Terminal threat detection method based on AI large model, storage medium and electronic equipment
By using large AI models to perform semantic representation and contextual reasoning on terminal behavior data, the problem of modal fragmentation and false alarm rate in advanced threat detection of EDR systems has been solved, enabling effective detection and automated response to advanced threats.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-12
- Publication Date
- 2026-03-24
AI Technical Summary
Existing endpoint detection and response (EDR) systems suffer from modal fragmentation, shallow behavioral correlation, and high false alarm rates when detecting advanced threats, making it difficult to effectively identify unknown attacks and advanced persistent threats.
The system employs a large AI model to perform semantic representation learning and contextual reasoning analysis on multi-source heterogeneous behavioral data, generating threat assessment results and attack chain graphs. It also uses a large language model to identify cross-data source related behavioral patterns and output threat assessment results.
It enables deep contextual analysis of advanced stealth threats, reduces false alarm rates, generates clear attack chain information, assists in security decision-making, and supports automated response.
Smart Images
Figure CN121727786A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of cybersecurity, and in particular to endpoint threat detection methods, storage media, and electronic devices based on AI large-scale models. Background Technology
[0002] Endpoint detection and response (EDR) systems are a key component of modern network security architecture. They continuously collect various data, such as operating system kernel, processes, network, files, and user behavior, by deploying agent programs on protected endpoints (such as servers, office computers, and workstations), and then perform threat detection, forensic analysis, and response based on this data.
[0003] However, existing EDR detection technologies have significant limitations that restrict their ability to detect advanced threats:
[0004] Signature-based detection: This method matches predefined malware signatures or behavioral rules. While efficient for detecting known threats, it is inherently lagging and cannot effectively detect unknown attacks (0-day attacks) or variant malware.
[0005] Machine learning-based analysis: This approach was introduced to address unknown threats, but it often suffers from strong reliance on feature engineering and limitations in model performance due to expert-designed features. More importantly, existing solutions are mostly "modal fragmented" single-point analyses, meaning that modules such as process analysis, network analysis, and file analysis run independently, lacking a core engine capable of deeply integrating multimodal data for correlated reasoning. This results in isolated alerts lacking context.
[0006] Alerts based on simple behavioral correlations: Some advanced EDR products attempt to perform behavioral correlations, but the correlation logic is often shallow, linear, and pre-coded. It cannot understand the complex semantics and intentions behind the behavior, and lacks effective detection capabilities for "Living Off the Land" attacks and advanced persistent threats (APTs) that are long-lasting, have discrete, and seemingly normal behaviors.
[0007] In recent years, artificial intelligence technologies such as large language models have demonstrated powerful contextual reasoning capabilities in fields such as natural language understanding. However, applying them to the field of endpoint security faces challenges such as heterogeneous endpoint behavior data, strong temporal sequence, and high noise levels. How to effectively learn representations of this data and combine it with the capabilities of large models, while simultaneously addressing the high deployment costs of large models, remains a technical challenge in this field.
[0008] Therefore, there is an urgent need in this field for an innovative technical solution that can break down modal fragmentation and achieve deep contextual analysis, thereby effectively detecting advanced covert threats. Summary of the Invention
[0009] To address the aforementioned technical problems, the technical solution adopted by this invention is as follows:
[0010] According to one aspect of this application, an endpoint threat detection method based on an AI large model is provided, comprising:
[0011] Acquire multi-source heterogeneous behavioral data from the terminal, wherein the multi-source heterogeneous behavioral data includes at least process behavior sequences and network behavior sequences;
[0012] The multi-source heterogeneous behavioral data is standardized into a structured event stream with time-series tags;
[0013] Semantic representation learning is performed on the structured event stream to generate a vector sequence containing behavioral semantics;
[0014] Contextual reasoning analysis is performed on the vector sequences based on a large language model to identify cross-data source correlation behavior patterns and output their threat assessment results; and,
[0015] Based on the threat assessment results, security incident information describing the potential attack chain is generated.
[0016] The semantic representation learning of the structured event stream includes:
[0017] This maps discrete event elements in a structured event stream to a unified low-dimensional vector space, where event elements include process names, command-line arguments, network connection endpoints, or file paths.
