Host security alert methods, devices, equipment, and readable media in data centers

Abstract

This disclosure provides embodiments of a host security early warning method, apparatus, device, and readable medium in a data center. One specific implementation of the method includes: collecting process information corresponding to processes running on a host to be monitored, and simultaneously collecting network port information corresponding to those processes; constructing a dynamic process feature library and a dynamic process baseline information set; and performing the following monitoring steps: collecting process information and corresponding network port information of processes on the host to be monitored; determining the collected process information and network port information as the behavior information of the process to be detected; performing dynamic risk detection processing based on the process liveness trust level of the behavior information of the process to be detected; performing dynamic baseline security detection processing on the behavior information of the process to be detected; and performing host security early warning processing on the host to be monitored. This implementation reduces the waste of early warning resources.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of computer technology, and more specifically to host security early warning methods, apparatus, devices, and readable media in data centers. Background Technology

[0002] Modern data centers host core business operations and critical data for enterprises, with hosts (including physical servers, virtual machines, and container instances) serving as their basic operating units. The security of business processes running on these hosts and their network behavior directly impacts service continuity, data confidentiality, and integrity. Any host security incident (such as malicious process intrusion or unauthorized port opening) can lead to serious consequences such as data breaches and service interruptions. Host security alerts are a technology for monitoring and providing early warnings about the security of hosts in data centers. Currently, the common methods for host security monitoring and alerts include deploying security probes or proxies to perform security checks on processes on hosts in the data center based on static malware signature databases, thereby generating host security alerts.

[0003] However, when using the above methods for security monitoring and early warning of hosts, the following technical problems often arise:

[0004] Deploying security probes or agents to perform security checks on processes on hosts in the data center based on static malware signature databases to provide host security alerts is problematic. Static signature databases are often not adapted to dynamically changing computing environments and cannot reflect new trends in processes or network activities running on hosts in real time. This results in poor detection capabilities when faced with new processes, variant malware, and changes in normal behavior, leading to an increase in the number of false alarms and missed alerts, thus wasting alert resources.

[0005] The information disclosed in this background section is only intended to enhance the understanding of the background of the inventive concept, and therefore may contain information that does not form prior art known to those skilled in the art. Summary of the Invention

[0006] The summary portion of this disclosure is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description portion. This summary portion is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0007] Some embodiments of this disclosure provide host security early warning methods, apparatuses, electronic devices, and computer-readable media in data centers to address one or more of the technical problems mentioned in the background section above.

[0008] In a first aspect, some embodiments of this disclosure provide a host security early warning method in a data center. The method includes: for a host to be monitored in the data center, during a preset initial learning period, collecting process information corresponding to processes running on the host to be monitored, and simultaneously collecting network port information corresponding to the processes, to generate a process behavior information set; based on the process behavior information set, constructing a dynamic process feature library and a dynamic process baseline information set; based on the dynamic process feature library and the initial process baseline information set, performing the following monitoring steps: collecting process information of processes on the host to be monitored and network port information corresponding to the processes; determining the collected process information and the network port information as process behavior information to be detected; based on the dynamic process feature library, performing dynamic risk detection processing on the process behavior information to be detected, fusing process liveness trust level, to obtain first dynamic risk detection information; based on the dynamic process baseline information set, performing dynamic baseline security detection processing on the process behavior information to be detected, to obtain second dynamic risk detection information; based on the first dynamic risk detection information and the second dynamic risk detection information, performing host security early warning processing on the host to be monitored; and in response to determining that the dynamic process feature library and the dynamic process baseline information set have not been updated, performing the above monitoring steps again according to the dynamic process feature library and the dynamic process baseline information set.

[0009] Secondly, some embodiments of this disclosure provide a host security early warning device in a data center. The device includes: an acquisition unit configured to acquire process information corresponding to processes running on the host to be monitored during a preset initial learning period, and simultaneously acquire network port information corresponding to the processes, to generate a process behavior information set; a construction unit configured to construct a dynamic process feature library and a dynamic process baseline information set based on the process behavior information set; and a monitoring unit configured to perform the following monitoring steps based on the dynamic process feature library and the initial process baseline information set: acquiring process information of processes on the host to be monitored and network port information corresponding to the processes; and processing the acquired information. The process information and network port information are identified as the process behavior information to be detected. Based on the dynamic process feature library, the process behavior information to be detected is subjected to dynamic risk detection processing that integrates process liveness trust level to obtain the first dynamic risk detection information. Based on the dynamic process baseline information set, the process behavior information to be detected is subjected to dynamic baseline security detection processing to obtain the second dynamic risk detection information. Based on the first dynamic risk detection information and the second dynamic risk detection information, the host to be monitored is subjected to host security warning processing. In response to the determination that the dynamic process feature library and the dynamic process baseline information set have not been updated, the above monitoring steps are executed again according to the dynamic process feature library and the dynamic process baseline information set.

[0010] Thirdly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0011] Fourthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

[0012] The above-described embodiments of this disclosure have the following beneficial effects: the host security early warning method in a data center according to some embodiments of this disclosure reduces the waste of early warning resources. Specifically, the reason for the waste of early warning resources is that deploying security probes or agents to perform security detection on processes on hosts in the data center based on a static malware signature library for host security early warning is often not adapted to dynamically changing computing environments and cannot reflect new trends in processes or network activities running on the host in real time. This results in poor detection capabilities when facing new processes, variant malware, and changes in normal behavior, leading to an increase in the number of false alarms and missed alarms, thus wasting early warning resources. Based on this, the host security early warning method in a data center according to some embodiments of this disclosure firstly collects process information corresponding to processes running on the host to be monitored in the data center during a preset initial learning period, and simultaneously collects network port information corresponding to the processes to generate a process behavior information set. Then, based on the process behavior information set, a dynamic process signature library and a dynamic process baseline information set are constructed. Thus, the collected process behavior information set can be used to construct a dynamic process signature library and a dynamic baseline information set to reflect the normal process behavior on the current host. Furthermore, the dynamic process feature library and dynamic process baseline information set are constantly updated. Next, based on the dynamic process feature library and the initial process baseline information set, the following monitoring steps are performed: First, process information and corresponding network port information of the processes on the host to be monitored are collected. This allows for the continuous collection of the latest process information and its corresponding network port information on the host to be monitored during the monitoring phase. Second, the collected process information and the aforementioned network port information are identified as the behavior information of the process to be detected. Third, based on the aforementioned dynamic process feature library, dynamic risk detection processing based on process liveness trust level is performed on the behavior information of the process to be detected to obtain the first dynamic risk detection information. This allows for risk detection of the behavior information of the process to be detected, taking into account the liveness trust level of the process, thereby reducing false alarms for highly liveness trusted processes due to business adjustments (e.g., a long-term stable process may be assessed as low risk due to its high liveness trust level when undergoing legitimate changes (such as listening on a new port)). Afterwards, based on the dynamic process baseline information set, dynamic baseline security detection processing is performed on the behavior information of the process to be detected to obtain the second dynamic risk detection information. Because the dynamic process baseline information set can be dynamically adjusted as business grows, it avoids misjudging normal developments as abnormalities and reduces false alarms. Next, based on the first and second dynamic risk detection information, host security warnings are issued to the monitored host. Furthermore, in response to the determination that the dynamic process feature library and dynamic process baseline information set have not been updated, the aforementioned monitoring steps are executed again based on the dynamic process feature library and dynamic process baseline information set.Because of the creation of a constantly updated dynamic process signature library and dynamic process baseline information set, it can reflect the new trends of processes or network activities running on the host in real time, and can better adapt to the detection of new processes, variant malware and normal behavior changes, thereby reducing the number of false alarms and missed alarms, and reducing the waste of warning resources. Attached Figure Description

[0013] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.

