Terminal deployment-based threat detection response intelligent agent security protection method and system

Abstract

The application relates to the technical field of information security, and discloses a terminal deployment-based threat detection response intelligent agent security protection method and system, wherein the terminal deployment-based threat detection response intelligent agent monitors behavior data of a terminal in real time, including process, network and file; the behavior data is rapidly screened based on a preset rule library, and a lightweight AI model is called to perform threat detection on dynamic behavior; the detected threats are subjected to risk level assessment, and hierarchical response actions are executed according to the assessment results; after completing a threat detection and response operation, the threat detection response intelligent agent returns the response results and user selected behavior to a cloud end security operation platform in real time through an encrypted communication channel; the lightweight AI model and the rule library are iteratively optimized based on user feedback and summarized data; and the application improves the accuracy and coverage of threat identification.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a threat detection and response intelligent agent security protection method and system based on terminal deployment. BACKGROUND

[0002] With terminals becoming the focus of attackers, traditional security protection methods such as virus scanning and static rule matching are not sufficient in dealing with advanced persistent threats (APT), fileless attacks, and lateral movement attack methods. At the same time, the threat detection and response system usually relies on the analysis results of the backend operation platform, which prolongs the response time and reduces the linkage ability, and cannot achieve rapid closed-loop response of the terminal.

[0003] At present, although there are some terminal security protection systems, the response ability is weak, it needs to rely on manual intervention, lacks judgment ability, the response action is not flexible enough, consumes a lot of terminal performance, and is difficult to adapt to low-end environment. SUMMARY

[0004] The present application relates to the technical field of information security, and in particular to a threat detection and response intelligent agent security protection method and system based on terminal deployment.

[0005] The first aspect of the present application provides a threat detection and response intelligent agent security protection method based on terminal deployment, which comprises the following steps:

[0006] The terminal-deployed threat detection and response intelligent agent monitors the behavior data of the terminal in real time, including processes, networks and files;

[0007] The behavior data is quickly screened based on a preset rule library, and a lightweight AI model is called to detect threats to dynamic behavior;

[0008] The detected threats are assessed for risk levels, and the assessment results are used to perform graded response actions, wherein low-risk threats perform log recording or prompt operations, medium-risk threats perform pop-up warnings and wait for user confirmation, and high-risk threats automatically perform blocking, process termination or network isolation operations;

[0009] After completing a threat detection and response operation, the threat detection and response intelligent agent transmits the response results and user selection behavior to the cloud security operation platform in real time through an encrypted communication channel;

[0010] Based on user feedback and summary data, the lightweight AI model and rule library are iteratively optimized.

[0011] Optionally, in the first implementation manner of the first aspect of the present application, the behavior data is quickly screened based on the preset rule library, comprising:

[0012] Extracting feature fields from the process, network, and file behavior data obtained in real time from the terminal, wherein the feature fields include process path, IP and port of network connection, and path and type of file operation;

[0013] Integrating the dispersed feature fields into a structured data sequence in chronological order, and calling a preset rule library, wherein the rule library includes known threat malicious process name, suspicious file hash value, and abnormal network port range;

[0014] Matching the structured data sequence with the rules in the rule library one by one, and if there is data that meets the rules, marking it as a suspected threat and recording the matched rule number and related behavior details.

[0015] Optionally, in a second implementation manner of the first aspect of the present application, the calling of the lightweight AI model for threat detection of dynamic behavior includes:

[0016] Extracting dynamic features from the behavior data that is not marked as a suspected threat after being screened by the rule library, wherein the dynamic features include change trend of process resource occupation, traffic fluctuation rule of network communication, frequency and association of file operation;

[0017] Converting the dynamic features into a feature vector recognizable by the model, and inputting the feature vector into the lightweight AI model to calculate the deviation degree by comparing the current feature vector with a normal behavior pattern baseline, wherein the lightweight AI model includes a One-Class SVM model and a lightweight graph model;

[0018] When the deviation degree exceeds a preset threshold, determining that the current dynamic behavior is abnormal, marking it as a potential threat, and outputting an abnormal confidence degree;

[0019] Summarizing the suspected threats marked by the rule library rapid screening and the potential threats marked by the lightweight AI model detection to form a preliminary threat detection result set.

