An abnormal process detection method and device, electronic equipment and medium

Abstract

Embodiments of the present application provide an abnormal process detection method and device, electronic equipment and medium, and relate to the technical field of computers. The method comprises: monitoring multi-dimensional behavior data of a to-be-detected process in real time, wherein the multi-dimensional behavior data comprises operation behavior data of multiple preset dimensions of the to-be-detected process; comparing the multi-dimensional behavior data with multi-dimensional associated data of the to-be-detected process in a baseline data set, wherein the multi-dimensional associated data comprises baseline conditions of multiple operation behaviors having an associated relationship; and if the multi-dimensional behavior data deviates from the multi-dimensional associated data of the to-be-detected process, determining that the to-be-detected process is an abnormal process. The scheme can improve the accuracy of abnormal process detection.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and medium for detecting abnormal processes. Background Technology

[0002] Various types of network viruses pose a significant threat to network security. Ransomware, for example, is malware that encrypts user data or locks system access permissions, demanding a ransom to restore access. It has become one of the most serious network security threats globally, easily causing business interruptions, data breaches, and huge economic losses.

[0003] Currently, the method for detecting network viruses is to detect abnormal behavior of processes in order to identify whether the abnormal behavior belongs to network viruses. For example, if a process performs high-frequency file encryption operations, then the file encryption operations performed by that process are determined to be the behavior of ransomware.

[0004] However, this detection method has problems with false positives or false negatives, such as identifying normal processes as abnormal processes or failing to identify abnormal processes, resulting in low accuracy. Summary of the Invention

[0005] The purpose of this application is to provide an abnormal process detection method, apparatus, electronic device, and medium to improve the accuracy of abnormal process detection. The specific technical solution is as follows:

[0006] In a first aspect, embodiments of this application provide an abnormal process detection method, including:

[0007] Real-time monitoring of multi-dimensional behavioral data of the process under test, wherein the multi-dimensional behavioral data includes operational behavioral data of the process under test in multiple preset dimensions;

[0008] The multidimensional behavioral data is compared with the multidimensional correlation data of the process to be detected in the baseline dataset, wherein the multidimensional correlation data includes baseline conditions for multiple operational behaviors that are correlated.

[0009] If the multidimensional behavioral data deviates from the multidimensional correlation data of the process to be detected, then the process to be detected is determined to be an abnormal process.

[0010] In one possible implementation, comparing the multidimensional behavioral data with the multidimensional correlation data of the process to be detected in the baseline dataset includes:

[0011] Obtain the process ID of the process to be detected;

[0012] Using the process ID as an index, the multidimensional association data of the process to be detected is retrieved from the baseline dataset. The multidimensional association data includes at least one baseline data group, and each baseline data group is used to describe a set of baseline conditions for operation behaviors with association relationships.

[0013] If the multidimensional behavioral data does not meet the baseline conditions included in any baseline data group of the multidimensional correlation data, then it is determined that the multidimensional behavioral data deviates from the multidimensional correlation data of the process to be detected.

[0014] In one possible implementation, after retrieving the multidimensional correlation data of the process to be detected from the baseline dataset using the process ID as an index, the method further includes:

[0015] For each operational behavior in the multidimensional behavioral data, a target baseline data group matching the operational behavior is found from the multidimensional correlation data;

[0016] Determine whether the multidimensional behavioral data meets the baseline conditions included in the target baseline data set.

[0017] In one possible implementation,

[0018] The multidimensional behavioral data also includes the generation time of the operational behavior data. Each baseline data group is used to describe the baseline conditions of a set of related operational behaviors in different time windows. The step of determining whether the multidimensional behavioral data satisfies the baseline conditions included in the target baseline data group includes:

[0019] For each operation in the multidimensional behavioral data, determine the target time window to which the generation time of the operation behavior data belongs;

[0020] Obtain the target baseline conditions corresponding to the target time window from the target baseline data group;

[0021] Determine whether the multidimensional behavioral data meets the target baseline conditions.

[0022] In one possible implementation, the process to be detected is a process in the target system; the baseline dataset is generated through the following steps:

[0023] During the stable operation of the target system, monitor the multi-dimensional behavioral data generated by each process within the target system in each time window within a preset time period;

[0024] Using a pre-defined correlation algorithm, multi-dimensional correlation data for each process is generated based on the multi-dimensional behavioral data of each process monitored.