[0014] Figure 1 This is a flowchart of some embodiments of the host security early warning method in a data center according to the present disclosure;

[0015] Figure 2 This is a schematic diagram of the structure of some embodiments of the host security early warning device in the data center according to the present disclosure;

[0016] Figure 3 This is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Implementation

[0017] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0018] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0019] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0020] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0021] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0022] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0023] Figure 1 A flow 100 of some embodiments of a host security alert method in a data center according to the present disclosure is shown. The host security alert method in a data center includes the following steps:

[0024] Step 101: For the host to be monitored in the data center, during the preset initial learning period, process information corresponding to the processes running on the host to be monitored is collected, and network port information corresponding to the processes is also collected to generate a process behavior information set.

[0025] In some embodiments, the execution entity (e.g., a computing device) of the host security early warning method in a data center can collect process information corresponding to processes running on the host to be monitored during a preset initial learning period, and simultaneously collect network port information corresponding to the processes, to generate a process behavior information set. The host to be monitored can be an enterprise server deployed within the data center that is affected by business cycles (e.g., weekdays / non-weekdays). The preset initial learning period can be a preset time period set after the host to be monitored is deployed (e.g., setting the initial learning period to 15 days after deployment). In practice, process information corresponding to processes running on the host to be monitored can be collected during the preset initial learning period using a secure communication protocol (SSH) or a local host agent module (Agent), and simultaneously collect network port information corresponding to the processes. The process information can describe relevant information about a running process instance. The process information can include, but is not limited to, the following: process identifier, command-line arguments, process PID, and process PPID. The network port information can be information about the ports used by the process to communicate with external networks (or other processes). The network port information can include, but is not limited to, the following: port number, port status information, and protocol type information. The process identifier mentioned above can be the process name. The port status information mentioned above indicates the port status. The protocol type information mentioned above indicates the protocol used for communication.

[0026] In some optional implementations of certain embodiments, the aforementioned execution entity can collect process information corresponding to processes running on the host to be monitored in the data center during a preset initial learning period through the following steps, and simultaneously collect network port information corresponding to the aforementioned processes, in order to generate a process behavior information set:

[0027] The first step involves periodically collecting process information corresponding to the processes running on the host in the data center during a preset initial learning period, at a preset collection frequency. Simultaneously, the network port information corresponding to these processes is collected. The collected process and network port information is then used as initial process behavior information. The network port information includes the port number, port status information, and protocol type information. For example, the preset collection frequency could be once every 5 minutes.

[0028] The second step is to determine the collected initial process behavior information as the initial process behavior information set.

[0029] Third, for each initial process behavior information in the above initial process behavior information set, perform the following steps:

[0030] The first sub-step involves extracting keywords from the process information included in the initial process behavior information to obtain keyword extraction information, wherein the keyword extraction information includes the process identifier. In practice, the aforementioned executing entity can use NLP keyword extraction technology to extract keywords (e.g., process identifiers) from the process information included in the initial process behavior information to obtain keyword extraction information.

[0031] The second sub-step involves determining the network port information, which includes the extracted keyword information and the initial process behavior information, as the process behavior information.

[0032] The fourth step is to define the determined process behavior information as a process behavior information set.

[0033] Step 102: Based on the process behavior information set, construct a dynamic process feature library and a dynamic process baseline information set.

[0034] In some embodiments, the aforementioned execution entity may construct a dynamic process feature library and a dynamic process baseline information set based on the aforementioned process behavior information set.

[0035] In some optional implementations of certain embodiments, the aforementioned execution entity may construct a dynamic process feature library and a dynamic process baseline information set based on the aforementioned process behavior information set through the following steps:

[0036] The first step is to deduplicate the process behavior information in the aforementioned process behavior information set to obtain a deduplicated process behavior information set. In practice, the aforementioned execution entity can use hash deduplication technology to deduplicate the process behavior information in the process behavior information set to obtain a deduplicated process behavior information set.

[0037] The second step is to perform the following steps for each deduplication process behavior information in the above deduplication process behavior information set:

[0038] The first sub-step involves determining the process identifier included in the above deduplication process behavior information as the process identifier to be queried.

[0039] The second sub-step involves querying the cumulative survival time of the process corresponding to the process identifier to be queried on the host to be monitored, and generating a trust score based on the cumulative survival time. In practice, the executing entity obtains a process lifecycle record table from the local host agent module (Agent). Then, the executing entity can obtain the cumulative survival time corresponding to the process identifier from the process lifecycle record table. Next, the cumulative survival time is compared with each survival interval in the preset survival time trust score mapping table, and the survival interval containing the cumulative survival time is determined as the target survival interval. The preset survival time trust score mapping table includes each survival interval and each preset mapping trust score, with each survival interval corresponding to a preset mapping trust score. Then, the preset mapping trust score corresponding to the target survival interval can be determined as the trust score. The survival interval can be a range of cumulative survival time (for example, the preset mapping trust score corresponding to the survival interval 36h-48h can be 8). The process lifecycle record table described above can be created and maintained by the local host agent module (Agent) to record the total runtime of each historical process instance that has ended on the host. This process lifecycle record table can be used to record and track the complete running history and lifespan of processes on the host.

[0040] The third sub-step is to obtain the current time as the update time.

[0041] The fourth sub-step involves determining the process identifier, the deduplication process behavior information (including network port information), the trust score, and the update time as process characteristic information.

[0042] The third step is to store the identified process characteristic information into a preset database. This preset database can be a relational database.

[0043] The fourth step is to define the preset database that stores the characteristic information of each process as the dynamic process characteristic database.

[0044] The fifth step is to generate a dynamic process baseline information set based on the process identifiers included in the above process behavior information set.

[0045] In some optional implementations of certain embodiments, the aforementioned execution entity may generate a dynamic process baseline information set based on the process identifiers included in the aforementioned process behavior information set through the following steps:

[0046] The first step is to deduplicate the process identifiers mentioned above, resulting in deduplicated process identifiers. In practice, a Set-based deduplication technique can be used to deduplicate the process identifiers.

[0047] The second step is to perform the following steps for each of the deduplication process identifiers mentioned above.

[0048] The first sub-step involves retrieving at least one process resource monitoring information corresponding to the aforementioned deduplication process identifier from a preset system log. Each of these process resource monitoring information segments includes resource usage information, memory usage information, and network traffic usage information. This information can represent the resource usage of the process corresponding to the deduplication process identifier at different points in the past. The resource usage information can be the instantaneous CPU utilization rate of the process corresponding to the deduplication process identifier at a given time (e.g., 15.2%). The memory usage information can be the instantaneous memory usage of the process corresponding to the deduplication process identifier at a given time (e.g., 1.2GB). The network traffic usage information can be the instantaneous network traffic of the process corresponding to the deduplication process identifier at a given time (e.g., inbound traffic of 10MB / s).

