Tampering processing method and device, electronic equipment, storage medium and product

Abstract

The application discloses a tampering processing method and device, electronic equipment, storage medium and product. The method comprises the following steps: acquiring multiple rounds of tampering detection results for a protected object; determining repeatedly occurring tampered content and occurrence round information of the tampered content in multiple rounds; mapping the tampered content to at least one tampering behavior category; organizing the tampering behavior categories of multiple rounds and the respective corresponding evidence strengths into a node sequence to generate a tampering behavior chain; matching the tampering behavior categories and behavior change patterns in the tampering behavior chain with a preset decision rule set; and determining a target object affected by the tampering behavior category according to prompt information and the tampering behavior category, and determining an affected degree index of the target object. The application solves the technical problem that related tampering detection only outputs a single snapshot type tampered file list and a tampering rate, lacks a time-varying evidence structure, and it is difficult to attribute file-level evidence to an operable disposal stage.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and more specifically, to a tampering processing method, apparatus, electronic device, storage medium, and product. Background Technology

[0002] Existing host tampering detection technologies rely on a single snapshot to output a list of tampered files and the tampering rate, lacking a multi-round evidence structure that changes over time and failing to reflect the dynamic trends of tampering behavior. Furthermore, these solutions fail to effectively map underlying file-level evidence into actionable handling phase prompts, requiring security operations personnel to manually interpret data to determine the order of evidence collection, isolation, or recovery. Impact assessments often suffer from conjecture due to insufficient evidentiary constraints, failing to provide auditable and verifiable handling guidelines.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a tampering processing method, apparatus, electronic device, storage medium, and product to at least solve the technical problem that related tampering detection only outputs a single snapshot-style list of tampered files and tampering rate, lacks evidence structure that changes over time, and makes it difficult to attribute file-level evidence to an actionable disposal stage.

[0005] According to one aspect of this application, a tampering processing method is provided, comprising: acquiring multiple rounds of tampering detection results of a protected object by a client within a preset period, wherein the tampering detection results include: a list of tampered content; determining the tampered content that recurs in multiple rounds and the round information of the occurrence of the tampered content; mapping the tampered content to at least one tampering behavior category, and determining the evidence strength of each tampering behavior category based on the round information of occurrence; organizing the tampering behavior categories and their corresponding evidence strengths in multiple rounds into a node sequence, determining the behavior change pattern of the tampering behavior category as an edge between two adjacent nodes in the node sequence, and generating a tampering behavior chain based on the edge; matching the tampering behavior categories and behavior change patterns in the tampering behavior chain with a preset set of decision rules, and generating a prompt message based on the matching result; determining the target object affected by the tampering behavior category based on the prompt message and the tampering behavior category, and determining the degree of impact index of the target object, wherein the degree of impact index is used to characterize the severity of the impact of the tampering behavior category.

[0006] Optionally, determining the tampered content that repeatedly appears in multiple rounds and the round information of the tampered content includes: for each tampered content in the list of tampered content, performing the following processing: if the tampered content is a file path, performing format normalization processing on the file path to obtain a normalized path, and using the normalized path as the identifier of the tampered content; if the tampered content is a software package, generating a package identifier based on the attribute information of the software package, and using the package identifier as the identifier of the tampered content; if the tampered content in multiple rounds has the same identifier, identifying the tampered content with the same identifier as the same tampered content, and generating an evidence node for the same tampered content, wherein the evidence node is a data node that associates and stores the identifier of the same tampered content and the observation records corresponding to the same tampered content in each round; the observation records include the scan time and verification information of the current round, and the observation records are used to characterize the round information of the tampered content; if tampered content with the same identifier as the evidence node appears in the list of tampered content in subsequent rounds, appending the observation record under the evidence node.

[0007] Optionally, mapping the tampered content to at least one tampering behavior category includes: normalizing the fields in the list of tampered content to obtain a normalized list of tampered content; matching the tampered content in the normalized list of tampered content with preset path-sensitive rules to obtain a path matching result; matching the attribute information of the tampered content with a preset software benchmark library to obtain an identity matching result; matching the verification information of the tampered content with a preset benchmark to obtain an integrity matching result; and mapping the tampered content to at least one tampering behavior category in a preset set of tampering behavior categories based on the path matching result, the identity matching result, and the integrity matching result.

[0008] Optionally, the tampered content in the normalized list of tampered content is matched with preset path sensitivity rules to obtain path matching results, including: determining a first path and a second path for the file paths of the tampered content, wherein the first path is a normalized path and the second path is a normalized path obtained after resolving symbolic links from the normalized path; matching the first path and the second path with the path sensitivity rules to obtain a first path sensitivity level and a second path sensitivity level, wherein both the first path sensitivity level and the second path sensitivity level are used to characterize the sensitivity of the region where the corresponding path is located; if the first path sensitivity level and the second path sensitivity level are the same, the path matching result is determined as the first path sensitivity level; if the first path sensitivity level and the second path sensitivity level are inconsistent, a path conflict flag is set, and the path matching result is determined as the higher of the first path sensitivity level and the second path sensitivity level, or the tampered content is marked as an object to be reviewed.

[0009] Optionally, based on the path matching result, identity matching result, and integrity matching result, the tampered content is mapped to at least one tampering behavior category from a preset set of tampering behavior categories. This includes: determining the path sensitivity level of the tampered content based on the path matching result, wherein the path sensitivity level is used to characterize the sensitivity of the region where the file path of the tampered content is located; determining the matching status of the tampered content based on the identity matching result, wherein the matching status is used to characterize the degree of matching between the tampered content and package entries in the software benchmark library; determining the integrity matching identifier of the tampered content based on the integrity matching result, wherein the integrity matching identifier includes consistent, inconsistent, and unknown; inputting the triple formed by the path sensitivity level, matching status, and integrity matching identifier into a preset mapping matrix to obtain the tampering behavior category corresponding to the tampered content, wherein the mapping matrix is ​​used to record the correspondence between multiple predefined triples and tampering behavior categories; if the integrity matching identifier is unknown or the software benchmark library is unavailable for the tampered content, the output of the mapping matrix is ​​an application anomaly replacement candidate category from the set of tampering behavior categories, or the tampered content is marked as an object to be reviewed.

[0010] Optionally, the tampering behavior categories and their corresponding evidence strengths from multiple rounds are organized into a node sequence. Between adjacent nodes in the node sequence, the behavioral change pattern of the tampering behavior category is determined as an edge. This includes: sorting the rounds according to the chronological order of the scan times of the tampering detection results in each round to obtain an ordered round sequence; for each round in the ordered round sequence, generating a corresponding node in the node sequence, where the node includes the scan time of the current round, the set of behavioral categories consisting of the tampering behavior categories of the current round, and a summary value of evidence strength; the summary value of evidence strength is the value obtained by aggregating the evidence strengths corresponding to each tampering behavior category in the set of behavioral categories of the current round according to a preset aggregation rule; for adjacent preceding and following nodes in the node sequence, determining the behavioral change pattern of the tampering behavior category between the preceding and following nodes based on the relationship between the behavioral category sets of the preceding and following nodes; and determining the behavioral change pattern of the tampering behavior category between the preceding and following nodes as an edge between the preceding and following nodes.

[0011] Optionally, the behavior change patterns include addition, disappearance, persistence, and transformation. Based on the relationship between the behavior category set of the previous node and the behavior category set of the next node, the behavior change pattern of tampering behavior categories between the previous and next nodes is determined, including: if the behavior category set of the next node contains tampering behavior categories that do not belong to the behavior category set of the previous node, the behavior change pattern of tampering behavior categories between the previous and next nodes is determined as addition; if the behavior category set of the previous node contains tampering behavior categories that do not belong to the behavior category set of the next node, the behavior change pattern of tampering behavior categories between the previous and next nodes is determined as disappearance; if the behavior category sets of the previous and next nodes intersect, for the tampering behavior categories in the intersection, the behavior change pattern of tampering behavior categories between the previous and next nodes is determined as persistence; if neither the behavior category set of the previous node nor the behavior category set of the next node is empty and the intersection is empty, the behavior change pattern of tampering behavior categories between the previous and next nodes is determined as transformation.