[0025] The baseline dataset is constructed by constructing the multidimensional correlation data of each process included in the target system.

[0026] In one possible implementation, the method further includes:

[0027] When it is determined that a new process exists in the target system, monitor the multi-dimensional behavioral data generated by the new process in each time window within a preset learning period.

[0028] Using the preset association algorithm, multidimensional association data of the newly added process is generated based on the monitored multidimensional behavioral data of the newly added process;

[0029] The multidimensional correlation data of the newly added process is added to the baseline dataset.

[0030] In one possible implementation, the multidimensional behavioral data includes any one or more of the following operational behavioral data:

[0031] The file operation behavior data of the process to be detected;

[0032] The data on the registry modifications made by the process to be detected;

[0033] The network connection data of the process to be detected;

[0034] The resource usage data of the process to be detected.

[0035] Secondly, embodiments of this application provide an abnormal process detection device, comprising:

[0036] The monitoring module is used to monitor the multi-dimensional behavioral data of the process under test in real time. The multi-dimensional behavioral data includes the operational behavioral data of the process under test in multiple preset dimensions.

[0037] The comparison module is used to compare the multidimensional behavioral data with the multidimensional correlation data of the process to be detected in the baseline dataset, wherein the multidimensional correlation data includes baseline conditions of multiple operational behaviors with correlation relationships.

[0038] The determination module is used to determine that the process to be detected is an abnormal process if the multidimensional behavioral data deviates from the multidimensional correlation data of the process to be detected.

[0039] In one possible implementation, the comparison module is specifically used for:

[0040] Obtain the process ID of the process to be detected;

[0041] Using the process ID as an index, the multidimensional association data of the process to be detected is retrieved from the baseline dataset. The multidimensional association data includes at least one baseline data group, and each baseline data group is used to describe a set of baseline conditions for operation behaviors with association relationships.

[0042] If the multidimensional behavioral data does not meet the baseline conditions included in any baseline data group of the multidimensional correlation data, then it is determined that the multidimensional behavioral data deviates from the multidimensional correlation data of the process to be detected.

[0043] In one possible implementation, the device further includes: a lookup module;

[0044] The search module is used to search for a target baseline data group that matches each operation behavior in the multidimensional behavioral data from the multidimensional associated data.

[0045] The determining module is also used to determine whether the multidimensional behavioral data satisfies the baseline conditions included in the target baseline data group.

[0046] In one possible implementation, the multidimensional behavioral data further includes the generation time of the operational behavior data, and each baseline data group is used to describe the baseline conditions of a set of related operational behaviors in different time windows; the determining module is specifically used for:

[0047] For each operation in the multidimensional behavioral data, determine the target time window to which the generation time of the operation behavior data belongs;

[0048] Obtain the target baseline conditions corresponding to the target time window from the target baseline data group;

[0049] Determine whether the multidimensional behavioral data meets the target baseline conditions.

[0050] In one possible implementation, the process to be detected is a process in the target system; the apparatus further includes a generation module, which is used to generate the baseline dataset through the following steps:

[0051] During the stable operation of the target system, monitor the multi-dimensional behavioral data generated by each process within the target system in each time window within a preset time period;

[0052] Using a pre-defined correlation algorithm, multi-dimensional correlation data for each process is generated based on the multi-dimensional behavioral data of each process monitored.

[0053] The baseline dataset is constructed by constructing the multidimensional correlation data of each process included in the target system.

[0054] In one possible implementation, the generation module is further configured to:

[0055] When it is determined that a new process exists in the target system, monitor the multi-dimensional behavioral data generated by the new process in each time window within a preset learning period.

[0056] Using the preset association algorithm, multidimensional association data of the newly added process is generated based on the monitored multidimensional behavioral data of the newly added process;

[0057] The multidimensional correlation data of the newly added process is added to the baseline dataset.

[0058] In one possible implementation, the multidimensional behavioral data includes any one or more of the following operational behavioral data:

[0059] The file operation behavior data of the process to be detected;

[0060] The data on the registry modifications made by the process to be detected;

[0061] The network connection data of the process to be detected;

[0062] The resource usage data of the process to be detected.