[0049] The second sub-step involves generating process resource baseline information based on the aforementioned at least one process resource monitoring information. In practice, the executing entity can determine at least one resource usage information included in the at least one process resource monitoring information. Then, the resource usage information with the lowest CPU utilization among the at least one resource usage information can be determined as the lower limit resource usage information. Then, the resource usage information with the highest CPU utilization among the at least one resource usage information can be determined as the upper limit resource usage information. Subsequently, the lower limit resource usage information and the upper limit resource usage information are determined as process resource baseline sub-information. Next, at least one memory usage information included in the at least one process resource monitoring information can be determined. Then, the memory usage information with the lowest memory usage among the at least one memory usage information can be determined as the lower limit memory usage information. Then, the memory usage information with the highest memory usage among the at least one resource usage information can be determined as the upper limit memory usage information. Then, the lower limit memory usage information and the upper limit memory usage information are determined as process resource baseline sub-information. Finally, at least one network traffic usage information included in the at least one process resource monitoring information can be determined. Then, the network traffic usage information with the lowest network traffic among the at least one network traffic usage information can be determined as the lower limit network traffic usage information. Then, the network traffic usage information representing the largest network traffic usage among at least one network traffic usage information is determined as the upper limit network traffic usage information. Next, the lower limit network traffic usage information and the upper limit network traffic usage information are determined as process resource baseline sub-information. Finally, each of the determined process resource baseline sub-information is confirmed as process resource baseline sub-information.

[0050] The third sub-step involves determining at least one network port information corresponding to the above deduplication process identifier as the network port baseline information.

[0051] The fourth sub-step involves determining the aforementioned process resource baseline information and network port baseline information as dynamic process baseline information.

[0052] The third step is to define the baseline information of each dynamic process as a dynamic process baseline information set.

[0053] In addressing the technical challenges mentioned above, the following technical issues often arise when implementing solutions for the application scenario: host security monitoring in large-scale data centers with periodic business load fluctuations (e.g., complex enterprise host operating environments where process behavior is affected by business cycles (e.g., weekdays / weekends)). Specifically, when generating process resource baseline information, the periodicity of process resource monitoring information is not considered, and different behavioral pattern baselines are not generated for different time periods. This makes it impossible to distinguish between normal resource usage fluctuations caused by business cycles (e.g., peak transaction times during weekdays and batch processing jobs at night on weekends) and genuine abnormal behavior. Using a uniform baseline across all time periods and alerting processes exceeding the baseline resource usage will generate numerous false alarms during peak business periods, while potentially ignoring actual low-baseline attacks during off-peak periods, leading to wasted alert resources. (For example, a database process reaching a CPU utilization peak of 60% at 10 AM on a weekday might be normal transaction load, but the same 60% utilization at 3 AM on a Sunday might indicate abnormal activity; using a uniform baseline across all time periods cannot effectively distinguish between these two scenarios.) The following requirements are necessary for this application scenario: It should be suitable for host security monitoring where process behavior is affected by business cycles (e.g., weekdays / weekends). To address the aforementioned technical challenges, we have decided to adopt the following solution:

[0054] In some embodiments, the aforementioned execution entity may generate process resource baseline information based on at least one of the aforementioned process resource monitoring information:

[0055] The first step is to determine at least one collection time corresponding to the at least one process resource monitoring information mentioned above. Each of the at least one process resource monitoring information has a corresponding collection time.

[0056] The second step is to sort the at least one process resource monitoring information according to at least one collection time to obtain a process resource monitoring information sequence. In practice, the process resource monitoring information can be sorted according to the order before and after the collection of at least one collection time to obtain the process resource monitoring information sequence.

[0057] The third step is to sort at least one piece of resource usage information included in the above process resource monitoring information sequence according to the order of the process resource monitoring information where the resource usage information is located, so as to obtain the resource usage information sequence.

[0058] Fourth, based on at least one of the above-mentioned collection times, the resource occupancy information sequence is grouped to obtain a weekday resource occupancy information sequence and a non-weekday resource occupancy information sequence. In practice, each resource occupancy information in the resource occupancy information sequence with a collection time on a weekday can be identified as a weekday resource occupancy information group. Each resource occupancy information in the resource occupancy information sequence with a collection time on a non-weekday can be identified as a non-weekday resource occupancy information group. Then, for each weekday resource occupancy information in the weekday resource occupancy information group, the collection time corresponding to the above-mentioned weekday resource occupancy information in at least one collection time can be identified as a first target collection time. Then, according to the determined first target collection times, the weekday resource occupancy information in the weekday resource occupancy information group is sorted to obtain a weekday resource occupancy information sequence. The collection time corresponding to the above-mentioned non-weekday resource occupancy information in at least one collection time can be identified as a second target collection time. Then, according to the determined second target collection times, the non-weekday resource occupancy information in the non-weekday resource occupancy information group is sorted to obtain a non-weekday resource occupancy information sequence.

[0059] The fifth step involves performing sliding window smoothing on the above-mentioned weekday resource usage information sequence and the above-mentioned non-weekday resource usage information sequence to obtain a smoothed weekday resource usage information sequence and a smoothed non-weekday resource usage information sequence. In practice, the execution entity can slide and group the weekday resource usage information sequence and the non-weekday resource usage information sequence according to a preset sliding window size (e.g., 3) and sliding step size (e.g., 1) to obtain a weekday resource usage information group sequence and a non-weekday resource usage information group sequence. For each weekday resource usage information group in the weekday resource usage information group sequence, the average value of each CPU utilization rate represented by each weekday resource usage information in the weekday resource usage information group can be determined as the smoothed weekday resource usage information. Then, the obtained smoothed weekday resource usage information is arranged according to the order of its corresponding weekday resource usage information group in the weekday resource usage information group sequence to obtain the smoothed weekday resource usage information sequence. For each non-working day resource usage information group in the non-working day resource usage information group sequence, the average value of each CPU utilization rate represented by each non-working day resource usage information in the non-working day resource usage information group can be determined as the working day smoothed resource usage information. Then, the obtained working day smoothed resource usage information is arranged according to the order of its corresponding non-working day resource usage information group in the non-working day resource usage information group sequence to obtain the non-working day smoothed resource usage information sequence.

[0060] Step 6: Based on the aforementioned weekday smoothed resource usage information sequence and the aforementioned non-weekday smoothed resource usage information sequence, generate weekday resource usage baseline information and non-weekday resource usage baseline information. In practice, the weekday smoothed resource usage information representing the lowest CPU utilization in the weekday smoothed resource usage information sequence can be determined as the first target lower limit resource usage information. Then, the weekday smoothed resource usage information representing the highest CPU utilization in the weekday smoothed resource usage information sequence is determined as the first target upper limit resource usage information. Afterwards, the first target lower limit resource usage information and the first target upper limit resource usage information are determined as the weekday resource usage baseline information. Similarly, the non-weekday smoothed resource usage information representing the lowest CPU utilization in the non-weekday smoothed resource usage information sequence can be determined as the second target lower limit resource usage information. Then, the non-weekday smoothed resource usage information representing the highest CPU utilization in the non-weekday smoothed resource usage information sequence is determined as the second target upper limit resource usage information. Afterwards, the second target lower limit resource usage information and the second target upper limit resource usage information are determined as the non-weekday resource usage baseline information.

