Terminal security monitoring method and device, electronic equipment, product and storage medium

Abstract

The invention relates to the technical field of safety monitoring, and provides a terminal safety monitoring method and device, electronic equipment, a product and a storage medium. The method comprises the following steps: acquiring baseline data of a multi-source terminal; preprocessing the baseline data to obtain preprocessed baseline data; inputting the preprocessed baseline data and rules in the baseline rule base into a multi-source data anomaly analysis model to obtain an abnormal event recognition result; updating a baseline rule base based on the abnormal event recognition result; inputting the abnormal event identification result and rules in a strategy rule base into a security decision model to obtain an abnormal event processing strategy; updating a strategy rule base based on the abnormal event processing strategy; and performing exception processing on the multi-source terminal based on the exception event processing strategy. According to the method and the device, novel abnormal events which change rapidly and change continuously can be identified in time, and the processing efficiency and accuracy of the abnormal events are improved, so that the security of the terminal can be effectively ensured.

Description

Technical Field

[0001] This application relates to the field of security monitoring technology, specifically to a terminal security monitoring method, device, electronic equipment, product, and storage medium. Background Technology

[0002] Terminal security monitoring is a crucial measure to ensure that smart terminals are protected from external threats and attacks during operation, thereby guaranteeing system stability, reliability, and security. By monitoring and analyzing terminal behavior in real time, potential abnormal behaviors and attacks can be detected and prevented promptly, reducing the risk of security vulnerabilities and protecting user privacy data and important information from leakage or tampering, ensuring the secure operation of smart terminals in the network environment. This is of paramount importance for the normal functioning of smart terminals, improved user experience, and the overall security of information systems.

[0003] While existing smart terminal security monitoring methods can quickly and accurately collect and summarize relevant data transmitted back by smart terminals through 5G or other transmission methods, and identify abnormal events based on rules in the rule base, on the one hand, the rule base has limited coverage and low update frequency, making it impossible to identify rapidly changing and constantly evolving new abnormal events in a timely manner; on the other hand, the handling of abnormal events usually relies on a lot of manual intervention and manual operation, resulting in low efficiency and accuracy in handling abnormal events.

[0004] In summary, existing smart terminal security monitoring methods are unable to promptly identify rapidly changing and constantly evolving new anomaly events, and their processing efficiency and accuracy for anomaly events are both low, resulting in significant risks to terminal security. Summary of the Invention

[0005] This application provides a terminal security monitoring method, device, electronic device, product, and storage medium to address the technical problem that existing smart terminal security monitoring methods are unable to promptly identify rapidly changing and constantly evolving new abnormal events, and have low efficiency and accuracy in handling abnormal events, resulting in significant risks to terminal security.

[0006] In a first aspect, embodiments of this application provide a terminal security monitoring method, including: Collect baseline data from multiple source terminals; The baseline data is preprocessed to obtain preprocessed baseline data; The preprocessed baseline data and the rules in the baseline rule base are input into the multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model. The baseline rule base is updated based on the abnormal event identification results; The abnormal event identification results and the rules in the policy rule base are input into the security decision model to obtain the abnormal event handling strategy output by the security decision model. Update the policy rule base based on the aforementioned abnormal event handling strategy; Based on the aforementioned abnormal event handling strategy, abnormal events are handled for the multi-source terminals.

[0007] In one embodiment, preprocessing the baseline data to obtain preprocessed baseline data includes: The baseline data is cleaned to remove duplicates, resulting in deduplicated baseline data. The deduplicated baseline data is then subjected to anti-fluctuation cleaning to obtain anti-fluctuation baseline data; The baseline data after wave reduction is filled in to obtain preprocessed baseline data.

[0008] In one embodiment, the process of deduplicating and cleaning the baseline data to obtain deduplicated baseline data includes: The baseline data is converted to lowercase to obtain lowercase baseline data; For each word group in the lowercase baseline data, a feature vector of the word group is obtained based on the number of documents in the device document set to which the lowercase baseline data belongs, and the frequency of the word group in its own document. The feature vector is input into multiple hash functions to obtain multiple hash values; For each document in the device document set, the minimum value of multiple hash values ​​corresponding to each word group in the document is obtained, and the minimum hash value corresponding to each word group is determined as the feature hash value of the document. The feature hash value is input into multiple bucket hash functions to obtain multiple bucket hash values, and the minimum value among the multiple bucket hash values ​​is determined as the category value of the document; For each pair of documents in each document, the similarity between the two documents is calculated based on their category values. If the similarity is greater than a similarity threshold, the baseline data in either of the two documents is deleted to obtain the deduplicated baseline data.

[0009] In one embodiment, performing fluctuation-removing cleaning on the deduplicated baseline data to obtain fluctuation-removed baseline data includes: The deduplicated baseline data are arranged in chronological order to obtain the first baseline time series; A smoothing window is set for the first baseline time series. For each target baseline data within the smoothing window, a weight matrix of the target baseline data is obtained based on the standard deviation of each baseline data within the smoothing window and other baseline data within the smoothing window besides the target baseline data. Based on the weight matrix, the regression coefficients between the other baseline data and their corresponding time points are calculated; Based on the regression coefficients, calculate the smoothed value of the target baseline data; Calculate the difference between each target baseline data and its corresponding smoothed value to obtain a difference sequence; Based on the mean and standard deviation of the difference sequence, the fluctuation threshold is determined; Based on the fluctuation threshold, abnormal fluctuation data in the deduplicated baseline data are determined; The abnormal fluctuation data is deleted to obtain the baseline data after fluctuation removal.

[0010] In one embodiment, the step of imputing missing data in the de-fluctuation baseline data to obtain preprocessed baseline data includes: The de-fluctuated baseline data is arranged in chronological order, and placeholders are used to fill in the missing parts to obtain the second baseline time series. A time window is set for the second baseline time series, and the baseline data within the time window is input into the autoencoder to obtain the preliminary fill data output by the autoencoder; The initial padding data is input into the least squares generative adversarial network to obtain the undetermined padding data output by the least squares generative adversarial network. With the goal of minimizing the generator loss and discriminator loss of the least squares generative adversarial network, the parameters of the least squares generative adversarial network are adjusted, and the process of inputting the initial padding data into the least squares generative adversarial network is repeated until the final padding data is obtained. The placeholders are replaced with the final fill data to obtain the preprocessed baseline data.

[0011] In one embodiment, the multi-source data anomaly analysis model includes a non-uniform quantizer and a temporal convolutional self-attention network; The step of inputting the preprocessed baseline data and rules from the baseline rule base into the multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model includes: The preprocessed baseline data and the rules in the baseline rule base are used as a dataset and input into the non-uniform quantizer to obtain the quantized dataset output by the non-uniform quantizer. The quantized dataset is input into the temporal convolutional self-attention network to obtain the abnormal event recognition results output by the temporal convolutional self-attention network.

