Terminal security detection method and device, computer equipment and storage medium

Abstract

The invention relates to a terminal security detection method and device, computer equipment and a storage medium. The method comprises the following steps: respectively acquiring network events of a terminal based on a plurality of independent acquisition threads; storing the network events in an annular buffer area in sequence; obtaining target events in the network events in sequence; a target event is detected based on a predefined security rule, the security rule comprises at least one of a file path blacklist rule, a process behavior blacklist rule and a network connection restriction rule, and under the condition that the target event is matched with the security rule, an anomaly detection result is generated and sent to a terminal.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, computer equipment, and storage medium for detecting terminal security. Background Technology

[0002] With the rapid development of information technology, computer systems face an increasing number of security threats. To protect systems from malware, viruses, and other security threats, it is necessary to detect intrusions as soon as they occur and take targeted measures. Therefore, real-time monitoring of system behavior, file changes, and network activity during system operation has become crucial.

[0003] Existing protection systems typically lack comprehensive monitoring mechanisms and efficient detection methods, making it impossible to detect and respond to security threats in a timely and accurate manner. Summary of the Invention

[0004] Therefore, it is necessary to provide a terminal security detection method, device, computer equipment, and storage medium to address the above-mentioned technical problems.

[0005] Firstly, this application provides a method for detecting terminal security. The method includes:

[0006] Network events from the terminal are acquired using multiple independent acquisition threads;

[0007] The network events are stored sequentially in a circular buffer;

[0008] Obtain the target events from the network events in sequence;

[0009] The system detects target events based on predefined security rules, including at least one of file path blacklist rules, process behavior blacklist rules, and network connection restriction rules. If the target event matches one of the security rules, an anomaly detection result is generated and sent to the terminal.

[0010] In one embodiment, storing the network events sequentially into a circular buffer includes:

[0011] Based on atomic instructions, write access to the circular buffer is preempted, resulting in a target acquisition thread with write access and a waiting acquisition thread without write access. The target acquisition thread is used to write network events into the free storage unit of the circular buffer, and after writing is completed, it releases the write access through atomic instructions and updates the write pointer position of the circular buffer.

[0012] In one embodiment, the detection of the target event based on predefined security rules includes:

[0013] Obtain key characteristics of the target event file, including its hash value, header information, and special sections.

[0014] The key features are compared with the virus feature database to obtain anomaly detection results.

[0015] In one embodiment, after updating the write pointer position of the circular buffer, the method further includes:

[0016] The storage occupancy rate of the circular buffer is detected. If the storage occupancy rate exceeds a preset threshold, a circular buffer alarm is triggered and low-priority network events are discarded according to event priority.

[0017] In one embodiment, comparing the key features with a virus signature database to obtain anomaly detection results includes:

[0018] If the key features match the features in the virus feature database to a first preset threshold, it is determined to be a high-level threat; if the match reaches a second preset threshold but is lower than the first preset threshold, it is determined to be a medium-level threat; if the match is lower than the second preset threshold, it is determined to be a low-level threat or no threat, wherein the first preset threshold is greater than the second preset threshold.

[0019] In one embodiment, the method further includes:

[0020] Record and analyze each anomaly detection result to obtain the analysis results;

[0021] Optimize detection rules and protection strategies based on analysis results.

[0022] Secondly, this application also provides a terminal security detection device, the device comprising:

[0023] The acquisition module is used to acquire network events from the terminal based on multiple independent acquisition threads;

[0024] The storage module is used to store the network events sequentially into a circular buffer;

[0025] The detection module is used to sequentially acquire target events from the network events;

[0026] The target event is detected based on predefined security rules, which include at least one of file path blacklist rules, process behavior blacklist rules, and network connection restriction rules. When the target event matches the security rules, an anomaly detection result is generated and sent to the terminal.

[0027] Thirdly, this disclosure also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of a terminal security detection method.

[0028] Fourthly, this disclosure also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of a terminal security detection method.

[0029] Fifthly, this disclosure also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of a terminal security detection method.