[0061] Step 7: Sort and group at least one memory usage information within the process resource monitoring information sequence according to the order of the process resource monitoring information containing the memory usage information, to generate a weekday memory usage information sequence and a non-weekday memory usage information sequence. In practice, the at least one memory usage information within the process resource monitoring information sequence can be sorted according to the order of the process resource monitoring information containing the memory usage information within the process resource monitoring information sequence to obtain the memory usage information sequence. Then, at least one memory usage information in the memory usage information sequence whose collection time is a weekday can be identified, and this identified at least one memory usage information can be sorted according to its order in the memory usage information sequence to obtain the weekday memory usage information sequence. Next, at least one memory usage information in the memory usage information sequence whose collection time is a non-weekday can be identified, and this identified at least one memory usage information can be sorted according to its order in the memory usage information sequence to obtain the non-weekday memory usage information sequence.

[0062] Step 8: Perform sliding window smoothing on the weekday memory usage information sequence and the non-weekday memory usage information sequence respectively to generate weekday memory usage baseline information and non-weekday memory usage baseline information. In practice, sliding window smoothing can be performed on the weekday memory usage information sequence and the non-weekday memory usage information sequence separately to obtain smoothed weekday memory usage information sequences and smoothed non-weekday memory usage information sequences. Then, the weekday smoothed memory usage information with the smallest memory usage in the weekday smoothed memory usage information sequence can be determined as the first target lower limit memory usage information. Then, the weekday smoothed memory usage information with the largest memory usage in the weekday smoothed memory usage information sequence can be determined as the first target upper limit memory usage information. Afterwards, the first target upper limit memory usage information and the first target lower limit memory usage information are determined as the weekday memory usage baseline information. The non-weekday smoothed memory usage information with the smallest memory usage in the non-weekday smoothed memory usage information sequence can be determined as the second target upper limit memory usage information. Subsequently, the lower limit memory usage information of the second target and the upper limit memory usage information of the second target were determined as the baseline information for memory usage on non-working days.

[0063] Step 9: Following the order of the process resource monitoring information containing the network traffic usage information within the process resource monitoring information sequence, sort and group at least one piece of network traffic usage information included in the aforementioned process resource monitoring information sequence to generate a weekday network traffic usage information sequence and a non-weekday network traffic usage information sequence. In practice, the network traffic usage information sequence is obtained by sorting at least one piece of network traffic usage information included in the aforementioned process resource monitoring information sequence according to the order of the process resource monitoring information containing the network traffic usage information within the process resource monitoring information sequence. Then, at least one piece of network traffic usage information in the network traffic usage information sequence whose collection time is a weekday can be determined. This determined at least one piece of network traffic usage information is then sorted according to its order within the network traffic usage information sequence to obtain the weekday network traffic usage information sequence. Next, at least one piece of network traffic usage information in the network traffic usage information sequence whose collection time is a non-weekday can be determined. This determined at least one piece of network traffic usage information is then sorted according to its order within the network traffic usage information sequence to obtain the non-weekday network traffic usage information sequence.

[0064] Step 10: Perform sliding window smoothing on the weekday network traffic usage information sequence and the non-weekday network traffic usage information sequence respectively to generate weekday network traffic usage baseline information and non-weekday network traffic usage baseline information. In practice, sliding window smoothing can be performed on the weekday network traffic usage information sequence and the non-weekday network traffic usage information sequence separately to obtain smoothed weekday network traffic usage information sequences and smoothed non-weekday network traffic usage information sequences. Then, the weekday smoothed network traffic usage information representing the minimum network traffic in the weekday smoothed network traffic usage information sequence can be determined as the first target lower limit network traffic usage information. Then, the weekday smoothed network traffic usage information representing the maximum network traffic in the weekday smoothed network traffic usage information sequence can be determined as the first target upper limit network traffic usage information. Afterwards, the first target upper limit network traffic usage information and the first target lower limit network traffic usage information are determined as the weekday network traffic usage baseline information. The non-weekday smoothed network traffic usage information representing the minimum network traffic in the non-weekday smoothed network traffic usage information sequence can be determined as the second target lower limit network traffic usage information. Then, the non-working day smoothed network traffic occupancy information representing the largest network traffic in the non-working day smoothed network traffic occupancy information sequence is determined as the second target upper limit network traffic occupancy information. Subsequently, the second target lower limit network traffic occupancy information and the second target upper limit network traffic occupancy information are determined as the non-working day network traffic occupancy baseline information.

[0065] Step 11: Determine the baseline information of resource usage on weekdays, resource usage on non-weekdays, memory usage on weekdays, memory usage on non-weekdays, network traffic usage on weekdays, and network traffic usage on non-weekdays as the process resource baseline information.

[0066] The above technical solution, combined with steps 1034 to 1035 and related content, serves as an inventive point of this disclosure, solving the technical problem of "waste of early warning resources." Factors leading to the waste of early warning resources often include: failure to consider the periodicity of process resource monitoring information when generating process resource baseline information; failure to generate different behavioral pattern baselines for different time periods; inability to distinguish between normal resource usage fluctuations caused by business cycles (such as peak daytime transactions on weekdays and batch processing jobs on weekend nights) and genuine abnormal behavior; and the use of a uniform baseline across all time periods, resulting in alerts for processes exceeding the baseline resource usage on the host. This leads to numerous false alarms during peak business periods and may overlook actual low-baseline attacks during off-peak periods, resulting in wasted early warning resources. Solving these factors can reduce the waste of early warning resources. To achieve this effect, this solution employs precise sorting and grouping based on collection time, distinguishing between weekday and non-weekday behavior patterns. This generates process resource baseline information, including baselines for weekday resource usage, non-weekday resource usage, weekday memory usage, non-weekday memory usage, weekday network traffic usage, and non-weekday network traffic usage. Therefore, taking into account the periodicity of process resource monitoring information, and for different time periods, different behavioral pattern baselines—i.e., process resource baseline information—are generated for each process, establishing normal behavior benchmarks that conform to its business patterns at different times. Therefore, combining step 1034, based on the dynamic process baseline information set, dynamic baseline security detection processing is performed on the behavior information of the process to be detected to obtain the second dynamic risk detection information. Step 1035, based on the first and second dynamic risk detection information, performs host security early warning processing on the host to be monitored. This allows for the selection of a matching baseline (such as a weekday baseline or a non-weekday baseline) as a comparison standard during dynamic baseline security detection, which helps distinguish between normal resource usage fluctuations caused by business cycles (such as peak daytime transactions on weekdays and batch processing operations on weekend nights) and genuine abnormal behavior. This reduces false alarms and missed alarms in host security early warnings, and reduces the waste of early warning resources.

[0067] Step 103: Based on the dynamic process feature library and the initial process baseline information set, perform the following monitoring steps:

[0068] Step 1031: Collect process information and network port information corresponding to the processes on the host to be monitored.

