key features from the key feature detection set, deep detection is performed on the client behavior according to each of the full feature detection sets. If the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior.

[0045] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0046] Obtain client behavior, key feature detection set, and full feature detection set; the key feature detection set is obtained by extracting and summarizing the full feature detection set.

[0047] The client behavior is detected based on the key feature detection set. If the client behavior does not contain any key features in the key feature detection set, the client behavior is determined to be normal behavior.

[0048] If the client behavior contains key features from the key feature detection set, deep detection is performed on the client behavior according to each of the full feature detection sets. If the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior.

[0049] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0050] Obtain client behavior, key feature detection set, and full feature detection set; the key feature detection set is obtained by extracting and summarizing the full feature detection set.

[0051] The client behavior is detected based on the key feature detection set. If the client behavior does not contain any key features in the key feature detection set, the client behavior is determined to be normal behavior.

[0052] If the client behavior contains key features from the key feature detection set, deep detection is performed on the client behavior according to each of the full feature detection sets. If the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior.

[0053] The aforementioned behavior detection methods, devices, computer equipment, computer-readable storage media, and computer program products detect client behavior using a key feature detection set obtained by extracting and summarizing the full feature detection set. This allows for the preliminary determination of whether the client behavior involves the full feature detection set, i.e., whether the client behavior contains key features from the key feature detection set. If the client behavior does not involve the key feature detection set, it is directly identified as normal behavior, avoiding the need to traverse the full feature detection set for each client behavior. Only when the detection result indicates that the client behavior contains key features from the key feature detection set is the full feature detection set traversed to detect the client behavior, resulting in a final detection result indicating whether the client behavior is normal or abnormal. This improves the efficiency of client behavior detection. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a diagram illustrating the application environment of the behavior detection method in one embodiment;

[0056] Figure 2 This is a flowchart illustrating a behavior detection method in one embodiment;

[0057] Figure 3 This is a flowchart illustrating the process of determining the key feature detection set and the full feature detection set in one embodiment, and constructing the target AC automaton.

[0058] Figure 4 This is a schematic diagram of a custom rule file in one embodiment;

[0059] Figure 5 This is a flowchart illustrating the preprocessing and compilation stages in one embodiment;

[0060] Figure 6 This is a flowchart illustrating the process of constructing the detection rule AC automaton and the whitening rule AC automaton in one embodiment;

[0061] Figure 7 This is a flowchart illustrating the process of performing deep detection of client behavior in one embodiment;

[0062] Figure 8 This is a flowchart illustrating an example of a behavior detection method in one embodiment;

[0063] Figure 9 This is a structural block diagram of the behavior detection device in one embodiment;

[0064] Figure 10 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0066] The behavior detection method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Terminal 102 acquires client behavior, a key feature detection set, and a full feature detection set. The key feature detection set is obtained by extracting and summarizing from the full feature detection set. The full feature detection set is obtained by parsing according to custom rules issued by server 104. Terminal 102 detects client behavior based on the key feature detection set. If the client behavior does not contain key features from the key feature detection set, the client behavior is determined to be normal. If the client behavior contains key features from the key feature detection set, terminal 102 performs deep detection on the client behavior based on each full feature detection set. If the deep detection passes, terminal 102 determines the client behavior to be normal; if the deep detection fails, the client behavior is determined to be abnormal. The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle systems, and projection devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. The server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0067] In one exemplary embodiment, such as Figure 2 As shown, a behavior detection method is provided, which can be applied to... Figure 1Taking terminal 102 as an example, the explanation includes the following steps 202 to 206. Wherein:

[0068] Step 202: Obtain client behavior, key feature detection set, and full feature detection set.

[0069] The key feature detection set is obtained by extracting and summarizing from the full feature detection set. For example, the terminal performs statistical analysis on the full feature detection set to identify features that appear frequently in each full feature detection set and have a significant impact on the judgment of abnormal behavior. The full feature detection set is predefined and contains all features that can be used to determine whether the client's behavior is abnormal. For example, the detection rules in the full feature detection set include access frequency thresholds for each access domain name, network protocol characteristics, user operation mode characteristics, system resource usage characteristics, etc.