[0012] In one embodiment, updating the baseline rule base based on the abnormal event identification result includes: If the abnormal event identification result is a highly suspected abnormal event or a low suspected abnormal event, the abnormal event identification result will be submitted to the assessment experts for manual assessment. If the manual assessment results indicate an abnormal event, the assessment rules for the abnormal event identification results are updated to the baseline rule base.

[0013] In one embodiment, the security decision model includes a deep Q-network, which includes an estimation network and a target network; The abnormal event identification results and rules from the policy rule base are input into the security decision model to obtain the abnormal event handling strategy output by the security decision model, including: If the abnormal event identification result is an abnormal event, the abnormal event identification result and the rules in the policy rule base are used as the current state and input into the estimation network to obtain the Q value output by the estimation network; Based on the Q value, a processing action is generated for the abnormal event identification result, and the processing action is determined as an abnormal event handling strategy. The parameters of the estimated network are obtained by optimizing the target network and the estimated network based on the whale optimization algorithm with the goal of achieving convergence of the output loss between the target network and the estimated network.

[0014] Secondly, embodiments of this application provide a terminal security monitoring device, comprising: The baseline data acquisition module is used to: acquire baseline data from multiple source terminals; The data preprocessing module is used to: preprocess the baseline data to obtain preprocessed baseline data; An anomaly event identification module is used to: input the preprocessed baseline data and the rules in the baseline rule base into the multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model; The baseline rule base update module is used to update the baseline rule base based on the abnormal event identification results. The processing strategy acquisition module is used to: input the abnormal event identification results and the rules in the policy rule base into the security decision model to obtain the abnormal event processing strategy output by the security decision model; The strategy rule base update module is used to update the strategy rule base based on the abnormal event handling strategy. The terminal exception handling module is used to: perform exception handling on the multi-source terminal based on the exception event handling strategy.

[0015] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the steps of the terminal security monitoring method described in the first aspect.

[0016] Fourthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the terminal security monitoring method described in the first aspect.

[0017] Fifthly, embodiments of this application provide a non-transitory computer-readable storage medium, including a computer program, which, when executed by a processor, implements the steps of the terminal security monitoring method described in the first aspect.

[0018] The terminal security monitoring method, device, electronic equipment, product, and storage medium provided in this application collect baseline data from multiple sources of terminals, preprocess the baseline data to obtain preprocessed baseline data, input the preprocessed baseline data and rules in the baseline rule base into a multi-source data anomaly analysis model to obtain anomaly event identification results output by the multi-source data anomaly analysis model, update the baseline rule base based on the anomaly event identification results, input the anomaly event identification results and rules in the policy rule base into a security decision model to obtain anomaly event handling strategies output by the security decision model, update the policy rule base based on the anomaly event handling strategies, and perform anomaly handling on multiple sources of terminals based on the anomaly event handling strategies. In this application, on the one hand, the deep learning capabilities of the multi-source data anomaly analysis model are used to identify and output anomaly event recognition results. This enables automatic learning and recognition of different or unknown anomaly events, improving the coverage of anomaly event recognition results. Furthermore, after the model outputs the recognition results, it immediately updates the baseline rule base based on these results, expanding the coverage and increasing the update frequency of the baseline rule base. This allows the model to learn the latest and more comprehensive rules in the baseline rule base when recognizing anomaly events, thus enabling timely identification of rapidly changing and constantly evolving new anomaly events. On the other hand, a policy rule base is also designed, which can automatically generate anomaly events based on the anomaly event recognition results and the rules in the policy rule base using a security decision model. This application employs a processing strategy to automatically handle anomalies on multi-source terminals without relying on manual intervention or operation, thereby effectively improving the efficiency and accuracy of anomaly handling. Furthermore, by leveraging the deep learning capabilities of the security decision model to generate anomaly handling strategies, it enables automatic strategy generation for different or unknown anomalies, expanding the coverage of the anomaly handling strategies. Immediately after the security decision model outputs anomaly handling strategies, the strategy rule base is updated based on these strategies, expanding the coverage of the rule base and increasing the update frequency. This allows the model to learn the latest and more comprehensive rules in the rule base when generating processing strategies next time, thus generating the optimal processing strategy more efficiently and accurately. In summary, this application effectively ensures terminal security by promptly identifying rapidly changing and constantly evolving new anomalies and improving the efficiency and accuracy of anomaly handling. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is one of the flowcharts illustrating the terminal security monitoring method provided in the embodiments of this application; Figure 2 This is an architecture diagram of the terminal security monitoring platform provided in the embodiments of this application; Figure 3 This is a second schematic flowchart of the terminal security monitoring method provided in the embodiments of this application; Figure 4 This is the third flowchart illustrating the terminal security monitoring method provided in this application embodiment; Figure 5 This is the fourth flowchart illustrating the terminal security monitoring method provided in this application embodiment; Figure 6 This is the fifth flowchart illustrating the terminal security monitoring method provided in this application embodiment; Figure 7 This is the sixth flowchart illustrating the terminal security monitoring method provided in this application embodiment; Figure 8 This is an architecture diagram of the temporal convolutional self-attention network provided in the embodiments of this application; Figure 9 This is a schematic diagram of the structure of the causal dilated convolutional layer provided in the embodiments of this application; Figure 10 This is a schematic diagram of the training and application process of the multi-source data anomaly analysis model provided in the embodiments of this application; Figure 11 This is a schematic diagram of the expert evaluation process in the terminal security monitoring method provided in this application embodiment; Figure 12 This is the seventh flowchart illustrating the terminal security monitoring method provided in this application embodiment; Figure 13 This is a schematic diagram of the training process of the security decision-making model provided in the embodiments of this application; Figure 14 This is a schematic diagram of the terminal security monitoring device provided in the embodiments of this application; Figure 15 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] Figure 1This is one of the flowcharts illustrating the terminal security monitoring method provided in this application. (Refer to...) Figure 1 This application provides a terminal security monitoring method, which may include: Step 101: Collect baseline data from multiple source terminals; Step 102: Preprocess the baseline data to obtain preprocessed baseline data; Step 103: Input the preprocessed baseline data and the rules in the baseline rule base into the multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model; Step 104: Update the baseline rule base based on the abnormal event identification results; Step 105: Input the abnormal event identification results and the rules in the policy rule base into the security decision model to obtain the abnormal event handling strategy output by the security decision model; Step 106: Update the policy rule base based on the exception event handling strategy; Step 107: Based on the abnormal event handling strategy, perform abnormal handling on multi-source terminals.

[0023] Reference Figure 2 : In step 101, the endpoint security monitoring platform monitors multiple source endpoints in real time and collects baseline data from these endpoints. For each endpoint device, the collected baseline data can include multiple dimensions, such as CPU data, memory data, disk data, process behavior data, file behavior data, network behavior data, DNS behavior data, open port behavior data, and account behavior data. CPU data, memory data, and disk data can all include usage rates and detailed usage data; Process behavior data may include process path, process name, and process hash value; File behavior data can include file path, file name, file hash value, and file permissions; Network behavior data may include connection direction, network protocol, local IP / port, peer IP / port, and associated process name; DNS behavioral data can include domain names and domain IP addresses; Open port behavior data may include network protocol, local port number, and associated process name; Account behavior data can include account names.