[0012] Optionally, generating a tampering behavior chain based on edges includes: determining the tampering behavior categories contained in the union of the behavior category sets of each node in the node sequence as a first category set; for each tampering behavior category in the first category set, determining the trajectory sequence corresponding to the tampering behavior category on an ordered round sequence, wherein the trajectory sequence records the occurrence state of the tampering behavior category in each round according to the round order of the ordered round sequence; the occurrence state includes occurrence and non-occurrence; for adjacent previous and subsequent rounds in the trajectory sequence, obtaining the occurrence state of the tampering behavior category in the previous round and the occurrence state in the subsequent round; determining the behavior change pattern of the tampering behavior category between the previous round and the subsequent round based on the occurrence state of the tampering behavior category in the previous round and the subsequent round; determining the behavior change pattern as a type-level edge on the trajectory sequence between the previous round and the subsequent round; and using the type-level edges on the trajectory sequence corresponding to each tampering behavior category as type-level components in the tampering behavior chain.

[0013] Optionally, the tampering behavior categories and behavior change patterns in the tampering behavior chain are matched with a preset set of decision rules, including: obtaining the target tampering behavior category and the target behavior change pattern corresponding to the target tampering behavior category between adjacent nodes from the tampering behavior chain; generating feature information corresponding to the tampering behavior chain based on the target tampering behavior category, the target behavior change pattern, the evidence strength corresponding to the target tampering behavior category, and the tampering rate; comparing each item in the feature information with the preset matching conditions of each rule in the decision rule set to obtain the target rule in the decision rule set that matches the feature information, and determining the target rule as the matching result, wherein each rule in the decision rule set corresponds to a type of prompt information in a preset set of prompt information.

[0014] Optionally, generating prompt information based on the matching results includes: determining whether the feature information meets preset threshold conditions, wherein the threshold conditions include at least one of the following: the number of rounds in the tampering behavior chain is not less than a preset round threshold; there are no evidence nodes with conflict markers in the tampering behavior chain; the high / low strength marker of the evidence strength corresponding to the target tampering behavior category indicates that the evidence strength is not lower than a preset strength threshold; generating prompt information based on the matching results when the feature information meets the threshold conditions and there is a target rule matching the feature information in the decision rule set; generating a prompt information to be reviewed and generating an evidence gap description when the feature information does not meet the threshold conditions or there is no target rule matching the feature information in the decision rule set, wherein the evidence gap description is used to indicate items in the feature information that do not meet the threshold conditions or to indicate that there is no target rule matching the feature information in the decision rule set.

[0015] Optionally, determining the impact level index of the target object includes: identifying the target object as an auditable object based on the prompt information and the tampering behavior category, wherein the auditable object includes at least one of the following: service objects, process objects, and port objects associated with the target object, observably affected objects caused by the tampering of the target object, and critical path objects to be reviewed triggered by the tampering of the target object; determining the impact level index of the auditable object based on the auditable object, the tampering behavior category, and the evidence strength corresponding to the tampering behavior category; after determining the impact level index of the target object, the method further includes: generating an impact cause description corresponding to the impact level index, the impact cause description being used to indicate the nodes in the tampering behavior chain on which the impact level index is based, the tampering behavior category corresponding to the node, and the edges between the nodes; generating a handling priority for the auditable object based on the impact level index and the prompt information, wherein the handling priority is used to indicate the order in which handling operations are performed on the auditable object.

[0016] According to another aspect of this application, a tampering processing apparatus is also provided, comprising: an acquisition module, configured to acquire multiple rounds of tampering detection results of a protected object by a client within a preset period, wherein the tampering detection results include: a list of tampered content; a first determination module, configured to determine the tampered content that recurs in multiple rounds and the round information of the occurrence of the tampered content; a mapping module, configured to map the tampered content to at least one tampering behavior category, and determine the evidence strength of each tampering behavior category based on the round information of occurrence; and a first generation module, configured to generate the tampering behavior categories of multiple rounds and their corresponding... The evidence strength is organized as a node sequence. Between two adjacent nodes in the node sequence, the behavior change pattern of the tampering behavior category is determined as an edge, and a tampering behavior chain is generated based on the edge. The second generation module is used to match the tampering behavior category and behavior change pattern in the tampering behavior chain with a preset set of decision rules, and generate prompt information based on the matching result. The second determination module is used to determine the target object affected by the tampering behavior category based on the prompt information and the tampering behavior category, and determine the degree of impact index of the target object, wherein the degree of impact index is used to characterize the severity of the impact of the tampering behavior category.

[0017] According to another aspect of this application, an electronic device is also provided, comprising: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the program executes the above-described tampering processing method during runtime.

[0018] In this application, the method involves obtaining multiple rounds of tampering detection results from the client for the protected object within a preset period. The tampering detection results include: a list of tampered content; identification of tampered content that repeatedly appears in multiple rounds and the round information of the tampered content's occurrence; mapping the tampered content to at least one tampering behavior category, and determining the evidentiary strength of each tampering behavior category based on the round information; organizing the tampering behavior categories and their corresponding evidentiary strengths from multiple rounds into a node sequence; determining the behavior change pattern of the tampering behavior category as an edge between adjacent nodes in the node sequence, and generating a tampering behavior chain based on the edge; matching the tampering behavior categories and behavior change patterns in the tampering behavior chain with a preset set of decision rules, and generating a prompt message based on the matching result; and generating a prompt message based on the prompt message. This method categorizes information and tampering behaviors, identifies target objects affected by these categories, and determines the degree of impact on these target objects. The degree of impact index characterizes the severity of the impact of each tampering behavior category. This transforms static file-level tampering evidence into a dynamic, time-series-based chain of tampering behaviors. Based on evidence constraints and behavioral patterns, it automatically maps these chains to specific handling stages. This achieves the technical effect of constructing an auditable tampering chain through multiple rounds of evidence, providing actionable handling stage prompts and referential impact assessments, and reducing the risk of inference without evidence. Furthermore, it solves the technical problem that related tampering detection only outputs a single snapshot-style list of tampered files and tampering rates, lacking a time-varying evidence structure, and making it difficult to attribute file-level evidence to actionable handling stages. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0020] Figure 1 This is a flowchart of a tampering processing method according to an embodiment of this application;

[0021] Figure 2 This is a flowchart of another tampering processing method according to an embodiment of this application;

[0022] Figure 3 This is a schematic diagram illustrating a tampering chain formed over time by a behavior category according to an embodiment of this application;

[0023] Figure 4 This is a schematic diagram illustrating the triggering of a processing stage prompt rule according to an embodiment of this application;

[0024] Figure 5 This is a structural diagram of a tampering processing apparatus according to an embodiment of this application;

[0025] Figure 6 This is a hardware structure block diagram of a computer terminal according to an embodiment of the present application of a tampering processing method. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] According to an embodiment of this application, a method embodiment for tampering processing is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0029] Figure 1 This is a flowchart of a tampering processing method according to an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps:

[0030] Step S101: Obtain the client's multi-round tampering detection results for the protected object within a preset period, wherein the tampering detection results include: a list of tampered content.

[0031] Specifically, within a preset period, a security collection module deployed on the same agent program retrieves tampering detection results from the most recent N rounds or fixed time windows. Each round of tampering detection results includes at least a list of tampered files (tampered_list). Preferably, the tampering detection results may also include a scan timestamp (scan_time) and a tampering rate (tamper_rate).

[0032] Step S102: Determine the tampered content that appears repeatedly in multiple rounds and the round information of the tampered content.

[0033] Specifically, the path and package information in the list of tampered content can be normalized. For paths, a unified format (e.g., removing redundant forward slashes, standardizing case) is used to obtain stable keys. For packages, a stable key is formed using package name + version + architecture. Based on these stable keys, repeatedly occurring tampered content is identified across multiple rounds, and its first occurrence round, continuous occurrence rounds, and disappearance rounds are recorded. If duplicate rows exist within the same round, they are merged to remove duplicates. For the same stable key, if it reappears in subsequent rounds, only observation records (time, hash, etc.) are appended, without creating new duplicate nodes, thus constructing a multi-round observation sequence.

