Process anomaly detection method and device, equipment and storage medium

Abstract

The invention provides a process exception detection method and device, equipment and a storage medium, relates to the technical field of computers, and is used for accurately performing exception detection on a process. The method comprises the following steps: acquiring identity information, current behavior data and a first digital identity signature of a process to be detected; the first digital identity signature is generated based on identity information and historical behavior data; performing verification based on the identity information, the current behavior data and the first digital identity signature, and determining a signature verification result; based on the current behavior data, determining a behavior deviation degree of the to-be-detected process; the behavior deviation degree is used for representing the deviation degree of the behavior of the to-be-detected process relative to a normal behavior baseline; determining an anomaly detection result of the to-be-detected process according to the signature verification result and the behavior deviation degree; the anomaly detection result is used for indicating whether the to-be-detected process is abnormal or not.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and in particular relates to a method, apparatus, device and storage medium for detecting process anomalies. Background Technology

[0002] With the widespread adoption of cloud computing and zero-trust architectures, traditional network perimeter-based protection models have revealed significant shortcomings. Once attackers breach outer defenses, they can exploit default trust relationships between processes to move laterally and launch attacks on critical business operations by exploiting vulnerabilities or stealing credentials. Clearly, traditional firewalls are ill-equipped to handle east-west traffic penetration attacks.

[0003] To effectively prevent lateral movement of penetration attacks between processes, a micro-segmentation approach can be adopted. This approach significantly reduces the scope of attack impact and decreases the attack surface through fine-grained strategies. However, current process-level micro-segmentation trust authentication processes typically rely on static strategies, making it difficult to effectively detect process anomalies in scenarios with frequent dynamic process scheduling. Summary of the Invention

[0004] This application provides a process anomaly detection method, apparatus, device, and storage medium for accurately and effectively detecting process anomalies.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, a method for detecting process anomalies is provided, comprising: acquiring the identity information, current behavior data, and a first digital identity signature of the process to be detected. The first digital identity signature is generated based on the identity information and historical behavior data. Verification is performed based on the identity information, current behavior data, and the first digital identity signature to determine the signature verification result. Based on the current behavior data, the behavioral deviation degree of the process to be detected is determined. The behavioral deviation degree is used to represent the degree to which the behavior of the process to be detected deviates from the normal behavior baseline. Based on the signature verification result and the behavioral deviation degree, an anomaly detection result of the process to be detected is determined. The anomaly detection result is used to indicate whether the process to be detected is abnormal.

[0007] Optionally, the current behavioral data includes: the call sequence of system calls corresponding to the process under test, network traffic metadata, and runtime data. Network traffic metadata includes the file access path, network connection mode, network identification information, and protocol type of the process under test. Runtime data includes the CPU usage and memory usage information of the process under test.

[0008] Optionally, based on the current behavioral data, the behavioral deviation degree of the process to be detected is determined, including: performing feature engineering on the behavioral data to obtain the behavioral features of the process to be detected. The behavioral features of the process to be detected include temporal features, network communication statistical features, contextual features, and semantic features of file access paths. Temporal features are used to represent the temporal distribution of system calls within the process to be detected. Network communication statistical features are used to represent the randomness of the communication behavior of the process to be detected. Contextual features are used to represent the parent-child process call relationship corresponding to the process to be detected. Density clustering analysis is performed on the temporal features to determine the behavioral deviation value of the system call sequence of the process to be detected. Gaussian mixture processing is applied to the file access path and network communication statistical features to determine the outliers in the resource usage probability distribution of the process to be detected. The temporal features, network communication statistical features, contextual features, and file access paths are processed using an LSTM network to determine the behavioral deviation index of the process to be detected. The behavioral deviation degree of the process to be detected is determined based on the behavioral deviation value of the system call sequence, the outliers in the resource usage probability distribution, and the behavioral deviation index.

[0009] Optionally, the behavioral deviation degree of the process to be detected is determined based on the behavioral deviation value of the system call sequence, the outlier of the resource usage probability distribution, and the behavioral deviation index. This includes: processing the behavioral features, the behavioral deviation value of the system call sequence, the outlier of the resource usage probability distribution, and the behavioral deviation index using the Isolation Forest algorithm to obtain the frequency of abnormal system calls; and then performing a weighted summation of the behavioral deviation value of the system call sequence, the outlier of the resource usage probability distribution, the behavioral deviation index, and the frequency of abnormal system calls to obtain the behavioral deviation degree of the process to be detected.

[0010] Optionally, the signature verification result is determined based on the identity information, current behavior data, and the first digital identity signature, including: generating a cryptographic hash value based on the identity information; generating a behavior fingerprint of the process to be detected based on the current behavior data; generating a second digital identity signature based on the cryptographic hash value and the behavior fingerprint; and determining the signature verification result based on the comparison between the first and second digital identity signatures.

[0011] Optionally, based on the signature verification result and the behavior deviation, an anomaly detection result for the process to be detected is determined, including: if the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is greater than or equal to a similarity threshold, and the behavior deviation is less than or equal to a deviation threshold, then the anomaly detection result is determined to indicate that the process to be detected is not abnormal. Alternatively, if the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is less than a similarity threshold, and / or the behavior deviation is greater than a deviation threshold, then the anomaly detection result is determined to indicate that the process to be detected is abnormal.

[0012] Secondly, a process anomaly detection device is provided, comprising: an acquisition module and a processing module. The acquisition module is used to acquire the identity information, current behavior data, and a first digital identity signature of the process to be detected. The first digital identity signature is generated based on the identity information and historical behavior data. The processing module is used to verify the identity information, current behavior data, and first digital identity signature to determine the signature verification result. The processing module is also used to determine the behavior deviation degree of the process to be detected based on the current behavior data. The behavior deviation degree is used to represent the degree of deviation of the behavior of the process to be detected from the normal behavior baseline. The processing module is also used to determine the anomaly detection result of the process to be detected based on the signature verification result and the behavior deviation degree. The anomaly detection result is used to indicate whether the process to be detected is abnormal.

[0013] Optionally, the current behavioral data includes: the call sequence of system calls corresponding to the process under test, network traffic metadata, and runtime data. Network traffic metadata includes the file access path, network connection mode, network identification information, and protocol type of the process under test. Runtime data includes the CPU usage and memory usage information of the process under test.

