Terminal behavior detection method and device, equipment and medium

Abstract

The invention discloses a terminal behavior detection method and device, equipment and a medium, and relates to the technical field of computers, and the method comprises the steps: determining a terminal behavior feature of a target terminal; constructing a time sequence behavior matrix according to the distribution rule of the terminal behavior characteristics in the time dimension; performing matrix polar decomposition on the time sequence behavior matrix to obtain an orthogonal component and a positive definite component; the orthogonal component is used for capturing terminal behavior direction features, and the positive definite component is used for reflecting terminal behavior abnormal strength features; performing threat mode identification of the terminal behavior by using the orthogonal component to obtain a first result; performing abnormal strength evaluation on the terminal behavior by using the positive definite component to obtain a second result; and determining a terminal behavior detection result of the target terminal based on the first result and the second result. According to the invention, the balance bottleneck among real-time performance, resource consumption and detection precision in the prior art is effectively broken through.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device and medium for detecting terminal behavior. Background Technology

[0002] As cyberattacks become increasingly sophisticated, threats such as malware and memory injection exhibit high levels of concealment and rapid mutation. While traditional endpoint detection methods (such as feature matching, machine learning classifiers, or deep learning models) are effective in some scenarios, they generally suffer from insufficient real-time performance, high resource consumption, and high false positive rates. Especially in resource-constrained endpoint environments, balancing detection accuracy with low latency and low resource consumption in real-time detection has become a critical technical bottleneck that urgently needs to be overcome. Summary of the Invention

[0003] The purpose of this application is to provide a terminal behavior detection method, device, equipment and medium that effectively breaks through the bottleneck of balancing real-time performance, resource consumption and detection accuracy in traditional technologies.

[0004] To address the above problems, this application provides a terminal behavior detection method, comprising:

[0005] Determine the terminal behavior characteristics of the target terminal;

[0006] Construct a temporal behavior matrix based on the distribution pattern of the terminal behavior characteristics in the time dimension;

[0007] The temporal behavior matrix is ​​subjected to matrix extreme decomposition to obtain orthogonal components and positive definite components; the orthogonal components are used to capture the terminal behavior direction features, and the positive definite components are used to reflect the abnormal intensity features of the terminal behavior.

[0008] Threat pattern recognition of terminal behavior is performed using the orthogonal components to obtain a first result;

[0009] The positive definite component is used to evaluate the abnormal intensity of the terminal behavior, and a second result is obtained;

[0010] The terminal behavior detection result of the target terminal is determined based on the first result and the second result.

[0011] Optionally, constructing a temporal behavior matrix based on the distribution pattern of the terminal behavior features in the time dimension includes:

[0012] The number of feature dimensions of the terminal behavior features is used as the matrix row dimension, the preset time window length is used as the matrix column dimension, and a time-series behavior matrix is ​​constructed based on the value of the terminal behavior feature of each feature dimension in the corresponding time window.

[0013] Optionally, the step of performing matrix extreme decomposition on the time-series behavior matrix to obtain orthogonal components and positive definite components includes:

[0014] The time-series behavior matrix is ​​decomposed into an orthogonal matrix and a positive definite matrix;

[0015] The orthogonal matrix and the positive definite matrix are optimized using an objective function constructed based on a minimax optimization strategy to obtain orthogonal components and positive definite components; wherein, the objective function includes:

[0016] ;

[0017] in, Represents an orthogonal matrix; Represents a positive definite matrix; Represents the constraint terms of an orthogonal matrix; Represents the constraint terms of a positive definite matrix; Represents the temporal behavior matrix; and Represents the regularization coefficient; Denotes the square of the F-norm; Represented by orthogonal matrix Minimize the variables and solve with positive definite matrices. Maximize the value of the variable.

[0018] Optionally, the terminal behavior detection method further includes:

[0019] Determine the incremental terminal behavior characteristics of the target terminal, and perform a first optimization update on the constructed time-series behavior matrix based on the distribution pattern of the incremental terminal behavior characteristics in the time dimension; wherein, the incremental terminal behavior characteristics are some terminal behavior characteristics that are added relative to the terminal behavior characteristics.

[0020] And / or, obtain feedback data, and perform a second optimization update on the constructed temporal behavior matrix based on the feedback data; wherein, the feedback data is obtained based on the degree of matching between the terminal behavior detection results and actual security events.

[0021] Optionally, the step of using the orthogonal components to perform threat pattern recognition of terminal behavior to obtain a first result includes:

[0022] Extract the directional feature vector representing the directional characteristics of the terminal behavior from the orthogonal components;

[0023] Calculate the similarity score between the directional feature vector and each threat pattern in the preset threat pattern library;

[0024] The threat pattern corresponding to the highest similarity score is determined as the threat pattern that matches the directional feature vector;

[0025] The first result is obtained based on the matched threat pattern and the corresponding highest similarity score.

[0026] Optionally, the step of using the positive definite component to evaluate the abnormal intensity of terminal behavior and obtain a second result includes:

[0027] Intensity feature parameters characterizing the intensity of the terminal behavior anomaly are extracted from the positive definite components;

[0028] The deviation of the intensity characteristic parameter from the normal behavior baseline is calculated, and the abnormal intensity level is evaluated based on the deviation value; wherein, the normal behavior baseline is obtained based on the historical behavior data of the target terminal;

[0029] The second result is obtained based on the anomaly intensity level and the corresponding deviation value.

[0030] Optionally, determining the terminal behavior detection result of the target terminal based on the first result and the second result includes:

[0031] The highest similarity score in the first result and the deviation value in the second result are normalized to obtain the standardized similarity score and the standardized deviation value.

