Network attack processing method, system and device, storage medium and program product

Abstract

The embodiment of the invention provides a network attack processing method, system and device, a storage medium and a program product. In the process of performing security protection on the target host, when a suspicious behavior on the target host is detected, behavior data corresponding to the suspicious behavior can be obtained, an interception rule corresponding to the suspicious behavior is obtained according to the behavior data, and the interception rule is determined by using an attack analysis model. The attack analysis model is obtained by training the behavior data sample of the process corresponding to the historical network attack behavior, so that the attack analysis model can better master the knowledge of the network attack field. When the behavior data of the process with the suspicious behavior is analyzed, the attack analysis model can identify and judge the behavior of the process more accurately, so that an interception rule with higher confrontation is generated. Therefore, the potential security threats corresponding to the suspicious behaviors can be quickly and accurately processed, the risk of missing potential attacks is reduced, and the defense capability is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, system, device, storage medium, and program product for handling network attacks. Background Technology

[0002] A cyberattack refers to any type of malicious act targeting computer information systems, infrastructure, computer networks, or personal computer devices. The purpose of such attacks is typically to damage, expose, modify, or disable software or services, or to steal or access computer data without authorization. With the rise of Artificial Intelligence Generated Content (AIGC) technology, especially the release of generative code products, the frequency and complexity of cyberattacks are constantly increasing, posing new challenges to cyberattack defense.

[0003] In traditional host-based intrusion prevention systems (HIPS), defense rules are typically generated through manual analysis, and network attacks that trigger these rules are defended against. However, this approach has relatively weak defensive capabilities. Therefore, a solution is needed. Summary of the Invention

[0004] This application provides a method, system, device, storage medium, and program product for handling network attacks, thereby enhancing the ability to resist network attacks.

[0005] This application provides a method for handling network attacks, including: when suspicious behavior is detected on a target host, acquiring behavioral data of the process corresponding to the suspicious behavior; obtaining an interception rule corresponding to the suspicious behavior based on the behavioral data; wherein the interception rule is determined based on a preset attack analysis model, the attack analysis model being a deep learning model trained based on behavioral data samples of processes corresponding to historical network attack behaviors; and intercepting the suspicious behavior according to the interception rule.

[0006] Optionally, obtaining the interception rule corresponding to the suspicious behavior based on the behavioral data includes: sending the behavioral data to a server so that the server inputs the behavioral data into the attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; receiving the interception rule corresponding to the suspicious behavior returned by the server, wherein the interception rule is generated by the server using the attack analysis model after determining that the suspicious behavior is a network attack behavior based on the behavior type prediction label.

[0007] Optionally, obtaining the interception rule corresponding to the suspicious behavior based on the behavioral data includes: sending the behavioral data to a server so that the server inputs the behavioral data into the attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; receiving the behavior type prediction label corresponding to the suspicious behavior returned by the server; if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, then determining the interception rule corresponding to the behavior type prediction label from at least one interception rule generated by the saved attack analysis model, and using it as the interception rule corresponding to the suspicious behavior.

[0008] Optionally, sending the behavioral data to the server includes: sending the behavioral data to the server via a long-lived connection with the server.

[0009] Optionally, obtaining the behavioral data of the process corresponding to the suspicious behavior includes: obtaining the danger level of the operation corresponding to the suspicious behavior; if the danger level of the operation corresponding to the suspicious behavior is greater than a preset level threshold, then obtaining the behavioral data of the process corresponding to the suspicious behavior.

[0010] This application embodiment also provides a method for handling network attacks, including: receiving behavioral data of a process corresponding to a suspicious behavior sent by a client, wherein the behavioral data is obtained by the client when it detects the suspicious behavior on a target host; inputting the behavioral data into a preset attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; wherein the attack analysis model is a deep learning model trained based on behavioral data samples of processes corresponding to historical network attack behaviors; if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, then determining an interception rule corresponding to the suspicious behavior; and sending the interception rule to the client, wherein the interception rule is used to intercept the suspicious behavior.

[0011] Optionally, determining the interception rule corresponding to the suspicious behavior includes: using the attack analysis model to generate an interception rule corresponding to the suspicious behavior based on the behavior data; or, determining an interception rule corresponding to the behavior type prediction label from at least one interception rule generated by the saved attack analysis model, and using it as the interception rule corresponding to the suspicious behavior.

[0012] Optionally, the method further includes: acquiring behavioral data samples of processes corresponding to historical network attack behaviors, wherein the behavioral data samples include: at least one set of behavioral data and their respective real labels for behavioral types; inputting the at least one set of behavioral data into a preset base model to obtain predicted labels for the behavioral types of the at least one set of behavioral data; the base model includes: a content-generating deep learning model; fine-tuning the base model based on the error between the real labels for the behavioral types of the at least one set of behavioral data and the predicted labels for the behavioral types, until the base model converges, and using the converged base model as the attack analysis model.

[0013] Optionally, the method further includes: obtaining the true label of the behavior type corresponding to the suspicious behavior; and, upon triggering a model update event, fine-tuning the attack analysis model with the goal of reducing the error between the true label of the behavior type corresponding to the suspicious behavior and the predicted label of the behavior type corresponding to the suspicious behavior.

[0014] This application embodiment also provides a network attack handling system, including: a client and a server; wherein, the client is configured to: when suspicious behavior is detected on a target host, acquire behavioral data of the process corresponding to the suspicious behavior; send the behavioral data to the server and receive the interception rules corresponding to the suspicious behavior returned by the server; and intercept the suspicious behavior according to the interception rules; the server is configured to: receive the behavioral data of the process corresponding to the suspicious behavior sent by the client, input the behavioral data into a preset attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, determine the interception rules corresponding to the suspicious behavior; and return the interception rules to the client; the attack analysis model is a deep learning model trained based on behavioral data samples of processes corresponding to historical network attack behaviors.

[0015] This application also provides an electronic device, including: a memory and a processor; the memory is used to store one or more computer instructions; the processor is used to execute the one or more computer instructions to perform the steps in the method provided in this application.

[0016] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the steps in the method provided in this application.

[0017] This application also provides a computer program product, including: a computer program / instructions, which, when executed by a processor, can implement the steps in the method provided in this application.