[0024] In step 102, during the data acquisition and transmission process, the terminal may experience data loss, data fluctuations, and data duplication in the baseline data due to network fluctuations or program abnormalities. Therefore, it is necessary to use corresponding methods to preprocess the baseline data to eliminate the impact of network fluctuations or program abnormalities on the baseline data, so as to accurately identify the real abnormal events and deal with them in a timely manner.

[0025] In step 103, the baseline rule base and the multi-source data anomaly analysis model are built into the endpoint security monitoring platform. This rule base integrates an open-source CVE (Common Vulnerabilities and Exposures) database, an expert assessment rule base, and a business system rule base. During the initial training of the multi-source data anomaly analysis model, historically preprocessed baseline data and data from this baseline rule base are used together as the training dataset to train the model. The open-source CVE database includes globally recognized security vulnerability datasets, containing information on a wide range of known security vulnerabilities. Utilizing the open-source CVE database, data covering a broad spectrum of vulnerability types and attack methods can be obtained, providing models with realistic and representative samples. This data not only includes instances of various vulnerabilities from the past but also the latest disclosed security vulnerabilities, ensuring that the training data remains up-to-date and guaranteeing the model's ability to identify emerging threats.

[0026] The expert-developed rule base, compiled by the team's security experts based on years of accumulated security analysis experience and countermeasures, contains a large number of rules and patterns capable of accurately identifying anomalous behavior. The data in this base is not limited to known attack patterns but also includes potential threat patterns predicted by experts based on experience. By incorporating data from this rule base into the training dataset, the model can learn more complex and covert attack behaviors, improving the accuracy and breadth of anomalous event identification.

[0027] The business system rule base is a security rule library developed based on the actual operating environment and characteristics of a specific business system. The rules in this library are tailored to the business logic and security needs of a particular industry or enterprise, covering both normal system behavior patterns and potential abnormal behavior patterns. By incorporating data from the business system rule base into the training dataset, the model can more accurately identify abnormal behaviors related to a specific business system, improving the platform's reliability and effectiveness in real-world application scenarios.

[0028] In this embodiment, the preprocessed baseline data and the rules in the baseline rule base are input into the trained multi-source data anomaly analysis model, which can obtain a relatively accurate anomaly event identification result output by the model.

[0029] In step 104, the baseline rule base is updated after each abnormal event identification result is obtained. This allows the baseline rule base to be continuously updated with the dynamic changes of the business system, ensuring that the model maintains high accuracy and flexibility in different scenarios. This enables the endpoint security monitoring platform to more accurately identify and respond to various abnormal events, improving its robustness in abnormal event identification.

[0030] In step 105, the policy rule base and security decision model are also built into the terminal security monitoring platform. When training the security decision model in the early stage, the historical abnormal event identification results and the data in the policy rule base are used together as the training dataset to train the model. In this embodiment, the current abnormal event identification results and the rules in the policy rule base are input into the trained security decision model to obtain the effective abnormal event handling strategy output by the model.

[0031] In step 106, the security decision model does not directly obtain the processing strategy that matches the abnormal event identification result from the current policy rule base. Instead, it optimizes the rules in the current policy rule base with reference to generate a more effective processing strategy for the abnormal event identification result. Especially when the abnormal event identification result is a new type of abnormal event, there is no processing strategy for it in the current policy rule base. The model needs to generate a targeted strategy. The abnormal event processing strategy generated by the model usually does not exist in the current policy rule base. Therefore, it needs to be updated to the current policy rule base so that a better processing strategy can be generated for similar abnormal event identification results in the future.

[0032] In step 107, the terminal security monitoring platform can directly distribute the abnormal event handling strategy to multiple source terminals to realize the abnormal handling of multiple source terminals.

[0033] It should be noted that, referring to Figure 2 The baseline rule base and the policy rule base can be integrated into a baseline / policy rule base, which includes both baseline rules and policy rules. When the rule base is updated, only the rules that need to be updated are updated.

[0034] The terminal security monitoring method provided in this embodiment collects baseline data from multiple sources of terminals, preprocesses the baseline data to obtain preprocessed baseline data, inputs the preprocessed baseline data and rules in the baseline rule base into a multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model, updates the baseline rule base based on the anomaly event identification results, inputs the anomaly event identification results and rules in the policy rule base into a security decision model to obtain the anomaly event handling strategy output by the security decision model, updates the policy rule base based on the anomaly event handling strategy, and performs anomaly handling on multiple sources of terminals based on the anomaly event handling strategy. In this embodiment, on the one hand, the deep learning capabilities of the multi-source data anomaly analysis model are used to identify and output anomaly event recognition results. This enables automatic learning and recognition of different or unknown anomaly events, improving the coverage of anomaly event recognition results. Furthermore, after the model outputs the recognition results, it immediately updates the baseline rule base based on these results, expanding the coverage and increasing the update frequency of the baseline rule base. This allows the model to learn the latest and more comprehensive rules in the baseline rule base when recognizing anomaly events, thus enabling timely identification of rapidly changing and constantly evolving new anomaly events. On the other hand, a policy rule base is also designed, and a security decision model can automatically generate anomaly events based on the anomaly event recognition results and the rules in the policy rule base. The system employs a processing strategy to automatically handle anomalies from multiple sources on terminals without relying on manual intervention or operation, thereby effectively improving the efficiency and accuracy of anomaly handling. Furthermore, by leveraging the deep learning capabilities of the security decision model to generate anomaly handling strategies, it can automatically generate strategies for different or unknown anomalies, expanding the coverage of the anomaly handling strategies. Immediately after the security decision model outputs an anomaly handling strategy, the strategy rule base is updated based on that strategy, expanding the coverage of the rule base and increasing the update frequency. This allows the model to learn the latest and more comprehensive rules in the rule base when generating processing strategies next time, thus generating the optimal processing strategy more efficiently and accurately. In summary, this embodiment effectively ensures terminal security by promptly identifying rapidly changing and constantly evolving new anomalies and improving the efficiency and accuracy of anomaly handling.

[0035] Figure 3 This is the second flowchart illustrating the terminal security monitoring method provided in this application. (Refer to...) Figure 3 In one embodiment, step 102 may include: Step 301: Perform deduplication and cleaning on the baseline data to obtain the deduplicated baseline data; Step 302: Perform anti-fluctuation cleaning on the deduplicated baseline data to obtain the anti-fluctuation baseline data; Step 303: Perform missing data completion on the de-fluctuation baseline data to obtain preprocessed baseline data.

[0036] In step 301, when a large amount of duplicate content appears in the baseline data within a certain period of time, it is necessary to perform deduplication and cleaning to maintain the uniqueness of the data within a unit of time, so as to facilitate subsequent fluctuation cleaning. Any deduplication and cleaning method can be used to perform deduplication and cleaning on the baseline data, and there is no limitation here.