[0069] In some embodiments, the aforementioned execution entity can collect process information of processes on the host to be monitored and the network port information corresponding to those processes. In practice, process information of processes on the host to be monitored at the current moment and the network port information corresponding to those processes can be collected through a Secure Communication Protocol (SSH) or a Local Host Agent module.

[0070] Step 1032: The collected process information and network port information are identified as the behavior information of the process to be detected.

[0071] In some embodiments, the aforementioned execution entity may determine the collected process information and the aforementioned network port information as the behavior information of the process to be detected.

[0072] Step 1033: Based on the dynamic process feature library, perform dynamic risk detection processing on the behavior information of the process to be detected, which integrates the process survival trust level, to obtain the first dynamic risk detection information.

[0073] In some embodiments, the aforementioned execution entity may perform dynamic risk detection processing on the aforementioned process behavior information to be detected, based on the aforementioned dynamic process feature library, and integrate process survival trust level to obtain first dynamic risk detection information.

[0074] In some optional implementations of certain embodiments, the aforementioned execution entity may perform dynamic risk detection processing on the behavior information of the process to be detected, based on the aforementioned dynamic process feature library, by fusing process liveness trust level, to obtain first dynamic risk detection information:

[0075] The first step is to determine the process information included in the above-mentioned process behavior information as the process information to be detected, wherein the above-mentioned process information to be detected includes the process identifier.

[0076] The second step is to identify the process identifier mentioned above as the process identifier to be inspected.

[0077] The third step is to query the trust score corresponding to the identifier of the process to be inspected from the dynamic process feature database mentioned above as the query trust score.

[0078] The fourth step is to determine the above query trust score as the first security score and use it as the first dynamic risk detection information.

[0079] In addressing the technical challenges mentioned above, the application scenario—host security monitoring in large-scale data centers with periodic business load fluctuations—often presents the following technical issues: Real-time process behavior detection typically relies on a single dimension (network behavior or resource usage) while ignoring temporal context. However, relying solely on a single characteristic (such as network behavior or resource usage) cannot comprehensively capture the true behavioral patterns of processes, easily leading to increased false positives and false negatives. Furthermore, some processes may be normal during specific time periods but abnormal at others; neglecting temporal characteristics may result in ineffective detection of abnormal processes, leading to untimely host security alerts. This application scenario requires the following characteristics: host security monitoring suitable for large-scale data centers with periodic business load fluctuations. Faced with these technical challenges, we have decided to adopt the following solution:

[0080] Step 1034: Based on the dynamic process baseline information set, perform dynamic baseline security detection processing on the behavior information of the process to be detected to obtain the second dynamic risk detection information.

[0081] In some embodiments, the aforementioned execution entity can perform dynamic baseline security detection processing on the behavior information of the process to be detected based on a dynamic process baseline information set to obtain second dynamic risk detection information:

[0082] The first step is to identify the network port information included in the above-mentioned process behavior information as the network port information to be matched.

[0083] The second step is to determine the process identifiers included in the above-mentioned process behavior information as the process identifiers to be matched.

[0084] The third step is to determine the dynamic process baseline information containing the process identifier to be matched in the above dynamic process baseline information set as the matching dynamic process baseline information. The matching dynamic process baseline information includes process resource baseline information and network port baseline information. The process resource baseline information includes weekday resource usage baseline information, non-weekday resource usage baseline information, weekday memory usage baseline information, non-weekday memory usage baseline information, weekday network traffic usage baseline information, and non-weekday network traffic usage baseline information. The network port baseline information includes at least one network port information.

[0085] The fourth step is to determine that, in response to the determination that there is no network port information in at least one network port information that is the same as the network port information to be matched, to determine the preset negative security score as the network port risk detection score.

[0086] The fifth step is to obtain the current process resource monitoring information corresponding to the above-mentioned process identifier to be matched. The current process resource monitoring information includes the current collection time, current resource usage information, current memory usage information, and current network traffic usage information.

[0087] Step 6: In response to determining that the current collection time meets the first preset condition, determine the weekday resource usage baseline information, weekday memory usage baseline information, and weekday network traffic usage baseline information included in the dynamic process baseline information. Based on the determined weekday resource usage baseline information, weekday memory usage baseline information, and weekday network traffic usage baseline information, perform security risk detection on the current process resource monitoring information to obtain a security risk detection score. The first preset condition can be that the time corresponding to the current collection time is a weekday. In practice, in response to determining that the CPU utilization rate represented by the current resource usage information included in the current process resource monitoring information is within the range of the CPU utilization rates corresponding to the first target lower limit resource usage information and the first target upper limit resource usage information included in the weekday resource usage baseline information, the executing entity can determine the first preset positive score as the resource usage score. In response to determining that the CPU utilization represented by the current resource usage information included in the current process resource monitoring information is not within the CPU utilization range (e.g., 15.2%-20%) corresponding to the first target lower limit resource usage information and the first target upper limit resource usage information included in the aforementioned workday resource usage baseline information, the aforementioned execution entity may determine a first preset negative score as the resource usage score. In response to determining that the memory usage represented by the current memory usage information included in the current process resource monitoring information is within the memory usage range (e.g., 1.2GB-2GB) corresponding to the first target upper limit memory usage information and the first target lower limit memory usage information included in the aforementioned workday memory usage baseline information, the aforementioned execution entity may determine a second preset positive score as the memory usage score. In response to determining that the memory usage represented by the current memory usage information included in the current process resource monitoring information is not within the memory usage range corresponding to the first target lower limit memory usage information and the first target upper limit memory usage information included in the aforementioned workday memory usage baseline information, the aforementioned execution entity may determine a second preset negative score as the memory usage score. In response to determining that the network traffic represented by the current network traffic usage information included in the current process resource monitoring information falls within the network traffic range corresponding to the first target upper limit network traffic usage information and the first target lower limit network traffic usage information included in the aforementioned workday network traffic usage baseline information (e.g., inbound 10MB / s - inbound 50MB / s), the executing entity may determine the third preset positive score as the network traffic usage score. In response to determining that the network traffic represented by the current network traffic usage information included in the current process resource monitoring information does not fall within the network traffic range corresponding to the first target lower limit network traffic usage information and the first target upper limit network traffic usage information included in the aforementioned workday network traffic usage baseline information, the executing entity may determine the third preset negative score as the network traffic score. Finally, the average of the resource usage score, memory usage score, and network traffic usage score is determined as the security risk detection score.