[0032] The standardized similarity score and the standardized deviation value are weighted and calculated to obtain a comprehensive risk score, and the terminal behavior risk level is determined based on the comprehensive risk score.

[0033] Optionally, determining the terminal behavior risk level based on the comprehensive risk score includes:

[0034] If the comprehensive risk score is less than the first preset threshold, the terminal behavior risk level is determined to be low risk level, and an alarm log is recorded.

[0035] If the comprehensive risk score is not less than the first preset threshold and less than the second preset threshold, the terminal behavior risk level is determined to be medium risk level, and an alarm is issued.

[0036] If the comprehensive risk score is not less than the second preset threshold, the terminal behavior risk level is determined to be high risk level, and blocking processing is performed.

[0037] Optionally, determining the terminal behavior characteristics of the target terminal includes:

[0038] Collect terminal behavior data of the target terminal and extract terminal behavior features from the terminal behavior data;

[0039] The terminal behavior data includes any one or a combination of several of the following: process behavior data, file operation data, network activity data, memory operation data, and system call data.

[0040] This application also provides a terminal behavior detection device, including:

[0041] The behavior feature determination module is used to determine the terminal behavior features of the target terminal.

[0042] The behavior matrix construction module is used to construct a time-series behavior matrix based on the distribution pattern of the terminal behavior features in the time dimension.

[0043] The behavior matrix decomposition module is used to perform matrix extreme decomposition on the temporal behavior matrix to obtain orthogonal components and positive definite components; the orthogonal components are used to capture the terminal behavior direction features, and the positive definite components are used to reflect the abnormal intensity features of the terminal behavior.

[0044] The threat pattern recognition module is used to perform threat pattern recognition of terminal behavior using the orthogonal components to obtain a first result;

[0045] An anomaly intensity assessment module is used to assess the anomaly intensity of the terminal behavior using the positive definite component, and obtain a second result;

[0046] The terminal behavior detection module is used to determine the terminal behavior detection result of the target terminal based on the first result and the second result.

[0047] This application also provides a terminal behavior detection device, including:

[0048] Memory, used to store computer programs;

[0049] A processor is configured to implement the steps of the terminal behavior detection method described above when executing the computer program.

[0050] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the terminal behavior detection method described above.

[0051] This application provides a terminal behavior detection method, comprising: determining the terminal behavior characteristics of a target terminal; constructing a temporal behavior matrix based on the distribution pattern of the terminal behavior characteristics in the time dimension; performing matrix extreme decomposition on the temporal behavior matrix to obtain orthogonal components and positive definite components; the orthogonal components are used to capture terminal behavior direction features, and the positive definite components are used to reflect the abnormal intensity features of terminal behavior; using the orthogonal components to perform threat pattern recognition of terminal behavior to obtain a first result; using the positive definite components to evaluate the abnormal intensity of terminal behavior to obtain a second result; and determining the terminal behavior detection result of the target terminal based on the first result and the second result.

[0052] In summary, since the temporal behavior matrix can comprehensively capture the temporal correlation information of terminal behavior features, this application can rely on this temporal correlation information to accurately adapt to the highly concealed and rapidly changing characteristics of threats such as malware and memory injection, effectively solving the technical shortcomings of traditional feature matching methods in capturing the dynamic changes of complex threats. Furthermore, by decomposing the temporal behavior matrix into orthogonal components representing the directional features of terminal behavior and positive definite components reflecting the abnormal intensity features of terminal behavior, this application achieves a two-dimensional analysis of threat pattern recognition and abnormal intensity quantification. This effectively avoids the misjudgment problem caused by feature coupling in traditional machine learning and deep learning models, significantly reducing the false positive rate. At the same time, this application does not require complex feature engineering and large-scale model training, greatly reducing system resource consumption and enabling rapid output of terminal behavior detection results. It adapts to resource-constrained terminal environments, thus overcoming the bottleneck of traditional technologies in balancing detection real-time performance, resource consumption, and detection accuracy, achieving high-precision threat detection with low latency and low resource consumption.

[0053] This application also provides a terminal behavior detection device, equipment, and medium, which have the above-mentioned beneficial effects, and will not be elaborated here. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0055] Figure 1 A flowchart of a terminal behavior detection method provided in an embodiment of this application;

[0056] Figure 2 This is a schematic diagram of a terminal behavior detection device provided in an embodiment of this application;

[0057] Figure 3This is a schematic diagram of a terminal behavior detection device provided in an embodiment of this application. Detailed Implementation

[0058] The core of this application is to provide a terminal behavior detection method, device, equipment and medium, which effectively breaks through the bottleneck of traditional technology in balancing real-time performance, resource consumption and detection accuracy.

[0059] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0060] As cyberattacks become increasingly sophisticated, threats such as malware and memory injection exhibit high levels of concealment and rapid mutation. While traditional endpoint detection methods (such as feature matching, machine learning classifiers, or deep learning models) are effective in some scenarios, they generally suffer from insufficient real-time performance, high resource consumption, and high false positive rates. Especially in resource-constrained endpoint environments, balancing detection accuracy with low latency and low resource consumption in real-time detection has become a critical technical bottleneck that urgently needs to be overcome.