[0020] Optionally, in a third implementation manner of the first aspect of the present application, the risk level assessment of the detected threats and the execution of a graded response action according to the assessment result include:

[0021] Extracting risk features for assessment from the detected threat-related behavior data, wherein the risk features include process behavior features, network features, file features, and CPU usage features;

[0022] Assigning a corresponding weight to each risk feature dimension extracted, and performing risk level assessment through a risk scoring function to obtain a comprehensive risk score;

[0023] According to the preset interval of the comprehensive risk score, the threat is divided into three risk levels of low, medium and high, and according to the divided risk level, a corresponding response action is triggered.

[0024] Optionally, in the fourth implementation manner of the first aspect of the present application, the risk score function is:

[0025]

[0026] Wherein: The higher the comprehensive risk score of the i-th terminal or agent, the greater the potential threat; The original monitoring data of the i-th terminal, including CPU behavior, file activity, network communication, process behavior, etc. Respectively represent the risk function based on CPU usage mode, such as sudden occupancy rate increase and continuous abnormal fluctuation.

[0027] Optionally, in the fifth implementation manner of the first aspect of the present application, after completing a threat detection and response operation, the threat detection and response intelligent agent through the encrypted communication channel returns the response result and user selection behavior to the cloud security operation platform in real time, including:

[0028] After completing the threat detection and response operation, the threat detection and response intelligent agent automatically collects the operation data of this time, wherein the operation data includes threat detection result, executed response action, execution state of the response action and user selection behavior in the response process;

[0029] The intelligent agent sends an encrypted channel establishment request to the cloud security operation platform, wherein the request contains terminal identification, intelligent agent version information and encryption method negotiation parameters;

[0030] After receiving the request, the cloud platform returns confirmation information of encrypted channel establishment and session key, and the intelligent agent uses the encryption mechanism in the HTTPS protocol to encrypt the sorted response result and user selection behavior data;

[0031] The intelligent agent sends the encrypted data to the cloud security operation platform according to the preset transmission format through the established encrypted channel.

[0032] Optionally, in the sixth implementation manner of the first aspect of the present application, the lightweight AI model and rule library are iteratively optimized based on user feedback and summary data, including:

[0033] The cloud security operation platform receives the response result and user selection behavior data returned by the threat detection and response intelligent agent of each terminal through the encrypted channel, classifies them according to the data type, marks the feedback data related to false positives and false negatives as model optimization data, and marks the newly appeared threat feature data as rule library supplement key data.

[0034] The labeled data is combined with the existing threat sample set to form a model training data set, the judgment threshold and feature weight of the model to abnormal behavior are optimized by adjusting the model parameters, and a lightweight AI model after iterative training and an optimized rule library are obtained.

[0035] The second aspect of the application provides a terminal-deployed threat detection response agent security protection system, which comprises:

[0036] A real-time monitoring module is configured to monitor the behavior data of processes, networks and files of the terminal-deployed threat detection response agent in real time.

[0037] A threat detection module is configured to perform rapid screening on the behavior data based on a preset rule library and call a lightweight AI model to perform threat detection on dynamic behavior.

[0038] A response decision module is configured to perform risk level assessment on the detected threats and execute graded response actions according to the assessment results, wherein low-risk threats are executed by log recording or prompting operations, medium-risk threats are executed by pop-up warning and waiting for user confirmation, and high-risk threats are executed by automatic blocking, process termination or network isolation operations.

[0039] A communication interface module is configured to transmit the response results and user-selected behaviors to a cloud security operation platform in real time through an encrypted communication channel after the threat detection response agent completes a threat detection and response operation.

[0040] An iterative optimization module is configured to perform iterative optimization on the lightweight AI model and the rule library based on user feedback and summarized data.