[0014] Optionally, the processing module is specifically used for: performing feature engineering on the behavioral data to obtain the behavioral features of the process to be detected. The behavioral features of the process to be detected include temporal features, network communication statistical features, contextual features, and semantic features of file access paths. Temporal features represent the temporal distribution of system calls within the process to be detected. Network communication statistical features represent the randomness of the communication behavior of the process to be detected. Contextual features represent the parent-child process call relationship corresponding to the process to be detected. Density clustering analysis is performed on the temporal features to determine the behavioral deviation value of the system call sequence of the process to be detected. Gaussian mixture processing is performed on the file access path and network communication statistical features to determine the outliers in the resource usage probability distribution of the process to be detected. The temporal features, network communication statistical features, contextual features, and file access paths are processed using an LSTM network to determine the behavioral deviation index of the process to be detected. Based on the behavioral deviation value of the system call sequence, the outliers in the resource usage probability distribution, and the behavioral deviation index, the behavioral deviation degree of the process to be detected is determined.

[0015] Optionally, the processing module is specifically used to: process behavioral features, system call sequence behavioral deviation values, resource usage probability distribution outliers, and behavioral deviation index based on the isolated forest algorithm to obtain the abnormal system call frequency. The system call sequence behavioral deviation values, resource usage probability distribution outliers, behavioral deviation index, and abnormal system call frequency are weighted and summed to obtain the behavioral deviation degree of the process to be detected.

[0016] Optionally, the processing module is specifically used for: generating a cryptographic hash value based on the identity information; generating a behavioral fingerprint of the process to be detected based on the current behavioral data; generating a second digital identity signature based on the cryptographic hash value and the behavioral fingerprint; and determining the signature verification result based on the comparison between the first and second digital identity signatures.

[0017] Optionally, the processing module is specifically configured to: determine an anomaly detection result to indicate that the process to be detected does not have an anomaly when the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is greater than or equal to a similarity threshold and the behavior deviation is less than or equal to a deviation threshold. Alternatively, determine an anomaly detection result to indicate that the process to be detected has an anomaly when the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is less than a similarity threshold and / or the behavior deviation is greater than a deviation threshold.

[0018] Thirdly, a computer device is provided. The computer device includes:

[0019] processor;

[0020] Memory used to store processor-executable instructions;

[0021] The processor is configured to execute instructions to implement any of the possible process anomaly detection methods described in the first aspect.

[0022] Fourthly, a computer-readable storage medium is provided, on which instructions are stored, such that when the instructions in the computer-readable storage medium are executed by a computer device, the computer device performs any of the possible process anomaly detection methods described in the first aspect.

[0023] Fifthly, a computer program product is provided, including a computer program that, when executed by a computer device, implements any of the possible process anomaly detection methods described in the first aspect.

[0024] These or other aspects of this application will become more readily apparent in the following description.

[0025] The technical solution provided in this application brings at least the following beneficial effects:

[0026] Based on any of the above, this application can obtain the identity information, current behavior data, and first digital identity signature of the process to be detected, and perform verification based on the identity information, current behavior data, and first digital identity signature to determine the signature verification result. Based on the current behavior data, it can determine the behavior deviation degree of the process to be detected, so as to further determine the abnormal detection result of the process to be detected based on the signature verification result and the behavior deviation degree.

[0027] Based on this, this application can achieve multi-level trusted authentication based on the behavioral data and digital identity signature of the process to be detected, avoiding the problem of easily forged certificates or malicious hijacking when relying solely on digital identity signature for verification. Furthermore, analysis through behavioral deviation can avoid false alarms caused by occasional process behavior fluctuations. Therefore, this application can be used for accurate and effective anomaly detection of processes. Attached Figure Description

[0028] Figure 1 This application provides a schematic diagram of the hardware structure of a computer device according to an embodiment of the present application.

[0029] Figure 2 A flowchart illustrating a process anomaly detection method provided in an embodiment of this application;

[0030] Figure 3 A flowchart illustrating another process anomaly detection method provided in this application embodiment;

[0031] Figure 4 A flowchart illustrating another process anomaly detection method provided in this application embodiment;

[0032] Figure 5 A flowchart illustrating another process anomaly detection method provided in this application embodiment;

[0033] Figure 6 A flowchart illustrating another process anomaly detection method provided in this application embodiment;

[0034] Figure 7 This is a schematic diagram of the functional architecture of a micro-segmentation agent provided in an embodiment of this application;

[0035] Figure 8 A schematic diagram of a process anomaly detection process provided in an embodiment of this application;

[0036] Figure 9 This is a schematic diagram of a process anomaly detection device provided in an embodiment of this application. Detailed Implementation

[0037] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0038] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0039] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0040] Furthermore, the terms "comprising" and "having" in the embodiments, claims, and drawings of this application are not exclusive. For example, a process, method, system, product, or device that includes a series of steps or modules is not limited to the listed steps or modules, but may also include steps or modules not listed.

[0041] To facilitate understanding of this application, the relevant elements involved in this application are described below.

[0042] With the widespread adoption of cloud computing and zero-trust architectures, traditional network perimeter-based protection models have revealed significant shortcomings. Once attackers breach outer defenses, they can exploit default trust relationships between processes to move laterally and launch attacks on critical business operations by exploiting vulnerabilities or stealing credentials. Clearly, traditional firewalls are ill-equipped to handle east-west traffic penetration attacks.

[0043] To effectively prevent lateral movement of penetration attacks between processes, a micro-segmentation approach can be adopted. This approach significantly reduces the scope of attack impact and decreases the attack surface through fine-grained strategies. Compared to virtual machines, process-level micro-segmentation requires fewer resources, starts up faster, and supports applying different isolation policies to different processes based on specific needs. It enables process-level trusted authentication and blocks covert communication between unauthorized processes.

[0044] Against this backdrop, the international standards organization NIST explicitly stated in SP 800-207 "Zero Trust Architecture" that "workload processes need to be authenticated and dynamically authorized." Furthermore, relevant network security level protection requirements also stipulate the implementation of "process-level trusted verification" for core systems.

[0045] Currently, the technical solutions for process-level micro-segmentation trusted authentication mainly include two aspects: process-level trusted authentication technology and process-level system isolation technology.