[0063] Thirdly, embodiments of this application provide an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0064] Memory, used to store computer programs;

[0065] When a processor executes a program stored in memory, it implements the method described in the first aspect above.

[0066] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the method described in the first aspect above.

[0067] Fifthly, embodiments of this application also provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the method described in the first aspect above.

[0068] By employing the above technical solution, multidimensional behavioral data of the process under test can be monitored in real time. This multidimensional behavioral data is then compared with multidimensional correlation data of the process under test in a baseline dataset. The multidimensional correlation data includes baseline conditions for multiple related operational behaviors. In other words, it can be determined whether multiple related operational behaviors among the multiple preset operational behavior data monitored in real time meet the baseline conditions. If not, it indicates that the multidimensional behavioral data deviates from the multidimensional correlation data, thus identifying the process under test as an abnormal process. This embodiment of the application determines whether a process is abnormal by using data from multiple related operational behaviors, which improves the accuracy of abnormal process identification compared to identifying only a single operational behavior.

[0069] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0070] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0071] Figure 1 A flowchart illustrating an abnormal process detection method provided in this application embodiment;

[0072] Figure 2 A flowchart of another abnormal process detection method provided in the embodiments of this application;

[0073] Figure 3 A flowchart of another abnormal process detection method provided in the embodiments of this application;

[0074] Figure 4 This is a schematic diagram of the structure of an abnormal process detection system provided in an embodiment of this application;

[0075] Figure 5 This is a schematic diagram of the structure of an abnormal process detection device provided in an embodiment of this application;

[0076] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0077] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0078] Currently, ransomware response is typically divided into three phases. The first phase is pre-emptive detection and prevention, which involves identifying ransomware activity as early as possible through security controls and perimeter protection, thereby isolating the host machine hosting the ransomware to prevent further actions. The second phase is in-process detection and prevention, which involves using honeypot technology or scanning to detect ransomware's file encryption behavior. Honeypot technology is a technique that deceives attackers by placing decoy information to lure them into attacks, allowing for the capture and analysis of attack activities. The third phase is post-incident recovery and source tracing, which involves restoring the ransomware-suppressed software through data backups to ensure continued business operations.

[0079] However, as preventative measures continue to be upgraded, ransomware is also constantly mutating, gradually evolving into double or triple ransomware. In addition to the threat of data encryption, it also poses the threat of data leakage and service paralysis, causing particularly severe damage to critical infrastructure such as healthcare and finance.

[0080] Currently, abnormal behavior of processes can be identified to detect virus actions. For example, high-frequency file encryption, registry tampering, and suspicious network connections can be identified as abnormal behaviors.

[0081] However, current methods for identifying abnormal behavior typically involve comparing the actual behavior with a pre-set threshold. For example, if the frequency of a process's file encryption operations exceeds a preset threshold, the process is identified as an abnormal process. However, a process may also perform frequent file encryption operations while running normal business operations, such as when performing regular backups or backup compression. When the preset threshold is set too low, it is easy to cause misidentification, which will affect business operations and require maintenance personnel to spend a lot of time confirming.

[0082] To improve detection accuracy, this application provides an anomaly detection method. This method is applied to an electronic device, which can be a host or server, and contains multiple processes, such as... Figure 1 As shown, the method includes:

[0083] S101. Real-time monitoring of multi-dimensional behavioral data of the process under test, including operational behavioral data of the process under test in multiple preset dimensions.

[0084] Among them, the operation behavior data is the data generated by the operation behavior of the process to be detected. The operation behavior can include file operation behavior, registry operation behavior, network connection behavior, and resource usage behavior.

[0085] Multidimensional behavioral data includes any one or more of the following operational behavioral data:

[0086] The data on the file operations performed by the process under test can include actions such as creating, reading, writing, deleting, and renaming. Specifically, the data on these actions can include the number, type, path, frequency, and amount of data of the files. For example, the number of files created, the type of files created, the path of the files created, the frequency of file creation, and the number of files created.

[0087] The data on the behavior of the process being detected in modifying the registry can include registry creation, reading, writing and deletion. The behavior data of these behaviors can specifically include the operation object, content and frequency, such as the operation object, the content read and the frequency of reading.