[0088] Step 7: In response to determining that the current collection time meets the second preset condition, determine the non-working day resource usage baseline information, non-working day memory usage baseline information, and non-working day network traffic usage baseline information included in the matching dynamic process baseline information. Based on the determined non-working day resource usage baseline information, non-working day memory usage baseline information, and non-working day network traffic usage baseline information, perform security risk detection on the current process resource monitoring information to obtain a security risk detection score. In response to determining that the CPU utilization rate represented by the current resource usage information included in the current process resource monitoring information is within the range of CPU utilization rates corresponding to the second target lower limit resource usage information and the second target upper limit resource usage information included in the non-working day resource usage baseline information, the executing entity can determine the first preset positive score as the resource usage score. In response to determining that the CPU utilization rate represented by the current resource usage information included in the current process resource monitoring information is not within the range of CPU utilization rates corresponding to the second target lower limit resource usage information and the second target upper limit resource usage information included in the non-working day resource usage baseline information (e.g., 15.2%-20%), the executing entity can determine the first preset negative score as the resource usage score. In response to determining that the memory usage represented by the current memory usage information included in the current process resource monitoring information is within the memory usage range (e.g., 1.2GB-2GB) corresponding to the second target upper limit memory usage information and the second target lower limit memory usage information included in the aforementioned non-working day memory usage baseline information, the executing entity may determine the second preset positive score as the memory usage score. In response to determining that the memory usage represented by the current memory usage information included in the current process resource monitoring information is not within the memory usage range corresponding to the second target lower limit memory usage information and the second target upper limit memory usage information included in the aforementioned non-working day memory usage baseline information, the executing entity may determine the second preset negative score as the memory usage score. In response to determining that the network traffic represented by the current network traffic usage information included in the current process resource monitoring information is within the network traffic range (e.g., inbound 10MB / s-50MB / s) corresponding to the second target upper limit network traffic usage information and the second target lower limit network traffic usage information included in the aforementioned non-working day network traffic usage baseline information, the executing entity may determine the third preset positive score as the network traffic usage score. In response to the determination that the network traffic represented by the current network traffic usage information included in the current process resource monitoring information is not within the network traffic range corresponding to the second target lower limit network traffic usage information and the second target upper limit network traffic usage information included in the aforementioned non-working day network traffic usage baseline information, the aforementioned executing entity may determine the third preset negative score as the network traffic score. Finally, the average of the resource usage score, memory usage score, and network traffic usage score is determined as the security risk detection score.

[0089] Step 8: Based on the network port risk detection score and the security risk detection score, generate second dynamic risk detection information. In practice, the aforementioned implementing entity can determine the average of the network port risk detection score and the security risk detection score as the second security score, which serves as the second dynamic risk detection information.

[0090] The above-described technical solution and its related content, as an inventive point of this disclosure, solve the technical problem of "increased false alarms and missed alarms, and untimely host security warnings." Factors leading to increased false alarms and missed alarms, and untimely host security warnings, are often as follows: When performing real-time detection of process behavior, security detection is typically based on only a single dimension (network behavior or resource usage) and ignores the temporal context. However, relying solely on a single feature (such as network behavior or resource usage) cannot comprehensively capture the true behavioral patterns of a process, easily leading to increased false alarms and missed alarms. Furthermore, some processes may be normal during specific time periods but abnormal at other times; neglecting time characteristics may result in the inability to effectively detect abnormal processes, leading to untimely host security warnings. Solving these factors can achieve the goal of reducing the number of false alarms and missed alarms and untimely host security warnings. To achieve this, firstly, the network port information included in the above-mentioned process behavior information to be detected is determined as the network port information to be matched. Then, the process identifier included in the above-mentioned process behavior information to be detected is determined as the process identifier to be matched. Subsequently, the dynamic process baseline information containing the process identifier to be matched is determined as the matching dynamic process baseline information. This matching dynamic process baseline information includes process resource baseline information and network port baseline information. The process resource baseline information includes weekday resource usage baseline information, non-weekday resource usage baseline information, weekday memory usage baseline information, non-weekday memory usage baseline information, weekday network traffic usage baseline information, and non-weekday network traffic usage baseline information. The network port baseline information includes at least one network port. In response to determining that no network port information in at least one network port is identical to the network port information to be matched, a preset negative security score is determined as the network port risk detection score. Thus, a preliminary risk assessment can be performed from the network port dimension. The current process resource monitoring information corresponding to the process identifier to be matched is obtained. This current process resource monitoring information corresponds to the current collection time and includes current resource usage information, current memory usage information, and current network traffic usage information. In response to determining that the current collection time meets the first preset condition, the system determines the weekday resource usage baseline information, weekday memory usage baseline information, and weekday network traffic usage baseline information included in the dynamic process baseline information, and performs security risk detection on the current process resource monitoring information based on the determined weekday resource usage baseline information, weekday memory usage baseline information, and weekday network traffic usage baseline information, and obtains a security risk detection score.In response to the determination that the current collection time meets the second preset condition, the baseline information on non-working day resource usage, non-working day memory usage, and non-working day network traffic usage included in the dynamic process baseline information is determined. Based on the determined baseline information on non-working day resource usage, non-working day memory usage, and non-working day network traffic usage, security risk detection is performed on the current process resource monitoring information to obtain a security risk detection score. Thus, baseline information from different time periods can be used to detect process resource usage, fully considering the time context. Based on the network port risk detection score and the security risk detection score, second dynamic risk detection information is generated. Finally, based on the network port risk detection score and the security risk detection score, the second dynamic risk detection information is generated, and combined with step 1035 based on the first and second dynamic risk detection information, host security warning processing is performed on the host to be monitored. A comprehensive detection of process behavior can be performed from two dimensions: network port and process resource usage, combined with the time context, to obtain more accurate second dynamic risk detection information. Because it employs a multi-dimensional detection method that incorporates time characteristics, it can more comprehensively and accurately capture the true behavior patterns of processes, reduce false alarms and missed alarms, and detect abnormal processes in a timely and effective manner, thereby ensuring the timeliness of host security alerts.

[0091] Step 1035: Based on the first dynamic risk detection information and the second dynamic risk detection information, perform host security warning processing on the host to be monitored, and in response to the determination that the dynamic process feature library and the dynamic process baseline information set have not been updated, perform the monitoring steps again according to the dynamic process feature library and the dynamic process baseline information set.

[0092] In some embodiments, the aforementioned execution entity can perform host security early warning processing on the host to be monitored based on the first dynamic risk detection information and the second dynamic risk detection information, and in response to determining that the dynamic process feature library and the dynamic process baseline information set have not been updated, perform the aforementioned monitoring steps again based on the dynamic process feature library and the dynamic process baseline information set. In practice, in response to determining that the average of the security scores represented by the first dynamic risk detection information and the second dynamic risk detection information is determined as the process trust score. In response to determining that the process trust score is less than or equal to a preset threshold, the aforementioned execution entity can send the identifier of the host to be monitored as early warning information to the maintenance terminal (e.g., the mobile phone used by the maintenance personnel).

[0093] Optionally, the aforementioned implementing entity may also perform the following steps:

[0094] The first step is to generate a process trust score based on the first and second dynamic risk detection information. In practice, the aforementioned executing entity can determine the process trust score as the average of the security scores represented by the first and second dynamic risk detection information.

[0095] The second step is to store the behavior information of the process to be detected in a preset queue in response to the determination that the process trust score is greater than or equal to the preset trust threshold.

[0096] Third, after a preset time period, based on a preset queue, the dynamic process feature library and dynamic process baseline information set are reconstructed to update the dynamic process feature library and the initial process baseline information set. In practice, the behavior information of each process to be detected stored in the preset queue can be used to determine the updated process behavior information set. The execution entity can then reconstruct the dynamic process feature library and dynamic process baseline information set based on the updated process behavior information set, respectively serving as the updated dynamic process feature library and the updated dynamic process baseline information set. The updated dynamic process feature library and the updated dynamic process baseline information set are then used to update the dynamic process feature library and the initial process baseline information set.