[0046] Process-level trusted authentication technology refers to implementing continuous authentication and behavior monitoring based on a zero-trust architecture, maintaining strict access control even in internal network environments.

[0047] Process-level system isolation technology refers to building a protective isolation system by applying multi-layered process-level micro-isolation techniques to the system kernel. Specifically, system call restriction mechanisms can be used to effectively reduce the attack surface by controlling or disabling dangerous system calls. Furthermore, resource isolation mechanisms can be used to create independent namespaces for processes, including isolated environments such as file systems, networks, and process trees. The isolation characteristics of network namespaces ensure that each process can only access the network resources allocated to it. Simultaneously, resource control mechanisms strictly limit the amount of CPU, memory, and disk resources used by processes. For example, by setting a memory usage cap for a process, proactive prevention of memory leaks or malicious attacks can be achieved. Moreover, the mandatory access control function of security modules can be used to restrict process behavior based on predefined policies, preventing processes from accessing sensitive system files or critical directories.

[0048] However, current process-level micro-segmentation trusted authentication processes typically rely on static policies to define identity issuance rules. When cloud environments scale up, frequent dynamic process scheduling can lead to delays in matching identity credentials with real-time process states, resulting in authentication failure risks. Furthermore, the certificate rotation mechanism in micro-segmentation trusted authentication requires precise coordination of process lifecycles; failure to promptly revoke identity credentials after abnormal process termination may leave security vulnerabilities. Especially in scenarios with short-lifecycle processes, high-frequency certificate issuance can also increase system load.

[0049] To address the aforementioned issues, this application provides a process anomaly detection method. This method acquires the identity information, current behavior data, and a first digital identity signature of the process to be detected. It then verifies the identity information, current behavior data, and first digital identity signature to determine the signature verification result. Based on the current behavior data, it determines the behavior deviation degree of the process to be detected. Finally, based on the signature verification result and the behavior deviation degree, it determines the anomaly detection result of the process to be detected.

[0050] Based on this, this application can achieve multi-level trusted authentication based on the behavioral data and digital identity signature of the process to be detected, avoiding the problem of easily forged certificates or malicious hijacking when relying solely on digital identity signature for verification. Furthermore, analysis through behavioral deviation can avoid false alarms caused by occasional process behavior fluctuations. Therefore, this application can be used for accurate and effective anomaly detection of processes.

[0051] The process anomaly detection method provided in this application can be applied to computer devices. These computer devices can be terminals, servers, or other devices. This application does not impose any limitations on this.

[0052] The terminal can be a device that provides voice and / or data connectivity to a user, a handheld device with wireless connectivity, or other processing devices connected to a wireless modem. The wireless terminal can communicate with one or more core networks via a radio access network (RAN). The wireless terminal can be a mobile terminal, such as a computer with a mobile terminal, or a portable, pocket-sized, handheld, or computer-embedded mobile device that exchanges voice and / or data with the radio access network, such as a mobile phone, tablet computer, laptop computer, netbook, or personal digital assistant (PDA). This application does not impose any limitations on these embodiments.

[0053] The server can be a single server or a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster. This application does not impose any limitations in this regard.

[0054] like Figure 1 The diagram shown is a hardware structure schematic of a computer device according to an embodiment of this application. The computer device includes a processor 11, a memory 12, a communication interface 13, and a bus 14. The processor 11, memory 12, and communication interface 13 are connected via the bus 14.

[0055] Processor 11 is the control center of the computer device. It can be a single processor or a collective term for multiple processing elements. For example, processor 11 can be a CPU or other general-purpose processors. A general-purpose processor can be a microprocessor or any conventional processor.

[0056] As one embodiment, processor 11 may include one or more CPUs, for example Figure 1 CPU0 and CPU1 are shown in the diagram.

[0057] The memory 12 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0058] In one possible implementation, the memory 12 can exist independently of the processor 11. The memory 12 can be connected to the processor 11 via a bus 14 and is used to store instructions or program code. When the processor 11 calls and executes the instructions or program code stored in the memory 12, it can implement the process anomaly detection method provided in the following embodiments of this application.

[0059] In another possible implementation, the memory 12 can also be integrated with the processor 11.

[0060] Communication interface 13 is used for connecting computer equipment to other devices via a communication network, which may be Ethernet, wireless access network, wireless local area network (WLAN), etc. Communication interface 13 may include a receiving unit for receiving data and a transmitting unit for sending data.

[0061] Bus 14 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 1 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0062] It should be pointed out that, Figure 1 The structure shown does not constitute a limitation on computer equipment, except Figure 1 In addition to the components shown, a computer device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0063] like Figure 2 The diagram shown is a flowchart illustrating a process anomaly detection method provided in an embodiment of this application. This process anomaly detection method can be applied to... Figure 1 The computer device shown. The abnormal process detection method includes: S201-S204.

[0064] S201. The computer device acquires the identity information, current behavior data and first digital identity signature of the process to be detected.

[0065] The process to be detected can be any process running on the computer device.

[0066] The identity information of the process to be detected is its unique identifier, which can be established based on attributes such as the associated container Pod ID, and / or namespace, and / or server, and / or account information. A mapping relationship can be established between the identity information of the process to be detected and its behavioral data to facilitate accurate process detection.

[0067] The current behavior data of the process under test refers to the behavior data generated during the current execution. Current behavior data may include the call sequence of system calls corresponding to the process under test, network traffic metadata, and runtime data. Network traffic metadata may include the file access path, network connection mode, network identification information, and protocol type of the process under test. Runtime data may include CPU usage information and memory usage information of the process under test. CPU usage information can be used to indicate the trend of CPU usage changing over time. Memory usage information can be used to indicate the trend of memory usage changing over time.

[0068] For example, a micro-segmentation agent can be deployed on a computer device to extract attribute information of the process under test, facilitating the establishment of the process's identity. Furthermore, based on the micro-segmentation agent, the computer device can use a lightweight probe to collect system calls of the process under test running on the computer device in real time, recording the call sequence of these system calls. Examples include system calls for executing files (execve) and the open function used to open and create files. Simultaneously, the computer device can use the micro-segmentation agent to record network traffic metadata such as the process's file access path, network connection mode, IP / port used (i.e., network identification information), and protocol type. Additionally, the computer device can use the micro-segmentation agent to record runtime data such as CPU usage and memory usage. Alternatively, the computer device can add timestamp elements to the recorded data to construct a multi-dimensional feature matrix related to the behavior of the process under test.