[0030] The aforementioned terminal security detection methods have at least the following beneficial effects:

[0031] The embodiments provided in this disclosure employ multiple independent threads to collect network events in parallel, enabling real-time capture of terminal network data. The independent operation of each thread avoids single points of failure and ensures continuous data collection. Atomic operations prevent multi-threaded write conflicts, a circular buffer reuses memory resources, and threshold alarms and priority discarding mechanisms prevent the loss of critical data. Dynamic updates of security rules and automatic threat handling are supported, and the management platform enables global threat control and policy optimization, reducing terminal operation and maintenance costs.

[0032] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments or conventional technologies of this disclosure, the accompanying drawings used in the description of the embodiments or conventional technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is an application environment diagram of a terminal security detection method in one embodiment;

[0035] Figure 2 This is a flowchart illustrating a terminal security detection method in one embodiment;

[0036] Figure 3 This is a schematic diagram of the detection system in one embodiment;

[0037] Figure 4 This is a structural block diagram of a terminal security detection device in one embodiment;

[0038] Figure 5 This is an internal structural diagram of a computer device in one embodiment;

[0039] Figure 6 This is an internal structure diagram of a server in one embodiment. Detailed Implementation

[0040] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0041] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims. The terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitation, the presence of other identical or equivalent elements in a process, method, product, or apparatus that includes said elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any specific order.

[0042] This disclosure provides a terminal security detection method that can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or located in the cloud or on other network servers. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. Server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0043] In some embodiments of this disclosure, such as Figure 2As shown, a terminal security detection method is provided, which is applied to... Figure 1 This paper uses the example of a server handling network events to illustrate the method. It is understood that this method can be applied to servers, as well as to systems including terminals and servers, and is implemented through interaction between the terminal and the server. In a specific embodiment, the method may include the following steps:

[0044] S202: The terminal's network events are acquired based on multiple independent acquisition threads.

[0045] Figure 3 This is a schematic diagram of a detection system in one embodiment. This embodiment can be applied to an EDR (Endpoint Detection and Response) product. It achieves comprehensive monitoring and real-time protection of the computer system through four core modules: an information acquisition module, an event detection module, a data processing and control module, and a management platform.

[0046] The information acquisition module is the core data source of the entire system, responsible for collecting file system events, process events, and network events from the operating system level. To ensure the real-time performance and accuracy of the data, the module employs different technical integration schemes across different operating systems and transmits the collected events to subsequent modules through a unified data flow interface.

[0047] In one embodiment of this disclosure, a data collection scheme can be implemented in a Linux system, with multiple independent collection threads collecting file system events, process events, and network events respectively. In the Linux system, the eBPF and inotify mechanisms are used to collect file system events. The eBPF mechanism uses the bpf() system call to load the eBPF program and mount it to a kernel hook point (kprobe) to capture file system operation events. sys_enter_openat is used to trace file open operations, file_rename is used to capture file renaming events, and vfs_write captures file write operations. The captured events are then passed to the information collection module via the perf_event mechanism for filtering and reporting. The inotify mechanism requires a kernel version of at least 4.x for eBPF. For systems with lower versions or high performance requirements, inotify is used. First, the monitored directories are registered using inotify_add_watch, and events caused by directory changes need to be dynamically handled, with timely additions or removals. Next, the `read` system call is used to read file change events from the inotify file in a loop, filtering relevant events such as `IN_CREATE` (creation) and `IN_MODIFY` (modification), and then pushing them to the event detection module. Netlink is used to monitor system process events. The information acquisition module first uses the `NETLINK_CONNECTOR` protocol to create a netlink socket and bind it to the `CN_PROC` group to receive process lifecycle events, such as `PROC_EVENT_FORK` (creating a child process), `PROC_EVENT_EXEC` (creating a new process), and `PROC_EVENT_EXIT` (process exit). Then, the `recvmsg` system call is used to read process events in a loop, and preliminary filtering is performed using a cache before pushing them to the event detection module. The pcap tool is used to capture network packets. The network interface is first opened using `pcap_open_live`, and network interface card packets are read in a loop using the `pcap_loop` or `pcap_dispatch` functions. After parsing the captured network events, key fields (such as source IP, destination IP, port number, etc.) are extracted and pushed to the event detection module according to time.