[0018] In the network attack handling method provided in this application embodiment, when suspicious behavior is detected on a target host, behavioral data corresponding to the suspicious behavior can be obtained, and interception rules corresponding to the suspicious behavior can be obtained based on the behavioral data. The interception rules are determined using an attack analysis model. Based on the interception rules, suspicious behavior can be intercepted. In this implementation, the attack analysis model is trained on behavioral data samples of processes corresponding to historical network attack behaviors. Therefore, the attack analysis model can better grasp knowledge in the field of network attacks and better understand and handle tasks in the field of network attacks. Based on this, when analyzing the behavioral data of processes exhibiting suspicious behavior, the attack analysis model can more accurately identify and judge the behavior of the processes, thereby generating more adversarial interception rules. Based on the more adversarial interception rules, the client can more accurately identify network attack behaviors, thereby quickly discovering potential security threats corresponding to suspicious behaviors, reducing the risk of missing potential attacks, reducing false positives and misreports, and improving defense capabilities. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0020] Figure 1 This is a schematic diagram of the structure of a network attack handling system provided in an exemplary embodiment of this application;

[0021] Figure 2 This is a schematic diagram of the interaction between various roles in a network attack handling system provided in an exemplary embodiment of this application;

[0022] Figure 3 A schematic flowchart illustrating the network attack handling method provided in an exemplary embodiment of this application when executed on the client side;

[0023] Figure 4 A schematic flowchart illustrating the execution of a network attack handling method provided in an exemplary embodiment of this application on the server side;

[0024] Figure 5 A schematic diagram of the structure of an electronic device provided in an exemplary embodiment of this application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. “Multiple” generally includes at least two, but does not exclude the inclusion of at least one.

[0027] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0028] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a product or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a product or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the product or system that includes said element.

[0029] When AIGC technology is applied for malicious purposes, it lowers the barrier to entry for writing malicious code. Non-professional attackers can use AIGC tools to generate complex malicious code without in-depth programming knowledge or understanding of specific system architectures, increasing the number of potential attackers. Furthermore, AIGC technology makes cyberattacks more automated, intelligent, and weaponized, increasing the quantity, complexity, and detection difficulty of attacks. Automation and intelligence in cyberattacks mean that AIGC tools can automatically create and modify attack strategies to adapt to different targets and defense mechanisms. This intelligence makes cyberattacks more dynamic, and traditional security solutions may struggle to keep up with the pace of change. Weaponization of attacks means that attackers can use AIGC tools to quickly generate a large number of customized attack tools, including but not limited to viruses, Trojans, and backdoors. These tools can be optimized for specific vulnerabilities, increasing the success rate of attacks. Increased attack quantity and complexity mean that AIGC tools enable attackers to launch multi-threaded attacks simultaneously, increasing the scale of attacks. Simultaneously, the generated code can contain complex logic and obfuscation techniques, increasing the difficulty of analysis and countermeasures. Increased detection difficulty means that the code generated by AIGC tools can mimic the behavior of legitimate programs or employ advanced evasion techniques to bypass common detection methods.

[0030] In this situation, the traditional approach of generating defense rules based on manual analysis and then using those rules to defend against cyberattacks is no longer sufficient to address the challenges posed by cyberattacks generated by AIGC tools.

[0031] To address the aforementioned technical problems, a solution is provided in some embodiments of this application. The technical solutions provided by each embodiment of this application are described in detail below with reference to the accompanying drawings.

[0032] Figure 1 This is a schematic diagram of the structure of a network attack handling system provided in an exemplary embodiment of this application, as shown below. Figure 1 As shown, the network attack handling system 100 may include: client 10, server 20 and target host 30.

[0033] The client 10 can run on the target host 30 to provide security protection for the target host 30. The target host 30 can be any device capable of connecting to a network, including but not limited to physical devices in a physical environment or virtual devices in a cloud environment. For example, in some scenarios, the target host 30 can be any physical device capable of connecting to a network, such as mobile phones, computers, smart wearable devices, smart home devices, physical servers, etc. In other scenarios, the target host 30 can be virtual devices such as virtual machines, virtual servers, and cloud desktops running in a cloud environment.

[0034] In this embodiment, server 20 can be a physical server or a virtual server in a cloud environment; this embodiment is not limited to either. Server 20 can communicate and interact with multiple clients and can provide network attack behavior analysis services to client 10 based on a pre-trained attack analysis model. The following will provide a detailed explanation.

[0035] In the network attack handling system 100, the client 10 is mainly used to detect suspicious behavior on the target host 30. When suspicious behavior is detected on the target host 30, the client 10 obtains the behavior data of the process corresponding to the suspicious behavior and sends the behavior data of the process to the server 20.

[0036] Suspicious behavior refers to actions that pose a security threat to the target host 30 or initiate abnormal activities on the target host 30. Suspicious behavior typically includes a series of operations. When detecting suspicious behavior on the target host 30, the client 10 can track operating system-level calls on the target host 30, such as file read / write operations, process management, memory management, registry access, and network connections. Based on the tracking results of each call operation and identification rules, the client 10 determines whether the behavior occurring on the target host 30 is suspicious. For example, if the frequency of file read / write operations on the target host 30 that access the disk exceeds a set frequency threshold, the file operation can be considered suspicious. For example, if a network connection operation on the target host 30 is an attempt to connect from an unknown source or the amount of data transmitted via the network connection exceeds a set threshold, the network connection operation can be considered suspicious. For example, if a process management operation on the target host 30 creates a process that is not associated with any known program on the target host 30, the process management operation can be considered suspicious. For example, when a registry access operation on target host 30 requests to modify the registry, the behavior of the process management operation can be considered suspicious, and will not be listed in detail.

[0037] When acquiring behavioral data of a process corresponding to suspicious behavior, client 10 may collect at least one of the following: process metadata, log data, and event data. The process metadata may include at least one of the following: process ID (identification), parent process ID, process name, start time, and path. Log data records process-related events and activities, including but not limited to: process start and termination times, errors or warnings generated by the process, operations and system calls performed by the process, system resource usage (such as processor resources and storage resources), network activity, and at least one of the following: process event data. The process event data may include at least one of the following: timestamps of events triggered by the process, event types, related filenames or registry keys, and related network endpoints.

[0038] The server 20 is mainly used to: receive the behavior data of the process corresponding to the suspicious behavior sent by the client 10, input the behavior data of the process into the preset attack analysis model, and obtain the behavior type prediction label corresponding to the suspicious behavior.