[0041] The third aspect of the application provides a terminal-deployed threat detection response agent security protection device, which comprises a memory and at least one processor, and the memory stores instructions; the at least one processor calls the instructions in the memory to enable the terminal-deployed threat detection response agent security protection device to perform the steps of the terminal-deployed threat detection response agent security protection method according to any one of the above.

[0042] The fourth aspect of the application provides a computer readable storage medium, which stores instructions, and the instructions are executed by a processor to realize the steps of the terminal-deployed threat detection response agent security protection method according to any one of the above.

[0043] The technical scheme provided by the application, the terminal deployment threat detection response agent monitors the behavior data of processes, networks and files of the terminal in real time; the behavior data is quickly screened based on a preset rule base, and a lightweight AI model is called to detect threats of dynamic behavior; the detected threats are assessed for risk levels, and hierarchical response actions are performed according to the assessment results; after completing a threat detection and response operation, the threat detection response agent transmits the response results and user selected behaviors to the cloud security operation platform in real time through an encrypted communication channel; the lightweight AI model and the rule base are iteratively optimized based on user feedback and aggregated data; the application aims to solve the problems of slow response, low intelligence, lack of closed-loop control capability and the like of existing terminal security protection systems, and provides a lightweight, intelligent and linked terminal threat detection response agent, which has the capabilities of real-time detection, hierarchical response, strategy linkage and model adaptation; through the hybrid detection mechanism of rules + model, the accuracy and coverage of threat identification are improved; the threat level hierarchical response is supported, and the flexibility and accuracy of terminal protection are improved; the linked operation platform realizes unified management and pushing of strategies / models in the cloud, has controllability and expandability, is suitable for various terminal environments, can realize continuous optimization of the model through the user feedback mechanism, and has self-learning capability. BRIEF DESCRIPTION OF DRAWINGS

[0044] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included only serving the purpose of illustrating the preferred embodiments and are not considered as limiting the present application.

[0045] Figure 1 A flowchart of a terminal deployment threat detection response agent security protection method provided by the embodiment of the application is provided.

[0046] Figure 2 A structural schematic diagram of a terminal deployment threat detection response agent security protection system provided by the embodiment of the application is provided.

[0047] Figure 3 A structural schematic diagram of a terminal deployment threat detection response agent security protection device provided by the embodiment of the application is provided. DETAILED DESCRIPTION

[0048] The terms "first", "second", "third", "fourth" and the like in the description and in the claims of the present application, and above-described drawings, if any, are used to distinguish between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of the terms so construed can be interchanged, under appropriate circumstances, to describe the embodiments of the application described herein in other than the particular order discussed herein. Also, the terms "comprise" and "comprising" and any variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of steps or elements does not necessarily comprise only those steps or elements but can include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

[0049] For the sake of understanding, the specific flow of the embodiments of the present application is described below, please refer to Figure 1 The flowchart of the method for intelligent agent security protection based on terminal deployment threat detection response provided by the embodiments of the present application, the method specifically comprises the following steps:

[0050] Step 101, the terminal deployment threat detection response intelligent agent monitors the behavior data of the terminal including processes, networks and files in real time;

[0051] In this embodiment, the terminal deployment threat detection response intelligent agent (DRAgent) runs in the form of a service process in the terminal operating system, loads the basic monitoring configuration immediately after starting, and monitors the process, network and file behavior data of the terminal in real time and comprehensively. Among them, for process behavior, the start and end time of the process, process ID, parent process association, module loading situation and the change of CPU, memory and other resource occupation are continuously tracked; for network behavior, the source IP address, destination IP address, communication port, protocol type used, data transmission byte number and frequency, and connection establishment and disconnection time are recorded; for file behavior, the creation, deletion, modification, movement and other operations of the file are monitored, and the file path, operation time, file hash value, permission change situation and whether to access the system sensitive directory such as system registry, user privacy folder are recorded; all the monitored behavior data are stored in the local cache area in real time according to the time stamp order, forming a continuous and complete terminal behavior log.