[0037] In step 302, when the deduplicated baseline data fluctuates significantly within a certain period of time, it is necessary to perform de-fluctuation cleaning to maintain the smoothness of the data over a continuous period of time, so as to facilitate subsequent missing data completion. Any de-fluctuation cleaning method can be used to perform de-fluctuation cleaning on the deduplicated baseline data, and there is no limitation here.

[0038] In step 303, due to interference with the baseline data itself, and the removal of some data by previous deduplication and defluidization cleaning, the baseline data after defluidization is missing some data, which needs to be filled in to maintain the integrity of the data; any missing data filling method can be used to fill in the missing data of the baseline data after defluidization, and there is no limitation here.

[0039] This embodiment provides high-quality data for subsequent analysis and decision-making by performing deduplication, fluctuation removal, and missing data completion on the baseline data.

[0040] Figure 4 This is the third flowchart illustrating the terminal security monitoring method provided in this application. (Refer to...) Figure 4 In one embodiment, step 201 may include: Step 401: Convert the baseline data to lowercase to obtain lowercase baseline data; Step 402: For each phrase in the lowercase baseline data, obtain the feature vector of the phrase based on the number of documents in the device document set to which the lowercase baseline data belongs, and the frequency of the phrase in its own document. Step 403: Input the feature vector into multiple hash functions to obtain multiple hash values; Step 404: For each document in the device document set, obtain the minimum value of multiple hash values ​​corresponding to each word group in the document, obtain the minimum hash value corresponding to each word group, and determine the minimum value among the minimum hash values ​​corresponding to each word group as the feature hash value of the document. Step 405: Input the feature hash value into multiple bucket hash functions to obtain multiple bucket hash values, and determine the minimum value among the multiple bucket hash values ​​as the document's category value; Step 406: For every pair of documents in each document, calculate the similarity between the two documents based on their category values. If the similarity is greater than the similarity threshold, delete the baseline data in either document to obtain the deduplicated baseline data.

[0041] In step 401, for the baseline data within each unit time T Convert it to lowercase baseline data This ensures the consistency and comparability of all data.

[0042] In step 402, for Each phrase in Its eigenvector can be calculated based on the following formula. : ; in, For the set of device documents to which the lowercase baseline data belongs, This represents the number of documents in the device's document collection. for exist The collection of documents that appear in the document, i.e. Includes A collection of documents, The number of documents in the set of documents that appear, i.e. Includes The number of documents, for exist Frequency of occurrence in for Any phrase in, then for All phrases in The sum of the frequencies that appear in the text.

[0043] In step 403, you can enter A hash function is obtained. A hash value.

[0044] In step 404, each phrase can be obtained based on the following formula. The corresponding minimum hash value : ; in, The hash function index; Furthermore, from Select the minimum value from the middle to obtain Feature hash value As shown in the following formula: .

[0045] In step 405, you can enter A bucket hash function, to obtain The minimum value among the hash values ​​of the buckets is selected as the... The category value.

[0046] In step 406, it is assumed that For document Category value, For document The category value can be calculated based on the following formula. and Similarity between : ; Delete if the similarity score is greater than the similarity threshold. and The baseline data in any document is used to obtain the deduplicated baseline data.

[0047] This embodiment first converts the baseline data to lowercase to ensure data consistency and comparability. Then, based on each word group in the lowercase baseline data, it counts the number of documents in which the word group appears and the frequency of its appearance in each of these documents. Based on the number of documents and the frequency of appearance, it characterizes the features and obtains the feature vector corresponding to each word group. Then, it uses multiple hash functions to filter out the feature hash value that can represent the document from the minimum hash value of all words in each document. Then, it uses the minimum value of multiple bucket hash functions as the category value of the document. The similarity between documents can be evaluated by the similarity between category values. The baseline data in documents with high similarity is deduplicated to achieve accurate deduplication of duplicate baseline data.

[0048] Figure 5 This is the fourth flowchart illustrating the terminal security monitoring method provided in this application. (Refer to...) Figure 5 In one embodiment, step 202 may include: Step 501: Arrange the deduplicated baseline data in chronological order to obtain the first baseline time series; Step 502: Set a smoothing window for the first baseline time series. For each target baseline data within the smoothing window, obtain the weight matrix of the target baseline data based on the standard deviation of each baseline data within the smoothing window and other baseline data within the smoothing window besides the target baseline data. Step 503: Based on the weight matrix, calculate the regression coefficients between other baseline data and their corresponding time points; Step 504: Calculate the smoothed value of the target baseline data based on the regression coefficients; Step 505: Calculate the difference between each target baseline data and its corresponding smoothed value to obtain a difference sequence; Step 506: Determine the volatility threshold based on the mean and standard deviation of the difference sequence; Step 507: Based on the fluctuation threshold, identify abnormal fluctuation data in the deduplicated baseline data; Step 508: Delete the abnormal fluctuation data to obtain the baseline data after fluctuation removal.

[0049] In steps 501 to 502, it is assumed that the first baseline time series is... , To smooth the window For any target baseline data in the dataset, a smoothing window can be obtained based on the following formula. Excluding target baseline data Any other baseline data weight : ; in, To smooth the window The standard deviation of each baseline data point is obtained using the following formula: ; in, To smooth the window The mean of each baseline data point, To smooth the window The number of baseline data within the system, To smooth the window The sum of all baseline data within the system.

[0050] After sorting, we can obtain: ; Similarly, calculate the smoothing window. Internal The weights of all other baseline data are then smoothed out by the window. Inside The weight matrix composed of other baseline data can be represented as: ; The weight matrix is ​​used as In smooth window Weight matrix within .

[0051] In step 503, the regression coefficients between other baseline data and their corresponding time points can be calculated based on the following formula. : ; in, , To smooth the window Inside A time-point matrix of other baseline data, Transpose it. To smooth the window Inside A data matrix of other baseline data.

[0052] In step 504, the following formula can be used for calculation. smoothing value : ; In step 505, calculations are performed based on the above steps. After smoothing the baseline data for each target, a smoothed value sequence is obtained. , then calculate and Difference sequence of corresponding data between .

[0053] In step 506, the fluctuation critical value can be determined based on the following formula. : ; in, for The mean, for The standard deviation.

[0054] In steps 507 to 508, in If there exists or Then determine corresponding For abnormal fluctuation data, Delete, and you get the baseline data after fluctuation removal.

[0055] In this embodiment, the deduplicated baseline data is first organized into a first baseline time series according to time order. Then, a smoothing window is set for this series. The smoothing window slides along the time axis to continuously frame the baseline data within the window to be processed. For each target baseline data within the smoothing window, a weighted regression is performed using the weights of other baseline data within the window to obtain regression coefficients. These regression coefficients are then used to fit the smoothed value of the target baseline data. Finally, the difference sequence between the original sequence and the smoothed value sequence is calculated. This sequence is used as the fluctuation value sequence to calculate the fluctuation critical value, thereby identifying and deleting abnormal fluctuation data in the original sequence and eliminating false alarms caused by data fluctuations during subsequent anomaly analysis.