[0070] In this embodiment, due to the highly information-driven, mobile, and cloud-collaborative nature of modern office environments, various types of enterprises have corresponding information security needs. For example, financial institutions need to focus on preventing data breaches and financial fraud, while manufacturing enterprises are more concerned with intellectual property protection and production system security. Furthermore, with the widespread adoption of remote work, terminal devices frequently need to operate in different network environments; therefore, it is necessary to detect the security of client behavior on these terminals.

[0071] First, the terminal monitors client behavior in real time, collecting client behaviors initiated by users on the client. For example, for OA (Office Automation) network application clients, the terminal can monitor client behaviors such as network requests, system calls, or data access initiated by the network application client.

[0072] After receiving client behavior, the terminal retrieves the full feature detection set and key feature detection set stored in the terminal. For example, different users have different information security requirements, meaning each user has a pre-set custom full feature detection set. For different users, the terminal reads the pre-stored key feature detection set and full feature detection set after receiving client behavior.

[0073] Step 204: Detect client behavior based on the key feature detection set. If the client behavior does not contain any key features in the key feature detection set, determine that the client behavior is normal behavior.

[0074] In this embodiment, the terminal extracts corresponding feature information from the client's behavior and matches the feature information corresponding to the current client behavior with features in the key feature detection set. For example, the terminal uses algorithms such as string matching and pattern matching to perform preliminary detection of the client behavior and determine whether the feature information of the current client behavior involves the full feature detection set. That is, if the client behavior does not contain any key features in the key feature detection set, it means that the current client behavior cannot match any detection rule in the full feature detection set, and the terminal can determine that the client behavior is normal behavior.

[0075] For example, taking the key feature detection set as a URL filtering rule, if the root domain of the URL in the full feature detection set is domain 1, domain 2, and domain 3 under domain A, then the key feature detection set includes domain A. When the terminal matches client behavior based on domain A, if the domain accessed in the current client behavior is not rooted in domain A, then the client behavior cannot match the full feature detection set, and thus the client behavior is directly determined as normal behavior. This avoids matching the feature information of the client behavior with domain 1, domain 2, and domain 3 in the full feature detection set separately, thus improving the efficiency of detecting client behavior.

[0076] Step 206: If the client behavior contains key features from the key feature detection set, perform deep detection on the client behavior based on each full feature detection set. If the deep detection passes, determine that the client behavior is normal behavior; if the deep detection fails, determine that the client behavior is abnormal behavior.

[0077] In this embodiment, if the client behavior contains key features from the key feature detection set, it indicates that the terminal's preliminary detection of the client behavior suggests a possibility of anomalies. This leads to the terminal further refining its judgment of the client behavior. Once the terminal obtains a preliminary detection result based on the key feature detection set, if it determines that the client behavior contains key features from the key feature detection set, it indicates that the current client behavior has a certain probability of being abnormal. At this point, the terminal performs further in-depth detection of the client behavior based on the full feature detection set.

[0078] During the deep detection phase, the terminal performs a detailed analysis of client behavior based on each detection rule in the full feature detection set. The full feature detection set is a more comprehensive and detailed feature set, containing all possible feature rules used to determine whether client behavior is abnormal. The terminal extracts detailed feature information from the client behavior. For example, the terminal uses more complex and precise algorithms such as string matching and pattern matching to compare the feature information of the client behavior with each feature rule in the full feature detection set one by one, obtaining more accurate deep detection results.

[0079] If, during the deep detection process, the feature information of the client's behavior can fully meet the rule requirements of the full feature detection set, that is, all features can pass detailed comparison and verification without finding any cases that match the abnormal rules, then the deep detection can be determined to be successful, and the terminal will determine that the client's behavior is normal.

[0080] Conversely, if during deep detection, the client's behavioral characteristics match one or more rules in the full feature detection set, indicating a violation of the rules—for example, if the client's behavioral characteristics match a malicious URL representing abnormal behavior—it means that the client accessed a URL prohibited by the full feature detection set or executed an abnormal system call. In this case, the terminal determines that the deep detection result of the client's behavior is a failure, and thus determines that the client's behavior is abnormal.