[0048] In one embodiment of this disclosure, a data collection scheme for a Windows system can be implemented. The `ReadDirectoryChangesW` system call is used to monitor file change events in the target directory, capturing file and subdirectory creation, modification, and deletion events, and pushing these events to the event detection module. The `EnableTraceEx2` function is used to enable the Microsoft-Windows-Kernel-Process provider, subscribing to `ProcessStart` and `ProcessStop` events. After parsing and filtering, these events are pushed to the event detection module. The `npcap` tool is used to capture network packets. First, the network interface is opened using `pcap_open`. Then, the `pcap_next_ex` function reads the packets passing through the network card one by one. The network interface is then opened again using `pcap_open`, enabling promiscuous mode to capture all packets. Finally, the `pcap_next_ex` function reads the packets one by one.

[0049] S204: Store the network events in a circular buffer in sequence.

[0050] All collected events, after filtering and formatting, are aggregated into a shared memory queue. To ensure data real-time performance and accuracy, the queue is implemented using a circular buffer. Before entering the queue, each collection method performs preliminary deduplication and filtering. Only the final event data is aggregated between collection modules, and each module's business logic is implemented in its own thread without interference.

[0051] S206: Obtain the target events in the network events in sequence; detect the target events based on predefined security rules, the security rules including at least one of file path blacklist rules, process behavior blacklist rules, and network connection restriction rules; if the target event matches the security rules, generate an anomaly detection result and send it to the terminal.

[0052] The event detection module is responsible for in-depth analysis and detection of events captured by the information collection module, and mainly provides two types of engines: a virus detection engine and a rule engine.

[0053] The control module is responsible for registering monitoring directories, receiving event notifications, forwarding detection requests, and comprehensively analyzing detection results. Its workflow is as follows: Register the directories and event types to be monitored, and send configuration commands to the information collection module. Receive event notifications from the shared memory queue and filter non-target events according to preset policies. Forward the remaining events to the event detection module for in-depth analysis. Comprehensively analyze the detection results, determine whether the system is under threat, and report the threat information to the management platform. Execute corresponding protective measures according to the management platform's handling policies.

[0054] In the aforementioned terminal security detection method, multiple independent threads collect network events in parallel, enabling real-time capture of terminal network data. The independent operation of threads avoids single points of failure and ensures continuous data collection. Atomic operations prevent multi-threaded write conflicts, a circular buffer reuses memory resources, and threshold alarms and priority discarding mechanisms prevent the loss of critical data. Dynamic updates of security rules and automatic threat handling are supported, and the management platform enables global threat control and policy optimization, reducing terminal operation and maintenance costs.

[0055] In some embodiments of this disclosure, storing the network events sequentially into a circular buffer includes:

[0056] Based on atomic instructions, write access to the circular buffer is preempted, resulting in a target acquisition thread with write access and a waiting acquisition thread without write access. The target acquisition thread is used to write network events into the free storage unit of the circular buffer, and after writing is completed, it releases the write access through atomic instructions and updates the write pointer position of the circular buffer.

[0057] Atomic instructions are uninterruptible computer instructions whose execution cannot be interrupted by other programs or threads. Atomic instructions are used to control the acquisition and release of write permissions to a circular buffer, preventing data corruption caused by multiple threads operating on the buffer simultaneously. A circular buffer is a cyclic memory storage structure, a circular queue with its head and tail connected. Write pointers and read pointers mark the positions for writing and reading data, respectively. Write permission is like a key to the circular buffer; only one thread can hold this key at a time, ensuring exclusive write access. Free storage units are unoccupied memory spaces in the circular buffer, used to store network events; target acquisition threads can only write data to these empty spaces. The write pointer is a variable in the circular buffer that marks the next writable location. After each write operation, the pointer moves sequentially to the next free unit, ensuring data is stored in a first-write-first-store order.