[0056] Figure 6 This is the fifth flowchart illustrating the terminal security monitoring method provided in this application. (Refer to...) Figure 6 In one embodiment, step 203 may include: Step 601: Arrange the defluxed baseline data in chronological order and fill in the missing parts with placeholders to obtain the second baseline time series; Step 602: Set a time window for the second baseline time series, input the baseline data within the time window into the autoencoder, and obtain the preliminary fill data output by the autoencoder; Step 603: Input the preliminary filling data into the least squares generative adversarial network to obtain the undetermined filling data output by the least squares generative adversarial network; Step 604: With the goal of minimizing the generator loss and discriminator loss of the least squares generative adversarial network, adjust the parameters of the least squares generative adversarial network and return to step 603. Step 605: With the final fill data obtained, replace the placeholders with the final fill data to obtain the preprocessed baseline data.

[0057] In step 602, it is assumed that For baseline data within the time window, preliminary filling data can be obtained based on the following formula. : ; in, It is a self-encoder.

[0058] In step 603, the data to be filled can be obtained based on the following formula. ; ; in, It is a least-squares generative adversarial network.

[0059] In steps 604 and 605, the generator loss target and discriminator loss target of the least squares generative adversarial network can be expressed by the following formulas: ; ; in, For generator loss, For discriminator loss, For taking values The mask vector, The predicted data output by the generator. for Corresponding real data For random variables that depend on the cue matrix, It expresses expectation.

[0060] Using the above formula as the target, the network parameters are continuously adjusted and the pending data is re-output until the training ends. The pending data at this time is the final data. This final data is output after the network parameters are continuously optimized, so it is closest to the real data. Therefore, it can replace the placeholders to complete the missing data and obtain the preprocessed baseline data.

[0061] This embodiment uses a least-squares generative adversarial network to obtain the padding data. This network improves the loss function based on the native generative adversarial network, which can not only solve the problems of gradient vanishing and mode collapse caused by the native cross-entropy loss function, but also make the padding data more accurate to a large extent.

[0062] Figure 7 This is the sixth flowchart illustrating the terminal security monitoring method provided in this application. (Refer to...) Figure 7 In one embodiment, the multi-source data anomaly analysis model includes a non-uniform quantizer and a temporal convolutional self-attention network; step 103 may include: Step 701: Take the preprocessed baseline data and the rules in the baseline rule base as the dataset, input them into the non-uniform quantizer, and obtain the quantized dataset output by the non-uniform quantizer. Step 702: Input the quantized dataset into the temporal convolutional self-attention network to obtain the abnormal event recognition results output by the temporal convolutional self-attention network.

[0063] In step 701, the non-uniform quantizer can dynamically and randomly quantize the dataset, making the dataset richer. Specifically, it can include Gaussian perturbation, random translation, random scaling, and time reversal. Assuming... Within a unit of time in the dataset any point in time The data, then: 1. Gaussian perturbation: for By applying a suitable perturbation, the perturbed data can be obtained. ; ; in, It is Gaussian noise with a mean of 0 and a variance of . Gaussian distribution .

[0064] 2. Random translation: [This likely refers to a specific method or technique, but without further context, it's difficult to translate accurately The data is obtained by appropriately shifting it over time. ; ; in, The time shift is uniformly distributed. , It is the maximum time shift.

[0065] 3. Random scaling: By scaling factor By scaling appropriately, we can obtain scaled data. ; ; in, Follows uniform distribution , It represents the range of scaling factor variation.

[0066] 4. Time Reversal: Sort the data in reverse order to obtain the reversed data. ; ; The above processing is performed on all data in the dataset to obtain the quantized dataset.

[0067] In step 702, refer to Figure 8 Temporal convolutional self-attention networks mainly consist of causal dilated convolutional layers, weight normalization layers, ReLU layers, and self-attention layers, among which: 1. Causal dilated convolutional layer: During the convolution process of the quantized dataset, interval sampling is performed, and a dilation factor is introduced. The dilation factor, representing the size of the interval, increases exponentially with each convolutional layer, resulting in a progressively larger sampling interval and an exponentially larger receptive field. Simultaneously, to ensure the network's output is determined solely by previous inputs, thus eliminating the potential influence of future information on current processing steps, each layer performs convolution operations only on input data from the previous layer. Figure 9As shown; the above process can also be expressed by the following formula: ; in, These are the features extracted after the convolution operation. For filter size, Based on the expansion factor Causal dilation convolution operation for feature extraction For the quantized dataset, The size of the convolution kernel. For the first One convolutional kernel, Ensure that convolution operations are performed only on past data.

[0068] 2. Weight Normalization Layer: By decomposing the weights into two parts, direction and norm, and optimizing them separately, the stability and convergence speed of the network are improved. This can be expressed by the following formula: ; Among them, the weight vector By new parameters and replace, Is with Matrices with the same shape for The Euclidean norm, As a scalar, the formula is obtained by... Normalization separates the direction of the weight vector from its norm.

[0069] 3. ReLU layer: The ReLU function is used to activate the input features, which improves the network's expressive power and computational efficiency, and ensures gradient stability.

[0070] 4. Self-attention layer: Maps the input sequence into three vectors through a linear transformation: query vector... Key vector Sum value vector Through the , , The autocorrelation feature matrix is ​​obtained by calculation. This effectively enhances the network's ability to capture long-term dependencies, which can be expressed by the following formula: ; in, for Dimensions This is the normalization function.

[0071] Furthermore, referring to Figure 8Temporal convolutional self-attention networks can also include Dropout layers and residual connections. Through the above processing, temporal convolutional self-attention networks can output relatively accurate abnormal event recognition results, which are output in the form of probabilities and can be divided into four types, as follows: 1. Abnormal events: These are events that match a large number of rules in the baseline rule base; 2. Highly suspected abnormal events: events that match a large number of rules in the baseline rule base; 3. Low-level suspected anomaly events: These are events that match few rules in the baseline rule base. 4. Normal events: These are events that do not match any rules in the baseline rule base.

[0072] It should be noted that the training dataset for the multi-source data anomaly analysis model also needs to undergo the above steps during the initial training process. The training and application processes of this model can be described as follows: Figure 10 As shown.

[0073] This embodiment utilizes a non-uniform quantizer to sequentially perform Gaussian perturbation, random translation, random scaling, and time reversal on the dataset, enriching the dataset and helping the subsequent temporal convolutional self-attention network capture more information. Furthermore, by using the temporal convolutional self-attention network to sequentially perform causal dilation convolution, weight normalization, ReLU, and self-attention operations on the quantized dataset, features with a larger receptive field can be extracted. The features are then weighted based on the decomposed weights and activated, thereby calculating the autocorrelation feature matrix, which effectively improves network performance and outputs more accurate abnormal event recognition results.

[0074] In one embodiment, step 104 may include: If the anomaly identification result is a highly suspected anomaly or a low suspected anomaly, the anomaly identification result will be submitted to the assessment experts for manual assessment. If the manual assessment result is an anomaly, the assessment rules for the anomaly identification result will be updated to the baseline rule base.