[0081] In a specific embodiment, taking the key feature detection set as the URL filtering rule as an example, assume that the root domains of the URLs in the full feature detection set are domain 1, domain 2, and domain 3 under domain A, and the key feature detection set includes domain A. When the terminal discovers in step 204 that the domain accessed by the client behavior has domain A as its root domain, it initiates the deep detection process. Specifically, the terminal further checks whether the specific domain accessed by the client behavior is one of domain 1, domain 2, or domain 3. If the specific domain accessed by the client behavior is not within the range of the three domains in the full feature detection set, the terminal determines that the deep detection result of the client behavior is deep detection passed, and determines that the client behavior is normal behavior; if the specific domain accessed by the client behavior is one of domain 1, domain 2, or domain 3 in the full feature detection set, the terminal determines that the deep detection result of the client behavior is deep detection failed, and determines that the client behavior is abnormal. By performing deep detection after initially detecting the possibility of anomalies, the high-cost operation of performing full feature detection on every client behavior can be avoided, and accurate judgment can be made when suspicious behavior is found, effectively improving the efficiency and accuracy of client behavior detection.

[0082] In the aforementioned behavior detection method, the key feature detection set obtained by extracting and summarizing the full feature detection set is used to detect client behavior. This allows for a preliminary determination of whether the client behavior involves the full feature detection set, i.e., whether the client behavior contains key features from the key feature detection set. If the client behavior does not involve the key feature detection set, it is directly identified as normal behavior, avoiding the need to traverse the full feature detection set for each client behavior. Only when the detection result indicates that the client behavior contains key features from the key feature detection set is the full feature detection set traversed to detect the client behavior, thus obtaining the final detection result of whether the client behavior is normal or abnormal, which improves the efficiency of client behavior detection.

[0083] In one exemplary embodiment, such as Figure 3 As shown, before step 202, the method further includes steps 302 to 306. Wherein:

[0084] Step 302: Obtain the custom rules under the target standard.

[0085] In this embodiment, different customers have different security detection needs. Users can pre-define custom rules under a target standard. For example, users can write custom rules according to the target standard and store them on the terminal in the form of a target file. For example, the target file can describe the custom rules in YAML (YAML Ain't Markup Language) file format, and the target file is compatible with the standard Sigma (Security Information and Event Management Generic Signature) format. Then, the terminal obtains the target file under the target standard, and according to the predefined reading location, the terminal searches for the target file containing the custom rules in the location where the custom rule set is stored.

[0086] The endpoint determines the target location for storing custom rules, which could be a specific directory on the endpoint's local file system or a database on a remote server. Then, the endpoint iterates through each file in the target location, reading its metadata and performing precise filtering based on target criteria. For example, when the target criterion is a high threat level, the endpoint filters the threat level information in the metadata of key check rule files to determine the target files used for client behavior detection in high-risk scenarios.

[0087] Step 304: Parse the custom rules to obtain metadata and detection rules.

[0088] The metadata includes a set of key feature detections, and the detection rules include a set of full feature detections.

[0089] In this embodiment, a custom rule set consisting of multiple rule files in YAML format and compatible with the Sigma standard is used as an example. The terminal parses the custom rules through a YAML parser to obtain the metadata and detection rules in the custom rules.

[0090] like Figure 4 As shown, the target file is a custom rule file containing custom rules. Each custom rule includes rule metadata and a rule detection section. The rule metadata includes Sigma standard metadata and extended metadata; the rule detection section includes detection blocks, matching content, and detection conditions. The Sigma standard metadata defines basic information such as rule name, rule description, and threat level. Extended metadata outside the Sigma standard includes behavior type, response action, rule type, and a set of pre-keywords. Behavior type refers to the behavior categories supported by the client, such as process creation and file creation. Response actions include interception and allow actions. Rule types include detection rules and whitelisting rules. The set of pre-keywords is a collection of field names and string pairs. For example, if the field name is "process path" and the string is "certutil," it means that the rule is likely to be matched only if the corresponding field value exists for that string. Since the pre-keyword set is a string set, for multiple rules, the terminal can use a multi-modal matching algorithm to accelerate rule matching and reduce deep matching detection. A detection block consists of multiple sets of matching fields and matching content. The matching content includes a matching condition and multiple matching values. The matching fields are the content fields corresponding to the behavior, such as process path, destination address, etc. Matching conditions support five types: beginning match, ending match, containment match, regular expression match, and equality match. The detection conditions are logical expressions composed of the detection block name and logical operators (OR, AND, NOT), which determine the detection logic between different detection blocks.