[0018] The contextual reasoning analysis based on the large language model includes:
[0019] The vector sequence is modeled using a pre-trained large language model;
[0020] The large language model is configured to perform the following operations: analyze the temporal dependencies and semantic associations between events to construct a coherent behavioral context; and determine the anomalousness and malicious intent of the behavioral sequence based on the behavioral context.
[0021] The large language model is a model that has been adjusted using malware behavior chain samples and attack technique description data.
[0022] The threat assessment results include information on the degree of matching with tactical techniques in known attack frameworks.
[0023] The generation of security event information describing a potential attack chain includes:
[0024] Multiple malicious related behavioral patterns are linked in chronological order and logically to generate an attack chain graph; and response measures are recommended based on the attack chain graph.
[0025] According to another aspect of this application, a non-transitory computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored therein, the at least one instruction or the at least one program being loaded and executed by a processor to implement the aforementioned method.
[0026] According to another aspect of this application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.
[0027] This invention, by introducing AI large-scale model technology and conducting semantic-level correlation analysis across data sources, can identify subtle abnormal behavior patterns that are difficult to detect from a single modality perspective, effectively reducing detection blind spots, and is particularly suitable for detecting low-level, slow, and small APT attacks. Context-based threat assessment can better distinguish between malicious behavior and normal abnormal operations, thus significantly reducing false positive rates. Simultaneously, the generated attack chain information provides security analysts with a clear and interpretable threat context, assisting in decision-making. Furthermore, by automatically reconstructing the attack chain and predicting attack intent, it can provide high-quality decision-making support for automated response systems, driving the evolution of security operations from manual intervention to an intelligent closed-loop system. Attached Figure Description
[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0029] Figure 1 A flowchart of an AI-based large-scale model-based endpoint threat detection method provided in an embodiment of the present invention. Detailed Implementation
[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0031] like Figure 1 As shown, the endpoint threat detection method based on AI large model of the present invention includes the following steps:
[0032] S101. Obtain multi-source heterogeneous behavior data on the terminal, and standardize the multi-source heterogeneous behavior data into a structured event stream with time-series tags.
[0033] Specifically, lightweight agent programs deployed on terminals such as servers and personal computers continuously collect various types of behavioral data. This multi-source heterogeneous behavioral data includes at least process behavior sequences such as process creation, execution, and exit, as well as network behavior sequences such as network connection establishment and data transmission. Preferably, it may also include file behavior sequences such as file creation, reading, writing, and deletion, and user operation behavior sequences such as user-inputted command lines.
[0034] After collecting the raw data, it is cleaned and standardized to form a structured event stream with key fields such as timestamp, process ID, operation type, and operation object. For example, an event can be represented as: {timestamp: T1, process_id: 1234, operation: "EXECUTE", target: "cmd.exe"}.
[0035] S102. Perform semantic representation learning on the standardized structured event stream and generate a vector sequence containing behavioral semantics.
[0036] Specifically, heterogeneous behavioral data is "translated" into a "language" that machines can deeply understand. Variants such as Word2Vec and BERT are used as pre-trained embedding models to map discrete event elements in a structured event stream to a unified low-dimensional vector space. For example, event elements might include the process name "powershell.exe", the command-line argument "-enc", the network connection endpoint IP "1.2.3.4", and the file path "C:\temp\script.ps1".
[0037] Each event element is transformed into a low-dimensional dense vector that captures its semantic information. For example, "powershell.exe" and "cmd.exe" are relatively close in the vector space, while they are relatively far from notepad.exe. Ultimately, a series of events is transformed into a sequence of vectors that generate behavioral semantics.
[0038] S103. Perform contextual reasoning analysis on the vector sequence based on a large language model to identify cross-data source related behavioral patterns and output its threat assessment results. The contextual reasoning analysis based on the large language model includes: modeling the vector sequence using a pre-trained large language model; the large language model is configured to perform the following operations: analyze temporal dependencies and semantic associations between events to construct a coherent behavioral context; and determine the anomalousness and malicious intent of the behavioral sequence based on the behavioral context. The large language model is a model adjusted using malware behavior chain samples and attack technique description data. The threat assessment results include matching information with tactical techniques in known attack frameworks.
[0039] Specifically, the vector sequence generated in step S102 is input into a large language model that has been fine-tuned. This large language model is pre-trained on a large amount of general corpus and further fine-tuned using massive amounts of malware behavior chains and attack techniques such as MITRE ATT&CK, enabling it to understand the logic of malicious behavior.