[0088] The network connection data of the process to be detected may include established connection information (such as IP address, port number and protocol), data transmission volume, frequency of connection establishment and accessed domain name or Uniform Resource Locator (URL).

[0089] Resource usage data of the process to be monitored may include CPU utilization, memory utilization, and number of threads.

[0090] In addition, the aforementioned multidimensional behavioral data may also include the time point when the action occurs and the duration of the action.

[0091] S102. Compare the multidimensional behavioral data with the multidimensional correlation data of the process to be detected in the baseline dataset. The multidimensional correlation data includes the baseline conditions of multiple operational behaviors with correlation relationships.

[0092] The baseline dataset is pre-constructed and includes multidimensional correlation data for each process. The correlations between multiple operational behaviors in the multidimensional correlation data are captured during the stable operation phase of the process under test. Based on the data of multiple correlated operational behaviors during the stable operation phase, the normal range of these correlated operational behaviors can be determined, thereby establishing the baseline conditions.

[0093] For example, when process A's CPU utilization increases, the number of network connections associated with process A also increases, indicating a correlation between the CPU utilization and network connection count of process A. This allows us to determine the normal range for the CPU utilization and network connection count of process A. If, during subsequent real-time monitoring of process A, the CPU utilization and network connection count of process A are not within this normal range, it means that the baseline conditions are not met.

[0094] For example, if process A modifies registry entries more frequently than normal when performing file write operations, or if process B has an abnormally high number of child processes and an abnormally high number of network connections, or if process C's operation frequency changes significantly within a specific time period and process C accesses files in sensitive directories more frequently than normal, these can all be considered as not meeting the baseline conditions.

[0095] S103. If the multidimensional behavioral data deviates from the multidimensional correlation data of the process to be detected, then the process to be detected is determined to be an abnormal process.

[0096] If the multidimensional behavioral data does not meet the baseline conditions in the multidimensional correlation data, then the multidimensional behavioral data is determined to deviate from the multidimensional correlation data of the process to be detected, and the process to be detected is thus identified as an abnormal process.

[0097] Optionally, after determining that the process to be detected is an abnormal process, alarm or protective actions can also be performed.

[0098] This method allows for real-time monitoring of multidimensional behavioral data of the process under test. This multidimensional behavioral data is then compared with multidimensional correlation data of the process under test in a baseline dataset. The multidimensional correlation data includes baseline conditions for multiple related operational behaviors. In other words, it can determine whether the operational behavior data of multiple preset operational behaviors monitored in real-time meets the baseline conditions. If not, it indicates that the multidimensional behavioral data deviates from the multidimensional correlation data, thus identifying the process under test as an abnormal process. This embodiment of the application determines whether a process is abnormal by using data from multiple related operational behaviors, which improves the accuracy of abnormal process identification compared to identifying only a single operational behavior.

[0099] In the embodiments of this application, such as Figure 2 As shown, S102 above compares the multidimensional behavioral data with the multidimensional correlation data of the process to be detected in the baseline dataset, specifically including S1021-S1023.

[0100] S1021. Obtain the process ID of the process to be detected.

[0101] S1022. Using the process ID as an index, search for the multidimensional correlation data of the process to be detected from the baseline dataset. The multidimensional correlation data includes at least one baseline data group, and each baseline data group is used to describe a set of baseline conditions for operation behaviors with correlation relationships.

[0102] For example, if there is a relationship between operation behavior 1, operation behavior 2 and operation behavior 3 of process A, and a relationship between operation behavior 3, operation behavior 4 and operation behavior 5, then the baseline dataset includes two baseline data groups of process A. Baseline data group A includes the baseline conditions of operation behavior 1, operation behavior 2 and operation behavior 3, and baseline data group B includes the baseline conditions of operation behavior 3, operation behavior 4 and operation behavior 5.

[0103] After finding the multidimensional correlation data of the process to be detected from the baseline dataset, for each operation behavior in the multidimensional behavior data, a target baseline data group matching the operation behavior can be found from the multidimensional correlation data; it can then be determined whether the multidimensional behavior data meets the baseline conditions included in the target baseline data group.