[0075] Although the model possesses powerful capabilities for identifying unknown events, there are still special events whose anomalies cannot be fully confirmed. For these events—highly suspected anomalies and lowly suspected anomalies—further expert evaluation can be conducted. If the expert evaluation concludes that the event is an anomaly, the rules from the expert evaluation will be updated to the baseline rule base. Figure 11 As shown.

[0076] Furthermore, for highly suspected anomaly events, since they already match many rules in the baseline rule base, they can be directly handed over to the platform administrator or business administrator for analysis and confirmation; for low-suspected anomaly events, since they only match a few rules in the baseline rule base, they can be given priority to be analyzed by analysis experts before being pushed to the platform administrator or business administrator for confirmation.

[0077] This embodiment uses manual assessment to identify suspected events that the model cannot fully recognize as a fallback assessment, and then updates the assessment rules to the baseline rule base. On the one hand, this ensures that abnormal events are not missed, and on the other hand, it avoids updating erroneous rules to the baseline rule base, which would lead to an invalid increase in rules.

[0078] Figure 12 This is the seventh flowchart illustrating the terminal security monitoring method provided in this application. (Refer to...) Figure 12 In one embodiment, the security decision model includes a deep Q-network, which includes an estimation network and a target network. Step 105 may include: Step 1201: If the abnormal event identification result is an abnormal event, the abnormal event identification result and the rules in the policy rule base are used as the current state and input into the estimation network to obtain the Q value output by the estimation network. Step 1202: Based on the Q value, generate processing actions for the abnormal event identification results, and determine the processing actions as the abnormal event handling strategy.

[0079] The parameters of the estimated network are obtained by optimizing the output loss between the target network and the estimated network based on the whale optimization algorithm.

[0080] In step 1201, the estimated Q-value of the network output is an estimate of the long-term value that can be obtained by performing each possible action in the current state.

[0081] In step 1202, the maximum Q value is selected from all possible Q values, and the action corresponding to the maximum Q value is used as the action to handle the abnormal event, i.e., the abnormal event handling strategy.

[0082] Furthermore, referring to Figure 13 The parameters of the estimated network are optimized during the training of the security decision model, as follows: 1. Interact the model with the terminal security monitoring environment, and generate sufficient state experience to store in the replay experience pool, based on the premise of selecting the optimal action; 2. Extract a small batch of samples from the replay experience pool. Each sample includes the current state, current action, environmental reward, next state, and end flag. 3. Input the next state from the mini-batch samples into the target network to obtain the estimated Q value of the target network's output for the next state of each sample, and select the largest estimated Q value. 4. Based on the maximum estimated Q value, the environmental reward in the small batch of samples, and the termination flag, calculate the target Q value; 5. Input the current state and current action state from the mini-batch samples into the estimation network to obtain the predicted Q value output by the estimation network for the current state and current action of each sample; 6. Calculate the mean square error between the target Q value and the predicted Q value. If the mean square error does not converge, generate a new random population of the estimation network. Each individual in the population generates random parameters based on the parameters of the estimation network. 7. Each individual interacts with the terminal security monitoring environment, calculates its own fitness function value based on the reward obtained from the interaction, and selects the individual with the largest fitness function value as the current optimal individual; 8. After optimizing the random parameters of other individuals based on the random parameters of the current best individual, return to step 7 until the iteration termination condition is met. Copy the random parameters of the current best individual to the estimation network to update the estimation network parameters. 9. After updating the latest parameters of the estimated network to the target network, return to step 2 until the termination condition is met or the mean square error converges, and obtain the final parameters of the estimated network.

[0083] In this embodiment, based on the whale optimization algorithm, the parameters of the estimation network are optimized with the goal of converging the mean square error between the output Q value of the target network and the output Q value of the estimation network in the deep Q network. This enables the estimation network to fully adapt to the terminal security monitoring environment, thereby allowing the model to output more reasonable and effective handling strategies for abnormal events in this environment. These handling strategies include temporarily isolating infected terminals, terminating suspicious processes, and prohibiting abnormal network behavior, so as to control security threats as soon as possible and reduce the possibility of risk spread.

[0084] The terminal security monitoring device provided in the embodiments of this application is described below. The terminal security monitoring device described below can be referred to in correspondence with the terminal security monitoring method described above.

[0085] Figure 14 This is a schematic diagram of the terminal security monitoring device provided in an embodiment of this application. (Refer to...) Figure 14 This application provides a terminal security monitoring device, which may include: The baseline data acquisition module 1401 is used to: acquire baseline data from multiple source terminals; Data preprocessing module 1402 is used to: preprocess the baseline data to obtain preprocessed baseline data; The abnormal event identification module 1403 is used to: input the preprocessed baseline data and the rules in the baseline rule base into the multi-source data anomaly analysis model to obtain the abnormal event identification results output by the multi-source data anomaly analysis model; The baseline rule base update module 1404 is used to update the baseline rule base based on the abnormal event identification results. The processing strategy acquisition module 1405 is used to: input the abnormal event identification result and the rules in the policy rule base into the security decision model to obtain the abnormal event processing strategy output by the security decision model; The strategy rule base update module 1406 is used to update the strategy rule base based on the abnormal event handling strategy. The terminal exception handling module 1407 is used to: perform exception handling on the multi-source terminal based on the exception event handling strategy.

[0086] The terminal security monitoring device provided in this embodiment collects baseline data from multiple sources of terminals, preprocesses the baseline data to obtain preprocessed baseline data, inputs the preprocessed baseline data and rules in the baseline rule base into a multi-source data anomaly analysis model to obtain the anomaly event identification result output by the multi-source data anomaly analysis model, updates the baseline rule base based on the anomaly event identification result, inputs the anomaly event identification result and rules in the policy rule base into a security decision model to obtain the anomaly event handling strategy output by the security decision model, updates the policy rule base based on the anomaly event handling strategy, and performs anomaly handling on multiple sources of terminals based on the anomaly event handling strategy. In this embodiment, on the one hand, the deep learning capabilities of the multi-source data anomaly analysis model are used to identify and output anomaly event recognition results. This enables automatic learning and recognition of different or unknown anomaly events, improving the coverage of anomaly event recognition results. Furthermore, after the model outputs the recognition results, it immediately updates the baseline rule base based on these results, expanding the coverage and increasing the update frequency of the baseline rule base. This allows the model to learn the latest and more comprehensive rules in the baseline rule base when recognizing anomaly events, thus enabling timely identification of rapidly changing and constantly evolving new anomaly events. On the other hand, a policy rule base is also designed, and a security decision model can automatically generate anomaly events based on the anomaly event recognition results and the rules in the policy rule base. The system employs a processing strategy to automatically handle anomalies from multiple sources on terminals without relying on manual intervention or operation, thereby effectively improving the efficiency and accuracy of anomaly handling. Furthermore, by leveraging the deep learning capabilities of the security decision model to generate anomaly handling strategies, it can automatically generate strategies for different or unknown anomalies, expanding the coverage of the anomaly handling strategies. Immediately after the security decision model outputs an anomaly handling strategy, the strategy rule base is updated based on that strategy, expanding the coverage of the rule base and increasing the update frequency. This allows the model to learn the latest and more comprehensive rules in the rule base when generating processing strategies next time, thus generating the optimal processing strategy more efficiently and accurately. In summary, this embodiment effectively ensures terminal security by promptly identifying rapidly changing and constantly evolving new anomalies and improving the efficiency and accuracy of anomaly handling.