[0052] Step 102, based on the preset rule library, the behavior data is quickly screened, and a lightweight AI model is called to detect the threat of dynamic behavior;

[0053] In this embodiment, from the process, network, and file behavior data obtained by real-time monitoring of the terminal, feature fields are extracted, including process path, network connection IP and port, file operation path and type; the dispersed feature fields are integrated into a structured data sequence in chronological order, and a preset rule library is called, including known threat malicious process name, suspicious file hash value, and abnormal network port range; the structured data sequence is matched with the rules in the rule library one by one, and if there is data that meets the rules, it is marked as a suspected threat, and the rule number and related behavior details matched are recorded.

[0054] In this embodiment, for behavior data that is not marked as a suspected threat after screening by the rule library, dynamic features are extracted, including process resource occupation trend, network communication traffic fluctuation rule, file operation frequency and association; the dynamic features are converted into feature vectors recognizable by the model, and input into a lightweight AI model, and the deviation degree is calculated by comparing the current feature vector with the normal behavior pattern baseline, wherein the lightweight AI model includes One-Class SVM model and lightweight graph model; when the deviation degree exceeds a preset threshold, it is determined that the current dynamic behavior is abnormal, marked as a potential threat, and the abnormal confidence is output; the suspected threats marked by the rule library rapid screening and the potential threats marked by the lightweight AI model detection are summarized to form a preliminary threat detection result set.

[0055] Step 103, risk level assessment is performed on the detected threats, and a graded response action is performed according to the assessment result;

[0056] In this embodiment, low-risk threats perform log recording or prompt operations, medium-risk threats perform pop-up warnings and wait for user confirmation, and high-risk threats automatically perform blocking, process termination, or network isolation operations.

[0057] In this embodiment, from the detected threat-related behavior data, the system sorts out and extracts key features that can be used for risk assessment one by one; process behavior features include whether the process is an unknown program, whether there is process injection or code obfuscation behavior, whether there are frequent creation of child processes, etc.; network features include whether the connected IP address is in the known malicious IP list, whether the communication uses a non-standard port, whether the data transmission is encrypted and has no obvious business association, whether there are abnormal connection frequency or traffic fluctuations, etc.; file features involve whether to access or modify system sensitive directories such as operating system kernel file directory, user permission file directory, whether to perform encryption or deletion operations on a large number of files, whether the file hash value matches the malicious sample library, etc.; CPU usage features include whether there is a sudden increase in CPU usage without business triggering, whether it is in a high load state and cannot be relieved by regular operations, etc.; these features together constitute the basic dimensions of risk assessment, ensuring comprehensive coverage of the terminal behavior aspects that threats may involve;

[0058] Based on the influence degree of each risk feature dimension on the threat severity, a corresponding weight is assigned to each dimension; for example, process behavior features involving process injection, network features connected to known malicious IPs, file features encrypting sensitive files, etc. have a greater impact on threat level and are assigned a higher weight; while features such as only slight CPU fluctuations have a smaller impact and are assigned a lower weight; then, the risk score function is used to quantitatively calculate each dimension feature: first, the specific performance of each feature is converted into a corresponding score, such as assigning a high score for malicious features and a low score for no abnormalities; then, multiply each feature score by the corresponding weight; finally, add up all the product results to get the comprehensive risk score of the threat, which quantitatively reflects the overall severity of the threat;

[0059] The system presets three risk score intervals, corresponding to low, medium and high risk levels respectively; when the comprehensive risk score is below the first threshold, it is determined to be a low-risk threat, and the system automatically performs log recording, recording the threat occurrence time, involved processes / files / network information and risk level in detail, and generates a simple prompt in the terminal notification bar; when the score is between the two thresholds, it is determined to be a medium-risk threat, and a pop-up window is triggered immediately to warn of the threat details, risk level and suggested handling method, waiting for the user to view and select "allow", "block" or "further analyze", and performing the corresponding operation according to the user's instruction; when the score is higher than the second threshold, it is determined to be a high-risk threat, and no user intervention is required, the emergency response mechanism is started directly, and operations such as process forced termination, abnormal network connection cut-off, and risky file isolation to a special security area are performed to quickly contain the threat spread.