[0040] This large language model is configured to perform:
[0041] Cross-modal association modeling: Analyze vectors from different sources such as processes, networks, and files to identify their potential temporal and semantic relationships, and construct a unified behavioral context. For example, associate events such as "process A starts", "process A connects to IP B", and "process A reads and writes file C" as the same set of activities.
[0042] Tactical Intent Recognition and Maliciousness Scoring: Based on the constructed context, determine the degree of match between the behavioral sequence and known attack tactics. For example, match the T1059.001 command interpreter. Furthermore, it is not a simple rule-based matching process, but rather a comprehensive evaluation of the sequence's statistical anomalies relative to a normal behavioral baseline, tactical match degree, and semantic anomalies (such as a text editor initiating a network connection), outputting a comprehensive threat assessment result (such as a threat score and tactical label).
[0043] S104. Based on the threat assessment results, generate security event information describing potential attack chains. Generating security event information describing potential attack chains includes: associating multiple related behavioral patterns assessed as malicious according to chronological order and logical relationships to generate an attack chain graph; and recommending response measures based on the attack chain graph.
[0044] Based on the threat assessment results output in step S103, multiple malicious behavior contexts that are sequential in time and causally related in logic are linked together to automatically generate a visualized attack chain diagram. This diagram displays the various stages of the attack, such as initial intrusion, execution, persistence, and command and control. Furthermore, based on its understanding of the current stage of the attack and the prediction of the next stage, the system can automatically generate or recommend corresponding handling strategies, such as isolating processes or blocking network connections. These strategies can be executed automatically or after administrator confirmation.
[0045] Embodiments of the present invention also provide a computer program product including program code, which, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above in various exemplary embodiments of the present invention.
[0046] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.
[0047] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.
[0048] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.
[0049] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”
[0050] An electronic device according to this embodiment of the invention. The electronic device is merely an example and should not be construed as limiting the functionality or scope of the embodiments of the invention.
[0051] Electronic devices are manifested in the form of general-purpose computing devices. The components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and a bus connecting different system components (including memory and processor).
[0052] The storage device stores program code that can be executed by the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of the present invention.
[0053] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).
[0054] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.
[0055] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.
[0056] Electronic devices can also communicate with one or more external devices (such as keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable users to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (such as routers, modems, etc.). This communication can be performed through input / output (I / O) interfaces. Furthermore, electronic devices can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapters.
[0057] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.
[0058] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0059] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.
[0060] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.
[0061] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java and C++, and conventional procedural programming languages such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).
[0062] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.
[0063] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.
[0064] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A terminal threat detection method based on an AI large-scale model, characterized in that, include: Acquire multi-source heterogeneous behavioral data from the terminal, wherein the multi-source heterogeneous behavioral data includes at least process behavior sequences and network behavior sequences; The multi-source heterogeneous behavioral data is standardized into a structured event stream with time-series tags; Semantic representation learning is performed on the structured event stream to generate a vector sequence containing behavioral semantics; Contextual reasoning analysis is performed on the vector sequences based on a large language model to identify cross-data source correlation behavior patterns and output their threat assessment results; and, Based on the threat assessment results, security incident information describing the potential attack chain is generated.
2. The method according to claim 1, characterized in that, The semantic representation learning of the structured event stream includes: This maps discrete event elements in a structured event stream to a unified low-dimensional vector space, where event elements include process names, command-line arguments, network connection endpoints, or file paths.
3. The method according to claim 1, characterized in that, The contextual reasoning analysis based on the large language model includes: The vector sequence is modeled using a pre-trained large language model; The large language model is configured to perform the following operations: analyze the temporal dependencies and semantic associations between events to construct a coherent behavioral context; and determine the anomalousness and malicious intent of the behavioral sequence based on the behavioral context.
4. The method according to claim 3, characterized in that, The large language model is a model that has been adjusted using malware behavior chain samples and attack technique description data.
5. The method according to claim 3, characterized in that, The threat assessment results include information on the degree of matching with tactical techniques in known attack frameworks.
6. The method according to claim 1, characterized in that, The generation of security event information describing a potential attack chain includes: Multiple malicious related behavioral patterns are linked in chronological order and logically to generate an attack chain graph; and response measures are recommended based on the attack chain graph.
7. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the method as described in any one of claims 1-6.
8. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 7.