Method and device for analyzing abnormal behavior of host

Abstract

The invention aims to provide a host abnormal behavior analysis method and device, and the method comprises the steps: building a recognition model according to different risk scenes, carrying out the abnormal recognition of input data, storing normal data and abnormal data, building a security baseline of a host according to the normal data, carrying out the multi-dimensional data aggregation processing, obtaining the access features of the host, and carrying out the abnormal behavior analysis of the host. And finally, outputting corresponding data statistical analysis results according to different labels. On one hand, the recognition model is established through machine learning and is periodically updated, the detection accuracy of the recognition model can be improved, on the other hand, behavior characteristics of different dimensions of host behaviors are analyzed, host behavior abnormity can be effectively found, the risk that enterprises suffer from network attacks is further reduced, and the network security is improved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a method for determining the characteristics of host access behavior by anomaly identification of host access behavior, as well as an apparatus for implementing the method. Background Technology

[0002] Traditional security products, technologies, and solutions are primarily based on rule matching of known features for analysis and detection. Feature-based detection and analysis suffers from blind spots in security visibility, significant lag effects, inability to detect unknown attacks, susceptibility to bypassing, and difficulty adapting to the realities of attack and defense in cyberspace and the rapidly changing enterprise environment and external threats. Against this backdrop, behavioral analysis technology has emerged.

[0003] Traditional behavioral analytics is used to detect abnormal user behavior, determine whether such behavior poses a security threat, and promptly alert operations personnel. It can enhance an enterprise's security capabilities by building upon existing network security systems or solutions. However, with the increasing variety of user access methods and devices, the complexity of network attacks is also constantly rising. Focusing solely on user behavior is insufficient to cover blind spots that traditional security systems or solutions cannot address, particularly those specific to IT systems, critical infrastructure, business processes, and organizational security risks. Summary of the Invention

[0004] In view of the above, the present invention aims to propose a method and apparatus for analyzing abnormal host behavior, for analyzing host behavior, identifying abnormal data and obtaining its access behavior characteristics, the specific invention content is as follows.

[0005] On the one hand, this invention proposes a method for analyzing abnormal host behavior, including: Based on the preset risk scenarios, a corresponding identification model is established through machine learning of historical data; The system periodically acquires and preprocesses the data to be analyzed for the corresponding risk scenarios, inputs it into the identification model, and determines whether it is abnormal data. If it is normal data, a new normal baseline is created and stored in the first database. If it is abnormal data, an abnormal baseline is marked and stored in the second database. The risk scenarios include user detection, traffic anomaly detection, database anomaly, outgoing file anomaly, outgoing data anomaly, and access anomaly. Data is retrieved from the first database to establish the host's security baseline. The baseline data of the target host is aggregated according to different preset dimensions to obtain the host's active access characteristics and passive access characteristics.

[0006] Preferably, in response to the input query tags, abnormal data is retrieved from the second database, aggregated and analyzed, and the analysis results are output. The query tags include risk scenarios, host IPs, and start and end times.

[0007] Furthermore, the establishment of the identification model includes: acquiring global whitelist data and host data of threat intelligence, acquiring historical data for a preset period based on host IP, performing data cleaning and cluster analysis, and establishing a host identification model through regression algorithms.

[0008] Furthermore, abnormal data obtained from matching is manually re-labeled, including marking incorrectly matched data as normal, and inputting the normal data obtained from this matching into the training data of the recognition model for the next cycle to update the recognition model.

[0009] Preferably, the active and passive access characteristics of the host include access time characteristics, access destination and source characteristics, and access content characteristics, wherein: access time characteristics include access traffic trends, frequency trends, and time periods; access destination and source characteristics include the source network segment and destination network segment, and the source host and destination host; access content characteristics include the applications and number of accesses and the access ports and number of accesses.

[0010] Furthermore, the traffic trends include: According to the start and end time of the preset period, query the first database or the second database and calculate the sum of all traffic base point values ​​within the period; in response to the input traffic trend command, obtain all the base point values ​​of the preset period, and predict the traffic of at least one future corresponding period based on the historical period traffic. The traffic trend includes determining upward and downward trends based on the direction of traffic flow.

[0011] Preferably, the security baseline of the host has a threshold, the threshold has a tolerance, and the tolerance is negatively correlated with the preset importance of the host; if the abnormal data exceeds the threshold and exceeds the tolerance, an alarm is issued.

[0012] On the other hand, the present invention proposes a host abnormal behavior analysis device to implement the above-mentioned host abnormal behavior analysis method. The device includes: The data storage module is used to store raw data, analyzed normal data, and abnormal data. The identification model module identifies whether the data is abnormal by inputting raw data into the model. The data analysis module is used to analyze the host's behavioral characteristics based on the recognition results of the recognition model.