[0104] For example, if multidimensional behavioral data includes operation behavior 1, then the target baseline data group matching operation behavior 1 is searched from the multidimensional associated data. Combining the example above, baseline data group A includes the baseline conditions for operation behavior 1, operation behavior 2, and operation behavior 3. Therefore, baseline data group A is the target baseline data group. Then, it is determined whether the operation behavior data of operation behavior 1, operation behavior 2, and operation behavior 3 in the multidimensional behavioral data meet the baseline conditions included in baseline data group A. If any one of these three operation behavior data does not meet the baseline conditions, then it is determined that the multidimensional behavioral data as a whole does not meet the baseline conditions.

[0105] Understandably, the multidimensional behavioral data can be compared with the baseline conditions in each baseline data group of the multidimensional associated data. If the multidimensional behavioral data meets the baseline conditions of each baseline data group, then it is determined that the multidimensional behavioral data has not deviated from the multidimensional associated data.

[0106] Optionally, the multidimensional behavioral data may also include the generation time of the operational behavior data. Correspondingly, each baseline data group is used to describe the baseline conditions of a set of related operational behaviors in different time windows. Based on this, it is determined whether the multidimensional behavioral data meets the baseline conditions included in the target baseline data group. Specifically, this can be achieved as follows: for each operational behavior in the multidimensional behavioral data, determine the target time window to which the generation time of the operational behavior data belongs; obtain the target baseline conditions corresponding to the target time window in the target baseline data group; and determine whether the multidimensional behavioral data meets the target baseline conditions.

[0107] The time window can be set according to the actual situation. For example, each hour of each day can be used as a time window. The baseline data group is used to describe the baseline conditions of a set of related operational behaviors in each hour.

[0108] Understandably, the baseline conditions for each time window can be different. For example, process A has low CPU utilization and network connection count most of the time, but increases CPU utilization and network connection count at 10:00 every day. Therefore, the baseline conditions for the time window at 10:00 are different from the baseline conditions for other time windows.

[0109] By setting baseline conditions for each time window, detection accuracy can be improved, and the accuracy of identifying abnormal processes can be further enhanced.

[0110] S1023. If the multidimensional behavioral data does not meet the baseline conditions included in any baseline data group in the multidimensional associated data, then the multidimensional behavioral data is determined to deviate from the multidimensional associated data of the process to be detected.

[0111] In this embodiment of the application, by comparing the multidimensional behavioral data with the baseline conditions in each baseline data group included in the multidimensional associated data, it is possible to accurately determine whether the associated operational behavioral data in each group of multidimensional behavioral data meets the baseline conditions. This allows for the detection of whether there are any abnormalities in the process to be detected from multiple dimensions, further improving the accuracy.

[0112] It should be noted that the process to be detected in this embodiment is a process in the target system, and this target system and the system used to implement the abnormal process detection method provided in this embodiment are in the same operating system of the electronic device. Before executing the above embodiments, the baseline dataset in the above embodiments needs to be generated in advance, such as... Figure 3 As shown, the baseline dataset is generated through the following steps:

[0113] S301. During the stable operation of the target system, monitor the multi-dimensional behavioral data generated by each process in the target system within each time window of the preset time period.

[0114] Both the preset time period and the time window can be flexibly set based on the characteristics of the process. For example, the preset time period can be 7 days, and the time window can be every hour.

[0115] The multidimensional behavioral data of each process includes any one or more of the following operational behavioral data:

[0116] Data on process file operations;

[0117] Data on process modifications to the registry;

[0118] Network connection data of the process;

[0119] Process resource usage data.

[0120] The specific contents of each type of data can be found in the relevant descriptions in the above embodiments, and will not be repeated here.

[0121] S302. Using a preset association algorithm, generate multidimensional association data for each process based on the multidimensional behavioral data of each process monitored.

[0122] The preset association algorithm can be implemented based on statistical models, time series analysis, graph models or machine learning models, and this application embodiment does not specifically limit it.

[0123] Taking the implementation based on a statistical model as an example, for each process, the numerical operation behavior data generated by the process in each time window can be statistically analyzed to obtain the statistical value of each operation behavior data in each time window. For example, the statistical value can be the maximum value, minimum value, average value, and variance.