[0034] Step S103: Map the tampered content to at least one tampering behavior category, and determine the evidence strength of each tampering behavior category based on the occurrence round information.

[0035] Among them, the tampering behavior category can be understood as a set of enumerable types that abstract the underlying file-level tampering evidence into specific security semantics based on the path sensitivity level of the tampered file, the package identity matching status, and the hash consistency verification result, through preset mapping rules.

[0036] The logic for generating tampering behavior categories includes: normalizing the file path and matching it against a pre-defined sensitive path rule base to determine the path's sensitivity level (e.g., system core area, configuration sensitive area, persistent area, log area, etc.); parsing the file's software package name, version, and architecture, and comparing it with a software benchmark library to determine the package identity matching status (exact match, fuzzy version match, or no match); comparing the file's actual hash value (actual_hash) with the expected hash value (expected_hash) in the benchmark library to generate a hash inconsistency flag; and based on the combination of the above three factors, determining a unique or primary tampering behavior category through a pre-defined mapping matrix.

[0037] The strength of evidence for a tampering behavior category refers to an indicator used to quantify the credibility and certainty of the current tampering behavior category. For example, the strength of evidence is graded as follows: Strong Evidence: Baseline available, hash clearly inconsistent, path highly sensitive, and consistently occurring or showing high-confidence packet identity matching across multiple rounds. This type of evidence is sufficient to directly trigger high-priority action prompts (such as isolation). Medium Evidence: Baseline available, hash inconsistent, but path sensitivity moderate, or packet identity matching slightly ambiguous. Weak Evidence: Baseline missing, hash verification unknown, key fields missing, or only exhibiting a single, isolated incident without high-sensitivity path support. This type of evidence typically triggers "requires review" or is downgraded to "unknown," and is not directly used as a basis for strong action.

[0038] Step S104: Organize the tampering behavior categories and their corresponding evidence strengths from multiple rounds into a node sequence. Between two adjacent nodes in the node sequence, determine the behavior change pattern of the tampering behavior category as an edge, and generate a tampering behavior chain based on the edge.

[0039] Specifically, the results of multiple rounds are sorted in ascending order by scan time, and rounds with abnormal reverse time are discarded or marked to obtain an ordered round sequence. For each round, a chain node is generated, which contains the scan time of the round, the set of tampering behavior categories (behavior_type_set) of the current round, and an evidence strength summary (such as the maximum strength or categorical strength mapping within the set).

[0040] Then, the behavioral change patterns between adjacent nodes are analyzed: if a new type is added, it is marked as "new"; if the type persists, it is marked as "persistent"; if the type disappears, it is marked as "disappear"; if the two sets have no intersection and are both non-empty or the main type changes, it is marked as "transform". These change patterns are used as directed edges to connect adjacent nodes, forming a tamper behavior chain containing nodes and edges, thus constructing a traceable time-series evidence structure.

[0041] Step S105: Match the tampering behavior categories and behavior change patterns in the tampering behavior chain with the preset decision rule set, and generate prompt information based on the matching results.

[0042] Specifically, feature packages are extracted from the tampering behavior chain, including the set of behavior types for each round, the change patterns on the edges (addition / persistence / disappearance / transformation), the tampering rate trend, and the strength of evidence. These feature packages are then input into a pre-defined set of decision rules (stage rule set) for matching. The decision rule set defines the mapping relationship from evidence patterns to disposal semantics (stage_hint). For example, if persistent behaviors occur consecutively and the evidence strength meets the standard, an isolation and persistence blocking hint (isolation_and_persistence_block_hint) is triggered; if highly sensitive behaviors decrease and the tampering rate drops, a cleanup and verification hint (cleanup_and_verify_hint) is triggered. If the evidence is insufficient (e.g., fewer rounds than the threshold, missing key fields, low confidence) or the rule is not matched, a forced downgrade output of an unknown or need-review hint (unknown_or_needs_review) is provided, along with a specific explanation of the evidence gap, ensuring the operability and security of the hint.

[0043] Step S106: Based on the prompt information and the tampering behavior category, determine the target object affected by the tampering behavior category, and determine the degree of impact index of the target object, wherein the degree of impact index is used to characterize the severity of the impact of the tampering behavior category.

[0044] Specifically, based on the generated stage hints and specific tampering behavior categories, the system maps to specific affected business targets (such as specific services, processes, ports, or critical data paths). The impact severity metric is determined by comprehensively assessing the sensitivity of the behavior type, the strength of the evidence, the persistence of the impact (e.g., whether it is long-term), and the trend of tampering rate changes. The output must provide impact rationale, clearly stating which rounds, behavior categories, and critical path evidence in the tampering behavior chain the impact conclusion originates from, ensuring the auditability and verifiability of the assessment results. Based on this, priority recommendations for handling (e.g., evidence collection, isolation, recovery, or review) are output to assist security operations personnel in responding quickly.

[0045] Through the above steps S101 to S105, the static file-level tampering evidence is transformed into a dynamic chain of tampering behavior with time-series characteristics. Based on evidence constraints and behavioral patterns, it is automatically mapped to specific handling stages. This achieves the technical effect of constructing an auditable tampering chain through multiple rounds of evidence, providing operable handling stage prompts and reversible impact assessments, and reducing the risk of inference without evidence.

[0046] The following are Figure 1 The steps shown are illustrated and explained by way of example.

[0047] According to some optional embodiments of this application, determining the tampered content that recurs in multiple rounds and the round information of the tampered content can be achieved through the following steps: For each tampered content in the list of tampered content, perform the following processing: If the tampered content is a file path, perform format normalization processing on the file path to obtain a normalized path, and use the normalized path as the identifier of the tampered content; if the tampered content is a software package, generate a package identifier based on the attribute information of the software package, and use the package identifier as the identifier of the tampered content; in multiple rounds of tampered content... If the tampered content has the same identifier, the tampered content with the same identifier is identified as the same tampered content, and an evidence node is generated for the same tampered content. The evidence node is a data node that associates and stores the identifier of the same tampered content with the observation records corresponding to the same tampered content in each round. The observation records include the scan time and verification information of the current round and are used to characterize the round in which the tampered content appears. If tampered content with the same identifier as the evidence node appears in the list of tampered content in subsequent rounds, an observation record is added under the evidence node.

[0048] In this implementation, to determine the tampered content that recurs across multiple rounds and the rounds in which the tampered content appears, a unique identifier is first applied to each tampered content in the list. Specifically, when the tampered content is a file path, the file path is normalized to eliminate data redundancy caused by differences in path representation (such as extra forward slashes, inconsistent capitalization, etc.), resulting in a stable normalized path, which is then used as the unique identifier of the tampered content. When the tampered content is a software package, a package identifier is generated based on the package's attribute information (such as package name, version, architecture, etc.), and this package identifier is used as the unique identifier of the tampered content.

[0049] Through the above processing, it is possible to identify tampered content with the same identifier in multiple rounds of tampered content, and determine it as the same tampered content, thereby generating an evidence node for each type of the same tampered content.

[0050] An evidence node is a type of associated storage data node used to associate and store the identifier of the same tampered content with the corresponding observation records of that tampered content in each round. The observation records include the scan time and verification information (such as hash values) for the current round. The specific content of the observation records is used to characterize in which rounds the tampered content appeared, i.e., to characterize the round information of the tampered content.

[0051] In the initial round, an evidence node is created for new instances of the same tampered content and written into the initial observation record. In subsequent rounds, if tampered content with the same identifier as an existing evidence node appears in the list of tampered content, no new node is created; instead, the observation record for this round is directly appended to the corresponding evidence node. In this way, the evidence node can completely record the history, time sequence, and state changes of the same tampered content throughout the entire preset period.

[0052] The above process, based on normalized paths or packet identifiers, performs deduplication and correlation on multi-round tampering detection data and adds observation records, thereby integrating discrete single tampering snapshots into continuous time-series evidence nodes, thus accurately tracking the rounds of occurrence and changing trends of the tampered content.