[0060] In this embodiment, the risk score function is:

[0061]

[0062] Wherein: The higher the comprehensive risk score of the i-th terminal or Agent, the greater the potential threat; The original monitoring data of the i-th terminal, including CPU behavior, file activity, network communication, process behavior, etc. Respectively represent the risk function based on CPU usage mode, such as sudden occupancy rate increase, continuous abnormal fluctuation.

[0063] Step 104, after completing a threat detection and response operation, the threat detection and response intelligent agent transmits the response result and user selection behavior to the cloud security operation platform in real time through the encrypted communication channel;

[0064] In this embodiment, the threat detection and response agent automatically collects the operation data of this time after completing the threat detection and response operation, wherein the operation data includes threat detection results, executed response actions, execution status of the response actions, and user selection behaviors in the response process; the agent sends an encrypted channel establishment request to the cloud security operation platform, wherein the request includes terminal identification, agent version information, and encryption method negotiation parameters; the cloud platform returns confirmation information of encrypted channel establishment and a session key after receiving the request, and the agent uses the encryption mechanism in the HTTPS protocol to encrypt the sorted response results and user selection behavior data; the agent sends the encrypted data to the cloud security operation platform in a preset transmission format through the established encrypted channel.

[0065] Step 105, based on user feedback and summary data, iteratively optimizing the lightweight AI model and rule library.

[0066] In this embodiment, the cloud security operation platform receives the response results and user selection behavior data returned by the threat detection and response agent of each terminal through the encrypted channel, wherein the response results include interception success, process termination, false positive confirmation, etc., and the user selection behaviors include release, joining the whitelist, etc.; the platform classifies the data according to the data types, marks the feedback data related to false positives and false negatives as model optimization key data, and marks the newly emerging threat feature data as rule library supplement key data;

[0067] The received feedback data and summary data are cleaned to eliminate duplicate, invalid, and format error data, such as deleting the same false positive records repeatedly reported by the same terminal; at the same time, the effective data are standardized to unify the data format and description method, such as unifying different expressions of process injection behaviors of different terminals into standard terms, to ensure that the data can be effectively recognized and utilized by subsequent processing steps;

[0068] According to the user selection behavior, the data are labeled, for example, the user marks the detection results as false positives, labels the false positive label and records the corresponding behavior characteristics; the user selects the processes or files to release, labels the trusted label and related attributes; these labels will be important reference basis for model training and rule library optimization, and the actual threat state corresponding to the data is clear;

[0069] The platform calls the model training module, combines the feedback data labeled with labels with existing threat sample sets and security event labels to form a model training data set; using the incremental learning method, the new data set is input into the lightweight AI model such as One-Class SVM and lightweight graph model, the model parameters are adjusted to optimize the judgment threshold and feature weight of the model to abnormal behaviors, so that the model can identify the behavior patterns previously missed or missed, and improve the detection accuracy of the model;

[0070] The new threat features in the aggregated data that are not covered by the existing rule library are analyzed, and combined with the expert knowledge base, these new features are converted into specific rule items, such as adding newly discovered malicious file hash values and abnormal network connection patterns to the rule library; at the same time, the original rules are checked, and obsolete or redundant rules are deleted, and the matching threshold of the rules is adjusted to ensure that the rule library can accurately identify new threats;

[0071] The iteratively trained lightweight AI model and the optimized rule library are verified in a test environment by inputting historical threat data and newly collected typical data to check the detection accuracy of the model and the matching effect of the rule library; the model version and rule library update content that pass the verification are selected, and the parts found to still have obvious defects in the verification process are excluded to ensure the reliability of the optimized model and rule library;

[0072] The platform dynamically distributes the optimized lightweight AI model and rule library that pass the verification to the threat detection and response agent of each terminal through an encrypted channel; after receiving, the agent replaces the original model and rule library, loads and takes effect locally, completes the deployment of this iteration optimization, and enables the terminal to apply the updated model and rules for threat detection and response.

