Terminal security detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a terminal security detection method and device, electronic equipment and a storage medium. The method comprises the steps of determining first terminal data of a current stage and second terminal data of a previous stage, wherein the terminal data at least comprises system logs, network traffic, file operation and process behaviors; constructing a first cross-modal feature matrix according to the first terminal data; constructing a second cross-modal feature matrix according to the second terminal data; according to the first cross-modal feature matrix and the second cross-modal feature matrix, the Markov transition probability of the current stage is determined; and if the Markov transition probability is greater than a preset probability, determining that the terminal has a risk. By adopting the technical scheme of the invention, the risk of the terminal is determined, and rapid determination can be carried out when the abnormal jump of the terminal occurs, so that whether the risk of the terminal exists or not is rapidly determined, and the data loss is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of terminal security protection, and in particular to a terminal security detection method and device, electronic equipment and a storage medium. BACKGROUND

[0002] With the continuous development of computer technology, terminals are used in various work scenarios. Meanwhile, unknown attacks such as APT (Advanced Persistent Threat) and ransomware have emerged, and traditional signature-based detection methods (such as antivirus software) have failed to identify zero-day vulnerabilities and hidden attack chains.

[0003] However, many terminal devices lack security protection in current work scenarios, which makes it impossible to ensure the security of terminals during use. Therefore, how to ensure the security of terminals and quickly analyze whether a terminal has risks has become a problem in terminal use. SUMMARY

[0004] The present application provides a terminal security detection method, device, electronic equipment and storage medium to solve the problem that terminals cannot immediately discover problems when facing ransomware and the like.

[0005] According to an aspect of the present application, a terminal security detection method is provided, which comprises:

[0006] determining first terminal data of a current stage and second terminal data of a previous stage, the terminal data at least including system logs, network traffic, file operations and process behavior;

[0007] constructing a first quasi-modal feature matrix according to the first terminal data;

[0008] constructing a second quasi-modal feature matrix according to the second terminal data;

[0009] determining a Markov transition probability of the current stage according to the first quasi-modal feature matrix and the second quasi-modal feature matrix;

[0010] if the Markov transition probability is greater than a preset probability, determining that the terminal has risks.

[0011] According to another aspect of the present application, a terminal security detection device is provided, which comprises:

[0012] a terminal data determination module configured to determine first terminal data of a current stage and second terminal data of a previous stage, the terminal data at least including system logs, network traffic, file operations and process behavior;

[0013] a first matrix generation module configured to construct a first quasi-modal feature matrix according to the first terminal data;

[0014] a second matrix generating module configured to construct a second multi-modal feature matrix according to the second terminal data;

[0015] a probability calculating module configured to determine a Markov transition probability of the current stage according to the first multi-modal feature matrix and the second multi-modal feature matrix;

[0016] a risk judging module configured to determine that the terminal has a risk if the Markov transition probability is greater than a preset probability.

[0017] According to another aspect of the present application, an electronic device is provided, which comprises:

[0018] at least one processor; and

[0019] a memory in communication with the at least one processor; wherein

[0020] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the terminal security detection method of any of the embodiments of the present application.

[0021] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to execute the terminal security detection method of any of the embodiments of the present application when executed by the processor.

[0022] The technical solution of the embodiments of the present application determines the first terminal data of the current stage and the second terminal data of the previous stage, wherein the terminal data at least includes system logs, network traffic, file operations and process behaviors; constructs a first multi-modal feature matrix according to the first terminal data; constructs a second multi-modal feature matrix according to the second terminal data; determines a Markov transition probability of the current stage according to the first multi-modal feature matrix and the second multi-modal feature matrix; and determines that the terminal has a risk if the Markov transition probability is greater than a preset probability, which can quickly determine when the terminal has an abnormal jump, thereby quickly determining whether the terminal has a risk and reducing data loss.

[0023] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent through the following description. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiments description. Obviously, the drawings in the following description only show some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative effort based on these drawings.