[0039] The behavior type prediction label is used to describe whether the suspicious behavior is a network attack. In some embodiments, the behavior type prediction label may include: non-network attack or network attack. In other embodiments, if the suspicious behavior is identified as a network attack, the attack analysis model may also predict the specific type of network attack. That is, the behavior type prediction label output by the attack analysis model may include: non-network attack or a specific type of network attack. For example, specific types of network attacks may include: unauthorized file operations, unauthorized registry modifications, malware execution, buffer overflows, privilege escalation, resource exhaustion attacks, process injection attacks, or denial-of-service (DoS) attacks, etc. This embodiment includes, but is not limited to, these.

[0040] In this embodiment, the attack analysis model is a deep learning model trained based on sample data corresponding to historical network attack behaviors. Historical network attack behaviors are real network attack behaviors that have actually occurred; therefore, the behavioral data of historical network attack behaviors can reflect the true behavioral patterns of the network attack process. The deep learning model performs tasks by constructing deep neural networks, possessing powerful feature representation capabilities, generalization capabilities, and adaptive capabilities. During training, the deep learning model learns rich feature representations related to network attack behaviors and behavioral data understanding capabilities based on the input behavioral data samples of historical network attack behaviors. This allows for in-depth analysis of the behavioral data of suspicious behaviors and accurate determination of whether the suspicious behaviors are network attack behaviors.

[0041] In some optional embodiments, the server 20 may directly return the behavior type prediction label to the client 10, so that the client 10 can process the process corresponding to the suspicious behavior based on the behavior type prediction label.

[0042] Accordingly, client 10 can receive a behavior type prediction label corresponding to the suspicious behavior returned by server 20. If the behavior type prediction label indicates that the suspicious behavior is a network attack, client 10 can intercept the suspicious behavior.

[0043] Optionally, when intercepting suspicious behavior, client 10 can obtain the interception rules that the suspicious behavior matches, and intercept the suspicious behavior based on the interception rules that the suspicious behavior matches. The interception rules can be used to describe the conditions satisfied by different types of network attack behaviors and the corresponding interception methods. These interception rules can be generated by client 10, obtained by client 10 from the user's configuration file, or obtained by client 10 from server 20; this embodiment does not impose any restrictions.

[0044] Optionally, the interception rule can be used to intercept a specific operation when the operation corresponding to the suspicious behavior meets the set conditions; or, the interception rule can be used to directly intercept the process corresponding to the suspicious behavior when the suspicious behavior meets the set conditions.

[0045] When intercepting operations corresponding to suspicious behavior, the system can identify operations contained within or associated with the suspicious behavior, and determine whether the operation meets the conditions set in the interception rules. If the operation meets the set conditions, it can be intercepted based on the interception method set in the interception rules. The set conditions that an operation meets may include: the operation is used to execute a specific command, the operation is used to access a specific file, or the operation is used to access a specific network resource. Methods for intercepting the operation may include: using a firewall system to block operations used to access specific network resources; or using access control lists or security policies to restrict access to specific files, and so on.

[0046] Process interception refers to preventing or restricting the startup or execution of processes corresponding to suspicious behavior. Optionally, the rules for intercepting processes may include, but are not limited to: if the suspicious behavior meets a first condition, directly terminating the process corresponding to the suspicious behavior; if the suspicious behavior meets a second condition, restricting the process's use of processor and memory resources; if the suspicious behavior meets a third condition, adding the process corresponding to the suspicious behavior to the blocked list; if the suspicious behavior meets a fourth condition, adding the ID of the process corresponding to the suspicious behavior to the access control list of specific files and resources to restrict the process's access permissions to specific files and resources; if the suspicious behavior meets a fifth condition, using kernel modules to intercept the process's system calls; and if the suspicious behavior meets a sixth condition, controlling the process's outbound and inbound network communication by configuring firewall rules.

[0047] In some embodiments A1, when determining the interception rules for suspicious behavior, the client 10 can identify the target condition satisfied by the behavioral data corresponding to the suspicious behavior from the above-mentioned multiple conditions, and use the interception rule corresponding to the target condition as the interception rule for the suspicious behavior. For example, if the system resource utilization rate of the process corresponding to the suspicious behavior is greater than 80% in the behavioral data corresponding to the suspicious behavior, it can be determined that the suspicious behavior meets the second condition, and the client 10 can restrict the use of processor and memory resources of the process. For example, if the file involved in the suspicious behavior is a sensitive file in the behavioral data corresponding to the suspicious behavior, it can be determined that the suspicious behavior meets the fourth condition, and the ID of the process corresponding to the suspicious behavior can be added to the access control list of the file corresponding to the file name.

[0048] In other embodiments A2, client 10 can identify target conditions that match the behavior type prediction label corresponding to the suspicious behavior from the above-mentioned multiple conditions, and use the interception rule corresponding to the target condition as the interception rule for the suspicious behavior. For example, when the behavior type prediction label corresponding to the suspicious behavior is a resource exhaustion attack, it can be determined that the suspicious behavior meets the second condition mentioned above, and client 10 can restrict the use of processor and memory resources of the process to reduce the risk of resource exhaustion of the target host 30.

[0049] In some optional embodiments, server 20 can be used to issue interception rules to client 10, which are generated by server 20 using an attack analysis model. Optionally, after obtaining the behavior type prediction label corresponding to the suspicious behavior, if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, server 20 can determine the interception rule corresponding to the suspicious behavior and issue the interception rule to client 10.

[0050] In some embodiments, after determining that the suspicious behavior is a network attack, server 20 can use an attack analysis model to generate interception rules corresponding to the suspicious behavior and send the interception rules to client 10. For example, server 20 can construct a prompt word according to a set format. This prompt word is used to enable the attack analysis model to generate interception rules to defend against the suspicious behavior based on the behavioral data of the process corresponding to the input suspicious behavior. For example, the interception rule generated by the attack analysis model could be: block any operation that attempts to execute a specific type of command from a specific path and contains a specific string.

[0051] In other embodiments, after determining that the suspicious behavior is a network attack, the server 20 can match the interception rule corresponding to the behavior type label from the interception rules generated by the attack analysis model according to the behavior type label, and send the matched interception rule to the client 10. This embodiment does not impose any restrictions.

[0052] Accordingly, client 10 can receive the interception rules corresponding to the suspicious behavior returned by server 20, and intercept the suspicious behavior according to the interception rules.