[0124] Then, a time-period feature map of each operation behavior data can be constructed. For example, the time-period feature map of an operation behavior includes the statistical value of the operation behavior in each time window within a preset time period.

[0125] Then, correlation analysis can be performed on the statistical values ​​of operational behavior data in multiple dimensions of each process to capture the correlation between operational behaviors in different dimensions, thereby generating baseline conditions for multiple operational behaviors with correlation.

[0126] The relationships between different dimensions of operational behaviors are as follows:

[0127] When process A runs, its CPU usage will increase, and it will usually connect to port C of internal server B. That is, when the CPU usage of process A increases, the number of network connections will also increase.

[0128] The backup process X, which starts at 2 AM every Sunday, typically has a child process Y that writes data to a specific path in the network storage Z. Its network traffic is usually between 50-100MB, meaning that the amount of data written and the network traffic of process X will both increase at 2 AM every Sunday.

[0129] When analyzing the statistical values ​​of operational behavior data with correlations, we can identify positive or negative correlations between different operational behavior data, and then determine the baseline conditions for these correlated operational behaviors. A positive correlation means that when one operational behavior data increases, other related operational behavior data also increase; a negative correlation means that when one operational behavior data increases, other related operational behavior data decrease.

[0130] The statistical values ​​of related operational behaviors within different time windows of a preset period can be compared to obtain the normal range of related operational behavior data within each time window. This normal range can be represented by the magnitude of the operational behavior data, such as the normal range of CPU utilization, memory utilization, network connection count, and disk read / write operations per second (IOPS). Alternatively, it can be represented by the growth rate or decrease rate obtained by comparing the statistical values ​​of operational behavior data from other time windows, such as the normal range of CPU utilization growth rate or the normal range of network connection growth rate.

[0131] For example, when the CPU utilization of process A increases, the number of network connections usually increases. By comparison, it was found that the CPU utilization of process A increases by 30% and the number of network connections increases by 20% at 10:00 AM every day of the week. Therefore, the normal range of CPU utilization and network connection number of process A in each time period can be specified in the baseline data group. If the CPU utilization or network connection number of process A in the same time period is found to be outside the range during actual monitoring, such as the CPU utilization of process A increasing by 80% and the number of network connections increasing by 80% at 10:00 AM, then it is determined that process A is abnormal.

[0132] In addition, if the preset association algorithm is implemented through a machine learning model, the multidimensional behavioral data collected in S301 can be input into the pre-trained machine model to obtain the multidimensional association data of each process output by the machine model.

[0133] S303. Construct a baseline dataset from the multidimensional correlation data of each process included in the target system.

[0134] This application embodiment monitors the multi-dimensional behavioral data generated by each process within a preset time window during the stable operation of the target system, and then uses a preset correlation algorithm to generate multi-dimensional correlation data to obtain a baseline dataset. This allows for the pre-capture of deep-seated correlations between the operational behavior data of each process in various dimensions and the establishment of a baseline dataset, thereby enabling efficient and accurate detection of abnormal processes during subsequent detection processes.

[0135] In some embodiments of this application, when a new process is added to the target system, a "change request" event will occur in the target system. After the "change request" event is completed, the system used to implement the embodiments of this application can receive a change request completion signal, thereby monitoring the multidimensional behavioral data generated by the new process in each time window within a preset learning period; using a preset association algorithm, multidimensional association data of the new process is generated based on the monitored multidimensional behavioral data of the new process; and the multidimensional association data of the new process is added to the baseline dataset.

[0136] The preset learning period can be flexibly set based on the characteristics of the process, for example, it can be 7 days.

[0137] For example, if process A is added or reset in the target system, it is necessary to collect multidimensional behavioral data of process A and generate multidimensional correlation data of process A.

[0138] In this way, the baseline dataset can be continuously updated, enabling it to adapt to the updates of the target system and ensuring that the baseline data can respond to the updates of the target system in a timely and accurate manner, so as to accurately detect abnormal processes.

[0139] The following describes the overall system corresponding to the method provided in the embodiments of this application, such as... Figure 4 As shown, the system includes a data acquisition module 401, a baseline modeling module 402, a baseline storage module 403, an anomaly detection engine 404, a response module 405, and a change management interface module 406.