[0053] According to some optional embodiments of this application, mapping the tampered content to at least one tampering behavior category can be achieved through the following steps: normalizing the fields in the list of tampered content to obtain a normalized list of tampered content; matching the tampered content in the normalized list of tampered content with preset path-sensitive rules to obtain a path matching result; matching the attribute information of the tampered content with a preset software benchmark library to obtain an identity matching result; matching the verification information of the tampered content with a preset benchmark to obtain an integrity matching result; and mapping the tampered content to at least one tampering behavior category in a preset set of tampering behavior categories based on the path matching result, the identity matching result, and the integrity matching result.

[0054] In this embodiment, the fields in the list of tampered content are first normalized to eliminate interference from differences in data format. Specifically, file paths are standardized by uniformly removing redundant forward slashes and determining a case sensitivity policy; hash values ​​are uniformly converted to lowercase hexadecimal and ensured to be of fixed length; package names, versions, and architecture information are cleaned and standardized. If key fields (such as actual hashes or package versions) are missing, the corresponding missing field flag is marked, thus obtaining a normalized list of tampered content with a unified structure and standardized format, laying the foundation for subsequent accurate matching.

[0055] Then, the normalized tampered content is matched against a preset rule base in multiple dimensions. On one hand, the normalized file path is compared with a preset path-sensitive rule base, which includes path prefixes or regular expressions categorized by sensitivity level (e.g., system core area, configuration sensitive area, persistent area, etc.) to obtain path matching results reflecting the file's security importance. On the other hand, the software package attribute information to which the file belongs is queried and matched against a preset software benchmark library to determine the correspondence between package name, version, and architecture, obtaining identity matching results reflecting the software's identity certainty. Simultaneously, the file's actual verification information is compared with the expected benchmark in the benchmark library to determine whether the actual hash matches the expected hash, obtaining integrity matching results reflecting the file's integrity.

[0056] Finally, based on the multi-dimensional matching results, the tampered content is mapped to specific tampering behavior categories through a pre-defined mapping logic. Specifically, based on the sensitivity level determined by the path matching results, the packet identity status determined by the identity matching results, and the hash consistency status determined by the integrity matching results, a pre-defined mapping matrix or rule set is queried. This mapping process can transform discrete field features into behavior types with security semantics. For example, if the path belongs to a high-sensitivity area and the hash is inconsistent, it can be mapped to "credential / authentication related tampering"; if the path is located in a persistent directory and the packet identity is clear, it can be mapped to "persistence related tampering". If there is insufficient evidence or conflict during the matching process, it can be mapped to "requires verification" or weak evidence categories, thereby ensuring that the output set of tampering behavior categories is both enumerable and reliable under evidence constraints.

[0057] The above steps, by combining multi-dimensional evidence constraints such as path sensitivity level, package identity matching status, and hash integrity verification, transform discrete file-level tampered data into enumerable behavior categories with clear security semantics, effectively avoiding misjudgments based on a single feature and improving the accuracy and interpretability of behavior attribution.

[0058] In some optional embodiments of this application, matching the tampered content in the normalized list of tampered content with preset path sensitivity rules to obtain path matching results can be achieved through the following steps: For the file paths of the tampered content, determine a first path and a second path respectively, wherein the first path is a normalized path and the second path is a normalized path obtained after resolving symbolic links from the normalized path; match the first path and the second path with the path sensitivity rules respectively to obtain a first path sensitivity level and a second path sensitivity level, wherein both the first path sensitivity level and the second path sensitivity level are used to characterize the sensitivity of the region where the corresponding path is located; if the first path sensitivity level and the second path sensitivity level are the same, determine the path matching result as the first path sensitivity level; if the first path sensitivity level and the second path sensitivity level are inconsistent, set a path conflict flag and determine the path matching result as the higher of the first path sensitivity level and the second path sensitivity level, or mark the tampered content as an object to be reviewed.

[0059] In this embodiment, to accurately assess the security risks of the tampered content, the file path of the tampered content is first analyzed in two dimensions. Specifically, a first path and a second path are determined: the first path is the path after format normalization, mainly used for display and general matching; the second path is the normalized real path obtained after parsing the symbolic links of the first path, used to eliminate path ambiguity caused by symbolic links.

[0060] Then, the first path and the second path are independently matched with the preset path sensitivity rule base to obtain the first path sensitivity level and the second path sensitivity level. The first path sensitivity level and the second path sensitivity level respectively represent the sensitivity of the corresponding path's region, such as the system core area, configuration sensitive area, or ordinary data area.

[0061] When determining the path matching result, different processing strategies are adopted based on the consistency between the first path sensitivity level and the second path sensitivity level. When the first path sensitivity level and the second path sensitivity level are consistent, it indicates that the path resolution has not introduced ambiguity, and the path matching result is directly determined as the consistent first path sensitivity level.

[0062] When the sensitivity levels of the first and second paths are inconsistent, it indicates a path conflict. A path conflict flag is set to record this anomaly. For these conflict scenarios, a conservative security strategy is adopted: the path matching result is determined to be the higher of the first and second path sensitivity levels to ensure that high-risk areas are fully identified; alternatively, the currently tampered content is marked as an object awaiting review so that it can be confirmed later by manual or higher-level analysis modules, thereby avoiding misjudgments or omissions due to path parsing errors.

[0063] The above steps effectively solve the path ambiguity problem caused by symbolic links by comparing the normalized path with the actual path after symbolic link resolution in parallel, and adopting a conservative strategy of taking the higher sensitivity level or marking it for review when there is a conflict. This significantly improves the accuracy and security of path sensitivity level determination.

[0064] As some optional embodiments of this application, mapping the tampered content to at least one tampering behavior category from a preset set of tampering behavior categories based on path matching results, identity matching results, and integrity matching results can be achieved through the following steps: determining the path sensitivity level of the tampered content based on the path matching results, wherein the path sensitivity level is used to characterize the sensitivity of the area where the file path of the tampered content is located; determining the matching status of the tampered content based on the identity matching results, wherein the matching status is used to characterize the degree of matching between the tampered content and package entries in the software benchmark library; determining the integrity matching identifier of the tampered content based on the integrity matching results, wherein the integrity matching identifier includes consistent, inconsistent, and unknown; inputting the triple formed by the path sensitivity level, matching status, and integrity matching identifier into a preset mapping matrix to obtain the tampering behavior category corresponding to the tampered content, wherein the mapping matrix is ​​used to record the correspondence between multiple predefined triples and tampering behavior categories; when the integrity matching identifier is unknown or the software benchmark library is unavailable for the tampered content, the output of the mapping matrix is ​​the application anomaly replacement candidate category in the set of tampering behavior categories, or the tampered content is marked as an object to be reviewed.

[0065] In this embodiment, firstly, key feature dimensions are extracted based on the aforementioned matching results. Based on the path matching results, the path sensitivity level of the tampered content is determined, whereby the path sensitivity level quantifies the security sensitivity of the area where the file path is located, such as the system core area, configuration sensitive area, or ordinary data area. Based on the identity matching results, the matching status of the tampered content is determined, whereby the matching status reflects the degree of consistency between the software package to which the file belongs and entries in a preset software benchmark library, including exact matching, version fuzzy matching, or no matching. Based on the integrity matching results, the integrity matching identifier of the tampered content is determined, whereby the integrity matching identifier clearly indicates the relationship between the actual verification information and the benchmark information, specifically divided into three states: consistent, inconsistent, or unknown.

[0066] Then, the features from the above three dimensions are combined into a triple: (path sensitivity level, matching status, integrity matching identifier). This triple is used as an input parameter and fed into a predefined mapping matrix for query processing. The mapping matrix stores the correspondence between multiple predefined triples and specific tampering behavior categories. Through table lookup or logical operations, discrete feature combinations are mapped to at least one behavior category from a predefined set of tampering behavior categories, such as persistence-related tampering, credential / authentication-related tampering, or log concealment / destruction—types with explicit security semantics.