[0013] Preferably, the identification model is established by machine learning on historical data based on preset risk scenarios; and periodically acquires and preprocesses the data to be analyzed for the corresponding risk scenarios to determine whether it is abnormal data; if it is normal data, a new normal baseline is created and stored in the first database; if it is abnormal data, an abnormal baseline is marked and stored in the second database.

[0014] Furthermore, data is retrieved from the first database to establish a security baseline for the host, and the baseline data of the target host is aggregated according to different preset dimensions to obtain the host's active access characteristics and passive access characteristics.

[0015] The present invention, employing the above technical solution, has the following beneficial effects: It establishes identification models based on different risk scenarios, identifies anomalies in the input data, stores normal and abnormal data separately, establishes a host security baseline based on the normal data, and performs multi-dimensional data aggregation processing to obtain the host's access characteristics. Finally, it outputs corresponding data statistical analysis results based on different labels. On the one hand, utilizing machine learning to establish identification models and periodically updating them can improve the detection accuracy of the identification models. On the other hand, analyzing the behavioral characteristics of hosts in different dimensions can effectively detect abnormal host behavior, further reducing the risk of enterprises suffering network attacks and improving network security. Detailed Implementation

[0016] The technical solution of the present invention will be described in detail below with reference to the embodiments.

[0017] First, a brief description of the relevant technical background and terminology of this invention.

[0018] EBA (Entity Behavior Analysis) identifies potential events related to unusual activity associated with standard user or entity profiles or behaviors. Detection targets include unusual access to the system by trusted internal or third-party personnel (user anomalies) or intrusions by external attackers bypassing security controls (abnormal users).

[0019] A security baseline is the minimum security guarantee for an information system, that is, the most basic security requirements that the information system must meet. Information system security often requires a balance between the security costs and the security risks that can be tolerated, and the security baseline is the reasonable dividing line of this balance.

[0020] On the one hand, this invention proposes a method for analyzing abnormal host behavior, including: Based on the preset risk scenarios, a corresponding identification model is established through machine learning of historical data; The system periodically acquires and preprocesses the data to be analyzed for the corresponding risk scenarios, inputs it into the identification model, and determines whether it is abnormal data. If it is normal data, a new normal baseline is created and stored in the first database. If it is abnormal data, an abnormal baseline is marked and stored in the second database. The risk scenarios include user detection, traffic anomaly detection, database anomaly, outgoing file anomaly, outgoing data anomaly, and access anomaly. Data is retrieved from the first database to establish the host's security baseline. The baseline data of the target host is aggregated according to different preset dimensions to obtain the host's active access characteristics and passive access characteristics.

[0021] Preferably, in response to the input query tags, abnormal data is retrieved from the second database, aggregated and analyzed, and the analysis results are output. The query tags include risk scenarios, host IPs, and start and end times.

[0022] Furthermore, the establishment of the identification model includes: acquiring global whitelist data and host data of threat intelligence, acquiring historical data for a preset period based on host IP, performing data cleaning and cluster analysis, and establishing a host identification model through regression algorithms.

[0023] Furthermore, abnormal data obtained from matching is manually re-labeled, including marking incorrectly matched data as normal, and inputting the normal data obtained from this matching into the training data of the recognition model for the next cycle to update the recognition model.

[0024] Preferably, the active and passive access characteristics of the host include access time characteristics, access destination and source characteristics, and access content characteristics, wherein: access time characteristics include access traffic trends, frequency trends, and time periods; access destination and source characteristics include the source network segment and destination network segment, and the source host and destination host; access content characteristics include the applications and number of accesses and the access ports and number of accesses.

[0025] Furthermore, the traffic trends include: According to the start and end time of the preset period, query the first database or the second database and calculate the sum of all traffic base point values ​​within the period; in response to the input traffic trend command, obtain all the base point values ​​of the preset period, and predict the traffic of at least one future corresponding period based on the historical period traffic. The traffic trend includes determining upward and downward trends based on the direction of traffic flow.

[0026] Preferably, the security baseline of the host has a threshold, the threshold has a tolerance, and the tolerance is negatively correlated with the preset importance of the host; if the abnormal data exceeds the threshold and exceeds the tolerance, an alarm is issued.

[0027] As described in the above embodiment of the host anomaly behavior analysis method, an identification model is established based on different risk scenarios. Anomalies are identified in the input data, and normal and abnormal data are stored separately. A security baseline for the host is established based on the normal data, and multi-dimensional data aggregation processing is performed to obtain the host's access characteristics. Finally, corresponding statistical analysis results are output based on different labels. On the one hand, using machine learning to build and periodically update the identification model can improve its detection accuracy. On the other hand, analyzing the behavioral characteristics of the host in different dimensions can effectively detect abnormal host behavior, further reducing the risk of network attacks on enterprises and improving network security.

[0028] In another embodiment of the present invention, a host abnormal behavior analysis device is provided to implement the host abnormal behavior analysis method of the above embodiment. The device includes: The data storage module is used to store raw data, analyzed normal data, and abnormal data. The identification model module identifies whether the data is abnormal by inputting raw data into the model. The data analysis module is used to analyze the host's behavioral characteristics based on the recognition results of the recognition model.