[0073] In this embodiment, bidirectional encrypted communication with the operation platform is supported through encrypted channels such as HTTPS and MQTT, and the transmission content includes terminal detection logs, policy synchronization, model update instructions, user feedback data, etc., to ensure the integrity and confidentiality during transmission; users can input query requests in natural language on the terminal side, such as: "What attacks have there been recently?" "How many isolation operations have there been in the past week?", and the semantic recognition module built into the agent can understand the user's input and extract keywords, extracting key elements such as query target, time range, content type, etc.; the agent packages the structured query intent as an API request, which is transmitted to the operation platform, and then the platform interface calls multiple data sources such as the security log database, threat intelligence library, and alarm record library to complete the query and analysis. The results are returned to the terminal side in real time in the form of structured tables, charts, and summary reports for users to view; the agent can achieve a "what you ask is what you get" security operation interaction experience through semantic input, improving information acquisition efficiency, reducing the use threshold, and enhancing user perception value.

[0074] In this embodiment, the intelligent agent runs in the form of a service process in the terminal operating system, loads policy rules and models after starting; scans the system behavior log every 5 seconds to determine whether there is a rule hit or abnormal behavior; if a hit is detected: determine the threat level; perform the corresponding response action (such as kill, isolation); report to the operation platform and wait for policy feedback. The platform can dynamically push response commands according to the policy, and the intelligent agent executes and records logs through MQ / HTTPS, etc. After the user confirms the result, the information is returned to the platform for model feedback update.

[0075] Referring to Figure 2 The structure diagram of the threat detection and response intelligent agent security protection system based on terminal deployment provided by the embodiment of the present application, the system comprises:

[0076] A real-time monitoring module for real-time monitoring of the behavior data of the terminal deployment threat detection and response intelligent agent including processes, networks and files;

[0077] A threat detection module for rapid screening of behavior data based on a preset rule library, and calling a lightweight AI model to detect threats to dynamic behavior;

[0078] A response decision module for risk level assessment of detected threats, and performing graded response actions according to the assessment results, wherein low-risk threats perform log recording or prompt operations, medium-risk threats perform pop-up warnings and wait for user confirmation, and high-risk threats automatically perform blocking, process termination or network isolation operations;

[0079] A communication interface module for real-time return of response results and user selected behaviors to the cloud security operation platform after the threat detection and response intelligent agent completes a threat detection and response operation through an encrypted communication channel;

[0080] An iterative optimization module for iterative optimization of the lightweight AI model and the rule library based on user feedback and summary data.

[0081] Figure 3is a structural schematic view of a terminal deployment based threat detection response agent security protection device provided by an embodiment of the present application. The terminal deployment based threat detection response agent security protection device 300 can have great differences due to different configurations or performances, and can include one or more than one central processing unit (CPU) 310 (for example, one or more than one processor) and a memory 320, one or more than one storage medium 330 (for example, one or more than one mass storage device) storing an application program 333 or data 332. The memory 320 and the storage medium 330 can be temporary storage or persistent storage. The program stored in the storage medium 330 can include one or more than one module (not shown in the figure), and each module can include a series of instruction operations in the terminal deployment based threat detection response agent security protection device 300. Further, the processor 310 can be configured to communicate with the storage medium 330 and execute the series of instruction operations in the storage medium 330 on the terminal deployment based threat detection response agent security protection device 300 to realize the method provided by the above embodiment.

[0082] The terminal deployment based threat detection response agent security protection device 300 can further include one or more than one power supply 340, one or more than one wired or wireless network interface 350, one or more than one input and output interface 360, and / or one or more than one operating system 331, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, and the like. Those skilled in the art can understand that the terminal deployment based threat detection response agent security protection device 300 can further include other components that are not shown in the figure, and the components shown in the figure do not constitute a limitation on the computer device provided by the present application. Figure 3 The terminal deployment based threat detection response agent security protection device structure shown does not constitute a limitation on the computer device provided by the present application, and can include more or fewer components than shown in the figure, or combine certain components, or different component arrangements.