[0069] Historical behavior data of the process to be monitored refers to the behavior data generated during one or more historical runs. Furthermore, no anomalies occurred during these one or more historical runs.

[0070] When the process to be detected is started and running, the computer device can generate a first digital identity signature for the process to be detected based on its identity information and historical behavior data. For example, the computer device can generate a cryptographic hash value based on the identity information of the process to be detected and generate a historical behavior fingerprint based on the historical behavior data of the process to be detected, so as to further generate a first digital identity signature based on the cryptographic hash value and the historical behavior fingerprint, so as to facilitate two-way verification between the process to be detected and the host.

[0071] S202. The computer device verifies the signature based on the identity information, current behavior data, and the first digital identity signature to determine the signature verification result.

[0072] For example, a computer device can generate a second digital identity signature based on identity information and current behavior data, and then further compare and verify the second digital identity signature with the first digital identity signature to determine the signature verification result. Comparison of the cryptographic hash values ​​between the second and first digital identity signatures can be used to verify whether the identity information of the process under investigation has been tampered with. Comparison of the behavioral fingerprints between the second and first digital identity signatures can be used to verify whether there are differences between the current behavior and historical behavior of the process under investigation. Based on this, the signature verification result can be used to represent the similarity or difference between the second digital identity signature and the first digital identity signature.

[0073] S203. The computer equipment determines the degree of behavioral deviation of the process to be detected based on the current behavioral data.

[0074] Among them, the behavior deviation degree is used to represent the degree to which the behavior of the process under test deviates from the normal behavior baseline. The normal behavior baseline can be established in advance based on the behavior data of multiple processes that have not experienced any abnormalities during operation. It is used to indicate the behavioral characteristics of normally running processes in dimensions such as resource interaction behavior, system call behavior, time-dependent behavior, and external interaction behavior, so as to facilitate the detection of abnormal process behavior.

[0075] For example, computer equipment can perform feature engineering on current behavioral data to obtain multidimensional behavioral features of the process to be detected. Furthermore, the computer equipment can process these multidimensional behavioral features to determine the degree of behavioral deviation of the process. The specific implementation of this process can be referred to the relevant descriptions in S301-S305 below, and will not be elaborated further.

[0076] S204. The computer equipment determines the abnormal detection result of the process to be detected based on the signature verification result and the behavior deviation degree.

[0077] Among them, the anomaly detection results are used to indicate whether there are any anomalies in the process to be detected.

[0078] If the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is greater than or equal to the similarity threshold, and the behavior deviation is less than or equal to the deviation threshold, it can be concluded that the process's digital identity signature has not been tampered with, and the behavior has not deviated from the normal behavior baseline, and there are no abnormalities during operation. The computer device can then determine that the anomaly detection result is used to indicate that the process under test is not abnormal.

[0079] If the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is less than the similarity threshold, and / or the behavioral deviation is greater than the deviation threshold, it can be concluded that the process's digital identity signature has been tampered with, and / or the behavior deviates from the normal behavioral baseline, indicating an anomaly during operation. The computer equipment can then determine that the anomaly detection result indicates an anomaly in the process under test.

[0080] Based on the above S201-S204, the computer device can verify the integrity of the digital identity signature of the process under test, achieving static verification. Furthermore, the computer device can dynamically detect whether the behavior of the process under test is abnormal in real time by analyzing the degree of deviation between the process's behavioral characteristics and the normal behavioral baseline. Subsequently, the computer device can combine the signature verification result and behavioral deviation of the process under test to comprehensively determine the abnormal detection result, achieving multi-level authentication processing for the process under test, accurately detecting credential abuse and spoofing attacks, and reducing manual intervention in operation and maintenance.

[0081] In one embodiment, such as Figure 3 The diagram shown is a flowchart illustrating another process anomaly detection method provided in this application embodiment. When a computer device determines the degree of behavioral deviation of a process to be detected based on current behavioral data, this application embodiment provides an optional implementation, including: S301-S305.

[0082] S301. The computer equipment performs feature engineering processing on the behavioral data to obtain the behavioral features of the process to be detected.

[0083] The behavioral characteristics of the process under test include temporal features, network communication statistics, contextual features, and semantic features of file access paths. Temporal features represent the temporal distribution of system calls within the process under test. Network communication statistics represent the randomness of the communication behavior of the process under test. Contextual features represent the parent-child process call relationships corresponding to the process under test.

[0084] For example, computer devices can analyze and process the call sequence of system calls in behavioral data to determine the temporal characteristics of the process to be detected. Optionally, the temporal characteristics may include the distribution pattern of the intervals between system calls.

[0085] For example, computer devices can calculate the entropy value of the network connection requests of the process under test based on the network traffic metadata of the process under test, so as to quantify the randomness of the communication behavior of the process under test and obtain the network communication statistical characteristics of the process under test.

[0086] For example, computer devices can construct a parent-child process call relationship graph of the process under test based on the behavioral data of the process under test, and obtain the contextual features of the process under test in order to reveal the derivation logic of the process under test.

[0087] For example, computer devices can parse the string patterns of file access paths, identify sensitive directory operations, and obtain the semantic features of file access paths.

[0088] S302. The computer equipment performs density clustering analysis on the timing features to determine the deviation value of the system call sequence behavior of the process to be detected.

[0089] Among them, the system call sequence behavior deviation value can be used to indicate whether the system call behavior of the process under test deviates from the normal process system call behavior indicated by the normal behavior baseline.

[0090] For example, computer devices can use the DBSCAN clustering algorithm to perform density clustering analysis on the temporal characteristics of the process to be detected, and obtain the deviation value of the system call sequence behavior of the process to be detected.

[0091] Specifically, the computer device can generate a system call timing sequence based on the system call timing data of the process under test. The system call timing data of the process under test may include call types such as read, write, and connect, call timestamps, and call order. The timing sequence of system calls can be represented as S = [s1, s2, ..., s...]. n Where si is the feature vector of the i-th system call, including the call type encoding and time interval of the i-th system call.