[0053] Optionally, after receiving an interception rule returned by the server 20 each time, the client 10 saves the correspondence between the interception rule and the behavior type tag. Based on this, in some optional embodiments, after receiving a behavior type prediction tag corresponding to a suspicious behavior returned by the server 20, the client 10 can determine the interception rule corresponding to the behavior type prediction tag from at least one interception rule generated by the saved attack analysis model, and use it as the interception rule corresponding to the suspicious behavior. In this implementation, the client 10 can reduce its dependence on the server 20 and the attack analysis model, improving defense speed.

[0054] In this implementation, when training the attack analysis model on behavioral data samples of processes corresponding to historical network attack behaviors, the attack types corresponding to historical network attack behaviors and the actual interception rules corresponding to historical network attack behaviors can be used as supervision signals. Based on the behavioral data samples and supervision signals, the attack analysis model is trained to output behavioral type prediction labels and generate interception rules according to the input behavioral data.

[0055] Optionally, the attack analysis model can generate different interception rules for different types of network attacks to effectively block them. For example, if the network attack involves unauthorized file operations, the interception rule generated by the attack analysis model could be: adding the ID of the process corresponding to the suspicious behavior to the access control list of specific files and resources to restrict the process's access permissions to those files and resources. For example, if the network attack involves unauthorized registry modification or process injection, the interception rule generated by the attack analysis model could be: directly terminating the process corresponding to the suspicious behavior. For example, if the network attack involves privilege escalation, the interception rule generated by the attack analysis model could be: adding the process corresponding to the suspicious behavior to the blocked list. As another example, if the network attack involves resource exhaustion, the interception rule generated by the attack analysis model could be: restricting the processor and memory resource usage of the process corresponding to the suspicious behavior, and so on.

[0056] In this implementation, the attack analysis model is trained on behavioral data samples of processes corresponding to historical network attack behaviors. Therefore, the attack analysis model can better grasp knowledge of the network attack domain and better understand and handle tasks within that domain. Based on this, when analyzing the behavioral data of processes exhibiting suspicious behavior, the attack analysis model can more accurately identify and judge the process's behavior, thereby generating more adversarial interception rules. Based on these more adversarial interception rules, clients can more accurately identify network attack behaviors, quickly discover potential security threats corresponding to suspicious behaviors, reduce the risk of missing potential attacks, decrease false positives and negatives, and improve defense capabilities.

[0057] The enhanced adversarial capability refers to two aspects: First, the attack analysis model is a deep learning model, enabling it to learn rich knowledge related to network attack behaviors and understand behavioral data. This allows for in-depth analysis of the behavioral data of suspicious input behaviors, generating more comprehensive interception rules. Second, the attack analysis model can adjust the interception rules in real time based on changes in the behavioral data of the suspicious behavior's progress, thus flexibly responding to network attacks with different behavioral characteristics.

[0058] In particular, when the intrusion program corresponding to the suspicious behavior is generated by AIGC technology, these intrusion programs are essentially highly similar. The attack analysis model can conduct in-depth analysis of the behavioral characteristics of the intrusion program generated by AIGC technology based on the learned network attack behavior related feature representation and behavioral data understanding ability, and accurately identify the network behavior initiated by various intrusion programs generated by AIGC technology. Thus, it can efficiently deal with scenarios where network attacks by AIGC tools are more frequent and more complex.

[0059] In some optional embodiments, a persistent connection can be maintained between client 10 and server 20. Furthermore, when client 10 sends the behavioral data to server 20, it can do so through the persistent connection. Correspondingly, server 20 can use this persistent connection to return the predicted behavior type label output by the attack analysis model to client 10.

[0060] Based on this implementation method, the communication interaction between the client 10 and the server 20 has a small communication latency. As a result, the client 10 can quickly obtain the analysis results of the network attack behavior type when using the remote device (i.e., the server 20) to analyze the network attack behavior type. This is conducive to quickly responding to network attacks and reducing the impact of network attacks on the compromised target host 30.

[0061] In some optional embodiments, after detecting suspicious behavior, the client 10 can perform preliminary screening of the suspicious behavior to preliminarily determine whether the suspicious behavior is relatively dangerous. Optionally, before obtaining the behavior data of the process corresponding to the suspicious behavior, the client 10 can obtain the danger level of the operation corresponding to the suspicious behavior. If the danger level of the operation corresponding to the suspicious behavior is greater than a preset level threshold, the client 10 obtains the behavior data of the process corresponding to the suspicious behavior.

[0062] The operation corresponding to the suspicious behavior refers to the operation initiated by the suspicious behavior or the operation associated with the suspicious behavior. Optionally, the operation corresponding to the suspicious behavior may include at least one of the following operations: downloading network packets, reading files, writing files, and modifying files. The above-mentioned different types of operations have different risk levels. For example, the risk level corresponding to the file reading operation is level one, the risk level corresponding to the file writing operation and the file modification operation can be level two, and the risk level of downloading network packets can be level three. Optionally, when obtaining the risk level of the operation corresponding to the suspicious behavior, the client 10 can obtain the type of the operation corresponding to the suspicious behavior and determine the risk level of the operation corresponding to the suspicious behavior based on the type of operation. For example, if the type of the operation corresponding to the suspicious behavior is writing files, the client 10 can determine that the risk level of the operation corresponding to the suspicious behavior is level two. Here, the risk level can be set to level one, that is, if the risk level of the operation corresponding to the suspicious behavior is greater than level one, the client 10 can consider that the consequences caused by the suspicious behavior are more serious, and therefore can obtain the behavioral data of the process corresponding to the suspicious behavior and use the attack analysis model to more accurately identify the behavioral type of the suspicious behavior.

[0063] In this implementation, initial screening is performed based on the type of operation corresponding to suspicious behavior. Behavioral data collection is only conducted when the risk level of the suspicious behavior is high, which helps reduce the amount of behavioral data to be collected. Especially in scenarios where network attacks are frequent, initial screening of suspicious behavior reduces the number of processes required to collect behavioral data, thereby reducing the resource consumption on the target host where client 10 resides and the transmission resources consumed between client 10 and server 20.

[0064] In some optional embodiments, the attack analysis model running on server 20 is obtained by fine-tuning the base model based on sample data corresponding to network attack behaviors, as will be illustrated below.