[0058] The atomic instruction checks the write permission status of the circular buffer. If the permission is available, it is allocated to the currently requesting thread, which becomes the target acquisition thread. Other threads requesting permission simultaneously become waiting acquisition threads, waiting for the target thread to release the permission before attempting to acquire it again. Once the target acquisition thread obtains write permission, it finds a free storage unit in the circular buffer and writes the parsed network event data completely into that unit. After completing the data writing, the target acquisition thread releases the write permission of the circular buffer again using an atomic instruction, allowing waiting acquisition threads to re-acquire the data. Simultaneously, the system moves the write pointer of the circular buffer sequentially to the next free storage unit, marking it for the next write operation and ensuring that subsequent network events are stored in the buffer in the first-to-first-to-write order.

[0059] In some embodiments of this disclosure, the detection of target events based on predefined security rules includes:

[0060] Obtain key characteristics of the target event file, including its hash value, header information, and special sections.

[0061] The key features are compared with the virus feature database to obtain anomaly detection results.

[0062] The event detection module is responsible for in-depth analysis and detection of events captured by the information collection module, and mainly provides two types of engines: a virus detection engine and a rule engine.

[0063] The virus detection engine analyzes file modification events based on signature-based matching technology. It extracts key file characteristics, such as file hash values, file headers, and special file sections, and compares them against a virus signature database to confirm whether it represents a known threat. If so, it generates a corresponding alert and sends it to the management platform.

[0064] The rule engine detects abnormal events based on predefined security rules. These rules include, but are not limited to, file path blacklists, process behavior blacklists, and network connection restrictions. When a process triggers certain operations defined in the rules, a corresponding alert is generated and sent to the management platform.

[0065] In some embodiments of this disclosure, after updating the write pointer position of the circular buffer, the method further includes:

[0066] The storage occupancy rate of the circular buffer is detected. If the storage occupancy rate exceeds a preset threshold, a circular buffer alarm is triggered and low-priority network events are discarded according to event priority.

[0067] After updating the write pointer position of the circular buffer, the system immediately counts the number of used and free storage units in the buffer and calculates the current storage occupancy rate using a formula. If the occupancy rate does not exceed a preset threshold, it means the buffer still has sufficient free space, and no further operations are needed; the system continues to wait for the next network event write. If the occupancy rate exceeds the preset threshold, subsequent alarm and event discarding procedures are triggered.

[0068] In some embodiments of this disclosure, comparing the key features with a virus signature database to obtain anomaly detection results includes:

[0069] If the key features match the features in the virus feature database to a first preset threshold, it is determined to be a high-level threat; if the match reaches a second preset threshold but is lower than the first preset threshold, it is determined to be a medium-level threat; if the match is lower than the second preset threshold, it is determined to be a low-level threat or no threat, wherein the first preset threshold is greater than the second preset threshold.

[0070] Events are categorized based on threat level, and specific handling instructions are generated and sent to the corresponding terminal nodes based on the user's selected response measures.

[0071] In some embodiments of this disclosure, the method further includes:

[0072] Record and analyze each anomaly detection result to obtain the analysis results;

[0073] Optimize detection rules and protection strategies based on analysis results.

[0074] The sorting and control module comprehensively analyzes the detection results, determines the system's security status, takes necessary security protection measures, and reports all information to the management platform. It then summarizes the reported threat information and protection results and presents them to the specific user. After the user selects a specific countermeasure, the message is sent to the corresponding power-off sorting and control module, which then executes the corresponding action.

[0075] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0076] Based on the same inventive concept, this disclosure also provides a terminal security detection device for implementing the aforementioned terminal security detection method. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in the terminal security detection device embodiments provided below can be found in the limitations of the terminal security detection method described above, and will not be repeated here.

[0077] The apparatus may include a system (including a distributed system), software (application), module, component, server, client, etc., that uses the methods described in the embodiments of this specification, combined with necessary hardware implementation. Based on the same innovative concept, the apparatuses in one or more embodiments provided in this disclosure are as described in the following embodiments. Since the implementation schemes and methods for solving the problem by the apparatus are similar, the implementation of the specific apparatus in the embodiments of this specification can refer to the implementation of the foregoing methods, and repeated details will not be repeated. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatuses described in the following embodiments are preferably implemented in software, hardware implementations, or a combination of software and hardware, are also possible and contemplated.