[0029] Preferably, the identification model is established by machine learning on historical data based on preset risk scenarios; and periodically acquires and preprocesses the data to be analyzed for the corresponding risk scenarios to determine whether it is abnormal data; if it is normal data, a new normal baseline is created and stored in the first database; if it is abnormal data, an abnormal baseline is marked and stored in the second database.

[0030] Furthermore, data is retrieved from the first database to establish a security baseline for the host, and the baseline data of the target host is aggregated according to different preset dimensions to obtain the host's active access characteristics and passive access characteristics.

[0031] As described in the above embodiment of the host abnormal behavior analysis device, an identification model is established based on different risk scenarios. The input data is anomaly identified, and normal and abnormal data are stored separately. A security baseline for the host is established based on the normal data, and multi-dimensional data aggregation processing is performed to obtain the host's access characteristics. Finally, corresponding data statistical analysis results are output based on different tags. On the one hand, using machine learning to establish and periodically update the identification model can improve its detection accuracy. On the other hand, analyzing the behavioral characteristics of the host in different dimensions can effectively detect abnormal host behavior, further reducing the risk of network attacks on enterprises and improving network security.

[0032] Those skilled in the art will understand that all or part of the steps in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc.

[0033] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method of host abnormal behavior analysis, the method comprising: The method comprises the following steps: According to the preset risk scenario, the corresponding identification model is established by machine learning on historical data; Periodically acquire and preprocess the data to be analyzed of the corresponding risk scenario, input the identification model, and judge whether it is abnormal data; If it is normal data, a new normal base point is created and stored in the first database, and if it is abnormal data, an abnormal base point is marked and stored in the second database; the risk scenario includes user detection, traffic anomaly detection, database anomaly, outgoing file anomaly, outgoing data anomaly, and access anomaly; The data from the first database is used to establish the security baseline of the host, and the baseline data of the target host is aggregated according to the preset different dimensions to obtain the active access characteristics and passive access characteristics of the host.

2. The host abnormal behavior analysis method of claim 1, wherein, In response to the input query label, the abnormal data from the second database is aggregated and analyzed, and the analysis result is output, the query label including risk scenario, host IP, start and end time.

3. The method of claim 1, wherein the host abnormal behavior analysis comprises: The establishment of the identification model comprises: obtaining the global whitelist data and host data of threat intelligence, obtaining the historical data of a preset period according to the host IP, performing data cleaning and clustering analysis, and establishing the identification model of the host by a regression algorithm.

4. The method of claim 1 or 3, wherein, The matching abnormal data is marked by artificial secondary marking, including marking the matching error data as normal, and inputting the normal data obtained in this matching into the training data of the identification model of the next period to update the identification model.

5. The method of claim 1, wherein the host abnormal behavior analysis comprises: The active access and passive access characteristics of the host include access time characteristics, access destination and source characteristics, and access content characteristics, wherein: the access time characteristics include access traffic trend, frequency trend, and time period; the access destination and source characteristics include the source network segment and the destination network segment of the access, and the source host and the destination host of the access; the access content characteristics include the application and the number of accesses, and the access port and the number.

6. The method of claim 5, wherein the host abnormal behavior analysis comprises: The traffic trend comprises: According to the start and end time of the preset period, the sum of all traffic base point values in the period is queried and counted from the first database or the second database; in response to the input traffic trend instruction, the base point values of all the preset periods are obtained, and at least one future corresponding period of traffic is predicted according to the historical period traffic; The traffic trend comprises determining the uplink and downlink trends according to the traffic direction respectively.

7. The method of claim 1, wherein the host abnormal behavior analysis comprises: The security baseline of the host has a threshold value, and the threshold value has a tolerance, and the tolerance is negatively correlated with the preset importance of the host; If the abnormal data exceeds the threshold value and exceeds the tolerance, an alarm is given.

8. A host abnormal behavior analysis apparatus that implements the host abnormal behavior analysis method according to any one of claims 1 to 7, characterized by The device comprises: A data storage module for storing raw data, analyzed normal data and abnormal data; An identification model module for identifying whether the data is abnormal by inputting the raw data into the model; A data analysis module for analyzing the host behavior characteristics according to the identification result of the identification model.

9. The host abnormal behavior analysis apparatus according to claim 8, characterized by, The identification model is established according to the preset risk scenario by machine learning on historical data, and periodically acquires and preprocesses the data to be analyzed of the corresponding risk scenario to judge whether it is abnormal data; If it is normal data, a new normal base point is created and stored in the first database, and if it is abnormal data, an abnormal base point is marked and stored in the second database.

10. The host abnormal behavior analysis apparatus according to claim 9, characterized by, The data from the first database are taken out to establish a security baseline of the host, and the baseline data of the target host are aggregated according to preset different dimensions to obtain active access features and passive access features of the host.