[0025] Figure 1 is a flow chart of a terminal security detection method according to an embodiment of the present application;

[0026] Figure 2 is a flow chart of another terminal security detection method according to another embodiment of the present application;

[0027] Figure 3 is a structural schematic diagram of a terminal security detection device according to an embodiment of the present application;

[0028] Figure 4 is a structural schematic diagram of an electronic device implementing the terminal security detection method according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the person skilled in the art better understand the present application, the following will combine the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort should be within the scope of the present application.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily mean a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment one

[0032] Figure 1A flowchart of a terminal security detection method is provided for Embodiment One of the present application. The present embodiment can be applied to the case of detecting the risk of a terminal. The method can be executed by a terminal security detection device, which can be realized in the form of hardware and / or software, and can be configured in an electronic device with data processing capability. As shown in FIG. 1, the method comprises the following steps. Figure 1

[0033] S110, determining first terminal data of a current stage and second terminal data of a previous stage. The terminal data at least includes system logs, network traffic, file operations, and process behaviors.

[0034] The system logs can be text files or data streams that record the relevant operations, events, errors, and status information of the terminal (command line interface, console, or remote terminal) during the running of the operating system or application program. The system logs contain at least event information such as user login, permission change, service start / stop, etc. The network traffic at least includes traffic direction (inbound / outbound), protocol distribution, load size, and standard deviation. The file operations include file entropy values and path depths of various files. The process behaviors include process tree depths, child process derivation rates, and system call sequence patterns of various processes.

[0035] The time intervals of the various stages can be the same or different.

[0036] Optionally, the determination of the time interval of the current stage can be determined by the following formula:

[0037] ;

[0038] wherein, represents the time interval of the current stage; represents the default window reference length; represents the number of packets (traffic density) in the current time unit; represents the maximum traffic density observed in history.

[0039] S120, constructing a first multi-modal feature matrix according to the first terminal data.

[0040] The multi-modal feature matrix can be a structured matrix formed by organizing the data of different modalities (such as text, image, audio, and video) after feature extraction and alignment.

[0041] Feature extraction is performed on different data in the first terminal data, and sequential splicing is performed according to a preset splicing rule, thereby obtaining the first multi-modal feature matrix.

[0042] Optionally, constructing the first multi-modal feature matrix according to the first terminal data comprises: ​

[0043] constructing a first cross-modal feature matrix based on the first expression and the first terminal data;

[0044] The first expression is:

[0045]

[0046] Wi represents a linear transformation matrix of the i-th modal; Xi represents a feature encoding of the i-th modal; Wi represents a weight coefficient of the i-th modal. In constructing the first cross-modal feature matrix, it is ensured that the constructed cross-modal feature matrix can more accurately reflect the changes of the terminal and the previous stage.

[0047] At this time, the linear transformation matrix of each modal, the feature encoding of the modal, and the weight coefficient of the modal can be determined.

[0048] The linear transformation matrix Wi of the i-th modal is used to realize the isomorphic alignment of the modal feature and other modal features. The specific generation method is not limited in the present application.

[0049] Optionally, the determination of the weight coefficient of the i-th modal includes:

[0050] determining the weight coefficient of the i-th modal based on the second expression, the first terminal data, and the second terminal data;

[0051] The second expression is the threat score of the i-th modal divided by the sum of the threat scores of the 1st to j-th modals.

[0052] Considering that the threat degrees of different modals are different, the weight coefficients of the modals are adjusted according to different threat degrees, so that the cross-modal feature matrix can be more accurate.

[0053] Therefore, the threat score of the i-th modal can be determined by dividing the threat score of the i-th modal by the sum of the threat scores of the 1st to j-th modals.

[0054] For the calculation of the threat score, an existing threat score function or a preset scoring rule can be used for scoring, and the present application does not limit this.

[0055] S130, constructing a second cross-modal feature matrix according to the second terminal data.

[0056] S140, determining a Markov transition probability of the current stage according to the first cross-modal feature matrix and the second cross-modal feature matrix.

[0057]

[0058] ​​The Markov transition probability is used to describe the probability value of the system transferring from one state to another state in the Markov process.

[0059] Due to the characteristics of the Markov transition probability, it can be judged by the Markov transition probability whether the terminal exists risk, that is, whether abnormal operation occurs.

[0060] The calculation of the Markov transition probability of the current stage is not limited.

[0061] In S150, if the Markov transition probability is greater than a preset probability, it is determined that the terminal exists risk.

[0062] After obtaining the Markov transition probability of the current stage, it can be judged whether the terminal exists risk according to the following formula:

[0063] ;

[0064] The abnormal score in the current stage is represented; The Markov transition probability in the current stage is represented; The Markov transition probability of normal behavior is represented; when the abnormal score is higher than the set threshold, it is determined that the stage exists abnormal jump, and at this time it is determined that the terminal exists risk.