[0067] Furthermore, to ensure the rigor of the conclusions and reduce the risk of misjudgment, a forced degradation mechanism is introduced. When the integrity matching identifier is unknown (e.g., missing hash or verification failure) or there is no applicable entry for the tampered content in the software benchmark library (i.e., the benchmark library is unavailable), the output of the mapping matrix is ​​strictly limited. In this case, high-confidence strong behavior categories are not output; the corresponding results are limited to applying anomaly replacement candidate categories, or the currently tampered content is directly marked as an object to be reviewed. This ensures that excessive security assertions are not made in the absence of sufficient evidence, but rather guides subsequent processes to manual review or conservative handling.

[0068] The above steps, by constructing a triplet mapping matrix based on path sensitivity level, packet identity matching status, and hash integrity verification, achieve accurate attribution from multidimensional evidence to specific security semantic behavior categories, and forcibly trigger downgrade or review mechanisms when evidence is insufficient, effectively reducing the risk of false alarms caused by unfounded inferences.

[0069] In some optional embodiments of this application, the tampering behavior categories and their corresponding evidence strengths across multiple rounds are organized into a node sequence. The behavior change pattern of the tampering behavior category between two adjacent nodes in the node sequence is determined as an edge. This can be achieved through the following steps: The rounds are sorted according to the chronological order of the scan times of the tampering detection results in each round, resulting in an ordered round sequence. For each round in the ordered round sequence, a corresponding node is generated in the node sequence. This node includes the scan time of the current round, the set of behavior categories consisting of the tampering behavior categories in the current round, and a summary value of evidence strength. The summary value of evidence strength is obtained by aggregating the evidence strengths corresponding to each tampering behavior category in the set of behavior categories in the current round according to a preset aggregation rule. For adjacent preceding and following nodes in the node sequence, the behavior change pattern of the tampering behavior category between the preceding and following nodes is determined based on the relationship between the behavior category sets of the preceding and following nodes. The behavior change pattern of the tampering behavior category between the preceding and following nodes is determined as an edge between the preceding and following nodes.

[0070] In this embodiment, firstly, the acquired multi-round tampering detection results are organized and aligned in terms of time dimension. Specifically, based on the scanning time of each round of tampering detection results, the rounds are sorted in order from earliest to latest, thereby constructing an ordered round sequence. It is worth noting that this sorting process ensures that subsequent analysis can accurately reflect the true trend of tampering behavior evolving over time. Then, for each round in the ordered round sequence, a corresponding node is generated in the node sequence. Each node contains three core elements: the scanning time of this round, the set of behavior categories consisting of the tampering behavior categories detected in this round, and the summary value of evidence strength. Among them, the summary value of evidence strength is a value obtained by calculating and aggregating the evidence strength corresponding to each tampering behavior category in the set of behavior categories in this round according to a preset aggregation rule. For example, the aggregation rule can be to take the maximum value of the evidence strength of all behavior categories in the set, or to retain the detailed strength distribution of each category. In this way, each node not only records the behavior state at a specific point in time, but also quantifies the credibility of the evidence in that state. Finally, by comparing two adjacent nodes in the node sequence, i.e., the previous node and the next node, the connection relationship between them, i.e., the "edge", is determined.

[0071] The above steps transform discrete tampering detection results into a continuous time-series evidence chain by constructing a time-ordered node sequence and edges representing behavioral evolution patterns. This allows for a direct presentation of the trends of tampering behavior, including its addition, continuation, disappearance, or transformation.

[0072] In the specific implementation process of this embodiment, the tamper detection results of the same Agent within a preset time window or the most recent N rounds are first obtained, the scan timestamps in each round are extracted, and the rounds are sorted in ascending order according to the chronological order of the scan times. If there are cases where the scan times are the same, they are further sorted according to the execution sequence number or the platform round ID, so as to obtain an ordered round sequence.

[0073] Then, for each round in the ordered round sequence, a corresponding node in the tampering behavior chain is generated. This node mainly contains information in three dimensions: first, the scanning time of this round, used to determine the time anchor point; second, the set of behavior categories composed of the tampering behavior categories of this round, which consists of all the mapped behavior categories in this round after evidence constraint attribution. If no valid behavior category is detected in this round, the set is empty; third, the evidence strength summary value, which is a scalar or mapping value obtained by aggregating the evidence strength corresponding to each behavior category in the behavior category set of this round according to the preset aggregation rules (such as taking the maximum value or weighted average of the evidence strength of each behavior category in the set), used to characterize the overall strength level of the tampering evidence in this round.

[0074] After constructing the node sequence, the dynamic relationships between adjacent nodes are further analyzed to define edges. Specifically, for each adjacent preceding and following node in the node sequence, its corresponding set of behavior categories is obtained, and the relationship between the two is analyzed through set operations to determine the behavior change pattern. If the behavior category set of the following node contains elements that do not belong to the behavior category set of the preceding node (i.e., the set difference is not empty), the behavior change pattern is determined to be "new," indicating that a new type of tampering behavior has appeared. If the behavior category set of the preceding node contains elements that do not belong to the behavior category set of the following node (i.e., the set difference in the other direction is not empty), the behavior change pattern is determined to be "disappearance," indicating that the original type of tampering behavior no longer appears. If the behavior category sets of two nodes have an intersection (i.e., the intersection is not empty), each behavior category in the intersection is determined to be "persistent," indicating that this type of tampering behavior exists stably in two adjacent rounds. If the behavior category sets of two nodes are not empty and the intersection is empty (i.e., the old and new behavior categories do not overlap at all and both exist), the behavior change pattern is determined to be "transition," indicating that the overall tampering situation has switched.

[0075] Finally, the identified behavioral change patterns are defined as edges connecting the previous node and the next node, thus linking the discrete nodes together to form a complete chain of tampering behavior. These edges not only record the changing trends of the behavioral category set between adjacent rounds (such as addition, disappearance, continuation, or transformation), but also implicitly contain the evolutionary logic of the strength of evidence.

[0076] By using a chain-building method based on time series and set relationships, static file-level tampering evidence can be transformed into a dynamic behavioral evolution structure, clearly showing the entire process of tampering behavior from its emergence, persistence, evolution to disappearance or transformation. This provides basic data with temporal logic and evidentiary coherence for subsequent handling stage prompts and impact assessments.

[0077] In some optional embodiments of this application, the behavior change patterns include addition, disappearance, persistence, and transformation.

[0078] Based on the relationship between the behavior category set of the previous node and the behavior category set of the next node, the behavior change pattern of tampering behavior categories between the previous and next nodes can be determined through the following steps: If the behavior category set of the next node contains tampering behavior categories that do not belong to the behavior category set of the previous node, the behavior change pattern of tampering behavior categories between the previous and next nodes is determined as "addition"; if the behavior category set of the previous node contains tampering behavior categories that do not belong to the behavior category set of the next node, the behavior change pattern of tampering behavior categories between the previous and next nodes is determined as "disappearance"; if the behavior category sets of the previous and next nodes intersect, for the tampering behavior categories in the intersection, the behavior change pattern of tampering behavior categories between the previous and next nodes is determined as "persistence"; if neither the behavior category set of the previous node nor the behavior category set of the next node is empty and the intersection is empty, the behavior change pattern of tampering behavior categories between the previous and next nodes is determined as "transformation".

[0079] In this embodiment, to accurately characterize the evolution trend of tampering behavior over time, the set of tampering behavior categories contained in each of two adjacent nodes, namely the preceding node and the following node, is first obtained. By performing a set-theoretic comparison analysis on these two sets, the specific change state of the behavior categories in the time series can be identified, thereby determining the behavior change pattern of the edge connecting these two nodes. Specifically, the following judgment logic is executed to distinguish four basic behavior change patterns:

[0080] First, to determine the newly added pattern, check if there are any elements in the behavior category set of the next node that do not belong to the behavior category set of the previous node. If the behavior category set of the next node contains at least one tampering behavior category that did not appear in the previous node, it indicates that a new security risk or behavior type has emerged, and the behavior change pattern between the previous and next nodes is determined as a newly added pattern.

[0081] Secondly, regarding the determination of the disappearance pattern, it is checked whether there are any elements in the behavior category set of the previous node that do not belong to the behavior category set of the next node. If there is at least one tampering behavior category in the behavior category set of the previous node that no longer appears in the next node, it means that some behavior types have stopped or are no longer detected, and the behavior change pattern between the previous node and the next node is determined to be disappearance.