[0083] The present application further provides a computer readable storage medium, which can be a non-volatile computer readable storage medium or a volatile computer readable storage medium. The computer readable storage medium has instructions stored therein, and when the instructions run on a computer, the computer executes the steps of the terminal deployment based threat detection response agent security protection method provided by the above embodiments.

[0084] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device or apparatus, unit can refer to the corresponding process in the foregoing method embodiments, which will not be described herein.

[0085] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0086] The basic principles, main features and advantages of the present application are shown and described above. Those skilled in the art should understand that the present application is not limited by the above embodiments, and the above embodiments and descriptions in the specification are only preferred examples of the present application and are not intended to limit the present application. Without departing from the spirit and scope of the present application, various changes and improvements can be made to the present application, and these changes and improvements all fall within the scope of the claimed present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for intelligent security protection based on terminal deployment threat detection response agent, characterized in that, The method comprises the following steps: The terminal deployment threat detection response agent monitors the terminal behavior data including processes, networks and files in real time; Based on the preset rule library, the behavior data is quickly screened, and a lightweight AI model is called to detect the dynamic behavior; The risk level of the detected threat is evaluated, and the graded response actions are executed according to the evaluation results, wherein the low-risk threat executes log recording or prompt operation, the medium-risk threat executes pop-up warning and waits for user confirmation, and the high-risk threat automatically executes blocking, process termination or network isolation operation; After completing a threat detection and response operation, the threat detection response agent transmits the response results and user selection behavior to the cloud security operation platform in real time through an encrypted communication channel; Based on user feedback and summary data, the lightweight AI model and rule library are iteratively optimized; The quick screening of the behavior data based on the preset rule library comprises: From the process, network and file behavior data obtained by real-time monitoring of the terminal, the feature fields are extracted, wherein the feature fields include process path, network connection IP and port, file operation path and type; The scattered feature fields are integrated into a structured data sequence in chronological order, and a preset rule library is called, wherein the rule library includes known threat malicious process name, suspicious file hash value and abnormal network port range; The structured data sequence and the rules in the rule library are matched one by one, and if there is data that meets the rules, it is marked as a suspected threat, and the matching rule number and related behavior details are recorded; The lightweight AI model is called to detect the dynamic behavior, comprising: For the behavior data that is not marked as a suspected threat after screening by the rule library, dynamic features are extracted, including process resource occupation trend, network communication traffic fluctuation rule, file operation frequency and association; The dynamic features are converted into feature vectors recognizable by the model, and input into the lightweight AI model, and the deviation degree is calculated by comparing the current feature vector with the normal behavior pattern baseline, wherein the lightweight AI model includes One-Class SVM model and lightweight graph model; When the deviation degree exceeds the preset threshold, it is determined that the current dynamic behavior is abnormal, marked as a potential threat, and the abnormal confidence is output; The suspected threats marked by the rule library quick screening and the potential threats marked by the lightweight AI model detection are summarized to form a preliminary threat detection result set.

2. The method of claim 1, wherein the method further comprises: The risk level of the detected threat is evaluated, and the graded response actions are executed according to the evaluation results, comprising: From the detected threat-related behavior data, risk features for evaluation are extracted, including process behavior features, network features, file features and CPU usage features; Each risk feature dimension extracted is assigned a corresponding weight, and a risk level evaluation is performed through a risk scoring function to obtain a comprehensive risk score; According to the preset interval of the comprehensive risk score, the threat is divided into three risk levels of low, medium and high, and the corresponding response action is triggered according to the divided risk level.

3. The method of claim 2, wherein the method further comprises: The risk scoring function is: ； wherein: is the overall risk score for the i-th terminal or Agent, with higher values indicating greater potential threat; is the raw monitoring data for the i-th terminal, including CPU behavior, file activity, network communication, process behavior; respectively represent the risk functions based on CPU usage patterns, file activity, network communication, process behavior.