[0065] By adopting the technical scheme of the present application, the first terminal data of the current stage and the second terminal data of the last stage are determined, and the terminal data at least includes system log, network traffic, file operation and process behavior; the first quasi-modal feature matrix is constructed according to the first terminal data; the second quasi-modal feature matrix is constructed according to the second terminal data; the Markov transition probability of the current stage is determined according to the first quasi-modal feature matrix and the second quasi-modal feature matrix; if the Markov transition probability is greater than a preset probability, it is determined that the terminal exists risk, which can realize rapid determination when the terminal appears abnormal jump, so as to realize rapid determination of whether the terminal exists risk, and reduce data loss.

[0066] Embodiment two

[0067] Figure 2 Another flowchart of a terminal security detection method is provided for the embodiments of the present application, and the process after it is determined that the terminal exists risk in the foregoing embodiment is further optimized on the basis of the foregoing embodiment. The present embodiment can be combined with each optional scheme in one or more of the foregoing embodiments. As shown in the following table, the terminal security detection method of the present embodiment can include the following steps: Figure 2

[0068] ​S210, determine first terminal data of a current stage and second terminal data of a previous stage, the terminal data at least including system logs, network traffic, file operations and process behaviors.

[0069] S220, construct a first cross-modal feature matrix according to the first terminal data.

[0070] S230, construct a second cross-modal feature matrix according to the second terminal data.

[0071] S240, determine a Markov transition probability of the current stage according to the first cross-modal feature matrix and the second cross-modal feature matrix.

[0072] S250, if the Markov transition probability is greater than a preset probability, determine that the terminal is at risk.

[0073] S260, determine byte size and time interval of a heartbeat packet corresponding to each process in the current stage.

[0074] S270, if the byte size is less than a preset size and the time interval is less than a preset time interval, retain the heartbeat packet.

[0075] The heartbeat packet is a lightweight data packet periodically sent between software systems to confirm the "online status" of the other party and the availability of the communication link.

[0076] Since the heartbeat packet has certain characteristics, such as small data volume and fixed sending period, a relatively special heartbeat packet may have certain problems, which can be screened.

[0077] Optionally, a heartbeat packet whitelist is set.

[0078] If the unique identifier of the heartbeat packet exists in the heartbeat packet whitelist, the heartbeat packet is not screened.

[0079] When the heartbeat packet is screened, the byte size and time interval of the heartbeat packet corresponding to each process are determined.

[0080] If the byte size of the heartbeat packet is less than a preset size and the time interval is less than a preset time interval, the heartbeat packet is retained.

[0081] Optionally, the determination of the preset time interval includes:

[0082] Based on a Kalman filter, the next arrival time of the heartbeat packet is predicted to obtain the next arrival time of the heartbeat packet.

[0083] According to the last arrival time of the heartbeat packet and the next arrival time of the heartbeat packet, the preset time interval is determined.

[0084] The heartbeat packet time interval rule is estimated from the historical arrival time data containing noise by Kalman filtering, and the arrival time of the next heartbeat packet is calculated. The preset time interval is determined according to the last arrival time of the heartbeat packet and the next arrival time of the heartbeat packet.

[0085] Optionally, after determining that the terminal is at risk, if the Yama Markov transition probability is greater than the preset probability, the method further comprises:

[0086] A first undirected graph is determined, the undirected graph taking processes, files and usernames as nodes and taking operation relationships as edges to construct;

[0087] Based on the pre-trained graph convolution network, the feature of the first undirected graph is extracted to obtain the node feature of each node;

[0088] Based on the node feature, the abnormal value of each node is determined;

[0089] For each node, if the abnormal value of the node is greater than the preset abnormal value, the node is determined as an abnormal node.

[0090] The node represents a key entity of the terminal system, including a process, a file and a user; each node is represented by a unique identifier and contains relevant feature information;

[0091] The edge represents the operation relationship between entities, such as process startup, file reading and writing, and network connection; the weight of the edge reflects the frequency or importance of the operation;

[0092] The behavior graph represents the undirected graph , wherein V represents a node set; E represents an edge set; and W represents an edge weight matrix;

[0093] The graph convolution network is used to extract and aggregate the features of the behavior graph; and the graph attention network is used to enhance the relevance between different nodes and adjust the edge weight through the attention mechanism.

[0094] The node feature is determined, and based on the node feature, the abnormal value of each node is determined; if the abnormal value of the node is greater than the preset abnormal value, the node is determined as an abnormal node.