[0091] Specifically, such as Figure 5As shown, after the terminal obtains the custom rules, it first performs rule format validation to determine if the custom rules meet the format requirements. Then, if the custom rules meet the format requirements, the terminal parses the custom rules, converting the text data of the custom rule set into a data format that the terminal can process. The custom rules are divided into two parts: metadata and detection rules. The terminal parses the metadata and detection rules separately, extracting the metadata and detection rules respectively. For parts outside the Sigma standard, the terminal adds default values. The default behavior type is all behaviors, the default rule type is detection rules, and the default response action is allow. This results in a key feature detection set and a full feature detection set. The key feature detection set contains the basic attributes and filtering conditions of the rules, while the full feature detection set is used for detailed detection of terminal behavior.

[0092] Step 306: Construct the target AC automaton based on metadata and detection rules.

[0093] In this embodiment, the terminal constructs a target AC automaton based on metadata and detection rules. AC automata are suitable for handling matching problems involving multiple pattern strings. The terminal uses the set of preceding keywords in the metadata and the matching content of the detection rules as pattern strings, and by constructing the AC automaton, it can match multiple pattern strings simultaneously in a single traversal, improving rule matching efficiency. In network security monitoring, it is necessary to perform rule matching on a large number of network data packets in real time. By using the AC automaton, the terminal can quickly determine whether a data packet hits the detection rules in the full feature detection set, thereby promptly discovering potential security threats and ensuring the safe and stable operation of the network system.

[0094] Specifically, the terminal first extracts all strings to be matched from the metadata's pre-keyword set and the matching content of the detection rules, using these as the pattern strings for the AC automaton. Then, the terminal uses the AC automaton construction algorithm to insert the pattern strings into the automaton and constructs failure pointers. These failure pointers allow for quick jumps when a match fails, avoiding starting the matching process from the beginning. Finally, the terminal optimizes the constructed AC automaton to obtain the target AC automaton, for example, by compressing the state space and improving the automaton's operating efficiency.

[0095] In this embodiment, by parsing the custom rules, metadata and detection rules are obtained, which can lead to a key feature detection set and a full feature detection set. These serve as the basis for multi-level detection of client behavior, and a target AC automaton is then constructed. This enables pre-detection of client behavior based on the key feature detection set before detection of client behavior based on the full feature detection set, thereby improving the detection efficiency of client behavior.

[0096] In an exemplary embodiment, the target AC automaton includes a detection rule AC automaton and a whitening rule AC automaton, and the key feature detection set includes a first key feature detection set corresponding to the detection rule set and a second key feature detection set corresponding to the whitening rule set; such as Figure 6 As shown, step 306 includes steps 602 to 604. Wherein:

[0097] Step 602: Based on the rule type corresponding to the metadata in each custom rule, determine the first key feature detection set corresponding to the detection rule set and the second key feature detection set corresponding to the whitening rule set.

[0098] In the embodiments of this application, such as Figure 5 As shown, during the compilation phase, after the terminal parses the custom rules to obtain metadata and detection rules, it classifies the detection rule set contained in the key feature detection set according to the rule type contained in the metadata, determines the detection rule set and the whitelisting rule set, and then determines the first key feature detection set corresponding to the detection rule set and the second key feature detection set corresponding to the whitelisting rule set. The detection rule set contains abnormal or malicious features that account for only a very small proportion of all behavioral events generated by the terminal in the actual operating environment. Then, for this very small proportion of abnormal or malicious features, the terminal extracts the pre-keyword group corresponding to the detection rule to obtain the first key feature detection set. That is, the terminal abstracts the pre-keyword group into a finite set of strings, such as command line parameters of malicious programs, specific file path patterns, suspicious registry keys, etc. This set of strings also exhibits a highly sparse distribution characteristic in the field space of the entire terminal behavioral data.

[0099] The whitelist rule set is a pre-set whitelist rule in the custom rules, and it is processed in the same way as the preceding keyword grouping corresponding to the above detection rules, and is used as the second key feature detection set. That is, the terminal abstracts the whitelist rule into the preceding keyword grouping corresponding to the whitelist rule.