[0140] The data acquisition module 401 is used to collect multi-dimensional behavioral data generated by each process in the target system within a preset time period during the stable operation of the target system.

[0141] The baseline modeling module 402 is used to build the baseline dataset, and the baseline storage module 403 is used to store the baseline dataset.

[0142] The anomaly detection engine 404 is used to detect abnormal processes using the methods described in the above embodiments.

[0143] The response module 405 is used to perform alarm or protective actions when an abnormal process is detected.

[0144] The change management interface module 406 is used to receive a change request completion signal when a new process is added to the target system.

[0145] Corresponding to the above method embodiments, this application provides an abnormal process detection device, such as... Figure 5 As shown, the device includes:

[0146] The monitoring module 501 is used to monitor the multi-dimensional behavioral data of the process to be detected in real time. The multi-dimensional behavioral data includes the operation behavior data of the process to be detected in multiple preset dimensions.

[0147] The comparison module 502 is used to compare the multidimensional behavioral data with the multidimensional association data of the process to be detected in the baseline dataset, wherein the multidimensional association data includes baseline conditions of multiple operational behaviors with association relationships.

[0148] The determination module 503 is used to determine that the process to be detected is an abnormal process if the multidimensional behavioral data deviates from the multidimensional correlation data of the process to be detected.

[0149] Optionally, the comparison module 502 is specifically used for:

[0150] Obtain the process ID of the process to be detected;

[0151] Using the process ID as an index, the multidimensional association data of the process to be detected is retrieved from the baseline dataset. The multidimensional association data includes at least one baseline data group, and each baseline data group is used to describe a set of baseline conditions for operation behaviors with association relationships.

[0152] If the multidimensional behavioral data does not meet the baseline conditions included in any baseline data group of the multidimensional correlation data, then it is determined that the multidimensional behavioral data deviates from the multidimensional correlation data of the process to be detected.

[0153] Optionally, the device further includes: a search module;

[0154] The search module is used for

[0155] For each operational behavior in the multidimensional behavioral data, a target baseline data group matching the operational behavior is found from the multidimensional correlation data;

[0156] The determination module 503 is also used to determine whether the multidimensional behavioral data meets the baseline conditions included in the target baseline data group.

[0157] Optionally, the multidimensional behavioral data also includes the generation time of the operational behavior data, and each baseline data group is used to describe the baseline conditions of a set of related operational behaviors in different time windows; the determination module 503 is specifically used for:

[0158] For each operation in the multidimensional behavioral data, determine the target time window to which the generation time of the operation behavior data belongs;

[0159] For each operation in the multidimensional behavioral data, determine the target time window to which the generation time of the operation behavior data belongs;

[0160] Obtain the target baseline conditions corresponding to the target time window from the target baseline data group;

[0161] Determine whether the multidimensional behavioral data meets the target baseline conditions.

[0162] Optionally, the process to be detected is a process in the target system; the device further includes a generation module;

[0163] The generation module is used to generate the baseline dataset through the following steps:

[0164] During the stable operation of the target system, monitor the multi-dimensional behavioral data generated by each process in the target system within each time window of a preset time period;

[0165] Using a pre-defined correlation algorithm, multi-dimensional correlation data for each process is generated based on the multi-dimensional behavioral data of each process monitored.

[0166] The baseline dataset is constructed by constructing the multidimensional correlation data of each process included in the target system.

[0167] Optionally, the generation module is also used for:

[0168] When it is determined that a new process exists in the target system, monitor the multi-dimensional behavioral data generated by the new process in each time window within a preset learning period.

[0169] Using the preset association algorithm, multidimensional association data of the newly added process is generated based on the monitored multidimensional behavioral data of the newly added process;

[0170] The multidimensional correlation data of the newly added process is added to the baseline dataset.

[0171] Optionally, the multidimensional behavioral data includes any one or more of the following operational behavioral data:

[0172] The file operation behavior data of the process to be detected;

[0173] The data on the registry modifications made by the process to be detected;

[0174] The network connection data of the process to be detected;

[0175] The resource usage data of the process to be detected.

[0176] This application also provides an electronic device, such as... Figure 6 As shown, it includes a processor 601, a communication interface 602, a memory 603, and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604.