[0095] Optionally, based on the node feature, the abnormal value of each node is determined, comprising:

[0096] Based on the third expression and the node feature, the abnormal value of the node is determined;

[0097] The third expression is:

[0098] ;

[0099] , wherein represents the distance measurement between the feature vectors of node i and node j. represents a set of nodes; represents an outlier of node i.

[0100] The technical scheme of the present application determines the byte size and time interval of the heartbeat packet corresponding to each process in the current stage; if the byte size is smaller than the preset size and the time interval is smaller than the preset time interval, the heartbeat packet is retained, thereby realizing the screening of the heartbeat packet, eliminating abnormal heartbeat packets, disconnecting as many viruses such as ransomware from the background server as possible, and improving the use safety of the terminal.

[0101] Embodiment three

[0102] Figure 3 A structural block diagram of a terminal security detection device is provided for the embodiment of the present application, and the embodiment can be applicable to the case of risk detection of a terminal. The terminal security detection device can be realized in the form of hardware and / or software, and the terminal security detection device can be configured in an electronic device with data processing capability. As shown in the figure, the terminal security detection device of the embodiment can include a terminal data determination module 310, a first matrix generation module 320, a second matrix generation module 330, a probability calculation module 340, and a risk judgment module 350. Among them: Figure 3

[0103] The terminal data determination module 310 is configured to determine the first terminal data in the current stage and the second terminal data in the previous stage, and the terminal data at least includes system logs, network traffic, file operations, and process behaviors.

[0104] The first matrix generation module 320 is configured to construct a first quasi-modal feature matrix according to the first terminal data.

[0105] The second matrix generation module 330 is configured to construct a second quasi-modal feature matrix according to the second terminal data.

[0106] The probability calculation module 340 is configured to determine the Markov transition probability in the current stage according to the first quasi-modal feature matrix and the second quasi-modal feature matrix.

[0107] The risk judgment module 350 is configured to determine that the terminal has a risk if the Markov transition probability is greater than a preset probability.

[0108] On the basis of the above-mentioned embodiment, the first matrix generation module 320 can include:

[0109] constructing the first quasi-modal feature matrix based on the first expression and the first terminal data;

[0110] The first expression is:

[0111] ​ ;

[0112] wherein, represents a linear transformation matrix of the i-th modality; represents a feature encoding of the i-th modality; represents a weight coefficient of the i-th modality.

[0113] On the basis of the above-mentioned embodiments, optionally, the determination of the weight coefficient of the i-th modality comprises:

[0114] determining the weight coefficient of the i-th modality based on a second expression, first terminal data and second terminal data;

[0115] wherein, the second expression is a threat score of the i-th modality divided by a sum of threat scores of the 1st to j-th modalities.

[0116] On the basis of the above-mentioned embodiments, optionally, after the risk judgment module 350, further comprising:

[0117] determining a byte size and a time interval of a heartbeat packet corresponding to each process in a current stage;

[0118] if the byte size is less than a preset size and the time interval is greater than a preset time interval, retaining the heartbeat packet.

[0119] On the basis of the above-mentioned embodiments, optionally, the determination of the preset time interval comprises:

[0120] based on a Kalman filter, predicting a next arrival time of the heartbeat packet to obtain the next arrival time of the heartbeat packet;

[0121] determining the preset time interval according to a last arrival time of the heartbeat packet and the next arrival time of the heartbeat packet.

[0122] On the basis of the above-mentioned embodiments, optionally, after the risk judgment module 350, further comprising:

[0123] determining a first undirected graph, the undirected graph being constructed with processes, files and usernames as nodes and operation relationships as edges;

[0124] based on a pre-trained graph convolution network, performing feature extraction on the first undirected graph to obtain node features of each node;

[0125] based on the node features, determining an abnormal value of each node;

[0126] for each node, if the abnormal value of the node is greater than a preset abnormal value, determining the node as an abnormal node.

[0127] On the basis of the above-mentioned embodiments, optionally, based on the node features, the abnormal value of each node is determined, including:

[0128] Based on the third expression and the node features, the abnormal value of the node is determined.

[0129] The third expression is:

[0130]

[0131] The third expression is: The distance measure between the feature vectors of node i and node j is represented by d (i, j). The node set is represented by S. The abnormal value of node i is represented by a i.

[0132] The terminal security detection device provided in the embodiments of the present application can execute the terminal security detection method provided in any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0133] Embodiment four

[0134] Figure 4 A structural schematic diagram of an electronic device 10 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present application described and / or claimed in this document.