[0100] Step 604: Construct the detection rule AC automaton and the whitening rule AC automaton based on the first key feature detection set and the second key feature detection set, respectively.

[0101] In this embodiment, the terminal extracts all preceding keyword strings from the first key feature detection set and the second key feature detection set, respectively. These preceding keyword strings serve as the pattern strings for constructing the AC automaton. For the detection rule AC automaton, the terminal compiles the strings from the first key feature detection set to obtain the detection rule AC automaton; for the whitewash rule AC automaton, the terminal compiles the strings from the second key feature detection set to obtain the whitewash rule AC automaton. Taking the rule detection AC automaton as an example, the rule detection AC automaton includes a success transition function, a failure transition function, and an output function. The success transition function indicates the next possible matching state, the failure transition function provides a fallback path when the current matching fails, and the output function marks the complete pattern matching position.

[0102] In this embodiment, the rules are divided into detection rules and whitening rules, with different types of rules corresponding to different key feature detection sets. By constructing detection rule AC automata and whitening rule AC automata based on the first and second key feature detection sets respectively, multi-level detection of input client behavior can be performed in parallel and efficiently. By utilizing the sparsity characteristics of abnormal terminal behavior, the processing efficiency of the rule engine can be improved, thereby increasing the efficiency of client behavior detection.

[0103] In an exemplary embodiment, step 204 includes step 2041. Wherein:

[0104] Step 2041: Detect client behavior based on the detection rule AC automaton and the key feature detection set, and determine client behavior that does not contain key features in the key feature detection set as normal behavior.

[0105] In this embodiment, the terminal detects client behavior based on a detection rule AC automaton and a key feature detection set, identifying client behavior that does not contain key features from the key feature detection set as normal behavior. The terminal inputs the acquired client behavior into the constructed detection rule AC automaton. The detection rule AC automaton traverses the feature information of the input client behavior, attempting to match key features from the key feature detection set in the data based on its state transition table and failure pointer mechanism. After traversing the client behavior data, the terminal checks whether the automaton has matched any key features from the key feature detection set. If no key features are matched, i.e., the client behavior does not contain the abnormal key features defined by the rules, the terminal identifies the client behavior as normal behavior. For example, in an enterprise network environment, it is necessary to monitor various behaviors of employee clients to prevent security incidents such as data leakage and malware attacks. The terminal can quickly determine whether an employee's operation complies with security rules by detecting client behavior based on the detection rule AC automaton and the key feature detection set. For example, if the rules define key features that prohibit access to certain sensitive files, then when an employee's client behavior does not contain these key features, it can be determined that their behavior is normal, reducing the computational resource consumption of traversing the entire feature detection set and improving the efficiency of security monitoring.

[0106] In one exemplary embodiment, such as Figure 7 As shown, step 206 includes steps 702 to 704. Wherein:

[0107] Step 702: Traverse each detection block of the full feature detection set, and match the client behavior according to the matching fields, matching content and matching conditions of each detection block to obtain the initial detection result of each detection block.

[0108] In this embodiment of the application, if the client behavior contains key features from the key feature detection set, it indicates that the current client behavior may be abnormal, that is, the current client behavior may be abnormal behavior. Then, the terminal performs deep detection on the client behavior according to the full feature detection set. Specifically, the terminal detects the client behavior according to each detection block in the full feature detection set, that is, it matches the client behavior according to the matching fields, matching conditions and matching content in the detection block, and obtains the initial detection result of each detection block for the client behavior.

[0109] Step 704: Summarize the initial detection results of each detection block to obtain the depth detection result. If the depth detection result is a successful depth detection, the client behavior is determined to be normal behavior. If the depth detection result is a failed depth detection, the client behavior is determined to be abnormal behavior.