[0061] From the perspective of technological development, endpoint malicious behavior detection technology has gradually evolved into four generations: The first generation is signature-based detection, which mainly relies on malware signature databases and identifies known threats through pattern matching, but cannot detect unknown threats and variants; the second generation is behavior-based detection, which monitors system calls and API (Application Programming Interface) calls and uses rule engines to judge abnormal behavior, but the rule maintenance cost is high and the flexibility is poor; the third generation is machine learning-based detection, which uses algorithms such as SVM (Support Vector Machine) and random forest to automatically learn behavior patterns, but it suffers from complex feature engineering and limited generalization ability; the fourth generation is deep learning-based detection, which uses models such as CNN (Convolutional Neural Network), RNN (Recurrent Neural Network), and Transformer to achieve feature extraction, but it suffers from high computational resource consumption and poor real-time performance.

[0062] While the evolution of these technologies has improved detection capabilities to some extent, several significant shortcomings remain: In terms of real-time performance, deep learning models typically have inference latency on the order of seconds, batch processing methods struggle to respond promptly to threats, and complex feature extraction is time-consuming, failing to meet real-time protection requirements; regarding resource consumption, deep models require substantial memory and computing resources, and continuous monitoring can lead to CPU (Central Processing Time) spikes. The high utilization rate of the CPU (central processing unit) not only affects the normal operation of terminal services but also makes deployment difficult on resource-constrained devices. Regarding false alarm rates, the diversity of normal behavior easily leads to frequent false alarms, coupled with the lack of effective noise filtering mechanisms and the difficulty in setting thresholds, making it hard to balance detection rate and false alarm rate, resulting in high false alarm processing costs. In terms of detection accuracy, existing technologies are weak in detecting new threats and zero-day attacks, struggle to capture complex multi-stage attacks, have insufficient temporal correlation analysis capabilities, and are easily deceived by adversarial examples. Regarding interpretability, deep learning models are black-box models, making it difficult to understand the basis of their detection decisions, unable to generate actionable threat intelligence, and difficult for security analysts to verify and debug. In terms of updates and maintenance, model retraining is costly, the adaptation speed to new threats is slow, feature engineering requires specialized expert knowledge, and the deployment and update process affects system stability.

[0063] Therefore, since the temporal behavior matrix can comprehensively capture the temporal correlation information of terminal behavior features, this application can rely on this temporal correlation information to accurately adapt to the highly concealed and rapidly changing characteristics of threats such as malware and memory injection, effectively solving the technical shortcomings of traditional feature matching methods in capturing the dynamic changes of complex threats. Furthermore, by decomposing the temporal behavior matrix into orthogonal components representing the directional features of terminal behavior and positive definite components reflecting the abnormal intensity features of terminal behavior, this application achieves a two-dimensional analysis of threat pattern recognition and abnormal intensity quantification. This effectively avoids the misjudgment problem caused by feature coupling in traditional machine learning and deep learning models, significantly reducing the false positive rate. At the same time, this application does not require complex feature engineering and large-scale model training, greatly reducing system resource consumption and enabling rapid output of terminal behavior detection results. It adapts to resource-constrained terminal environments, thus overcoming the bottleneck of traditional technologies in balancing detection real-time performance, resource consumption, and detection accuracy, achieving high-precision threat detection with low latency and low resource consumption.

[0064] The following examples illustrate a terminal behavior detection method provided in this application.

[0065] Please refer to Figure 1 , Figure 1 This is a flowchart of a terminal behavior detection method provided in an embodiment of this application.

[0066] In this embodiment, the method may include:

[0067] S101: Determine the terminal behavior characteristics of the target terminal.

[0068] In this embodiment, a lightweight data collection agent deployed on the target terminal collects terminal behavior data and extracts terminal behavior features from the terminal behavior data. The terminal behavior data includes any one or a combination of process behavior data, file operation data, network activity data, memory operation data, and system call data. Process behavior data covers events such as process creation, termination, permission changes, and cross-process injection. File operation data includes records of file read / write, deletion, modification, encryption, and tampering operations. Network activity data includes information such as network connection establishment, port scanning, data transmission volume, and timing characteristics. Memory operation data involves behaviors such as memory allocation, release, cross-process memory access, and memory injection. System call data includes API (Application Programming Interface) call sequences, system service request frequencies, and call timing relationships.

[0069] Furthermore, preprocessing operations are performed on the collected terminal behavior data: First, the data is processed to filter redundant information and noisy data, and invalid behavior records are removed; second, data of different dimensions are normalized to unify the numerical range and eliminate differences in units; then, time alignment of multi-source behavior data is achieved through timestamp synchronization to ensure temporal consistency; finally, feature encoding technology is used to transform discrete behavior events into quantifiable numerical vectors, thereby extracting terminal behavior features that comprehensively represent terminal behavior patterns, providing data support for the subsequent construction of a temporal behavior matrix.

[0070] S102: Construct a temporal behavior matrix based on the distribution pattern of the terminal behavior features in the time dimension.

[0071] In this embodiment, the number of feature dimensions of terminal behavior features is used as the matrix row dimension (denoted as m, where m is a positive integer, corresponding to different types of behavior features such as process behavior, file operation, and network activity), and the preset time window length is used as the matrix column dimension (denoted as n, where n is a positive integer, and this value can be dynamically configured according to terminal performance and real-time detection requirements) to construct a time-series behavior matrix. ; matrix elements This represents the quantized value of the terminal behavior feature corresponding to the i-th feature dimension in the j-th time slice. In this way, this embodiment can comprehensively capture the temporal correlation information of the terminal behavior features.