[0087] In one embodiment, the data preprocessing module 1402 is specifically used for: The baseline data is cleaned to remove duplicates, resulting in deduplicated baseline data. The deduplicated baseline data is then subjected to anti-fluctuation cleaning to obtain anti-fluctuation baseline data; The baseline data after wave reduction is filled in to obtain preprocessed baseline data.

[0088] In one embodiment, the data preprocessing module 1402 is specifically used for: The baseline data is converted to lowercase to obtain lowercase baseline data; For each word group in the lowercase baseline data, a feature vector of the word group is obtained based on the number of documents in the device document set to which the lowercase baseline data belongs, and the frequency of the word group in its own document. The feature vector is input into multiple hash functions to obtain multiple hash values; For each document in the device document set, the minimum value of multiple hash values ​​corresponding to each word group in the document is obtained, and the minimum hash value corresponding to each word group is determined as the feature hash value of the document. The feature hash value is input into multiple bucket hash functions to obtain multiple bucket hash values, and the minimum value among the multiple bucket hash values ​​is determined as the category value of the document; For each pair of documents in each document, the similarity between the two documents is calculated based on their category values. If the similarity is greater than a similarity threshold, the baseline data in either of the two documents is deleted to obtain the deduplicated baseline data.

[0089] In one embodiment, the data preprocessing module 1402 is specifically used for: The deduplicated baseline data are arranged in chronological order to obtain the first baseline time series; A smoothing window is set for the first baseline time series. For each target baseline data within the smoothing window, a weight matrix of the target baseline data is obtained based on the standard deviation of each baseline data within the smoothing window and other baseline data within the smoothing window besides the target baseline data. Based on the weight matrix, the regression coefficients between the other baseline data and their corresponding time points are calculated; Based on the regression coefficients, calculate the smoothed value of the target baseline data; Calculate the difference between each target baseline data and its corresponding smoothed value to obtain a difference sequence; Based on the mean and standard deviation of the difference sequence, the fluctuation threshold is determined; Based on the fluctuation threshold, abnormal fluctuation data in the deduplicated baseline data are determined; The abnormal fluctuation data is deleted to obtain the baseline data after fluctuation removal.

[0090] In one embodiment, the data preprocessing module 1402 is specifically used for: The de-fluctuated baseline data is arranged in chronological order, and placeholders are used to fill in the missing parts to obtain the second baseline time series. A time window is set for the second baseline time series, and the baseline data within the time window is input into the autoencoder to obtain the preliminary fill data output by the autoencoder; The initial padding data is input into the least squares generative adversarial network to obtain the undetermined padding data output by the least squares generative adversarial network. With the goal of minimizing the generator loss and discriminator loss of the least squares generative adversarial network, the parameters of the least squares generative adversarial network are adjusted, and the process of inputting the initial padding data into the least squares generative adversarial network is repeated until the final padding data is obtained. The placeholders are replaced with the final fill data to obtain the preprocessed baseline data.

[0091] In one embodiment, the multi-source data anomaly analysis model includes a non-uniform quantizer and a temporal convolutional self-attention network; the anomaly event recognition module 1403 is specifically used for: The preprocessed baseline data and the rules in the baseline rule base are used as a dataset and input into the non-uniform quantizer to obtain the quantized dataset output by the non-uniform quantizer. The quantized dataset is input into the temporal convolutional self-attention network to obtain the abnormal event recognition results output by the temporal convolutional self-attention network.

[0092] In one embodiment, the baseline rule base update module 1404 is specifically used for: If the abnormal event identification result is a highly suspected abnormal event or a low suspected abnormal event, the abnormal event identification result will be submitted to the assessment experts for manual assessment. If the manual assessment results indicate an abnormal event, the assessment rules for the abnormal event identification results are updated to the baseline rule base.

[0093] In one embodiment, the security decision model includes a deep Q-network, which comprises an estimation network and a target network; the policy acquisition module 1405 is specifically used for: The abnormal event identification results and rules from the policy rule base are input into the security decision model to obtain the abnormal event handling strategy output by the security decision model, including: If the abnormal event identification result is an abnormal event, the abnormal event identification result and the rules in the policy rule base are used as the current state and input into the estimation network to obtain the Q value output by the estimation network; Based on the Q value, a processing action is generated for the abnormal event identification result, and the processing action is determined as an abnormal event handling strategy. The parameters of the estimated network are obtained by optimizing the target network and the estimated network based on the whale optimization algorithm with the goal of achieving convergence of the output loss between the target network and the estimated network.

[0094] Figure 15 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application, such as... Figure 15 As shown, the electronic device may include: a processor 1510, a communication interface 1520, a memory 1530, and a communication bus 1540, wherein the processor 1510, the communication interface 1520, and the memory 1530 communicate with each other via the communication bus 1540. The processor 1510 can call a computer program in the memory 1530 to execute the steps of the terminal security monitoring method, such as including: Collect baseline data from multiple source terminals; The baseline data is preprocessed to obtain preprocessed baseline data; The preprocessed baseline data and the rules in the baseline rule base are input into the multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model. The baseline rule base is updated based on the abnormal event identification results; The abnormal event identification results and the rules in the policy rule base are input into the security decision model to obtain the abnormal event handling strategy output by the security decision model. Update the policy rule base based on the aforementioned abnormal event handling strategy; Based on the aforementioned abnormal event handling strategy, abnormal events are handled for the multi-source terminals.

[0095] Furthermore, the logical instructions in the aforementioned memory 1530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0096] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the steps of the terminal security monitoring method provided in the above embodiments, such as including: Collect baseline data from multiple source terminals; The baseline data is preprocessed to obtain preprocessed baseline data; The preprocessed baseline data and the rules in the baseline rule base are input into the multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model. The baseline rule base is updated based on the abnormal event identification results; The abnormal event identification results and the rules in the policy rule base are input into the security decision model to obtain the abnormal event handling strategy output by the security decision model. Update the policy rule base based on the aforementioned abnormal event handling strategy; Based on the aforementioned abnormal event handling strategy, abnormal events are handled for the multi-source terminals.