[0110] In this embodiment, the terminal summarizes the initial detection results of each detection block according to the predefined detection conditions in the custom rules to obtain the deep detection result. The detection conditions include the logical operations corresponding to the names of each detection block. That is, the terminal calculates the detection condition expression based on the preset logical operations of each detection block. If the result of the calculated detection condition expression is true, it indicates that the client behavior may be abnormal. For example, taking detection block 1 as "domain name A" and detection block 2 as a preset access frequency as an example, if the initial detection results of detection block 1 and detection block 2 both match, it means that the client behavior accesses the domain name A and accesses it at a certain frequency. Furthermore, if the logical expression is "detection block A and detection block B", it means that the client behavior needs further deep detection, and the terminal determines that the deep detection result is a deep detection failure and an abnormal behavior. If the logical expression is "detection block A and detection block C", the terminal determines that the deep detection result is a deep detection success and a normal behavior.

[0111] In this embodiment, when the client behavior contains key features from the key feature detection set, the initial detection results of each detection block for client behavior detection are used, and the initial detection results are summarized. This enables multi-level detection of client behavior, and the client behavior is judged through multi-dimensional, in-depth detection and flexible logical summarization, thereby improving the comprehensiveness and accuracy of client behavior detection.

[0112] In an exemplary embodiment, if depth detection fails, before determining the client behavior as anomalous in step 206, the method further includes step 2061, wherein:

[0113] Step 2061: Match the client behavior according to the whitelisting rule AC automaton. If the matching result is successful, determine that the client behavior is normal behavior.

[0114] In this embodiment, the whitewash rule AC automaton is constructed based on pre-defined whitewash rules, which include a series of behavioral features and patterns considered normal. When the terminal evaluates client behavior, the initial detection results of each detection block are summarized. If the depth detection result is a depth detection failure, the terminal can also perform a final detection of the client behavior according to the whitewash rules. That is, the terminal inputs the client's behavior data into the whitewash rule AC automaton for matching. The whitewash rule AC automaton utilizes its efficient multi-pattern matching algorithm to quickly search for features in the client behavior data that match the whitewash rules. If the matching result output by the whitewash rule AC automaton shows a successful match, it indicates that the client behavior conforms to the normal pattern defined by the whitewash rules. At this point, the terminal can determine that the client behavior is normal.

[0115] In this embodiment, the determinism of the whitelisting rules and the high efficiency of the AC automaton enable the rapid and accurate identification of normal behavior, reducing unnecessary further detection processes, improving the detection efficiency of client behavior detection and the utilization rate of computing resources, and ensuring the safe operation of client behavior.

[0116] In a specific embodiment, such as Figure 8 As shown, an example of a behavior detection method is provided, wherein:

[0117] Step 801: Obtain client behavior generated by terminal behavior.

[0118] Step 802: Match the client behavior according to the detection rule AC automaton. If the detection rule AC automaton does not match, proceed to step 803; if the detection rule AC automaton matches, proceed to step 804: deep detection.

[0119] Step 803: Determine that the client behavior is normal.

[0120] Step 804: Traverse the detection blocks, match the client behavior according to each detection block, and obtain the initial detection results of each detection block.

[0121] Step 805: Summarize the initial detection results of each detection block according to the conditional expression to obtain the depth detection result. If the depth detection result is a depth detection pass, proceed to step 806; if the depth detection result is a depth detection failure, proceed to step 807.

[0122] Step 806: Determine that the client behavior is normal.

[0123] Step 807: Match the client behavior according to the whitelisting rule AC automaton. If the matching result is a successful match, proceed to step 808; if the matching result is a failed match, proceed to step 809.

[0124] Step 808: Determine that the client behavior is normal.

[0125] Step 809: Determine that the client's behavior is abnormal and execute the interception.

[0126] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0127] Based on the same inventive concept, this application also provides a behavior detection device for implementing the behavior detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more behavior detection device embodiments provided below can be found in the limitations of the behavior detection method described above, and will not be repeated here.

[0128] In one exemplary embodiment, such as Figure 9 As shown, a behavior detection device 900 is provided, including: a first acquisition module 901, a first detection module 902, and a second detection module 903, wherein:

[0129] The first acquisition module 901 is used to acquire client behavior, key feature detection set, and full feature detection set; the key feature detection set is obtained by extracting and summarizing the full feature detection set.

[0130] The first detection module 902 is used to detect client behavior based on the key feature detection set. If the client behavior does not contain the key features in the key feature detection set, the client behavior is determined to be normal behavior.

[0131] The second detection module 903 is used to perform deep detection on the client behavior based on each full feature detection set if the client behavior contains key features from the key feature detection set. If the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior.