[0092] Furthermore, computer equipment can use the DBSCAN clustering algorithm to perform cluster analysis on the time sequence of system calls of the process to be detected. Specifically, MinPts can be set as the minimum number of points, and ε as the radius of the normal behavior neighborhood. If s i If the number of feature vectors contained in the ε-neighborhood is greater than or equal to MinPts, then the computer device can determine s. i The core points are the feature vectors that are reachable by the density of the core points. Clusters are formed based on these feature vectors, and feature vectors not included in any cluster are considered noise points. The computer can then output a cluster anomaly score. The cluster anomaly score ranges from [0, 1]. When the process under test is entirely within anomalous noise points, the cluster anomaly score is 1; when there are no anomalous noise points, the cluster anomaly score is 0. When the time sequence of system calls of the process under test contains anomalous noise, the cluster anomaly score is between 0 and 1.

[0093] In this way, computer devices can determine the deviation of the system call sequence behavior of the process under test based on the cluster anomaly score.

[0094] Optionally, the computer device may also employ a Hidden Markov Model (HMM) to convert the time sequence of system calls into a hidden state sequence, thereby avoiding the misclustering problem of the DBSCAN clustering algorithm. For example, the computer device may calculate the difference between the time sequence of system calls of the process under test and the time sequence of system calls of normal processes based on the following first formula.

[0095]

[0096] Where HMM(S1, S2) represents the difference between the system call timing sequence of the process under test and the system call timing sequence of a normal process. S1 is the system call timing sequence of the process under test. S2 is the system call timing sequence of a normal process. γ ij Let s be the state transition probability between the feature vector of the i-th system call in S1 and the feature vector of the j-th system call in S2. 1i Let s be the feature vector of the i-th system call in S1. 2j Let d(s) be the feature vector of the j-th system call in S2. 1i s 2j ) for s 1i and s 2j The Euclidean distance between them.

[0097] S303. The computer device performs Gaussian mixture processing on the file access path and network communication statistical characteristics to determine the outliers in the resource usage probability distribution of the process to be detected.

[0098] Among them, outliers in the resource usage probability distribution can be used to indicate whether the resource interaction behavior of the process under test deviates from the resource interaction behavior of the normal process indicated by the baseline behavior.

[0099] For example, computer devices can use Gaussian mixture processing to model and analyze the file access paths and network communication statistical characteristics of the process to be detected, and obtain outliers in the probability distribution of resource usage of the process to be detected.

[0100] Specifically, the computer device can extract the file access frequency, path depth, and access time interval of the process under test based on its file access path, and generate vector X1. Furthermore, based on the network communication statistical characteristics of the process under test, the computer device can extract the network traffic volume, connection frequency, port distribution, and protocol type of the process under test, and generate vector X2. Then, based on vectors X1 and X2, the computer device can generate feature X of the process under test, and further determine the outlier value B = 1 - P(X) of the resource usage probability distribution of the process under test. The larger B is, the more abnormal the resource usage probability distribution of the process under test is.

[0101] in, Let X be the probability that feature X belongs to a normal distribution, which is a mixture of K Gaussian distributions. k Let N(X; μ) be the weight of the k-th Gaussian component. k ∑k) is a Gaussian distribution. μ k Let be the mean vector. Let ∑k be the covariance matrix.

[0102] S304. The computer equipment uses an LSTM network to process timing features, network communication statistics, context features, and file access paths to determine the behavioral deviation index of the process to be detected.

[0103] Among them, the behavior deviation index can be used to indicate whether the time-dependent behavior and external interaction behavior of the process under test deviate from the time-dependent behavior and external interaction behavior of the normal process indicated by the normal behavior baseline.

[0104] For example, computer devices can use LSTM networks to learn and process the temporal characteristics, network communication statistical characteristics, contextual characteristics, and semantic characteristics of the process to be detected, and learn the temporal dependencies between these four types of features in order to further determine the behavioral deviation index of the process to be detected.

[0105] Specifically, combining the descriptions in S302 and S303 above, the computer device can use the system call timing sequence S of the process to be detected, the file system access feature vector X1, the network communication statistical feature vector X2, and the parent-child process creation interval sequence vector F. p This is integrated into a unified time-series input sequence M = [m1, m2, ..., m...]. t ]. Where, m t Let be the multidimensional feature vector at time t.

[0106] Furthermore, the computer device can input a multi-dimensional feature vector M into an LSTM network, which then outputs the predicted features at time t+1 through fully connected layers. An example of an LSTM network is shown below:

[0107]

[0108] in, The predicted feature for time t+1. m t This represents the actual characteristic at time t. h This is the weight matrix. (b) h This is the bias vector.

[0109] Furthermore, the computer equipment can use the normalization formula to analyze the actual characteristic m at time t+1. t+1 With predictive features The Euclidean distance is normalized to determine the behavioral deviation index of the process to be detected. The normalization formula is:

[0110]

[0111] Where C ∈ [0, 1], the larger the value, the greater the degree of behavioral deviation. M p The predicted feature sequence includes predicted features corresponding to the actual features at each time step in M. 1-＞t (‖MM p ‖) represents the maximum difference between the actual feature and the predicted feature at the same time from time 1 to time t.

[0112] S305. The computer device determines the degree of behavioral deviation of the process to be detected based on the deviation value of the system call sequence behavior, the abnormal value of the resource usage probability distribution, and the behavioral deviation index.

[0113] For example, computer devices can perform a weighted summation of system call sequence behavior deviation values, resource usage probability distribution anomalies, and behavior deviation indices to determine the degree of behavior deviation of the process under test.

[0114] In one embodiment, such as Figure 4 The diagram shown is a flowchart illustrating another process anomaly detection method provided in this application embodiment. When a computer device determines the degree of behavioral deviation of a process to be detected based on system call sequence behavior deviation values, resource usage probability distribution anomaly values, and behavior deviation index, this application embodiment provides an optional implementation, including: S401-S402.

[0115] S401. The computer equipment uses the isolated forest algorithm to process behavioral characteristics, system call sequence behavior deviation values, resource usage probability distribution anomalies, and behavior deviation index to obtain the abnormal system call frequency.