[0065] Optionally, server 20 can obtain behavioral data samples of processes corresponding to historical network attack behaviors. These behavioral data samples include at least one set of behavioral data and its respective behavioral type true label. Each set of behavioral data is collected from the behavioral data of the process corresponding to a real network attack behavior when such an attack occurs. The behavioral type true label for each set of behavioral data is used to mark the true behavioral type of this set of behavioral data as a network attack behavior. The behavioral type true label can be generated by manually labeling the types of behavioral data. Based on manual labeling, accumulated experience can be used to obtain the true type of behavioral data, thereby providing effective guidance for training the attack analysis model. In some embodiments, when fine-grained prediction of the type of network attack behavior is required, the behavioral type true label for each set of behavioral data can also mark the true network attack behavior type of this set of behavioral data.

[0066] Server 20 can input the at least one set of behavioral data into a preset base model to obtain behavioral type prediction labels for each of the at least one set of behavioral data. Based on the error between the actual behavioral type labels and the predicted behavioral type labels for each of the at least one set of behavioral data, server 20 can fine-tune the base model. When fine-tuning the base model, the goal can be to reduce the error between the actual behavioral type labels and the predicted behavioral type labels, modifying some parameters already learned in the base model; alternatively, one or more modules can be added to the base model, and the goal can be to reduce the error between the actual behavioral type labels and the predicted behavioral type labels, modifying the parameters of the newly added one or more modules. This embodiment does not impose any limitations. The fine-tuning operation of the base model can be performed iteratively multiple times until the base model converges. Server 20 can then use the converged base model as the attack analysis model. Base model convergence means that the error between the actual behavioral type labels and the predicted behavioral type labels is less than a set threshold.

[0067] The foundational model includes a content-generating deep learning model (hereinafter referred to as a content-generating model). A content-generating model is a neural network architecture capable of creating new content, generating various forms of content based on unsupervised or semi-supervised learning. This content-generating model can include, but is not limited to, any of the following: Generative Adversarial Networks (GANs), Variational Autoencoders (VAEs), Transformer-based models, Recurrent Neural Networks (RNNs), and Long Short-Term Memory Networks (LSTMs). In practical host security scenarios, content-generating models can be used by intruders to generate intrusion programs. When network attacks are frequently initiated by such intrusion programs, the content-generating model's ability to understand attack behavior and code can be leveraged to accurately identify attacks initiated by these programs.

[0068] Optionally, the pre-set base model can be a content-generative model pre-trained on a large-scale dataset, such as a pre-trained large language model. During pre-training, the base model learns rich and generalized feature representations. When fine-tuning the pre-trained large language model using behavioral data from cyberattacks, the prior knowledge and generalization ability learned by the base model through pre-training can be transferred to the task of cyberattack behavior analysis. This allows the fine-tuned large language model to be more adaptable to the cyberattack behavior analysis task, thereby improving the accuracy of the cyberattack behavior analysis results.

[0069] In some optional embodiments, the attack analysis model running on server 20 can be dynamically updated. Continuing with the suspicious behavior described in the foregoing embodiments as an example, optionally, after obtaining the behavior type prediction label of the suspicious behavior based on the attack behavior analysis model, server 20 can obtain the actual behavior type label corresponding to the suspicious behavior. In some optional embodiments, server 20 can send the behavior data and behavior type prediction label of the suspicious behavior to a security operations client, whereby security operations personnel can determine whether the behavior type prediction label is reasonable based on the behavior data. If unreasonable, the actual behavior type label provided by the security operations personnel can be obtained through the security operations client. After obtaining the actual behavior type label, server 20 can fine-tune the attack analysis model under the triggering of a model update event, aiming to reduce the error between the actual behavior type label corresponding to the suspicious behavior and the behavior type prediction label corresponding to the suspicious behavior. The model update event can be an event where the accumulated sample data volume exceeds a set data volume threshold, or an event where the error between the actual label of the behavior type and the predicted label of the behavior type exceeds a set error threshold, or an event where the update cycle is reached, or an event where a user is detected triggering an intrusion into the model update operation. This embodiment does not impose any restrictions.

[0070] Optionally, after obtaining the interception rule corresponding to any suspicious behavior based on the attack behavior analysis model, the server 20 can obtain the interception feedback data corresponding to the suspicious behavior. In some optional embodiments, this interception feedback data can be provided by security operations personnel. In this embodiment, the server 20 can send the behavior data of the suspicious behavior and the interception rule to the security operations client, and the security operations personnel can determine whether the interception rule is reasonable based on the behavior data. If it is unreasonable, the server 20 can obtain the correction result of the interception rule provided by the security operations personnel through the security operations client. After obtaining the correction result of the interception rule, the server 20 can fine-tune the attack analysis model under the trigger of a model update event, with the goal of reducing the error between the interception rule corresponding to the suspicious behavior and the correction result of the interception rule.

[0071] In some alternative embodiments, the interception feedback data may be provided by the client 10. In this embodiment, the client 10 may statistically analyze the interception results during the interception of suspicious behavior using interception rules. These results may include the number of successful interceptions or the interception success rate. The client may provide the interception results to the server 20, which may then determine whether the attack analysis model needs fine-tuning based on these results. For example, if the interception success rate of a certain interception rule is less than a set success rate threshold, or if the number of successful interceptions is less than a set number threshold, the server 20 may initiate a fine-tuning operation on the attack analysis model. During the fine-tuning process, the server 20 may continue to train the attack analysis model based on behavioral data samples and monitoring signals until the model converges to a smaller range. Optionally, during the fine-tuning process, the training dataset may be updated based on the actual operating data of the attack analysis model. For example, if the interception success rate of a certain interception rule is less than 50%, the server 20 may send the interception rule and the corresponding behavioral data to the security operations client and obtain the results of the security operations personnel correcting the interception rule based on the behavioral data. Server 20 can use the correction result of the interception rule as a new supervision signal corresponding to the behavior data, and use the behavior data and the updated supervision signal to continue training the attack analysis model to improve the performance of the attack analysis model.

[0072] Based on this implementation method, the attack analysis model can be dynamically updated, thereby improving its ability to identify diverse network attack behaviors. When network attack behaviors change dynamically, the attack analysis model can change accordingly in a timely manner, thus continuously updating defense capabilities in scenarios where network attack behaviors are long-term and frequent, effectively improving long-term intrusion resistance.