[0097] On the other hand, embodiments of this application also provide a non-transitory computer-readable storage medium storing a computer program thereon, the computer program being used to cause a processor to execute the steps of the terminal security monitoring method provided in the above embodiments, for example including: Collect baseline data from multiple source terminals; The baseline data is preprocessed to obtain preprocessed baseline data; The preprocessed baseline data and the rules in the baseline rule base are input into the multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model. The baseline rule base is updated based on the abnormal event identification results; The abnormal event identification results and the rules in the policy rule base are input into the security decision model to obtain the abnormal event handling strategy output by the security decision model. Update the policy rule base based on the aforementioned abnormal event handling strategy; Based on the aforementioned abnormal event handling strategy, abnormal events are handled for the multi-source terminals.

[0098] The non-transitory computer-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0099] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0100] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A terminal security monitoring method, characterized in that, include: Collect baseline data from multiple source terminals; The baseline data is preprocessed to obtain preprocessed baseline data; The preprocessed baseline data and the rules in the baseline rule base are input into the multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model. The baseline rule base is updated based on the abnormal event identification results; The abnormal event identification results and the rules in the policy rule base are input into the security decision model to obtain the abnormal event handling strategy output by the security decision model. Update the policy rule base based on the aforementioned abnormal event handling strategy; Based on the aforementioned abnormal event handling strategy, abnormal events are handled for the multi-source terminals.

2. The terminal security monitoring method according to claim 1, characterized in that, The preprocessing of the baseline data to obtain preprocessed baseline data includes: The baseline data is cleaned to remove duplicates, resulting in deduplicated baseline data. The deduplicated baseline data is then subjected to anti-fluctuation cleaning to obtain anti-fluctuation baseline data; The baseline data after wave reduction is filled in to obtain preprocessed baseline data.

3. The terminal security monitoring method according to claim 2, characterized in that, The process of deduplicating and cleaning the baseline data to obtain the deduplicated baseline data includes: The baseline data is converted to lowercase to obtain lowercase baseline data; For each word group in the lowercase baseline data, a feature vector of the word group is obtained based on the number of documents in the device document set to which the lowercase baseline data belongs, and the frequency of the word group in its own document. The feature vector is input into multiple hash functions to obtain multiple hash values; For each document in the device document set, the minimum value of multiple hash values ​​corresponding to each word group in the document is obtained, and the minimum hash value corresponding to each word group is determined as the feature hash value of the document. The feature hash value is input into multiple bucket hash functions to obtain multiple bucket hash values, and the minimum value among the multiple bucket hash values ​​is determined as the category value of the document; For each pair of documents in each document, the similarity between the two documents is calculated based on their category values. If the similarity is greater than a similarity threshold, the baseline data in either of the two documents is deleted to obtain the deduplicated baseline data.

4. The terminal security monitoring method according to claim 2, characterized in that, The step of performing fluctuation-removing cleaning on the deduplicated baseline data to obtain fluctuation-removed baseline data includes: The deduplicated baseline data are arranged in chronological order to obtain the first baseline time series; A smoothing window is set for the first baseline time series. For each target baseline data within the smoothing window, a weight matrix of the target baseline data is obtained based on the standard deviation of each baseline data within the smoothing window and other baseline data within the smoothing window besides the target baseline data. Based on the weight matrix, the regression coefficients between the other baseline data and their corresponding time points are calculated; Based on the regression coefficients, calculate the smoothed value of the target baseline data; Calculate the difference between each target baseline data and its corresponding smoothed value to obtain a difference sequence; Based on the mean and standard deviation of the difference sequence, the fluctuation threshold is determined; Based on the fluctuation threshold, abnormal fluctuation data in the deduplicated baseline data are determined; The abnormal fluctuation data is deleted to obtain the baseline data after fluctuation removal.

5. The terminal security monitoring method according to claim 2, characterized in that, The step of performing missing data completion on the de-fluctuation baseline data to obtain preprocessed baseline data includes: The de-fluctuated baseline data is arranged in chronological order, and placeholders are used to fill in the missing parts to obtain the second baseline time series. A time window is set for the second baseline time series, and the baseline data within the time window is input into the autoencoder to obtain the preliminary fill data output by the autoencoder; The initial padding data is input into the least squares generative adversarial network to obtain the undetermined padding data output by the least squares generative adversarial network. With the goal of minimizing the generator loss and discriminator loss of the least squares generative adversarial network, the parameters of the least squares generative adversarial network are adjusted, and the process of inputting the initial padding data into the least squares generative adversarial network is repeated until the final padding data is obtained. The placeholders are replaced with the final fill data to obtain the preprocessed baseline data.

6. The terminal security monitoring method according to claim 1, characterized in that, The multi-source data anomaly analysis model includes a non-uniform quantizer and a temporal convolutional self-attention network; The step of inputting the preprocessed baseline data and rules from the baseline rule base into the multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model includes: The preprocessed baseline data and the rules in the baseline rule base are used as a dataset and input into the non-uniform quantizer to obtain the quantized dataset output by the non-uniform quantizer. The quantized dataset is input into the temporal convolutional self-attention network to obtain the abnormal event recognition results output by the temporal convolutional self-attention network.

7. The terminal security monitoring method according to claim 1, characterized in that, The step of updating the baseline rule base based on the abnormal event identification results includes: If the abnormal event identification result is a highly suspected abnormal event or a low suspected abnormal event, the abnormal event identification result will be submitted to the assessment experts for manual assessment. If the manual assessment results indicate an abnormal event, the assessment rules for the abnormal event identification results are updated to the baseline rule base.

8. The terminal security monitoring method according to claim 1, characterized in that, The security decision model includes a deep Q-network, which comprises an estimation network and a target network. The abnormal event identification results and rules from the policy rule base are input into the security decision model to obtain the abnormal event handling strategy output by the security decision model, including: If the abnormal event identification result is an abnormal event, the abnormal event identification result and the rules in the policy rule base are used as the current state and input into the estimation network to obtain the Q value output by the estimation network; Based on the Q value, a processing action is generated for the abnormal event identification result, and the processing action is determined as an abnormal event handling strategy. The parameters of the estimated network are obtained by optimizing the target network and the estimated network based on the whale optimization algorithm with the goal of achieving convergence of the output loss between the target network and the estimated network.

9. A terminal security monitoring device, characterized in that, include: The baseline data acquisition module is used to: acquire baseline data from multiple source terminals; The data preprocessing module is used to: preprocess the baseline data to obtain preprocessed baseline data; An anomaly event identification module is used to: input the preprocessed baseline data and the rules in the baseline rule base into the multi-source data anomaly analysis model to obtain the anomaly event identification results output by the multi-source data anomaly analysis model; The baseline rule base update module is used to update the baseline rule base based on the abnormal event identification results. The processing strategy acquisition module is used to: input the abnormal event identification results and the rules in the policy rule base into the security decision model to obtain the abnormal event processing strategy output by the security decision model; The strategy rule base update module is used to update the strategy rule base based on the abnormal event handling strategy. The terminal exception handling module is used to: perform exception handling on the multi-source terminal based on the exception event handling strategy.

10. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the terminal security monitoring method according to any one of claims 1 to 8.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the terminal security monitoring method according to any one of claims 1 to 8.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the terminal security monitoring method according to any one of claims 1 to 8.

Images