[0116] The Isolation Forest algorithm can be pre-trained based on multiple combinations of sample features, including multiple isolated trees. A combination of sample features includes the behavioral characteristics of a normally running process, deviations from the system call sequence, outliers in the resource usage probability distribution, and a behavioral deviation index.

[0117] For example, the computer device can integrate the behavioral feature system of the process to be detected, the call sequence behavior deviation value, the resource usage probability distribution outlier value, and the behavior deviation index obtained in S301-S304 above to form an input vector Z. Then, the computer device can input the input vector Z into the isolated forest algorithm for processing to determine the isolated tree in which the input vector Z resides, and further calculate the path length of the input vector Z in the isolated tree. The longer the path length, the lower the probability of an anomaly. The shorter the path length, the higher the probability of an anomaly.

[0118] Furthermore, the computer device can determine the frequency of abnormal system calls of the process under test based on the following second formula. The second formula is:

[0119]

[0120] Where D(z, n) is the frequency of abnormal system calls of the process to be detected; a larger value indicates a higher probability of abnormality. The value of D(z, n) ranges from [0, 1], and a value greater than 0.5 indicates a possible abnormality. h(z) is the path length of the input vector Z in the isolated tree. g(z) is the normalization factor. n is the sample size.

[0121] S402. The computer device performs a weighted summation of the deviation values ​​of system call sequence behavior, the abnormal values ​​of resource usage probability distribution, the behavior deviation index, and the frequency of abnormal system calls to obtain the behavior deviation degree of the process to be detected.

[0122] For example, computer equipment can use the third formula to perform a weighted summation of the deviation values ​​of system call sequence behavior, outliers in resource usage probability distribution, behavior deviation index, and frequency of abnormal system calls to obtain the behavior deviation degree of the process under test, thereby achieving a comprehensive anomaly assessment of the process under test. The third formula is:

[0123] T=ω1·A+ω2·B+ω3·C+ω4·D.

[0124] Where T represents the behavioral deviation of the process under test. A represents the behavioral deviation value of the system call sequence. B represents the outlier value of the resource usage probability distribution. C represents the behavioral deviation index. D represents the frequency of abnormal system calls. ω1, ω ω ω1, ω2, and ω4 are the weights corresponding to each type of feature, which can be set according to the importance of the respective indicators. For example, ω1 = 0.25, ω2 = 0.2, ω3 = 0.4, and ω4 = 0.15.

[0125] In one embodiment, the computer device can process multiple normal samples based on the processing logic in S301-S305 and S401-S402 described above to establish a normal behavior baseline for the process. Normal samples are the behavioral data of a normally running process. Alternatively, the computer device can establish a sliding window based on the timestamps collected from the normal samples to continuously update the normal behavior baseline.

[0126] In one embodiment, such as Figure 5 The diagram shown is a flowchart illustrating another process anomaly detection method provided in this application embodiment. When a computer device verifies an identity based on identity information, current behavior data, and a first digital identity signature to determine the signature verification result, this application embodiment provides an optional implementation, including: S501-S504.

[0127] S501. The computer device generates a cryptographic hash value based on the identity information.

[0128] Computer devices can input the identity information of the process to be detected into a cryptographic hash function (such as SHA-256 or SM3) to generate a fixed-length hash value.

[0129] S502. The computer device generates a behavioral fingerprint of the process to be detected based on the current behavioral data.

[0130] Computer devices can process the current behavioral data of the process to be detected using feature extraction algorithms to generate a behavioral fingerprint of the process.

[0131] S503: The computer device generates a second digital identity signature based on cryptographic hash values ​​and behavioral fingerprints.

[0132] Computer devices can combine cryptographic hashes with behavioral fingerprints and perform digital signature operations using a private key to generate a second digital identity signature.

[0133] S504. The computer device determines the signature verification result based on the comparison result of the first digital identity signature and the second digital identity signature.

[0134] Based on this, computer equipment can perform static verification of the process to be detected, and comprehensively judge the authenticity of the identity and the rationality of the behavior of the process to be detected.

[0135] In one embodiment, combined with Figure 2 ,like Figure 6 The diagram shown is a flowchart illustrating another process anomaly detection method provided in this application embodiment. In S204 above, when the computer device determines the anomaly detection result of the process to be detected based on the signature verification result and the behavior deviation degree, this application embodiment provides an optional implementation, including: S2041-S2042.

[0136] S2041. When the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is greater than or equal to the similarity threshold and the behavior deviation is less than or equal to the deviation threshold, the computer device determines the anomaly detection result to indicate that there is no anomaly in the process to be detected.

[0137] S2042. When the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is less than the similarity threshold, or the behavior deviation is greater than the deviation threshold, the computer device determines the abnormal detection result to indicate that there is an abnormality in the process to be detected.

[0138] In one embodiment, the computer device can optimize a normal behavior baseline through an active learning mechanism. For example, the computer device can achieve dynamic evolution by combining incremental updates of the normal behavior baseline with continuous detection of abnormal processes to drive the optimization of isolation rules. When an abnormal revocation of the digital identity signature of a process to be detected is detected, the computer device can trigger an automated retraining process of historical behavior data through an adaptive learning mechanism to complete the iterative update of the detection rules.

[0139] In one embodiment, such as Figure 7 The diagram shown is a functional architecture diagram of a micro-segmentation proxy provided in an embodiment of this application. The functions of the micro-segmentation proxy can be divided into three parts: behavior acquisition, behavior baseline modeling, and trusted authentication.

[0140] Specifically, the micro-segmentation proxy can collect the system call sequence, network traffic metadata, file access paths, and runtime data of the process under test, and extract behavioral features from this collected behavioral data. Furthermore, the micro-segmentation proxy can collect the identity information of the process under test and extract its identity features.

[0141] Furthermore, the micro-segmentation agent can process multi-dimensional behavioral features based on DBSCAN clustering, Hidden Markov Models, Gaussian Mixture Models, LSTM networks, and Isolation Forest algorithms, enabling the modeling of the behavioral baseline of the process to be detected. Simultaneously, the micro-segmentation agent can establish a behavioral sliding window based on the timestamps of the collected behavioral data of the process to be detected, continuously updating the normal behavioral baseline.