[0132] In one embodiment, the device 900 further includes:

[0133] The second acquisition module is used to acquire custom rules under the target standard;

[0134] The parsing module is used to parse custom rules to obtain metadata and detection rules; the metadata includes a set of key feature detections, and the detection rules include a set of full feature detections.

[0135] The building module is used to construct the target AC automaton based on metadata and detection rules.

[0136] In one embodiment, the target AC automaton includes a detection rule AC automaton and a whitening rule AC automaton, and the key feature detection set includes a first key feature detection set corresponding to the detection rule set and a second key feature detection set corresponding to the whitening rule set.

[0137] The construction module is specifically used to determine the first key feature detection set corresponding to the detection rule set and the second key feature detection set corresponding to the whitening rule set based on the rule type corresponding to the metadata in each custom rule;

[0138] Based on the first key feature detection set and the second key feature detection set, construct the detection rule AC automaton and the whitening rule AC automaton respectively.

[0139] In one embodiment, the first detection module 902 is specifically used to detect client behavior based on the detection rule AC automaton and the key feature detection set, and to determine client behavior that does not contain key features in the key feature detection set as normal behavior.

[0140] In one embodiment, the second detection module 903 is specifically used to traverse each detection block of the full feature detection set, match the client behavior according to the matching fields, matching content and matching conditions of each detection block, and obtain the initial detection result of each detection block.

[0141] The initial detection results of each detection block are summarized to obtain the depth detection result. If the depth detection result is a pass, the client behavior is determined to be normal behavior. If the depth detection result is a failure, the client behavior is determined to be abnormal behavior.

[0142] In one embodiment, the device 900 further includes:

[0143] The matching module is used to match client behavior according to the whitelisting rules AC automaton. If the matching result is successful, the client behavior is determined to be normal behavior.

[0144] Each module in the aforementioned behavior detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0145] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 10 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a behavior detection method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0146] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0147] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0148] Obtain client behavior, key feature detection set, and full feature detection set; the key feature detection set is obtained by extracting and summarizing from the full feature detection set.

[0149] The client behavior is detected based on the key feature detection set. If the client behavior does not contain the key features in the key feature detection set, the client behavior is determined to be normal behavior.

[0150] If the client behavior contains key features from the key feature detection set, perform deep detection on the client behavior based on each full feature detection set. If the deep detection passes, the client behavior is determined to be normal behavior; if the deep detection fails, the client behavior is determined to be abnormal behavior.

[0151] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0152] Retrieve custom rules under the target standard;

[0153] The custom rules are parsed to obtain metadata and detection rules; the metadata includes a set of key feature detections, and the detection rules include a set of full feature detections.

[0154] Construct the target AC automaton based on metadata and detection rules.

[0155] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0156] Based on the rule type corresponding to the metadata in each custom rule, determine the first key feature detection set corresponding to the detection rule set and the second key feature detection set corresponding to the whitening rule set;

[0157] Based on the first key feature detection set and the second key feature detection set, construct the detection rule AC automaton and the whitening rule AC automaton respectively.

[0158] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0159] Client behavior is detected based on the detection rule AC automaton and the key feature detection set. Client behavior that does not contain key features in the key feature detection set is identified as normal behavior.

[0160] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0161] Traverse each detection block in the full feature detection set, and match the client behavior according to the matching fields, matching content and matching conditions of each detection block to obtain the initial detection result of each detection block;

[0162] The initial detection results of each detection block are summarized to obtain the depth detection result. If the depth detection result is a pass, the client behavior is determined to be normal behavior. If the depth detection result is a failure, the client behavior is determined to be abnormal behavior.

[0163] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0164] The client behavior is matched using the AC automaton based on the whitespace rules. If the match is successful, the client behavior is determined to be normal.