[0073] In addition to the network attack processing system described in the foregoing embodiments, this application also provides a network attack processing method, which will be described exemplarily below with reference to the accompanying drawings.

[0074] Figure 3 This is a flowchart illustrating a network attack handling method provided in an exemplary embodiment of this application. When executed on the client side, the method may include, for example... Figure 3 The steps shown are as follows:

[0075] Step 301: When suspicious behavior is detected on the target host, obtain the behavior data of the process corresponding to the suspicious behavior.

[0076] Step 302: Based on the behavioral data, obtain the interception rules corresponding to the suspicious behavior; wherein, the interception rules are determined based on a preset attack analysis model, and the attack analysis model is a deep learning model trained based on behavioral data samples of processes corresponding to historical network attack behaviors.

[0077] Step 303: Intercept the suspicious behavior according to the interception rules.

[0078] In some optional embodiments, the attack analysis model can run on the client. When the client executes step 302, it can run the attack analysis model locally, input the process behavior data into the attack analysis model, obtain the behavior type prediction label corresponding to the suspicious behavior, and generate interception rules using the attack analysis model after the behavior type prediction label indicates that the suspicious behavior is a network attack behavior.

[0079] In some alternative embodiments, the attack analysis model can run on a server side. When the client executes step 302, it can send the behavioral data to the server, allowing the server to input the behavioral data into the attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior. After the behavior type prediction label indicates that the suspicious behavior is a network attack, the server uses the attack analysis model to generate blocking rules. The client can receive the blocking rules returned by the server.

[0080] In some alternative embodiments, the attack analysis model can run on a server side. When the client executes step 302, it can send the behavioral data to the server, allowing the server to input the behavioral data into the attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior. The client then receives the behavior type prediction label returned by the server. The client can determine the interception rule corresponding to the behavior type prediction label from at least one interception rule generated by the saved attack analysis model, and use this rule as the interception rule for the suspicious behavior.

[0081] Optionally, sending the behavioral data to the server includes: sending the behavioral data to the server via a long-lived connection with the server.

[0082] Optionally, intercepting the suspicious behavior includes: receiving the interception rules corresponding to the suspicious behavior returned by the server, wherein the interception rules are generated by the server using the attack analysis model; and intercepting the suspicious behavior according to the interception rules.

[0083] Optionally, obtaining the behavioral data of the process corresponding to the suspicious behavior includes: obtaining the danger level of the operation corresponding to the suspicious behavior; if the danger level of the operation corresponding to the suspicious behavior is greater than a preset level threshold, then obtaining the behavioral data of the process corresponding to the suspicious behavior.

[0084] In this embodiment, when the client detects suspicious behavior on a target host, it can obtain behavioral data corresponding to the suspicious behavior and generate interception rules based on the behavioral data. These interception rules are determined using an attack analysis model. Based on these rules, the suspicious behavior can be intercepted. In this implementation, the attack analysis model is trained on behavioral data samples of processes corresponding to historical network attack behaviors. Therefore, the attack analysis model can better grasp knowledge in the field of network attacks and better understand and handle tasks in this field. Based on this, when analyzing the behavioral data of processes exhibiting suspicious behavior, the attack analysis model can more accurately identify and judge the process's behavior, thereby generating more adversarial interception rules. Based on these more adversarial interception rules, the client can more accurately identify network attack behaviors, quickly discover potential security threats corresponding to suspicious behaviors, reduce the risk of missing potential attacks, reduce false positives and negatives, and improve defense capabilities.

[0085] Figure 4 This is a flowchart illustrating a network attack handling method provided in an exemplary embodiment of this application. When executed on the server side, this method may include, for example... Figure 4 The steps shown are as follows:

[0086] Step 401: Receive the behavior data of the process corresponding to the suspicious behavior sent by the client. The behavior data is obtained by the client when it detects the suspicious behavior on the target host.

[0087] Step 402: Input the behavioral data into a preset attack analysis model to obtain the behavioral type prediction label corresponding to the suspicious behavior; the attack analysis model is a deep learning model trained based on behavioral data samples of processes corresponding to historical network attack behaviors.

[0088] Step 403: If the predicted label of the behavior type indicates that the suspicious behavior is a network attack behavior, then determine the interception rule corresponding to the suspicious behavior, and the interception rule is generated by the attack analysis model.

[0089] Step 405: Send the interception rules to the client. The interception rules are used to intercept the suspicious behavior.

[0090] Optionally, determining the interception rule corresponding to the suspicious behavior includes: using the attack analysis model to generate an interception rule corresponding to the suspicious behavior based on the behavior data; or, determining an interception rule corresponding to the behavior type prediction label from at least one interception rule generated by the saved attack analysis model, and using it as the interception rule corresponding to the suspicious behavior.

[0091] Optionally, the method further includes: acquiring behavioral data samples of processes corresponding to historical network attack behaviors, wherein the behavioral data samples include: at least one set of behavioral data and their respective real labels for behavioral types; inputting the at least one set of behavioral data into a preset base model to obtain predicted labels for the behavioral types of the at least one set of behavioral data; the base model includes: a content-generating deep learning model; fine-tuning the base model based on the error between the real labels for the behavioral types of the at least one set of behavioral data and the predicted labels for the behavioral types, until the base model converges, and using the converged base model as the attack analysis model.

[0092] Optionally, the method further includes: obtaining the true label of the behavior type corresponding to the suspicious behavior; and, upon triggering a model update event, fine-tuning the attack analysis model with the goal of reducing the error between the true label of the behavior type corresponding to the suspicious behavior and the predicted label of the behavior type corresponding to the suspicious behavior.

[0093] In this embodiment, the server can provide network attack behavior analysis services to the client. When it receives behavioral data corresponding to suspicious behavior sent by the client, the server can use an attack analysis model to identify the behavior type prediction label corresponding to the behavioral data and return the behavior type prediction label to the client. In this implementation, the server can accurately obtain the interception rules corresponding to suspicious behavior based on behavioral data and attack analysis model, thereby facilitating the rapid and accurate handling of potential security threats corresponding to suspicious behavior, reducing the risk of missing potential attacks, and improving defense capabilities.

[0094] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 301 to 303 can be device A; or the execution subject of steps 301 and 302 can be device A, and the execution subject of step 303 can be device B; and so on.