[0142] Furthermore, the micro-segmentation agent can perform static and dynamic verification on the process to be detected, and combine the results of these two verifications to further achieve multi-level verification and output anomaly scores.

[0143] In one embodiment, such as Figure 8 The diagram shown illustrates a process anomaly detection flow provided in an embodiment of this application. A micro-segmentation agent can be pre-deployed in the computer device. In this way, the computer device can collect behavioral data through the micro-segmentation agent and perform feature engineering processing to obtain the temporal characteristics, network communication statistical characteristics, contextual characteristics, and semantic characteristics of the file access path of the process to be detected.

[0144] Furthermore, computer devices can perform behavioral baseline modeling through micro-segmentation agents. This involves processing behavioral features of corresponding dimensions using density clustering analysis, Gaussian mixture processing, LSTM networks, and isolated forest algorithms to obtain the system call sequence behavior deviation value, resource usage probability distribution outlier, behavior deviation index, and abnormal system call frequency of the process under test. The system call sequence behavior deviation value, resource usage probability distribution outlier, behavior deviation index, and abnormal system call frequency of the process under test are then weighted and summed to obtain the behavior deviation degree of the process under test, thus achieving dynamic verification.

[0145] Simultaneously, the computer device can generate a second data identity signature in real time through the micro-segmentation agent, and compare and verify the first and second data identity signatures of the process to be detected to determine the signature verification result and achieve static verification.

[0146] Furthermore, the computer equipment can determine the abnormal detection result based on the deviation of the behavior of the process under detection and the signature verification result, and further determine whether to isolate it.

[0147] If the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is greater than or equal to the similarity threshold, and the behavior deviation is less than or equal to the deviation threshold, then the computer device can determine that the process to be detected continues to run and will not be isolated.

[0148] If the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is less than the similarity threshold, and / or the behavioral deviation is greater than the deviation threshold, the computer device can determine that the process to be detected will be terminated and isolated.

[0149] In the embodiments described above, a micro-segmentation proxy can be used to collect real-time behavioral data such as system call sequences and CPU / memory usage of the process under test, and combine this data with machine learning to generate a baseline of normal process behavior. When a trusted authentication center issues an identity, it synchronously verifies whether the process behavior conforms to the historical baseline pattern, effectively identifying credential hijacking or abnormal process impersonation. Furthermore, by continuously monitoring the lifecycle events of processes such as startup, communication, and exit, and linking them with certificate issuance / revocation operations, it can prevent the remnants of zombie credentials. Further, by employing dynamic process injection technology to achieve low-overhead monitoring, fine-grained behavioral analysis is performed on high-frequency inter-process interactions, enhancing lateral traffic security while reducing resource consumption. Moreover, anomaly detection can be performed through the normal behavior baseline, solving the fragmentation problem of identity management in non-standard environments.

[0150] Based on the above embodiments, this application can solve the problem that traditional static rule configuration cannot adapt to changes in abnormal process behavior by modeling process-level behavioral baselines, using multi-dimensional feature extraction methods, and learning feedback mechanisms. Furthermore, it can achieve multi-level authentication processing based on process behavior baselines and digital identity signatures, thereby solving the problem that relying solely on digital identity signatures is susceptible to certificate forgery or malicious hijacking, and avoiding false alarms caused by occasional process behavior fluctuations. Simultaneously, by embedding lightweight probes during process runtime, comparing the deviation of real-time process behavior from the normal behavior baseline, multi-level authentication processing is completed and isolation processing is triggered, achieving lightweight anomaly detection and avoiding the performance overhead of full log analysis. Moreover, by associating the parent-child process relationships of abnormal processes with corresponding behavioral feature data, an attack chain graph is formed, achieving cross-process context awareness, preventing risk propagation, and also avoiding the risk of over-isolation.

[0151] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0152] This application embodiment can divide a computer device into functional modules based on the above method examples. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated modules can be implemented in hardware or as software functional modules. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0153] As an example, such as Figure 9 The diagram shown is a structural schematic of a process anomaly detection device provided in an embodiment of this application. This process anomaly detection device can be used to perform tasks such as... Figure 2-6 The process anomaly detection method shown is described. The process anomaly detection device includes an acquisition module 601 and a processing module 602.

[0154] The acquisition module 601 is used to acquire the identity information, current behavior data, and first digital identity signature of the process to be detected. The first digital identity signature is generated based on the identity information and historical behavior data. The processing module 602 is used to verify the identity information, current behavior data, and first digital identity signature to determine the signature verification result. The processing module 602 is also used to determine the behavior deviation degree of the process to be detected based on the current behavior data. The behavior deviation degree indicates the degree to which the behavior of the process to be detected deviates from the normal behavior baseline. The processing module 602 is also used to determine the anomaly detection result of the process to be detected based on the signature verification result and the behavior deviation degree. The anomaly detection result indicates whether there is an anomaly in the process to be detected.

[0155] Optionally, the current behavioral data includes: the call sequence of system calls corresponding to the process under test, network traffic metadata, and runtime data. Network traffic metadata includes the file access path, network connection mode, network identification information, and protocol type of the process under test. Runtime data includes the CPU usage and memory usage information of the process under test.

[0156] Optionally, the processing module 602 is specifically used for: performing feature engineering processing on the behavioral data to obtain the behavioral features of the process to be detected. The behavioral features of the process to be detected include temporal features, network communication statistical features, context features, and semantic features of file access paths. Temporal features are used to represent the temporal distribution of system calls within the process to be detected. Network communication statistical features are used to represent the randomness of the communication behavior of the process to be detected. Context features are used to represent the parent-child process call relationship corresponding to the process to be detected. Density clustering analysis is performed on the temporal features to determine the deviation value of the system call sequence behavior of the process to be detected. Gaussian mixture processing is performed on the file access path and network communication statistical features to determine the outliers of the resource usage probability distribution of the process to be detected. The temporal features, network communication statistical features, context features, and file access paths are processed based on an LSTM network to determine the behavioral deviation index of the process to be detected. The behavioral deviation degree of the process to be detected is determined based on the system call sequence behavioral deviation value, the outlier of the resource usage probability distribution, and the behavioral deviation index.