4. The method of claim 1, wherein the method further comprises: The threat detection and response agent through the encrypted communication channel transmits the response result and the user selection behavior to the cloud security operation platform in real time after completing a threat detection and response operation, including: The threat detection and response agent automatically collects operation data after completing the threat detection and response operation, wherein the operation data includes threat detection result, executed response action, execution state of the response action, and user selection behavior in the response process; The agent sends an encrypted channel establishment request to the cloud security operation platform, wherein the request contains terminal identification, agent version information, and encryption mode negotiation parameters; After receiving the request, the cloud platform returns confirmation information of the encrypted channel establishment and a session key, and the agent uses the encryption mechanism in the HTTPS protocol to encrypt the sorted response result and user selection behavior data; The agent sends the encrypted data to the cloud security operation platform in a preset transmission format through the established encrypted channel.

5. The method of claim 1, wherein the method further comprises: The lightweight AI model and rule library are iteratively optimized based on user feedback and summarized data, including: The cloud security operation platform receives the response result and user selection behavior data returned by the threat detection and response agent of each terminal through the encrypted channel, classifies the data according to the data type, marks the feedback data related to false positives and false negatives as model optimization data, and marks the newly appeared threat feature data as rule library supplement key data; The data with labels are combined with the existing threat sample set to form a model training data set, the judgment threshold and feature weight of the model for abnormal behavior are optimized by adjusting the model parameters, and the iteratively trained lightweight AI model and optimized rule library are obtained.

6. A terminal-deployed threat detection response agent security system, characterized in that, The system includes: A real-time monitoring module for real-time monitoring of behavior data of processes, networks, and files of the threat detection and response agent deployed on the terminal; The threat detection module is used for rapid screening of behavior data based on a preset rule base, and calling a lightweight AI model for threat detection of dynamic behavior: feature fields are extracted from process, network, and file behavior data obtained in real time from terminal monitoring, wherein the feature fields include process path, network connection IP and port, and file operation path and type; the dispersed feature fields are integrated into a structured data sequence in chronological order, and a preset rule base is called, wherein the rule base includes known threat malicious process name, suspicious file hash value, and abnormal network port range; the structured data sequence is matched with rules in the rule base piece by piece, and if there is data that meets the rules, it is marked as a suspected threat, and the rule number and related behavior details matched are recorded; for behavior data that is not marked as a suspected threat after rule base screening, dynamic features are extracted, wherein the dynamic features include process resource occupation trend, network communication traffic fluctuation rule, file operation frequency, and association; the dynamic features are converted into feature vectors recognizable by the model, and input into the lightweight AI model, and the deviation degree is calculated by comparing the current feature vector with the normal behavior pattern baseline, wherein the lightweight AI model includes One-Class SVM model and lightweight graph model; when the deviation degree exceeds a preset threshold, it is determined that the current dynamic behavior is abnormal, marked as a potential threat, and the abnormal confidence is output; the suspected threats marked by the rule base rapid screening and the potential threats marked by the lightweight AI model detection are summarized to form a preliminary threat detection result set; The response decision module is used for risk level assessment of the detected threats, and performs graded response actions according to the assessment results, wherein low-risk threats perform log recording or prompt operations, medium-risk threats perform pop-up warnings and wait for user confirmation, and high-risk threats automatically perform blocking, process termination, or network isolation operations; The communication interface module is used for real-time feedback of the response results and user selection behaviors to the cloud security operation platform through an encrypted communication channel after the threat detection and response intelligent agent completes a threat detection and response operation; The iterative optimization module is used for iterative optimization of the lightweight AI model and the rule base based on user feedback and summary data.

7. A terminal-deployed threat detection response agent security device, characterized by, The terminal-deployed threat detection and response intelligent agent security protection device includes a memory and at least one processor, and the memory stores instructions; the at least one processor calls the instructions in the memory to make the terminal-deployed threat detection and response intelligent agent security protection device perform the steps of the terminal-deployed threat detection and response intelligent agent security protection method according to any one of claims 1-5.

8. A computer-readable storage medium having stored thereon instructions, the computer-readable storage medium comprising: The instructions are executed by the processor to implement the steps of the terminal-deployed threat detection and response intelligent agent security protection method according to any one of claims 1-5.

Images