[0095] Furthermore, in some of the processes described in the above embodiments and accompanying drawings, multiple operations appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or they may be executed in parallel. The operation numbers, such as 301, 302, etc., are merely used to distinguish different operations and do not represent any execution order. Additionally, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first" and "second" in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to different types.

[0096] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0097] Figure 5 This application illustrates a schematic diagram of the structure of an electronic device provided in an exemplary embodiment, as shown below. Figure 5 As shown, the electronic device may include: a memory 501, a processor 502, and a communication component 503.

[0098] Memory 501 is used to store computer programs and can be configured to store various other data to support operation on the electronic device. Examples of this data include instructions for any application or method used to operate on the electronic device.

[0099] In some exemplary embodiments, Figure 5 The illustrated electronic device can run a client of a security system. In this embodiment, a processor 502, coupled to a memory 501, is used to execute a computer program in the memory 501 for: upon detecting suspicious behavior on a target host, acquiring behavioral data of the process corresponding to the suspicious behavior; obtaining an interception rule corresponding to the suspicious behavior based on the behavioral data; wherein the interception rule is determined based on a preset attack analysis model, the attack analysis model being a deep learning model trained based on behavioral data samples of processes corresponding to historical network attack behaviors; and intercepting the suspicious behavior according to the interception rule.

[0100] Optionally, when the processor 502 obtains the interception rule corresponding to the suspicious behavior based on the behavior data, it is specifically used to: send the behavior data to the server through the communication component 503, so that the server inputs the behavior data into the attack analysis model to obtain the behavior type prediction label corresponding to the suspicious behavior; receive the interception rule corresponding to the suspicious behavior returned by the server, wherein the interception rule is generated by the server using the attack analysis model after determining that the suspicious behavior is a network attack behavior based on the behavior type prediction label.

[0101] Optionally, when the communication component 503 obtains the interception rule corresponding to the suspicious behavior based on the behavior data, it is specifically used to: send the behavior data to the server through the communication component 503, so that the server inputs the behavior data into the attack analysis model to obtain the behavior type prediction label corresponding to the suspicious behavior; receive the behavior type prediction label corresponding to the suspicious behavior returned by the server; if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, then determine the interception rule corresponding to the behavior type prediction label from at least one interception rule generated by the saved attack analysis model, and use it as the interception rule corresponding to the suspicious behavior.

[0102] Optionally, when the processor 502 sends the behavioral data to the server via the communication component 503, it is specifically used to: use the communication component 503 to send the behavioral data to the server via a long connection with the server.

[0103] Optionally, when the processor 502 acquires the behavior data of the process corresponding to the suspicious behavior, it is specifically used to: acquire the danger level of the operation corresponding to the suspicious behavior; if the danger level of the operation corresponding to the suspicious behavior is greater than a preset level threshold, then acquire the behavior data of the process corresponding to the suspicious behavior.

[0104] In some other exemplary embodiments, Figure 5The illustrated electronic device can run a server-side security system. In this embodiment, processor 502, coupled to memory 501, is used to execute a computer program in memory 501 for: receiving behavioral data of a process corresponding to a suspicious behavior sent by a client via communication component 503, the behavioral data being acquired by the client when it detects the suspicious behavior on a target host; inputting the behavioral data into a preset attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; the attack analysis model is a deep learning model trained based on behavioral data samples of processes corresponding to historical network attack behaviors; if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, then determining an interception rule corresponding to the suspicious behavior, the interception rule being generated by the attack analysis model; and sending the interception rule to the client via communication component 503, the interception rule being used to intercept the suspicious behavior.

[0105] Optionally, when determining the interception rule corresponding to the suspicious behavior, the processor 502 is specifically used to: use the attack analysis model to generate the interception rule corresponding to the suspicious behavior based on the behavior data; or, determine the interception rule corresponding to the behavior type prediction label from at least one interception rule generated by the stored attack analysis model, and use it as the interception rule corresponding to the suspicious behavior.

[0106] Optionally, the processor 502 is further configured to: acquire behavioral data samples of processes corresponding to historical network attack behaviors, the behavioral data samples including: at least one set of behavioral data and their respective behavioral type real labels; input the at least one set of behavioral data into a preset base model to obtain behavioral type predicted labels for each of the at least one set of behavioral data; the base model including: a content-generating deep learning model; fine-tune the base model according to the error between the behavioral type real labels and behavioral type predicted labels for each of the at least one set of behavioral data, until the base model converges, and use the converged base model as the attack analysis model.

[0107] Optionally, the processor 502 is further configured to: obtain the true label of the behavior type corresponding to the suspicious behavior; and, upon triggering a model update event, fine-tune the attack analysis model with the goal of reducing the error between the true label of the behavior type corresponding to the suspicious behavior and the predicted label of the behavior type corresponding to the suspicious behavior.

[0108] Furthermore, such as Figure 5 As shown, the electronic device also includes other components such as a power supply component 504, a display component 505, and an audio component 506. Figure 5 The diagram only shows some components and does not mean that the electronic device includes only these components. Figure 5The components shown. Figure 5 In this embodiment, the components within the dashed boxes are optional, not mandatory, and their specific requirements depend on the product form of the electronic device. The electronic device in this embodiment can be a terminal device such as a desktop computer, laptop computer, smartphone, or IoT device, or a server-side device such as a conventional server, cloud server, or server array. If the electronic device in this embodiment is a terminal device such as a desktop computer, laptop computer, or smartphone, it may include... Figure 5 The components within the dashed box; if the electronic device in this embodiment is implemented as a conventional server, cloud server, or server array, etc., it may be omitted. Figure 5 The component within the dashed box.

[0109] The memory 501 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0110] The communication component 503 is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as Wi-Fi, 2G (e.g., Global System for Mobile Communications (GSM)), 3G (e.g., Wideband Code Division Multiple Access (WCDMA), 4G (e.g., Long Term Evolution (LTE)), 4G+ (e.g., LTE-Advanced (LTE-A)), or 5G (5th Generation Mobile Communication Technology), or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component may be implemented based on Near Field Communication (NFC), Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wide Band (UWB), Bluetooth (BT), and other technologies.

[0111] The power supply component 504 is used to provide power to various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which it resides.

[0112] The display component includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touchscreen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation.