[0072] Specifically, the matrix construction process employs a multi-dimensional optimization strategy to adapt to the performance requirements of real-time detection scenarios, including: 1. Sliding window update mechanism: A fixed-size time window is used to slide and capture terminal behavior data. When new time slice data arrives, the window automatically discards the earliest time slice data and incorporates the new data, ensuring that the time-series behavior matrix reflects the recent behavior status of the terminal in real time and avoiding data redundancy accumulation; 2. Sparse coding storage: For a large number of invalid or zero-value records in the terminal behavior data, a sparse matrix storage format is adopted, storing only non-zero elements and their coordinate information, significantly reducing storage resource consumption and improving data read and write efficiency; 3. Incremental update strategy: When incremental terminal behavior features are generated, it is not necessary to rebuild the entire time-series behavior matrix. Only the row vectors corresponding to the newly added features and the column vectors corresponding to the new time slices in the matrix are locally updated, reusing historical calculation data to reduce real-time calculation overhead; 4. Feature dimension adaptation: It supports dynamically adjusting the number of feature dimensions corresponding to the matrix row dimensions according to the terminal resource status and security detection requirements. In resource-constrained scenarios, redundant features can be pruned to reduce the matrix size, and in high-security scenarios, feature dimensions can be expanded to improve detection comprehensiveness.

[0073] For example, the above incremental update strategy may specifically include the following two aspects: First, determine the incremental terminal behavior features of the target terminal (i.e., the additional behavior features relative to the initial terminal behavior features), and perform a first optimization update on the constructed time-series behavior matrix based on the distribution pattern of the incremental terminal behavior features in the time dimension; and / or, obtain feedback data (generated based on the matching degree between terminal behavior detection results and actual security events), and perform a second optimization update on the constructed time-series behavior matrix based on the feedback data. Specifically, the first optimization update includes: adding row vectors corresponding to the incremental behavior features in the row dimension of the matrix, supplementing the quantized values ​​of the incremental features in each time slice in the column dimension, and synchronously updating the column vectors corresponding to the newly arrived time slices, thereby expanding the feature coverage of the matrix and synchronizing the latest terminal behavior data; the second optimization update specifically includes: adjusting the quantized value weights of the corresponding behavior features in the matrix based on feedback data (such as false positives and false negatives in the detection results), or removing invalid or interfering behavior feature data.

[0074] Through the above construction method, the temporal behavior matrix can transform discrete terminal behavior events into a continuous mathematical expression, thereby providing a structured data foundation for subsequent efficient analysis based on minimax matrix extreme decomposition. At the same time, by optimizing the storage and update strategy, the consumption of terminal resources can be further reduced, adapting to the performance requirements of real-time detection scenarios.

[0075] S103: Perform matrix extreme decomposition on the time-series behavior matrix to obtain orthogonal components and positive definite components; the orthogonal components are used to capture the terminal behavior direction features, and the positive definite components are used to reflect the abnormal intensity features of the terminal behavior.

[0076] In this embodiment, the time-series behavior matrix is ​​decomposed into an orthogonal matrix and a positive definite matrix; the orthogonal matrix and the positive definite matrix are optimized using an objective function constructed based on a minimax optimization strategy to obtain orthogonal components and positive definite components; wherein, the objective function includes:

[0077] ;

[0078] in, It is an orthogonal matrix; It is a positive definite matrix; These are orthogonal matrix constraint terms; These are positive definite matrix constraint terms; This is a time-series behavior matrix; and The regularization coefficient is used. Denotes the square of the F-norm; Represented by orthogonal matrix Minimize the variables and solve with positive definite matrices. Maximize the value of the variable.

[0079] Specifically, the execution steps of this iterative solution process are as follows: 1. Initialize parameters , 2. Alternating optimization stage: First fix P and optimize Q by minimizing it, then fix Q and optimize P by maximizing it. 3. Determine the convergence of the optimization results. If the convergence condition is met, output the final optimal solution to complete the entire iterative solution process.

[0080] In this embodiment, the minimax optimization strategy can enhance the ability of orthogonal components to capture behavioral direction features and the ability of positive definite components to distinguish abnormal intensity features. This allows orthogonal components to accurately correspond to the pattern direction of terminal behavior, and positive definite components to clearly reflect the degree of abnormality of behavior, providing a more accurate basis for the subsequent identification of malicious terminal behavior.

[0081] S104: Using the orthogonal components, threat pattern recognition of terminal behavior is performed to obtain a first result.

[0082] In this embodiment, a directional feature vector representing the directional characteristics of terminal behavior is extracted from orthogonal components; a similarity score is calculated between the directional feature vector and each threat pattern in a preset threat pattern library; the threat pattern corresponding to the highest similarity score is determined as the threat pattern matching the directional feature vector; and the first result is obtained based on the matched threat pattern and its corresponding highest similarity score. Furthermore, if multiple threat patterns have the same highest similarity score, the threat pattern with the higher frequency of occurrence is preferentially selected as the threat pattern matching the directional feature vector.

[0083] In this embodiment, different types of behavior, whether normal operation or malicious attack, have different execution logic: normal operation usually follows a fixed and compliant time sequence path, while malicious attack has abnormal behavioral logic. Therefore, this embodiment uses directional feature vectors to transform this abstract behavioral execution logic into a quantifiable numerical vector form, thereby accurately capturing the logical differences between different behavior types. It is understood that the preset threat pattern library is a structured feature vector set covering typical threat patterns such as malware execution, memory injection, port scanning, file encryption and tampering, and abnormal privilege escalation. It should be noted that identifying the threat pattern corresponding to the highest similarity score as the threat pattern matching the directional feature vector can accurately pinpoint the known attack type corresponding to the current terminal behavior and quickly associate the typical characteristics of the threat with the attack path, thus significantly improving the targeting and accuracy of threat identification.

[0084] S105: Use the positive definite component to evaluate the abnormal intensity of the terminal behavior and obtain a second result.