[0082] Next, for determining persistent patterns, the intersection of the behavior category set of the preceding node and the behavior category set of the following node is calculated. If this intersection is not empty, meaning the two nodes share at least one identical tampering behavior category, then for each tampering behavior category in the intersection, the behavior change pattern between the preceding and following nodes for that specific behavior category is determined to be persistent. This indicates that the behavior type exists in both adjacent rounds of detection and has continuity.

[0083] Finally, regarding the determination of the transition pattern, it is determined whether both the behavior category sets of the preceding node and the behavior category sets of the following node are not empty sets, and whether their intersection is an empty set. If this condition is met—that is, tampering behavior is detected in both rounds, but the detected behavior types are completely different and have no overlap—it is determined that the overall situation has switched, thus identifying the behavior change pattern between the preceding and following nodes as a transition. This pattern usually indicates that the attacker has changed their attack methods or the system has entered a new threat phase.

[0084] The above steps compare the differences in the behavior categories of adjacent nodes based on set operations, accurately distinguishing four dynamic evolution modes: addition, disappearance, persistence, and transformation. This constructs a time-series evidence chain with fine-grained semantics, providing a reliable basis for accurately identifying the stage characteristics and trend changes of tampering behavior.

[0085] As some alternative embodiments of this application, generating a tampering behavior chain based on edges can be achieved through the following steps: determining the tampering behavior categories contained in the union of the behavior category sets of each node in the node sequence as a first category set; for each tampering behavior category in the first category set, determining the trajectory sequence corresponding to the tampering behavior category on an ordered round sequence, wherein the trajectory sequence records the occurrence state of the tampering behavior category in each round according to the round order of the ordered round sequence; the occurrence state includes occurrence and non-occurrence; for adjacent previous and subsequent rounds in the trajectory sequence, obtaining the occurrence state of the tampering behavior category in the previous round and the occurrence state in the subsequent round; determining the behavior change pattern of the tampering behavior category between the previous round and the subsequent round based on the occurrence state of the tampering behavior category in the previous round and the subsequent round; determining the behavior change pattern as a type-level edge on the trajectory sequence between the previous round and the subsequent round; and using the type-level edges on the trajectory sequence corresponding to each tampering behavior category as type-level components in the tampering behavior chain.

[0086] In this embodiment, to construct a more granular chain of tampering behaviors, based on the generated node sequence and set-level edges, each specific tampering behavior category is independently tracked to form a type-level trajectory sequence. Specifically, firstly, the union of the behavior category sets of all nodes in the node sequence is extracted, and all unique tampering behavior categories contained in this union are determined as the first category set. For each tampering behavior category in the first category set, its exclusive trajectory sequence is constructed on the time axis of the ordered round sequence. This trajectory sequence records in detail the occurrence state of the specific tampering behavior category in each round of detection, according to the order of the rounds. The occurrence state is defined as a binary state, i.e., present or absent.

[0087] Furthermore, for each tampering behavior category, the state changes between adjacent rounds are analyzed to determine the evolutionary pattern of that behavior category at the micro level. Specifically, the occurrence state of the tampering behavior category in the preceding and following rounds of the trajectory sequence is obtained. Based on the occurrence or absence state of the preceding and following rounds, the behavior change pattern of the tampering behavior category between the preceding and following rounds is determined. For example, if the preceding state is absent and the following state is present, it is determined to be a new addition; if the preceding state is present and the following state is absent, it is determined to be a disappearance; if both states are present, it is determined to be continuous; if both states are absent, it is determined to be unchanged (or ignored).

[0088] Finally, the behavior change patterns determined for each tampering behavior category are defined as type-level edges on the trajectory sequence for that behavior category. These type-level edges record the specific flow path of a particular behavior type in the time series, constituting the type-level components of the tampering behavior chain.

[0089] By introducing type-level edges, the chain of tampering behavior not only preserves the changing trends at the macro-level (such as changes in the overall situation), but also preserves the specific trajectories of micro-level individual behaviors (such as the continued existence or sudden disappearance of a certain type of tampering behavior), thus providing a richer and more accurate time-dimensional evidence structure, which helps to more accurately determine the handling stage and assess the scope of impact in the future.

[0090] In some optional embodiments, matching the tampering behavior categories and behavior change patterns in the tampering behavior chain with a preset set of decision rules can be achieved through the following steps: obtaining the target tampering behavior category and the target behavior change pattern corresponding to the target tampering behavior category between adjacent nodes from the tampering behavior chain; generating feature information corresponding to the tampering behavior chain based on the target tampering behavior category, the target behavior change pattern, the evidence strength corresponding to the target tampering behavior category, and the tampering rate; comparing each item in the feature information with the preset matching conditions of each rule in the decision rule set to obtain the target rule in the decision rule set that matches the feature information, and determining the target rule as the matching result, wherein each rule in the decision rule set corresponds to a type of prompt information in a preset set of prompt information.

[0091] In this embodiment, to transform the structured chain of tampering behavior into actionable handling suggestions, a rule-based matching process is executed to generate targeted handling stage prompts. First, key feature elements are extracted from the tampering behavior chain. These feature elements specifically include the target tampering behavior category, the target behavior change pattern corresponding to that category between adjacent nodes, the strength of evidence associated with that target tampering behavior category, and the current tampering rate. These elements collectively constitute the core data points reflecting the current security posture, where the behavior change pattern describes trends (such as new occurrences or continuation), the strength of evidence reflects credibility, and the tampering rate provides the context for overall risk quantification.

[0092] Furthermore, based on the key elements extracted above, feature information corresponding to the tampering behavior chain is generated. This feature information is a structured dataset containing the specific type of the target tampering behavior category, its dynamic evolution pattern over time (i.e., the target behavior change pattern), the strength level of evidence supporting the judgment (e.g., strong, medium, weak), and the current tampering rate value or trend. By integrating this multi-dimensional information into a unified feature package, standardized and complete input data is provided for subsequent rule matching, ensuring the objectivity and reproducibility of the matching process.

[0093] Finally, the generated feature information is compared one by one with the matching conditions defined by each rule in the preset decision rule set. Each rule in the decision rule set predefines a specific combination of triggering conditions, such as "specific behavior category" plus "continuous occurrence pattern" and "high evidence strength," and each rule is pre-associated with one type of prompt from a corresponding set of prompts (such as "isolation and persistence blocking prompt" or "cleanup and verification prompt"). If the seed feature information satisfies all the preset matching conditions of a rule, that rule is determined as the target rule, and its associated prompt is output as the matching result. This process achieves automatic mapping from low-level technical evidence to high-level handling semantics, ensuring that the generated handling recommendations are based on solid evidence and conform to preset security operation and maintenance logic.

[0094] The above steps integrate the types of tampering behavior, behavior change patterns, evidence strength, and tampering rate into structured features and match them with the decision rule set. This achieves an automated mapping from multi-dimensional time-series evidence to specific handling stage prompts, thereby ensuring that the generation of handling recommendations is based on objective evidence and is logically traceable.

[0095] According to some preferred embodiments of this application, generating prompt information based on matching results can be achieved through the following steps: determining whether the feature information meets preset threshold conditions, wherein the threshold conditions include at least one of the following: the number of rounds in the tampering behavior chain is not less than a preset round threshold; there are no evidence nodes with conflict markers in the tampering behavior chain; the high / low strength marker corresponding to the target tampering behavior category indicates that the evidence strength is not lower than a preset strength threshold; if the feature information meets the threshold conditions and there is a target rule matching the feature information in the decision rule set, generating prompt information based on the matching results; if the feature information does not meet the threshold conditions or there is no target rule matching the feature information in the decision rule set, generating a prompt information to be reviewed and generating an evidence gap description, wherein the evidence gap description is used to indicate items in the feature information that do not meet the threshold conditions or to indicate that there is no target rule matching the feature information in the decision rule set.