[0113] An audio component may be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals may be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0114] In this embodiment, when suspicious behavior is detected on a target host, behavioral data corresponding to the suspicious behavior can be obtained, and interception rules corresponding to the suspicious behavior can be obtained based on the behavioral data. These interception rules are determined using an attack analysis model. Based on the interception rules, suspicious behavior can be intercepted. In this implementation, the attack analysis model is trained on behavioral data samples of processes corresponding to historical network attack behaviors. Therefore, the attack analysis model can better grasp knowledge in the field of network attacks and better understand and handle tasks in the field of network attacks. Based on this, when analyzing the behavioral data of processes exhibiting suspicious behavior, the attack analysis model can more accurately identify and judge the behavior of the processes, thereby generating more adversarial interception rules. Based on these more adversarial interception rules, the client can more accurately identify network attack behaviors, thereby quickly discovering potential security threats corresponding to suspicious behaviors, reducing the risk of missing potential attacks, reducing false positives and misreports, and improving defense capabilities.

[0115] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed, can implement the steps that can be performed by an electronic device in the above method embodiments.

[0116] This application also provides a computer program product, including: a computer program / instructions, which, when executed by a processor, can implement the steps in the method provided in this application.

[0117] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM (Compact Disc Read-Only Memory), optical storage, etc.) containing computer-usable program code.

[0118] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0119] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0120] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0121] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interfaces, network interfaces, and memory.

[0122] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0123] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0124] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, product, or apparatus that includes said element.

[0125] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for handling network attacks, characterized in that, include: When suspicious behavior is detected on the target host, the behavioral data of the process corresponding to the suspicious behavior is obtained; Based on the behavioral data, interception rules corresponding to the suspicious behavior are obtained; wherein, the interception rules are determined based on a preset attack analysis model, and the attack analysis model is a deep learning model trained based on behavioral data samples of processes corresponding to historical network attack behaviors. The suspicious behavior is intercepted according to the interception rules.

2. The method according to claim 1, characterized in that, Based on the behavioral data, the interception rules corresponding to the suspicious behavior are obtained, including: The behavioral data is sent to the server so that the server inputs the behavioral data into the attack analysis model to obtain the behavioral type prediction label corresponding to the suspicious behavior. The server receives the interception rules corresponding to the suspicious behavior returned by the server. The interception rules are generated by the server using the attack analysis model after determining that the suspicious behavior is a network attack behavior based on the behavior type prediction label.

3. The method according to claim 1, characterized in that, Based on the behavioral data, the interception rules corresponding to the suspicious behavior are obtained, including: The behavioral data is sent to the server so that the server inputs the behavioral data into the attack analysis model to obtain the behavioral type prediction label corresponding to the suspicious behavior. Receive the behavior type prediction label corresponding to the suspicious behavior returned by the server; If the predicted label of the behavior type indicates that the suspicious behavior is a network attack, then from at least one interception rule generated by the saved attack analysis model, the interception rule corresponding to the predicted label of the behavior type is determined as the interception rule corresponding to the suspicious behavior.

4. The method according to claim 2 or 3, characterized in that, Sending the behavioral data to the server includes: The behavioral data is sent to the server via a long-lived connection.

5. The method according to any one of claims 1-3, characterized in that, Obtain behavioral data of the process corresponding to the suspicious behavior, including: Obtain the danger level of the operation corresponding to the suspicious behavior; If the danger level of the operation corresponding to the suspicious behavior is greater than a preset level threshold, then the behavior data of the process corresponding to the suspicious behavior is obtained.

6. A method for handling network attacks, characterized in that, include: The system receives behavioral data of the process corresponding to the suspicious behavior sent by the client, wherein the behavioral data is obtained by the client when it detects the suspicious behavior on the target host; The behavioral data is input into a preset attack analysis model to obtain the behavioral type prediction label corresponding to the suspicious behavior; the attack analysis model is a deep learning model trained based on behavioral data samples of processes corresponding to historical network attack behaviors. If the predicted label of the behavior type indicates that the suspicious behavior is a network attack, then the interception rule corresponding to the suspicious behavior is determined, and the interception rule is generated by the attack analysis model; The interception rules are sent to the client, and the interception rules are used to intercept the suspicious behavior.

7. The method according to claim 6, characterized in that, Determining the interception rules corresponding to the suspicious behavior includes: Using the attack analysis model, an interception rule corresponding to the suspicious behavior is generated based on the behavioral data; or, from at least one interception rule generated by the attack analysis model that has been saved, an interception rule corresponding to the behavior type prediction label is determined as the interception rule corresponding to the suspicious behavior.

8. The method according to claim 6, characterized in that, Also includes: Obtain behavioral data samples of processes corresponding to historical network attack behaviors, wherein the behavioral data samples include: at least one set of behavioral data and their respective behavioral type real labels; The at least one set of behavioral data is input into a preset base model to obtain behavioral type prediction labels for each of the at least one set of behavioral data; the base model includes: a content-generating deep learning model; Based on the error between the true label and the predicted label of the behavior type for each of the at least one set of behavior data, the base model is fine-tuned until the base model converges, and the converged base model is used as the attack analysis model.

9. The method according to any one of claims 6-8, characterized in that, Also includes: Obtain the real label of the behavior type corresponding to the suspicious behavior; When a model update event is triggered, the attack analysis model is fine-tuned with the goal of reducing the error between the actual label of the behavior type corresponding to the suspicious behavior and the predicted label of the behavior type corresponding to the suspicious behavior.

10. A network attack handling system, characterized in that, include: Client and server; The client is configured to: upon detecting suspicious behavior on a target host, acquire behavioral data of the process corresponding to the suspicious behavior; send the behavioral data to the server and receive the interception rules corresponding to the suspicious behavior returned by the server; and intercept the suspicious behavior according to the interception rules. The server is configured to: receive behavioral data of the process corresponding to the suspicious behavior sent by the client; input the behavioral data into a preset attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, determine the interception rule corresponding to the suspicious behavior; and return the interception rule to the client; the attack analysis model is a deep learning model trained based on behavioral data samples of processes corresponding to historical network attack behaviors.

11. An electronic device, characterized in that, include: Memory and processor; The memory is used to store one or more computer instructions; The processor is configured to execute one or more computer instructions for performing the steps of the method according to any one of claims 1-9.

12. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it can implement the network attack processing method according to any one of claims 1-9.

13. A computer program product, characterized in that, include: A computer program / instruction, which, when executed by a processor, enables the implementation of the network attack processing method according to any one of claims 1-9.

Images