[0085] In this embodiment, intensity feature parameters characterizing the abnormal behavior intensity of the terminal are extracted from the positive definite components; the deviation value of the intensity feature parameters relative to the normal behavior baseline is calculated, and the abnormal intensity level is evaluated based on the deviation value; wherein, the normal behavior baseline is obtained based on the historical behavior data of the target terminal; the second result is obtained based on the abnormal intensity level and the corresponding deviation value.

[0086] In this embodiment, the intensity characteristic parameters include peak behavior frequency and resource usage amplitude. The peak behavior frequency corresponds to the intensity of frequently repeated behavioral events within a short period on the terminal; the resource usage amplitude reflects the intensity of the behavior's consumption of system resources such as CPU and memory. The deviation of the intensity characteristic parameters from the normal behavior baseline directly reflects the degree to which the terminal's behavior deviates from its normal operating state. It can be understood that a larger deviation value indicates a greater deviation from the normal pattern.

[0087] S106: Determine the terminal behavior detection result of the target terminal based on the first result and the second result.

[0088] In this embodiment, the highest similarity score in the first result and the deviation value in the second result are normalized to obtain a standardized similarity score and a standardized deviation value; the standardized similarity score and the standardized deviation value are weighted to obtain a comprehensive risk score, and the terminal behavior risk level is determined based on the comprehensive risk score.

[0089] Specifically, the standardized similarity score and the degree of deviation from standardization The process of weighting the standardized similarity score and the standardized deviation score to obtain the comprehensive risk score can be expressed as follows: ,in, and These are weighting coefficients, which are determined based on the actual scenario.

[0090] Further, determining the terminal behavior risk level based on the comprehensive risk score includes: if the comprehensive risk score is less than a first preset threshold, the terminal behavior risk level is determined to be low risk and an alarm log is recorded; if the comprehensive risk score is not less than the first preset threshold and less than a second preset threshold, the terminal behavior risk level is determined to be medium risk and an alarm is issued; if the comprehensive risk score is not less than the second preset threshold, the terminal behavior risk level is determined to be high risk and blocking is implemented. In some embodiments, the first preset threshold can be 0.3, and the second preset threshold can be 0.7. That is, if the comprehensive risk score is less than 0.3, the terminal behavior risk level is determined to be low risk and an alarm log is recorded; if the comprehensive risk score is not less than 0.3 and less than 0.7, the terminal behavior risk level is determined to be medium risk and an alarm is issued; if the comprehensive risk score is not less than 0.7, the terminal behavior risk level is determined to be high risk and blocking is implemented.

[0091] The following specific example illustrates this solution:

[0092] This application designs a real-time detection system for malicious terminal behavior. The system adopts a layered architecture, consisting of four main layers: a data acquisition layer, a matrix construction layer, a minimax decomposition core layer, and a decision fusion layer. The specific functionalities are implemented as follows:

[0093] I. Data Acquisition Layer

[0094] The core modules include a registry monitoring module, a process monitoring module, a file system monitoring module, a network behavior monitoring module, and a memory activity monitoring module. This layer uses a lightweight agent to collect real-time, multi-dimensional behavioral data from the terminal. The collection scope covers various behavioral events such as registry operations, process creation / termination / injection / permission changes, file read / write / deletion / modification / encryption, network connection establishment / data transmission / port scanning, memory allocation / release / cross-process access, etc. Ultimately, the multi-source behavioral data is aggregated into a unified behavioral event stream, providing complete and reliable raw data support for subsequent analysis and processing at each level.

[0095] II. Matrix Construction Layer

[0096] The core modules include a feature extraction module, a temporal coding module, an incremental update module, a real-time optimization module, a threshold adjustment module, and a cache management module. The functions of each module work together as follows: The feature extraction module accurately extracts key features such as process interactions, resource access, and system calls from the behavioral event stream; the temporal coding module organizes discrete features according to the time dimension to construct a behavioral temporal matrix A (rows of the matrix correspond to different behavioral feature dimensions, and columns correspond to preset time windows); the incremental update module performs local updates to the matrix based on newly added behavioral data, avoiding the resource consumption caused by full reconstruction; the real-time optimization module combines optimization strategies such as sparse coding and compressed storage to further reduce the resource overhead of data storage and computation; the threshold adjustment module dynamically calibrates detection-related thresholds, and the cache management module optimizes data storage and retrieval efficiency; simultaneously, this layer receives feedback information from the decision fusion layer to continuously optimize the accuracy and operational efficiency of matrix construction.

[0097] III. Minimax Extreme Decomposition Core Layer

[0098] The core modules include a minimax optimizer, an anomaly detector, and a pattern matcher. The minimax optimizer receives the behavioral time-series matrix A output from the matrix construction layer and performs iterative optimization using a preset objective function, decomposing the behavioral time-series matrix A into an orthogonal component Q (used to capture the directional features of terminal behavior) and a positive definite component P (used to reflect the intensity features of terminal behavior). The pattern matcher extracts directional feature vectors based on the orthogonal component Q and matches them with standard patterns in a preset threat pattern library to complete threat type identification. The anomaly detector extracts intensity feature parameters based on the positive definite component P and compares them with a normal behavior baseline to complete anomaly intensity assessment.