[0078] In one embodiment, such as Figure 4 As shown, a terminal security detection device 400 is provided. The device can be the aforementioned server, or a module, component, device, or unit integrated into the server. The device 400 may include:

[0079] The acquisition module 402 is used to acquire network events of the terminal based on multiple independent acquisition threads;

[0080] Storage module 404 is used to store the network events sequentially into a circular buffer;

[0081] Detection module 406 is used to sequentially acquire target events in the network events;

[0082] The target event is detected based on predefined security rules, which include at least one of file path blacklist rules, process behavior blacklist rules, and network connection restriction rules. When the target event matches the security rules, an anomaly detection result is generated and sent to the terminal.

[0083] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0084] The modules in the aforementioned terminal security detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0085] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores network events. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a terminal security detection method.

[0086] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a terminal security detection method. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0087] Those skilled in the art will understand that Figure 5 , Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present disclosure and does not constitute a limitation on the computer device to which the present disclosure is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0088] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the methods described in any embodiment of this disclosure.

[0089] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the methods described in any embodiment of this disclosure.

[0090] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this disclosure can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this disclosure may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this disclosure may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0091] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0092] The embodiments described above are merely illustrative of several implementations of this disclosure, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent disclosure. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this disclosure, and these all fall within the protection scope of this disclosure. Therefore, the protection scope of this disclosure should be determined by the appended claims.

Claims

1. A terminal security detection method, characterized by, The method comprises: respectively acquiring network events of a terminal based on multiple independent acquisition threads; storing the network events in sequence into a ring buffer; sequentially acquiring a target event in the network events; detecting the target event based on predefined security rules, the security rules comprising at least one of a file path blacklist rule, a process behavior blacklist rule, and a network connection restriction rule, and in a case where the target event matches the security rules, generating an anomaly detection result and sending the anomaly detection result to the terminal.

2. The method of claim 1, wherein, The storing the network events in sequence into a ring buffer comprises: occupying a write permission of the ring buffer based on an atomic instruction to obtain a target acquisition thread containing the write permission and a waiting acquisition thread not containing the write permission, the target acquisition thread being used to write the network events into an idle storage unit of the ring buffer and release the write permission through the atomic instruction after the writing is completed to update a write pointer position of the ring buffer.

3. The method of claim 1, wherein, The detecting the target event based on the predefined security rules comprises: acquiring key features of a target event file hash value, file header information, and file special segment content; comparing the key features with a virus feature library to obtain the anomaly detection result.

4. The method of claim 2, wherein, After the updating the write pointer position of the ring buffer, the method further comprises: detecting a storage occupancy rate of the ring buffer, and if the storage occupancy rate exceeds a preset threshold, triggering a ring buffer alarm and discarding network events of a low priority according to an event priority.

5. The method of claim 3, wherein, The comparing the key features with the virus feature library to obtain the anomaly detection result comprises: if a matching degree of the key features with features in the virus feature library reaches a first preset threshold, determining a high-level threat, if the matching degree reaches a second preset threshold and is lower than the first preset threshold, determining a medium-level threat, and if the matching degree is lower than the second preset threshold, determining a low-level threat or no threat, wherein the first preset threshold is greater than the second preset threshold.

6. The method of claim 1, wherein, The method further comprises: recording and analyzing each anomaly detection result to obtain an analysis result; optimizing a detection rule and a protection strategy based on the analysis result.

7. A terminal security detection apparatus, characterized by comprising: The apparatus comprises: an acquisition module configured to respectively acquire network events of a terminal based on multiple independent acquisition threads; a storage module configured to store the network events in sequence into a ring buffer; a detection module configured to sequentially acquire a target event in the network events; detect the target event based on predefined security rules, the security rules comprising at least one of a file path blacklist rule, a process behavior blacklist rule, and a network connection restriction rule, and in a case where the target event matches the security rules, generate an anomaly detection result and send the anomaly detection result to the terminal. 8.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-7. The processor implements the steps of the method of any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 6.

Images