[0096] In this embodiment, to ensure the generated handling prompts have high confidence and executability, a strict threshold condition check is first performed on the generated feature information. This threshold condition is used to exclude situations that may lead to misjudgment due to insufficient data, conflicting evidence, or insufficient strength. Specifically, it includes at least one of the following requirements: the number of valid rounds in the tampering behavior chain is not less than a preset round threshold to ensure sufficient time series samples for analysis; there are no evidence nodes marked as conflicting in the tampering behavior chain to ensure the consistency and reliability of the evidence source; and the evidence strength indicator corresponding to the target tampering behavior category indicates that the evidence strength is not lower than a preset strength threshold to ensure the sufficiency of the judgment basis.

[0097] Formal prompts are only generated based on the matching results when the feature information fully meets all preset threshold conditions and a target rule matching the feature information exists in the decision rule set. This ensures that specific handling suggestions, such as isolation and persistent blocking, are only output when the evidence chain is complete, conflict-free, and meets the strength requirements, and clearly hits a specific handling logic, thereby guaranteeing the accuracy and effectiveness of the handling actions.

[0098] Conversely, if the feature information does not meet any of the above threshold conditions, or if it meets the threshold conditions but there is no matching target rule in the decision rule set, a prompt message indicating that the information needs to be reviewed will be forcibly generated. Simultaneously, a detailed explanation of the evidence gap will be generated. This explanation indicates the specific reason why a formal prompt was not generated, such as insufficient rounds, conflicting evidence, evidence strength below the threshold, or a lack of corresponding rule matching. Through this forced degradation mechanism and gap explanation, the risk of arbitrary judgments in cases of insufficient evidence or logical mismatches is effectively avoided. This provides security operations personnel with clear review guidelines, ensuring the rigor and security of the overall handling process.

[0099] The above steps, by setting multiple threshold conditions including round, conflict identifier and evidence strength and implementing a mandatory downgrade mechanism, ensure that a disposal prompt is generated only when the evidence is sufficient and the rules are matched; otherwise, a pending review status and a detailed explanation of the evidence gap are output. This effectively reduces the risk of unfounded inferences and improves the credibility and auditability of disposal recommendations.

[0100] According to some optional embodiments of this application, determining the degree of impact index of a target object can be achieved through the following steps: identifying the target object as an auditable object based on the prompt information and the category of tampering behavior, wherein the auditable object includes at least one of the following: service objects, process objects and port objects associated with the target object, observable objects affected by the tampering of the target object, and critical path objects to be reviewed triggered by the tampering of the target object; determining the degree of impact index of the auditable object based on the auditable object, the category of tampering behavior and the strength of evidence corresponding to the category of tampering behavior.

[0101] In addition, after determining the impact level index of the target object, the following steps can be performed: generate an impact cause description corresponding to the impact level index, which is used to indicate the nodes in the tampering behavior chain on which the impact level index is based, the tampering behavior category corresponding to the node, and the edges between the nodes; generate a handling priority for the auditable object based on the impact level index and the prompt information, wherein the handling priority is used to indicate the order in which handling operations are performed on the auditable object.

[0102] In this embodiment, to translate the proposed actions into concrete execution actions, the relevant entities are first identified as auditable objects based on the generated prompt information and the corresponding tampering behavior category. Auditable objects include key components closely related to the target host or application, specifically including: affected service platforms or interfaces, abnormally running processes, and exposed network ports; objects whose observability, such as logs and monitoring data, is compromised due to tampering; and critical paths requiring manual review due to conflicts or uncertainties in the evidence chain. By clearly defining the scope of auditable objects, abstract security alerts can be grounded in specific asset or component-level risk points.

[0103] Then, based on the identified auditable object, the specific type of tampering behavior, and the strength of evidence associated with that behavior type, a comprehensive assessment and calculation of the impact index is performed. The impact index quantifies the risk level or degree of damage caused by the tampering behavior to a specific auditable object. It considers not only the nature of the behavior itself (such as persistence, credential theft, etc.) but also the sufficiency of evidence (strong, medium, weak), thus yielding a more accurate risk assessment result.

[0104] Furthermore, to ensure the interpretability and auditability of the assessment results, a corresponding explanation of the causes of impact is generated after the impact level indicators are determined. This explanation traces the assessment basis in detail, clearly identifying the specific tampering behavior chain nodes supporting the impact level indicator, the types of tampering behavior these nodes represent, and the links (such as addition, persistence, disappearance, or transformation) that connect these nodes to form the evidence chain. This back-reference mechanism allows each impact level indicator to be traced back to the original multi-round scan evidence, avoiding black-box judgment and facilitating verification by security personnel.

[0105] Finally, by combining the impact severity indicators with the aforementioned generated alerts, a handling priority is generated for each auditable object. The handling priority indicates the specific order in which forensic investigation, isolation, recovery, or review operations are performed on different auditable objects. For example, objects with a high impact severity and alerts indicating isolation and persistence blocking are assigned a higher handling priority, guiding operations personnel to prioritize high-risk targets, thereby achieving optimal resource allocation and maximizing handling efficiency.

[0106] The above steps map tampering behavior to specific assets as auditable objects, quantify the degree of impact by combining the strength of evidence and generate a traceable explanation of the causes of the impact, and output disposal priorities based on risk levels. This achieves a closed loop from multi-dimensional evidence to specific asset risk quantification and orderly disposal decisions, thereby improving the efficiency and auditability of security response.

[0107] Figure 2 This is a flowchart of another tampering processing method according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0108] Step S201: Obtain evidence of tampering through multiple rounds.

[0109] Retrieve tampering detection results from the most recent N rounds (or within a fixed time window) on the same Agent, retaining the scan time (scan_time), the list of tampered files (tampered_list), and the tampering rate (tamper_rate). Perform path and package normalization processing, standardizing the path format (e.g., removing redundant forward slashes, standardizing capitalization), and identifying packages as stable keys of "package name + version + architecture". Build deduplicated evidence nodes based on stable keys, retaining only one node for the same stable key to avoid duplicate creation. In multiple rounds of observation, if the same path or package appears continuously in the list, append key fields such as the time of this round, round number, and hash to the corresponding node; if duplicate records exist within the same round, merge them first and then deduplicate them. Analyze the appearance, disappearance, and hash changes of each node based on time series analysis, constructing relationships of addition, persistence, disappearance, or transformation for subsequent use; if the same path causes conclusion conflicts in multiple rounds (e.g., hash contradictions), mark the node with a conflict flag, adopt a conservative strategy to mark it as pending review, and do not forcibly assign strong conclusions.

[0110] Step S202, evidence normalization.

[0111] The fields in `tampered_list` are standardized, including normalizing the full path string, unifying the hash to a lowercase hexadecimal fixed-length format, standardizing the package name / version and architecture format, and marking missing fields (such as `actual_hash`, `package_version`) as missing. The basic attributes of the file to be detected are parsed to obtain the normalized full path, the actual hash (such as SHA256), and the associated package name, version, and architecture; if package information cannot be parsed, it is marked as unparsed. Optionally, symbolic links are parsed according to a configuration strategy to obtain the actual path, and inconsistencies between the displayed path and the matching path are recorded to aid in conflict detection.

[0112] Step S203, attribution of behavioral category constraints.

[0113] The normalized path is compared with a pre-defined sensitive path rule base. This rule base includes layers such as core area, configuration sensitive area, persistent area, and log audit area. The `primary_tier` is determined based on the highest sensitivity level of the matched rules. The expected hash of the file in the corresponding package version is obtained by querying the software benchmark library. If the benchmark library has no record or the file entry is missing, the benchmark is marked as unusable and a degradation branch is initiated. If the benchmark is available, the actual hash is compared with the expected hash, generating a hash inconsistency flag (true / false / unknown). Simultaneously, the package identity matching status (exact / version_fuzzy / none) is determined.

[0114] Specifically, the mapping of behavior categories is based on a configurable rule table, which includes at least three types of input constraints: path-sensitive rules (such as persistent directories, authentication-related paths, and log-related paths), package name / version matching rules (which need to be consistent with tampered library evidence), and hash inconsistency rules (the inequality between actual_hash and expected_hash is regarded as valid tampering evidence). The rule table also includes a degradation strategy for missing fields, that is, when a key field is missing, a strong behavior category is not output and the state enters unknown. Based on the path sensitivity level, package matching status and hash inconsistency flag, the preset mapping matrix is queried to output enumerable behavior categories (behavior_type, such as persistence, credential tampering, log hiding, etc.), evidence strength (strong / medium / weak) and confidence; if the baseline is unavailable or the hash status is unknown, a weak behavior type or a pending review mark is forcibly output to reduce the risk of misjudgment.