[0157] Optionally, the processing module 602 is specifically used to: process behavioral features, system call sequence behavioral deviation values, resource usage probability distribution outliers, and behavioral deviation index based on the isolated forest algorithm to obtain the abnormal system call frequency. The system call sequence behavioral deviation values, resource usage probability distribution outliers, behavioral deviation index, and abnormal system call frequency are weighted and summed to obtain the behavioral deviation degree of the process to be detected.

[0158] Optionally, the processing module 602 is specifically used for: generating a cryptographic hash value based on the identity information; generating a behavioral fingerprint of the process to be detected based on the current behavioral data; generating a second digital identity signature based on the cryptographic hash value and the behavioral fingerprint; and determining the signature verification result based on the comparison result of the first digital identity signature and the second digital identity signature.

[0159] Optionally, the processing module 602 is specifically configured to: determine an anomaly detection result to indicate that the process to be detected does not have an anomaly when the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is greater than or equal to a similarity threshold and the behavior deviation is less than or equal to a deviation threshold. Alternatively, determine an anomaly detection result to indicate that the process to be detected has an anomaly when the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is less than a similarity threshold and / or the behavior deviation is greater than a deviation threshold.

[0160] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this application can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer-readable storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0161] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0162] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and other division methods may exist in actual implementation. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms. Units described as separate components may or may not be physically separate; components shown as units may be one physical unit or multiple physical units, i.e., they may be located in one place or distributed in multiple different places. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0163] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting process anomalies, characterized in that, include: The identity information, current behavior data, and first digital identity signature of the process to be detected are obtained; the first digital identity signature is generated based on the identity information and historical behavior data. Verification is performed based on the identity information, the current behavior data, and the first digital identity signature to determine the signature verification result; Based on the current behavior data, the behavioral deviation of the process to be detected is determined; The behavioral deviation is used to indicate the degree to which the behavior of the process under test deviates from the normal behavioral baseline; Based on the signature verification result and the behavior deviation, the anomaly detection result of the process to be detected is determined; the anomaly detection result is used to indicate whether there is an anomaly in the process to be detected.

2. The method according to claim 1, characterized in that, The current behavior data includes: the call sequence of system calls corresponding to the process under test, network traffic metadata, and runtime data; the network traffic metadata includes the file access path, network connection mode, network identification information, and protocol type of the process under test; the runtime data includes the CPU usage information and memory usage information of the process under test.

3. The method according to claim 2, characterized in that, The step of determining the behavioral deviation of the process to be detected based on the current behavioral data includes: The behavioral data is subjected to feature engineering to obtain the behavioral features of the process to be detected. The behavioral features of the process to be detected include temporal features, network communication statistical features, context features, and semantic features of the file access path. The temporal features are used to represent the temporal distribution of system calls within the process to be detected. The network communication statistical features are used to represent the randomness of the communication behavior of the process to be detected. The context features are used to represent the parent-child process call relationship corresponding to the process to be detected. Density clustering analysis is performed on the time-series features to determine the deviation value of the system call sequence behavior of the process to be detected; Gaussian mixture processing is applied to the file access path and the network communication statistical characteristics to determine outliers in the resource usage probability distribution of the process to be detected. The timing features, network communication statistics, context features, and file access paths are processed using an LSTM network to determine the behavior deviation index of the process to be detected. The behavioral deviation degree of the process to be detected is determined based on the system call sequence behavior deviation value, the resource usage probability distribution anomaly value, and the behavior deviation index.

4. The method according to claim 3, characterized in that, The step of determining the behavioral deviation degree of the process to be detected based on the system call sequence behavior deviation value, the resource usage probability distribution anomaly value, and the behavior deviation index includes: The isolated forest algorithm is used to process the behavioral characteristics, the behavioral deviation values ​​of the system call sequence, the outliers of the resource usage probability distribution, and the behavioral deviation index to obtain the abnormal system call frequency. The behavioral deviation of the process to be detected is obtained by weighted summing of the deviation values ​​of the system call sequence behavior, the abnormal values ​​of the resource usage probability distribution, the behavior deviation index, and the abnormal system call frequency.

5. The method according to claim 2, characterized in that, The step of verifying the identity information, the current behavior data, and the first digital identity signature to determine the signature verification result includes: Generate a cryptographic hash value based on the identity information; Based on the current behavior data, generate the behavior fingerprint of the process to be detected; Based on the cryptographic hash value and the behavioral fingerprint, a second digital identity signature is generated; The signature verification result is determined based on the comparison between the first digital identity signature and the second digital identity signature.

6. The method according to claim 5, characterized in that, The step of determining the anomaly detection result of the process to be detected based on the signature verification result and the behavior deviation includes: If the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is greater than or equal to a similarity threshold, and the behavior deviation is less than or equal to a deviation threshold, then the anomaly detection result is determined to indicate that the process to be detected does not have any anomalies; or... If the signature verification result indicates that the similarity between the first digital identity signature and the second digital identity signature is less than the similarity threshold, and / or the behavior deviation is greater than the deviation threshold, the anomaly detection result is determined to indicate that there is an anomaly in the process to be detected.

7. A process anomaly detection device, characterized in that, include: Acquisition module and processing module; The acquisition module is used to acquire the identity information, current behavior data, and first digital identity signature of the process to be detected; the first digital identity signature is generated based on the identity information and historical behavior data. The processing module is used to perform verification based on the identity information, the current behavior data, and the first digital identity signature, and determine the signature verification result; The processing module is further configured to determine the behavioral deviation degree of the process to be detected based on the current behavioral data; the behavioral deviation degree is used to represent the degree to which the behavior of the process to be detected deviates from the normal behavioral baseline; The processing module is further configured to determine the anomaly detection result of the process to be detected based on the signature verification result and the behavior deviation; the anomaly detection result is used to indicate whether there is an anomaly in the process to be detected.

8. The apparatus according to claim 7, characterized in that, The current behavior data includes: the call sequence of system calls corresponding to the process under test, network traffic metadata, and runtime data; the network traffic metadata includes the file access path, network connection mode, network identification information, and protocol type of the process under test; the runtime data includes the CPU usage information and memory usage information of the process under test.

9. A computer device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the process anomaly detection method as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed by a computer device, cause the computer device to perform the process anomaly detection method as described in any one of claims 1-6.

Images