[0135] As shown in Figure 4 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11, wherein the memory stores a computer program that can be executed by the at least one processor. The processor 11 can execute various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0136] ​A plurality of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0137] The processor 11 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the terminal security detection method.

[0138] In some embodiments, the terminal security detection method can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded onto the RAM 13 and executed by the processor 11, one or more steps of the terminal security detection method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the terminal security detection method by any other appropriate means, such as by means of firmware.

[0139] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0140] Computer programs for implementing the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer program, when executed, enables the functions / acts specified in the flowcharts and / or block diagrams to be implemented. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a standalone software package and partially on a remote machine or entirely on a remote machine or server.

[0141] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0142] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0143] The systems and techniques described herein can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described herein, or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0144] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0145] It should be understood that the various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the scope of the present disclosure. For example, the steps recited in the present disclosure can be executed in parallel, executed in series, or executed in different orders, as long as the desired results of the technical solutions of the present disclosure can be achieved, and the present disclosure is not limited herein.

[0146] The above detailed description does not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A terminal security detection method, characterized in that, include: Determine the first terminal data of the current stage and the second terminal data of the previous stage. The terminal data includes at least system logs, network traffic, file operations, and process behavior. Based on the data from the first terminal, a first cross-modal feature matrix is ​​constructed; Based on the data from the second terminal, a second cross-modal feature matrix is ​​constructed; Based on the first cross-modal feature matrix and the second cross-modal feature matrix, determine the Markov transition probability of the current stage; If the Markov transition probability is greater than the preset probability, then the terminal is determined to be at risk.

2. The method according to claim 1, characterized in that, Based on the data from the first terminal, a first cross-modal feature matrix is ​​constructed, including: Based on the first expression and the first terminal data, a first cross-modal feature matrix is ​​constructed; The first expression is: ； in, Let represent the linear transformation matrix of the i-th mode; The feature encoding representing the i-th mode; This represents the weight coefficient of the i-th mode.

3. The method according to claim 2, characterized in that, The determination of the weight coefficients for the i-th mode includes: Based on the second expression, the first terminal data, and the second terminal data, the weight coefficient of the i-th type of mode is determined; Wherein, the second expression is the threat score of the i-th modality divided by the sum of the threat scores of the 1st to j-th modalities.

4. The method according to claim 1, characterized in that, After determining that the terminal is at risk if the Markov transition probability is greater than a preset probability, the method further includes: Determine the size and time interval of the heartbeat packets for each process in the current stage; If the size of the heartbeat packet is less than the preset size and the time interval is greater than the preset time interval, the heartbeat packet will be retained.

5. The method according to claim 4, characterized in that, The determination of the preset time interval includes: Based on the Kalman filter, the next arrival time of the heartbeat packet is predicted, and the next arrival time of the heartbeat packet is obtained. The preset time interval is determined based on the previous arrival time of the heartbeat packet and the next arrival time of the heartbeat packet.

6. The method according to claim 4, characterized in that, After determining that the terminal is at risk if the Markov transition probability is greater than a preset probability, the method further includes: A first undirected graph is determined, wherein the undirected graph is constructed with processes, files, and usernames as nodes and operation relationships as edges; Based on a pre-trained graph convolutional network, feature extraction is performed on the first undirected graph to obtain the node features of each node. Based on node characteristics, outliers of each node are identified; For each node, if the abnormal value of the node is greater than the preset abnormal value, then the node is determined to be an abnormal node.

7. The method according to claim 6, characterized in that, Based on node characteristics, outliers for each node are identified, including: Based on the third expression and node characteristics, the outlier values ​​of the node are determined; The third expression is: ； in, This represents the distance metric between the feature vectors of node i and node j; Represents a set of nodes; This represents an outlier value for node i.

8. A terminal security detection device, characterized in that, include: The terminal data determination module is used to determine the first terminal data in the current stage and the second terminal data in the previous stage. The terminal data includes at least system logs, network traffic, file operations, and process behavior. The first matrix generation module is used to construct a first cross-modal feature matrix based on the first terminal data; The second matrix generation module is used to construct a second cross-modal feature matrix based on the second terminal data; The probability calculation module is used to determine the Markov transition probability of the current stage based on the first cross-modal feature matrix and the second cross-modal feature matrix. The risk assessment module is used to determine that there is a risk in the terminal if the Markov transition probability is greater than a preset probability.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the terminal security detection method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the terminal security detection method according to any one of claims 1-7.

Images