[0099] IV. Decision Integration Layer

[0100] The core modules include a fusion decision-making module and a response strategy module. The fusion decision-making module receives the threat identification results (i.e., pattern scores) and anomaly strength assessment results (i.e., anomaly scores) output from the Minimax decomposition core layer, calculates a comprehensive risk score through weighted averages, and determines the threat level of the terminal behavior based on this score (divided into three levels: low, medium, and high). The response strategy module executes corresponding actions according to the determined threat level: low-risk levels only record alarm logs, medium-risk levels trigger alarm prompts, and high-risk levels immediately perform blocking or isolation operations. At the same time, this layer sends the handling results and detection feedback information back to the matrix construction layer, forming a closed-loop operation system of "collection-processing-detection-feedback-optimization".

[0101] It should be noted that this application innovatively combines minimax optimization with matrix extreme decomposition and applies it to the field of terminal malicious behavior detection for the first time. This breaks down the industry barriers between mathematical optimization theory and security detection technology, and constructs an innovative path of "theoretical support - technology implementation", providing a brand-new technical solution for the efficient analysis of terminal high-dimensional time-series behavioral data.

[0102] It is understandable that terminal behavior data is essentially high-dimensional time-series data containing multi-dimensional information such as process calls, file operations, network connections, and memory accesses. Complex relationships and temporal dependencies exist between these behavioral data points, making it difficult for traditional detection methods to capture these deep features. Therefore, this application constructs a multi-dimensional terminal behavior time-series matrix, transforming discrete terminal behavior events into a continuous mathematical representation: the rows of the matrix correspond to different behavioral feature dimensions, the columns correspond to time windows, and the matrix elements represent the quantized values ​​of specific behavioral features in their corresponding time slices, thus creating conditions for the application of matrix analysis algorithms. Based on this, this application utilizes minimax optimization to solve for the optimal decomposition coefficients, decomposing the complex behavior time-series matrix into orthogonal components and positive definite components: the orthogonal components focus on capturing the directional features of the behavior, providing a core basis for threat pattern recognition; the positive definite components primarily reflect the intensity features of the behavior, used for accurate assessment of the degree of anomaly. This decomposition not only has clear mathematical meaning but also significantly reduces computational complexity, enabling real-time detection in the terminal environment.

[0103] Based on the above technical approach, the core innovations of this application are as follows: First, it pioneers the application of minimax matrix extreme decomposition in security detection, introducing mathematical optimization theory into the field of endpoint security. Through innovative threat modeling methods, it effectively combines theory and practice, breaking through the limitations of the underlying logic of traditional technologies. Second, it constructs a dual-component parallel detection architecture. Through the unique division of labor between orthogonal components and positive definite components, it achieves the fusion of pattern recognition and anomaly detection, and the parallel processing mechanism significantly improves detection efficiency. Third, it achieves the optimal balance between real-time performance and accuracy. Through optimized algorithm design, it achieves millisecond-level detection latency, maintaining high detection accuracy while minimizing the consumption of system resources such as CPU and memory. Fourth, it possesses mathematical interpretability. The matrix decomposition results have clear mathematical meaning, making the detection process transparent and traceable, facilitating verification and debugging by security analysts, and generating actionable threat intelligence, thus solving the "black box" problem of traditional deep learning models.

[0104] The technical solution protected in this application covers the following six core modules: a terminal malicious behavior detection method based on minimax matrix extreme decomposition, including a complete detection process design, specific application methods of the minimax optimization algorithm in the security field, and the conversion logic from behavior matrix to threat judgment; a multi-dimensional behavior time-series matrix construction technology, involving matrix representation methods of behavior data, multi-dimensional feature fusion encoding schemes, and time-series information preservation mechanisms; a fast decomposition algorithm for minimax optimization, including optimization objective function design, efficient iterative solution algorithms, and convergence guarantee methods; a dual-component threat detection mechanism, covering pattern recognition methods for orthogonal components, anomaly detection methods for positive definite components, and dual-path fusion decision algorithms; real-time detection optimization technology, including incremental matrix update methods, caching acceleration mechanisms, and parallel processing architectures; and an adaptive parameter optimization method, involving dynamic threshold adjustment algorithms, feedback-based parameter optimization logic, and environmental adaptive learning mechanisms. Table 1 is a comparative analysis of the effectiveness of traditional methods and this prevention method.

[0105] Table 1. Comparison of the effects of traditional methods and this method

[0106]

[0107] Furthermore, to enhance the flexibility and adaptability of the technical solution, this application also provides two types of modified design schemes: one is a variant of the decomposition algorithm, including replacing extreme decomposition with Singular Value Decomposition (SVD): this scheme is faster in computation but suffers from a small amount of information loss, suitable for terminal scenarios with extremely limited resources; and a simplified scheme using only QR (QR Decomposition), which further reduces computational complexity by lowering some detection accuracy, meeting the lightweight deployment requirements of low-configuration terminals. The other type is a scheme for changing the detection granularity, including a coarse-grained fast mode and a fine-grained precise mode: the coarse-grained mode achieves rapid initial screening by reducing the matrix dimension, suitable for high-traffic, high-concurrency terminal behavior detection scenarios; the fine-grained mode performs in-depth analysis by increasing the feature dimension, which can meet the needs of scenarios with extremely high security requirements, such as finance and industrial control, thereby achieving flexible adaptation under different security levels and resource conditions.

[0108] This application provides a terminal behavior detection method, comprising: determining the terminal behavior characteristics of a target terminal; constructing a temporal behavior matrix based on the distribution pattern of the terminal behavior characteristics in the time dimension; performing matrix extreme decomposition on the temporal behavior matrix to obtain orthogonal components and positive definite components; the orthogonal components are used to capture terminal behavior direction features, and the positive definite components are used to reflect the abnormal intensity features of terminal behavior; using the orthogonal components to perform threat pattern recognition of terminal behavior to obtain a first result; using the positive definite components to evaluate the abnormal intensity of terminal behavior to obtain a second result; and determining the terminal behavior detection result of the target terminal based on the first result and the second result.