[0097] The fourth step involves repeating the above monitoring steps based on the updated dynamic process feature library and the initial process baseline information set.

[0098] The above-described embodiments of this disclosure have the following beneficial effects: the host security early warning method in a data center according to some embodiments of this disclosure reduces the waste of early warning resources. Specifically, the reason for the waste of early warning resources is that deploying security probes or agents to perform security detection on processes on hosts in the data center based on a static malware signature library for host security early warning is often not adapted to dynamically changing computing environments and cannot reflect new trends in processes or network activities running on the host in real time. This results in poor detection capabilities when facing new processes, variant malware, and changes in normal behavior, leading to an increase in the number of false alarms and missed alarms, thus wasting early warning resources. Based on this, the host security early warning method in a data center according to some embodiments of this disclosure firstly collects process information corresponding to processes running on the host to be monitored in the data center during a preset initial learning period, and simultaneously collects network port information corresponding to the processes to generate a process behavior information set. Then, based on the process behavior information set, a dynamic process signature library and a dynamic process baseline information set are constructed. Thus, the collected process behavior information set can be used to construct a dynamic process signature library and a dynamic baseline information set to reflect the normal process behavior on the current host. Furthermore, the dynamic process feature library and dynamic process baseline information set are constantly updated. Next, based on the dynamic process feature library and the initial process baseline information set, the following monitoring steps are performed: First, process information and corresponding network port information of the processes on the host to be monitored are collected. This allows for the continuous collection of the latest process information and its corresponding network port information on the host to be monitored during the monitoring phase. Second, the collected process information and the aforementioned network port information are identified as the behavior information of the process to be detected. Third, based on the aforementioned dynamic process feature library, dynamic risk detection processing based on process liveness trust level is performed on the behavior information of the process to be detected to obtain the first dynamic risk detection information. This allows for risk detection of the behavior information of the process to be detected, taking into account the liveness trust level of the process, thereby reducing false alarms for highly liveness trusted processes due to business adjustments (e.g., a long-term stable process may be assessed as low risk due to its high liveness trust level when undergoing legitimate changes (such as listening on a new port)). Afterwards, based on the dynamic process baseline information set, dynamic baseline security detection processing is performed on the behavior information of the process to be detected to obtain the second dynamic risk detection information. Because the dynamic process baseline information set can be dynamically adjusted as business grows, it avoids misjudging normal developments as abnormalities and reduces false alarms. Next, based on the first and second dynamic risk detection information, host security warnings are issued to the monitored host. Furthermore, in response to the determination that the dynamic process feature library and dynamic process baseline information set have not been updated, the aforementioned monitoring steps are executed again based on the dynamic process feature library and dynamic process baseline information set.Because of the creation of a constantly updated dynamic process signature library and dynamic process baseline information set, it can reflect the new trends of processes or network activities running on the host in real time, and can better adapt to the detection of new processes, variant malware and normal behavior changes, thereby reducing the number of false alarms and missed alarms, and reducing the waste of warning resources.

[0099] Further reference Figure 2 As an implementation of the methods shown in the figures, this disclosure provides some embodiments of a host security early warning device in a data center, and these device embodiments are similar to... Figure 1 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.

[0100] like Figure 2 As shown, a host security early warning device 200 in a data center according to some embodiments includes: an acquisition unit 201, a generation unit 202, and a processing unit 203. The acquisition unit 201 is configured to collect process information corresponding to processes running on the host to be monitored during a preset initial learning period, and simultaneously collect network port information corresponding to the processes, to generate a process behavior information set. The generation unit 202 is configured to build a dynamic process feature library and a dynamic process baseline information set based on the process behavior information set. The monitoring unit 203 is configured to perform the following monitoring steps based on the dynamic process feature library and the initial process baseline information set: collecting process information of processes on the host to be monitored and network port information corresponding to the processes; and processing the collected process information and network port information... The process behavior information is identified as the target process behavior information. Based on the aforementioned dynamic process feature library, dynamic risk detection processing based on process liveness trust level is performed on the target process behavior information to obtain first dynamic risk detection information. Based on the dynamic process baseline information set, dynamic baseline security detection processing is performed on the target process behavior information to obtain second dynamic risk detection information. Based on the first and second dynamic risk detection information, host security warning processing is performed on the host to be monitored. In response to the determination that the dynamic process feature library and dynamic process baseline information set have not been updated, the aforementioned monitoring steps are executed again based on the dynamic process feature library and dynamic process baseline information set.

[0101] It is understandable that the units described in the device 200 are related to the reference. Figure 1 The steps in the method described above correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the device 200 and the units contained therein, and will not be repeated here.

[0102] The following is for reference. Figure 3 It shows a schematic diagram of the structure of an electronic device 300 suitable for implementing some embodiments of the present disclosure. Figure 3The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0103] like Figure 3 As shown, the electronic device 300 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the electronic device 300. The processing unit 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0104] Typically, the following devices can be connected to I / O interface 305: input devices 306 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 307 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 308 including, for example, magnetic tapes, hard disks, etc.; and communication devices 309. Communication device 309 allows electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 3 An electronic device 300 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 3 Each box shown can represent a device or multiple devices as needed.

[0105] In particular, according to some embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 309, or installed from storage device 308, or installed from ROM 302. When the computer program is executed by processing device 301, it performs the functions defined in the methods of some embodiments of this disclosure.

[0106] It should be noted that, in some embodiments of this disclosure, the computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In some embodiments of this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0107] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0108] Computer-readable media may be contained within an electronic device or may exist independently, not assembled into the electronic device. The computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: For a host to be monitored in a data center, during a preset initial learning period, collect process information corresponding to processes running on the host to be monitored, and simultaneously collect network port information corresponding to the aforementioned processes to generate a process behavior information set; based on the aforementioned process behavior information set, construct a dynamic process feature library and a dynamic process baseline information set; based on the dynamic process feature library and the initial process baseline information set, perform the following monitoring steps: collect process information of processes on the host to be monitored and network port information corresponding to the aforementioned processes; and combine the collected process information and the aforementioned network port information... Network port information is identified as the behavior information of the process to be detected. Based on the aforementioned dynamic process feature library, dynamic risk detection processing based on the process liveness trust level is performed on the behavior information of the process to be detected to obtain first dynamic risk detection information. Based on the dynamic process baseline information set, dynamic baseline security detection processing is performed on the behavior information of the process to be detected to obtain second dynamic risk detection information. Based on the first dynamic risk detection information and the second dynamic risk detection information, host security warning processing is performed on the host to be monitored. In response to the determination that the dynamic process feature library and the dynamic process baseline information set have not been updated, the aforementioned monitoring steps are executed again according to the dynamic process feature library and the dynamic process baseline information set.