[0177] Memory 603 is used to store computer programs;

[0178] When the processor 601 executes the program stored in the memory 603, it implements the steps in the above method embodiments.

[0179] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0180] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0181] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0182] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0183] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of any of the above-described abnormal process detection methods.

[0184] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the abnormal process detection methods described above.

[0185] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0186] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0187] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0188] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A method for detecting abnormal processes, characterized in that, include: Real-time monitoring of multi-dimensional behavioral data of the process under test, wherein the multi-dimensional behavioral data includes operational behavioral data of the process under test in multiple preset dimensions; The multidimensional behavioral data is compared with the multidimensional correlation data of the process to be detected in the baseline dataset, wherein the multidimensional correlation data includes baseline conditions for multiple operational behaviors that are correlated. If the multidimensional behavioral data deviates from the multidimensional correlation data of the process to be detected, then the process to be detected is determined to be an abnormal process.

2. The method according to claim 1, characterized in that, The step of comparing the multidimensional behavioral data with the multidimensional correlation data of the process to be detected in the baseline dataset includes: Obtain the process ID of the process to be detected; Using the process ID as an index, the multidimensional association data of the process to be detected is retrieved from the baseline dataset. The multidimensional association data includes at least one baseline data group, and each baseline data group is used to describe a set of baseline conditions for operation behaviors with association relationships. If the multidimensional behavioral data does not meet the baseline conditions included in any baseline data group of the multidimensional correlation data, then it is determined that the multidimensional behavioral data deviates from the multidimensional correlation data of the process to be detected.

3. The method according to claim 2, characterized in that, After retrieving the multidimensional correlation data of the process to be detected from the baseline dataset using the process ID as an index, the method further includes: For each operational behavior in the multidimensional behavioral data, a target baseline data group matching the operational behavior is found from the multidimensional correlation data; Determine whether the multidimensional behavioral data meets the baseline conditions included in the target baseline data set.

4. The method according to claim 3, characterized in that, The multidimensional behavioral data also includes the generation time of the operational behavior data. Each baseline data group is used to describe the baseline conditions of a set of related operational behaviors in different time windows. The determination of whether the multidimensional behavioral data satisfies the baseline conditions included in the target baseline data set includes: For each operation in the multidimensional behavioral data, determine the target time window to which the generation time of the operation behavior data belongs; Obtain the target baseline conditions corresponding to the target time window from the target baseline data group; Determine whether the multidimensional behavioral data meets the target baseline conditions.

5. The method according to any one of claims 1-4, characterized in that, The process to be detected is a process in the target system; the baseline dataset is generated through the following steps: During the stable operation of the target system, monitor the multi-dimensional behavioral data generated by each process within the target system in each time window within a preset time period; Using a pre-defined correlation algorithm, multi-dimensional correlation data for each process is generated based on the multi-dimensional behavioral data of each process monitored. The baseline dataset is constructed by constructing the multidimensional correlation data of each process included in the target system.

6. The method according to claim 5, characterized in that, The method further includes: When it is determined that a new process exists in the target system, monitor the multi-dimensional behavioral data generated by the new process in each time window within a preset learning period. Using the preset association algorithm, multidimensional association data of the newly added process is generated based on the monitored multidimensional behavioral data of the newly added process; The multidimensional correlation data of the newly added process is added to the baseline dataset.

7. The method according to claim 1, characterized in that, The multidimensional behavioral data includes any one or more of the following operational behavioral data: The file operation behavior data of the process to be detected; The data on the registry modifications made by the process to be detected; The network connection data of the process to be detected; The resource usage data of the process to be detected.

8. An abnormal process detection device, characterized in that, include: The monitoring module is used to monitor the multi-dimensional behavioral data of the process under test in real time. The multi-dimensional behavioral data includes the operational behavioral data of the process under test in multiple preset dimensions. The comparison module is used to compare the multidimensional behavioral data with the multidimensional correlation data of the process to be detected in the baseline dataset, wherein the multidimensional correlation data includes baseline conditions of multiple operational behaviors with correlation relationships. The determination module is used to determine that the process to be detected is an abnormal process if the multidimensional behavioral data deviates from the multidimensional correlation data of the process to be detected.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method described in any one of claims 1-7.

Images