[0109] In summary, since the temporal behavior matrix can comprehensively capture the temporal correlation information of terminal behavior features, this application can rely on this temporal correlation information to accurately adapt to the highly concealed and rapidly changing characteristics of threats such as malware and memory injection, effectively solving the technical shortcomings of traditional feature matching methods in capturing the dynamic changes of complex threats. Furthermore, by decomposing the temporal behavior matrix into orthogonal components representing the directional features of terminal behavior and positive definite components reflecting the abnormal intensity features of terminal behavior, this application achieves a two-dimensional analysis of threat pattern recognition and abnormal intensity quantification. This effectively avoids the misjudgment problem caused by feature coupling in traditional machine learning and deep learning models, significantly reducing the false positive rate. At the same time, this application does not require complex feature engineering and large-scale model training, greatly reducing system resource consumption and enabling rapid output of terminal behavior detection results. It adapts to resource-constrained terminal environments, thus overcoming the bottleneck of traditional technologies in balancing detection real-time performance, resource consumption, and detection accuracy, achieving high-precision threat detection with low latency and low resource consumption.

[0110] This application also provides a terminal behavior detection device, equipment, and medium, which have the above-mentioned beneficial effects, and will not be elaborated here.

[0111] The terminal behavior detection device provided in the embodiments of this application is described below.

[0112] Please refer to Figure 2 , Figure 2 This is a schematic diagram of the structure of a terminal behavior detection device provided in an embodiment of this application.

[0113] In this embodiment, the device may include:

[0114] The behavior feature determination module 100 is used to determine the terminal behavior features of the target terminal;

[0115] The behavior matrix construction module 200 is used to construct a temporal behavior matrix based on the distribution pattern of the terminal behavior features in the time dimension.

[0116] The behavior matrix decomposition module 300 is used to perform matrix extreme decomposition on the temporal behavior matrix to obtain orthogonal components and positive definite components; the orthogonal components are used to capture the terminal behavior direction features, and the positive definite components are used to reflect the abnormal intensity features of the terminal behavior.

[0117] Threat pattern recognition module 400 is used to perform threat pattern recognition of terminal behavior using the orthogonal components to obtain a first result;

[0118] Anomaly intensity assessment module 500 is used to assess the anomaly intensity of terminal behavior using the positive definite component to obtain a second result;

[0119] The terminal behavior detection module 600 is used to determine the terminal behavior detection result of the target terminal based on the first result and the second result.

[0120] Figure 3 This is a schematic diagram of the structure of a terminal behavior detection device provided in an embodiment of this application.

[0121] This application embodiment also provides a terminal behavior detection device, which may include:

[0122] Memory, used to store computer programs;

[0123] A processor is configured to implement the steps of the terminal behavior detection method as described in the above embodiments when executing the computer program.

[0124] like Figure 3The diagram shows the structural composition of a terminal behavior detection device, which may include a processor 10, a memory 11, a communication interface 12, and a communication bus 13. The processor 10, memory 11, and communication interface 12 all communicate with each other through the communication bus 13.

[0125] In this embodiment, the processor 10 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic devices.

[0126] The processor 10 can call the program stored in the memory 11. Specifically, the processor 10 can execute the operations in the embodiments of the terminal behavior detection method.

[0127] The memory 11 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment, the memory 11 stores at least a program for implementing the following functions:

[0128] Determine the terminal behavior characteristics of the target terminal;

[0129] Construct a temporal behavior matrix based on the distribution pattern of the terminal behavior characteristics in the time dimension;

[0130] The temporal behavior matrix is ​​subjected to matrix extreme decomposition to obtain orthogonal components and positive definite components; the orthogonal components are used to capture the terminal behavior direction features, and the positive definite components are used to reflect the abnormal intensity features of the terminal behavior.

[0131] Threat pattern recognition of terminal behavior is performed using the orthogonal components to obtain a first result;

[0132] The positive definite component is used to evaluate the abnormal intensity of the terminal behavior, and a second result is obtained;

[0133] The terminal behavior detection result of the target terminal is determined based on the first result and the second result.

[0134] In one possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0135] In addition, memory 11 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0136] Communication interface 12 can be an interface for the communication module, used to connect with other devices or systems.

[0137] Of course, it should be noted that, Figure 3 The structure shown does not constitute a limitation on the terminal behavior detection device in the embodiments of this application. In practical applications, the terminal behavior detection device may include more than Figure 3 More or fewer components as shown, or combinations of certain components.

[0138] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the terminal behavior detection method described in the above embodiments.

[0139] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0140] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0141] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0142] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0143] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0144] The present application provides a detailed description of a terminal behavior detection method, apparatus, device, and medium. Specific examples have been used to illustrate the principles and implementation methods of the present application. The descriptions of these embodiments are merely illustrative of the method and its core concepts. It should be noted that those skilled in the art can make various improvements and modifications to the present application without departing from its principles, and these improvements and modifications also fall within the scope of protection of the claims.

Claims

1. A terminal behavior detection method, characterized by, The method comprises: determining terminal behavior characteristics of a target terminal; constructing a time sequence behavior matrix according to distribution rules of the terminal behavior characteristics in a time dimension; performing matrix polar decomposition on the time sequence behavior matrix to obtain an orthogonal component and a positive definite component; the orthogonal component is used to capture terminal behavior direction characteristics, and the positive definite component is used to reflect terminal behavior abnormal intensity characteristics; performing threat mode identification of terminal behavior by using the orthogonal component to obtain a first result; performing abnormal intensity evaluation of terminal behavior by using the positive definite component to obtain a second result; determining a terminal behavior detection result of the target terminal based on the first result and the second result.