[0109] Computer program code for performing operations of some embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0110] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0111] The units described in some embodiments of this disclosure can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor may be described as including an acquisition unit, a generation unit, and a processing unit. The names of these units do not necessarily limit the specific unit itself. For example, the acquisition unit may be described as "a unit that, for a host to be monitored in a data center, collects process information corresponding to processes running on the host to be monitored during a preset initial learning period, and simultaneously collects network port information corresponding to the aforementioned processes, in order to generate a process behavior information set."

[0112] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0113] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of technical features, but should also cover other technical solutions formed by arbitrary combinations of technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A host security early warning method in a data center, comprising: For the host to be monitored in the data center, process information corresponding to the processes running on the host to be monitored is collected during the preset initial learning period, and network port information corresponding to the processes is also collected to generate a process behavior information set. Based on the process behavior information set, a dynamic process feature library and a dynamic process baseline information set are constructed, wherein the process behavior information includes process identifiers, and the construction of the dynamic process feature library and dynamic process baseline information set based on the process behavior information set includes: The process behavior information in the process behavior information set is deduplicated to obtain a deduplicated process behavior information set. For each piece of deduplication process behavior information in the deduplication process behavior information set, perform the following steps: The process identifier included in the deduplication process behavior information is determined as the process identifier to be queried; The cumulative survival time of the process corresponding to the process identifier to be queried on the host to be monitored is queried, and a trust score is generated based on the cumulative survival time; Get the current time as the update time; The process identifier, the deduplication process behavior information including network port information, the trust score, and the update time are determined as process feature information; Store the identified process characteristic information into a preset database; The preset database storing the characteristic information of each process is defined as the dynamic process characteristic database; Based on the process identifiers included in the process behavior information set, a dynamic process baseline information set is generated; Based on the dynamic process feature library and the initial process baseline information set, the following monitoring steps are performed: Collect process information of processes on the host to be monitored and the network port information corresponding to the processes; The collected process information and the network port information are determined as the behavior information of the process to be detected; Based on the dynamic process feature library, the behavior information of the process to be detected is subjected to dynamic risk detection processing that integrates process survival trust level to obtain the first dynamic risk detection information. Based on the dynamic process baseline information set, dynamic baseline security detection processing is performed on the behavior information of the process to be detected to obtain the second dynamic risk detection information. Based on the first dynamic risk detection information and the second dynamic risk detection information, host security early warning processing is performed on the host to be monitored, and in response to the determination that the dynamic process feature library and the dynamic process baseline information set have not been updated, the monitoring steps are executed again according to the dynamic process feature library and the dynamic process baseline information set.

2. The method according to claim 1, wherein, The method further includes: Based on the first dynamic risk detection information and the second dynamic risk detection information, a process trust score is generated; In response to determining that the process trust score is greater than or equal to the preset trust threshold, the behavior information of the process to be detected is stored in the preset queue; After a preset time period, based on a preset queue, the dynamic process feature library and the dynamic process baseline information set are reconstructed to update the dynamic process feature library and the initial process baseline information set. Based on the updated dynamic process feature library and the initial process baseline information set, the monitoring steps are executed again.

3. The method according to claim 1, wherein, For the host to be monitored in the data center, during a preset initial learning period, process information corresponding to the processes running on the host to be monitored is collected, and network port information corresponding to the processes is also collected to generate a process behavior information set, including: For the host to be monitored in the data center, during the preset initial learning period, process information corresponding to the processes running on the host to be monitored is collected periodically at a preset collection frequency, and network port information corresponding to the processes is collected at the same time. The process information and network port information collected each time are determined as the initial process behavior information. The network port information includes port number, port status information and protocol type information. The collected initial process behavior information is defined as the initial process behavior information set. For each initial process behavior information in the initial process behavior information set, perform the following steps: Keywords are extracted from the process information included in the initial process behavior information to obtain keyword extraction information, wherein the keyword extraction information includes the process identifier; The network port information included in the keyword extraction information and the initial process behavior information is determined as the process behavior information; The determined process behavior information is used to define a process behavior information set.

4. The method according to claim 1, wherein, The generation of a dynamic process baseline information set based on the process identifiers included in the process behavior information set includes: The process identifiers are deduplicated to obtain the deduplicated process identifiers. For each deduplication process identifier in the aforementioned deduplication process identifiers, perform the following steps; Obtain at least one process resource monitoring information corresponding to the deduplication process identifier from the preset system log; Based on the at least one process resource monitoring information, process resource baseline information is generated; At least one network port information corresponding to the deduplication process identifier in the process behavior information set is determined as the network port baseline information; The process resource baseline information and the network port baseline information are determined as dynamic process baseline information; The determined baseline information of each dynamic process is used to define the dynamic process baseline information set.

5. The method according to claim 1, wherein, The dynamic risk detection process, based on the dynamic process feature library, performs dynamic risk detection processing on the behavior information of the process to be detected, fusing process survival trust level, to obtain first dynamic risk detection information, including: The process information included in the behavior information of the process to be detected is determined as the process information to be detected, wherein the process information to be detected includes a process identifier; The process identifier is determined as the process identifier to be inspected; The trust score corresponding to the identifier of the process to be inspected is retrieved from the dynamic process feature database and used as the query trust score. The query trust score is determined as the first security score and used as the first dynamic risk detection information.

6. A host security early warning device for a data center, comprising: The acquisition unit is configured to collect process information corresponding to the processes running on the host to be monitored in the data center during a preset initial learning period, and at the same time collect the network port information corresponding to the processes, so as to generate a process behavior information set. The construction unit is configured to construct a dynamic process feature library and a dynamic process baseline information set based on the process behavior information set. The process behavior information includes process identifiers. The construction of the dynamic process feature library and dynamic process baseline information set based on the process behavior information set includes: deduplicating the process behavior information in the process behavior information set to obtain a deduplicated process behavior information set; for each deduplicated process behavior information in the deduplicated process behavior information set, performing the following steps: determining the process identifier included in the deduplicated process behavior information as the process identifier to be queried; querying the cumulative survival time of the process corresponding to the process identifier to be queried on the host to be monitored, and generating a trust score based on the cumulative survival time; obtaining the current time as the update time; determining the process identifier, the network port information included in the deduplicated process behavior information, the trust score, and the update time as process feature information; storing each determined process feature information in a preset database; determining the preset database storing each process feature information as the dynamic process feature library; and generating a dynamic process baseline information set based on each process identifier included in the process behavior information set. The monitoring unit is configured to perform the following monitoring steps based on a dynamic process feature library and an initial process baseline information set: collecting process information of processes on the host to be monitored and network port information corresponding to those processes; determining the collected process information and network port information as the behavior information of the process to be detected; performing dynamic risk detection processing on the behavior information of the process to be detected based on the dynamic process feature library and the fusion of process liveness trust level to obtain first dynamic risk detection information; performing dynamic baseline security detection processing on the behavior information of the process to be detected based on the dynamic process baseline information set to obtain second dynamic risk detection information; performing host security early warning processing on the host to be monitored based on the first and second dynamic risk detection information; and, in response to determining that the dynamic process feature library and the dynamic process baseline information set have not been updated, re-executing the monitoring steps according to the dynamic process feature library and the dynamic process baseline information set.

7. An electronic device, comprising: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 5.

8. A computer-readable medium having a computer program stored thereon, wherein, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 5.

Images