[0165] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0166] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0167] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0168] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0169] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0170] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A behavior detection method, characterized in that, The method includes: Obtain custom rules under the target standard, parse the custom rules to obtain metadata and detection rules; the metadata includes a key feature detection set, and the detection rules include a full feature detection set; A target AC automaton is constructed based on the metadata and the detection rules; the target AC automaton includes a detection rule AC automaton and a whitening rule AC automaton, and the key feature detection set includes a first key feature detection set corresponding to the detection rule set and a second key feature detection set corresponding to the whitening rule set. The step of constructing the target AC automaton based on the metadata and the detection rules includes: Based on the rule type corresponding to the metadata in each of the custom rules, determine the first key feature detection set corresponding to the detection rule set and the second key feature detection set corresponding to the whitening rule set; The detection rule AC automaton and the whitening rule AC automaton are constructed based on the first key feature detection set and the second key feature detection set, respectively. Obtain client behavior; The client behavior is detected based on the detection rule AC automaton. If the client behavior does not contain the key features in the key feature detection set, the client behavior is determined to be normal behavior. If the client behavior contains key features from the key feature detection set, deep detection is performed on the client behavior according to each full feature detection set. If the deep detection passes, the client behavior is determined to be normal behavior. If the deep detection fails, the client behavior is matched according to the whitewash rule AC automaton. If the matching result is a successful match, the client behavior is determined to be normal behavior; otherwise, the client behavior is determined to be abnormal behavior.

2. The method according to claim 1, characterized in that, The detection of client behavior based on the detection rule AC automaton, and the determination that the client behavior is normal if the client behavior does not contain the key features in the key feature detection set, includes: The client behavior is detected based on the detection rule AC automaton and the key feature detection set, and the client behavior that does not contain the key features in the key feature detection set is determined as normal behavior.

3. The method according to claim 1, characterized in that, The method further includes: Traverse each detection block of the full feature detection set, and match the client behavior according to the matching fields, matching content and matching conditions of each detection block to obtain the initial detection result of each detection block; The initial detection results of each detection block are summarized to obtain the depth detection result. If the depth detection result is that the depth detection is passed, the client behavior is determined to be normal behavior. If the depth detection result is that the depth detection is failed, the client behavior is determined to be abnormal behavior.

4. The method according to claim 1, characterized in that, The key feature detection set is obtained by extracting and summarizing the full feature detection set.

5. A behavior detection device, characterized in that, The device includes: The second acquisition module is used to acquire custom rules under the target standard; The parsing module is used to parse the custom rules to obtain metadata and detection rules; the metadata includes a key feature detection set, and the detection rules include a full feature detection set; The construction module is used to construct the target AC automaton based on the metadata and the detection rules; The target AC automaton includes a detection rule AC automaton and a whitening rule AC automaton, and the key feature detection set includes a first key feature detection set corresponding to the detection rule set and a second key feature detection set corresponding to the whitening rule set. The construction module is specifically used to determine the first key feature detection set corresponding to the detection rule set and the second key feature detection set corresponding to the whitening rule set according to the rule type corresponding to the metadata in each of the custom rules; and to construct the detection rule AC automaton and the whitening rule AC automaton based on the first key feature detection set and the second key feature detection set, respectively. The first acquisition module is used to acquire client behavior, a key feature detection set, and a full feature detection set; the key feature detection set is obtained by extracting and summarizing the full feature detection set. The first detection module is used to detect the client behavior based on the detection rule AC automaton. If the client behavior does not contain the key features in the key feature detection set, the client behavior is determined to be normal behavior. The second detection module is used to perform deep detection on the client behavior according to each of the full feature detection sets if the client behavior contains key features from the key feature detection set. If the deep detection passes, the client behavior is determined to be normal behavior. If the deep detection fails, the client behavior is matched according to the whitewash rule AC automaton. If the matching result is a successful match, the client behavior is determined to be normal behavior; otherwise, the client behavior is determined to be abnormal behavior.

6. The apparatus according to claim 5, characterized in that, The first detection module is specifically used to detect the client behavior based on the detection rule AC automaton and the key feature detection set, and to determine the client behavior that does not contain the key features in the key feature detection set as normal behavior.

7. The apparatus according to claim 5, characterized in that, The second detection module is specifically used to traverse each detection block of the full feature detection set, and match the client behavior according to the matching fields, matching content and matching conditions of each detection block to obtain the initial detection result of each detection block; The initial detection results of each detection block are summarized to obtain the depth detection result. If the depth detection result is that the depth detection is passed, the client behavior is determined to be normal behavior. If the depth detection result is that the depth detection is failed, the client behavior is determined to be abnormal behavior.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images