2. The terminal behavior detection method according to claim 1, characterized by, The method of constructing a time sequence behavior matrix according to distribution rules of the terminal behavior characteristics in a time dimension comprises: taking the number of feature dimensions of the terminal behavior characteristics as a matrix row dimension, taking a preset time window length as a matrix column dimension, and constructing a time sequence behavior matrix based on the values of the terminal behavior characteristics of each feature dimension in a corresponding time window.

3. The terminal behavior detection method of claim 1, wherein, The method of performing matrix polar decomposition on the time sequence behavior matrix to obtain an orthogonal component and a positive definite component comprises: decomposing the time sequence behavior matrix into an orthogonal matrix and a positive definite matrix; performing optimization processing on the orthogonal matrix and the positive definite matrix by using a target function constructed based on a minimax optimization strategy to obtain an orthogonal component and a positive definite component; wherein the target function comprises: ； wherein, denotes an orthogonal matrix; denotes a positive definite matrix; denotes an orthogonal matrix constraint term; denotes a positive definite matrix constraint term; denotes a timing behavior matrix; and denotes a regularization coefficient; denotes the square of the F-norm; denotes the minimization with respect to the orthogonal matrix and the maximization with respect to the positive definite matrix .

4. The terminal behavior detection method of claim 1, wherein, The method further comprises: determining incremental terminal behavior characteristics of a target terminal, and performing first optimization update on the constructed time sequence behavior matrix according to distribution rules of the incremental terminal behavior characteristics in a time dimension; wherein the incremental terminal behavior characteristics are part of the terminal behavior characteristics that are newly added relative to the terminal behavior characteristics; and / or, obtaining feedback data, and performing second optimization update on the constructed time sequence behavior matrix based on the feedback data; wherein the feedback data is obtained based on the matching degree between the terminal behavior detection result and an actual security event.

5. The terminal behavior detection method of claim 1, wherein, The method of performing threat mode identification of terminal behavior by using the orthogonal component to obtain a first result comprises: extracting a direction feature vector representing the terminal behavior direction characteristics from the orthogonal component; calculating similarity scores between the direction feature vector and each threat mode in a preset threat mode library; determining the threat mode corresponding to the highest similarity score as a threat mode matched with the direction feature vector; obtaining the first result according to the matched threat mode and the corresponding highest similarity score.

6. The terminal behavior detection method according to claim 5, characterized by, The method of performing abnormal intensity evaluation of terminal behavior by using the positive definite component to obtain a second result comprises: extracting an intensity feature parameter representing the terminal behavior abnormal intensity characteristics from the positive definite component; calculating a deviation degree value of the intensity feature parameter relative to a normal behavior baseline, and evaluating an abnormal intensity level based on the deviation degree value; wherein the normal behavior baseline is obtained according to historical behavior data of the target terminal; obtaining the second result according to the abnormal intensity level and the corresponding deviation degree value.

7. The terminal behavior detection method according to claim 6, characterized by, The method of determining a terminal behavior detection result of the target terminal based on the first result and the second result comprises: normalizing the highest similarity score in the first result and the deviation degree value in the second result to obtain a standardized similarity score and a standardized deviation degree value; performing weighted calculation on the standardized similarity score and the standardized deviation degree value to obtain a comprehensive risk score, and determining a terminal behavior risk level according to the comprehensive risk score.

8. The terminal behavior detection method according to claim 7, characterized by, The determining of the terminal behavior risk level according to the comprehensive risk score comprises: if the comprehensive risk score is less than a first preset threshold, determining that the terminal behavior risk level is a low risk level, and recording an alarm log; if the comprehensive risk score is not less than the first preset threshold and less than a second preset threshold, determining that the terminal behavior risk level is a medium risk level, and performing an alarm prompt; if the comprehensive risk score is not less than the second preset threshold, determining that the terminal behavior risk level is a high risk level, and performing a blocking process.

9. The method of claim 1 to 8, wherein, The determining of the terminal behavior feature of the target terminal comprises: collecting terminal behavior data of the target terminal, and extracting a terminal behavior feature of the terminal behavior data; wherein the terminal behavior data comprises any one or a combination of process behavior data, file operation data, network activity data, memory operation data and system call data.

10. A terminal behavior detection apparatus characterized by comprising: It comprises: a behavior feature determination module configured to determine a terminal behavior feature of a target terminal; a behavior matrix construction module configured to construct a time sequence behavior matrix according to a distribution rule of the terminal behavior feature in a time dimension; a behavior matrix decomposition module configured to perform matrix polar decomposition on the time sequence behavior matrix to obtain an orthogonal component and a positive definite component; the orthogonal component is used to capture a terminal behavior direction feature, and the positive definite component is used to reflect a terminal behavior abnormal intensity feature; a threat mode identification module configured to perform threat mode identification of terminal behavior by using the orthogonal component to obtain a first result; an abnormal intensity evaluation module configured to perform abnormal intensity evaluation of terminal behavior by using the positive definite component to obtain a second result; a terminal behavior detection module configured to determine a terminal behavior detection result of the target terminal based on the first result and the second result.

11. A terminal behavior detection apparatus characterized by comprising: It comprises: a memory configured to store a computer program; a processor configured to execute the computer program to implement the steps of the terminal behavior detection method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the terminal behavior detection method according to any one of claims 1 to 9.

Images