[0115] Step S204, tamper chain construction: addition / persistence / disappearance / transition.

[0116] Sort each round of scanning in ascending order of scanning time, discard or mark data with abnormal reverse chronological order to obtain an ordered round sequence. A chain node is constructed for each round, and the node includes scanning time, the behavior category set of the current round and an evidence strength summary. Set-level comparison is performed based on the behavior category sets of two adjacent rounds: an added set (appeared in the current round but not in the previous round), a disappeared set (appeared in the previous round but not in the current round) and a persistent set (appeared in both rounds) are calculated, based on which set-level edge labels (has_new / has_disappear / has_persistent) are generated. If the two sets have no intersection and both are non-empty, they are marked as set-level transition. Figure 3 is a schematic diagram of a tamper chain formed by behavior categories changing over time according to an embodiment of the present application, as Figure 3 shown, it illustrates how behavior categories evolve over time and form a tamper chain with semantics of addition, persistence, disappearance or transition. Specifically, multiple rounds of tamper detection results within a continuous time window are first obtained, and each round is sorted according to the scanning time (ScanTime). Figure 3 four consecutive time nodes are shown, which are ScanTimet1, ScanTimet2, ScanTimet3 and ScanTimet4 respectively, where t1<t2<t3<t4, corresponding to the first, second, third and fourth round detection times respectively.

[0117] At each time point, a corresponding node is constructed, which includes the scan time of this round and the corresponding set of behavior categories. Specifically, ScanTimet1 generates the first node, which includes behavior category set #1 (BehaviorTypeSet#1); ScanTimet2 generates the second node, which includes behavior category set #2 (BehaviorTypeSet#2); ScanTimet3 generates the third node, which includes behavior category set #3 (BehaviorTypeSet#3); and ScanTimet4 generates the fourth node, which includes behavior category set #4 (BehaviorTypeSet#4). Behavior category sets #1 to #4 are enumerated sets of behavior types obtained after evidence normalization and behavior category constraint processing in the corresponding round, such as persistence, credential tampering, or log concealment. If no valid behavior is detected in a round, this set is empty.

[0118] Between adjacent nodes, the behavior change pattern is determined by comparing the differences between the behavior category sets in the previous two rounds, and this change pattern is defined as an edge connecting the adjacent nodes, thus forming a chain structure. Specifically, the first edge from the first node (ScanTimet1, BehaviorTypeSet#1) to the second node (ScanTimet2, BehaviorTypeSet#2) represents the behavior change pattern from t1 to t2. This pattern is labeled as one or more combinations of addition, persistence, disappearance, or transformation based on the set operation result. Similarly, the second edge from the second node to the third node represents the behavior change pattern from t2 to t3, and the third edge from the third node to the fourth node represents the behavior change pattern from t3 to t4. Through this method of connecting nodes and edges, Figure 3 It intuitively demonstrates the emergence, maintenance, disappearance, or transformation of tampering behavior at different time stages, providing a structured temporal evidence basis for generating disposal stage prompts and impact assessments based on this chain structure.

[0119] Furthermore, a separate time-trajectory sequence is maintained for each behavior category, and the local transition type (new / persistent / disappear / noop) of the type-level edge is determined based on the occurrence status (appearance / absence) of adjacent rounds. Simultaneously, the trends in tampering rate (increasing / decreasing / stable) and evidence strength are recorded as additional on-chain summary fields to support finer-grained situational analysis.

[0120] Specifically, step S204 can be implemented through the following sub-steps.

[0121] Step S2041, Time Sorting and Alignment. Assume there are N rounds after time sorting, and the node of the i-th round is denoted as Vi, where i belongs to 1 to N. Sort the detection data of each round in ascending order of scan_time. If the timestamps are the same, use execution_no or platform round ID to break the tie; discard or mark rounds with abnormal time reversal, obtaining an ordered round index sequence that satisfies a monotonically increasing time relationship.

[0122] Step S2042: Construct round-level chain nodes. For each round i, generate a chain node Vi. The node contains the scan time, the set of behavior types Ti (behavior_type_set, a finite enumeration set, which can be empty), and an evidence strength summary si. The evidence strength summary si can be the maximum value (scalar) of the strength of each type within the set, or it can be a categorical mapping that retains the strength of each type (mapped to {strong, medium, weak}), with a fixed caliber throughout the text. This yields the node sequence V1 to V2. N .

[0123] Step S2043: Construct set-level adjacent edges. For two adjacent rounds i and i+1, compare their behavior category sets Si and Si+1, and calculate the following three sets: the new set Delta_i_plus equals Si+1 minus Si (representing the type that appears newly relative to the previous round); the disappearance set Delta_i_minus equals Si minus Si+1 (representing the type that disappears relative to the previous round); the persistent set Ki equals the intersection of Si and Si+1 (representing the type that exists simultaneously in two adjacent rounds). Define Boolean semantic flags based on the non-empty condition of the sets: if Delta_i_plus is not empty, mark it as new; if Delta_i_minus is not empty, mark it as disappear; if Ki is not empty, mark it as persistent; if Si and Si+1 are both not empty and Ki is empty, mark it as transform, indicating a change in the overall situation. It is recommended to persistently save the above three sets for audit playback and derive Boolean flags for use by the downstream rule engine.

[0124] Step S2044, Type-level Trajectory Construction. Let U be the set of all behavior types that have appeared within the window. For each behavior type b, define an indicator sequence xi(b), which is 1 when b belongs to Ti, and 0 otherwise. For each adjacent edge, determine the local transition type phi_i(b) of type b based on the values ​​of xi(b) and xi+1(b): if xi(b) is 0 and xi+1(b) is 1, mark it as new; if both are 1, mark it as persistent; if xi(b) is 1 and xi+1(b) is 0, mark it as disappear; if both are 0, mark it as noop. If the evidence strength is a categorical mapping, the strength order relationship between adjacent rounds can also be compared to generate sub-flags indicating an increase or decrease in strength.

[0125] Step S2045, precise definition of the transition. For set-level transitions, it is defined as two rounds of behavior category sets having no intersection and being non-empty. For type-level transitions, a pre-defined mutually exclusive transition graph or transition matrix is ​​introduced to support the migration of the main behavior type from A to B; when a change of the main type from A to B is detected and conforms to the rule-permitted migration path, it is marked as a type-level transition, and the specific round that triggered the transition and the evidence are recorded to ensure recursiveness.

[0126] Step S2046, Linkage Analysis. Let the tampering rate of the i-th round be ri. Calculate the change in tampering rate between two adjacent rounds, delta_i, which equals ri+1 minus ri. Based on the configurable noise threshold epsilon, classify the trend as rising, falling, or stable. This field serves as an additional summary field, combined with the change pattern of the behavior set, for use in subsequent stage prompting rules (e.g., cleanup verification prompts require a reduction in the high-sensitivity set and a continuous decrease in the tampering rate in the later stages).

[0127] Step S2047, Conflict and Insufficiency Handling. If the available rounds are less than the minimum threshold, mark the chain history as insufficient and tend to output evidence preservation or a conclusion pending review; if there is evidence conflict, mark the conflict on the chain and adopt a conservative strategy to not output a strong stage conclusion; at the same time, record the rule version to ensure that the chain output has a version number for review.

[0128] Step S205, generation of disposal stage prompts. Specifically, this step is implemented through the following sub-steps:

[0129] Step S2051, Feature Compilation. The chain of tampering behaviors is organized into a feature package with fixed fields. The set of behavior categories for each round, the change patterns between adjacent rounds (new / continuous / disappear / transformation), the tampering rate sequence and its trend (e.g., continuous decline), the strength of evidence, the number of rounds, and the conflict identifier are extracted to form structured input features.

[0130] Step S2052, Hard Threshold Verification. Check whether the feature package meets the preset hard threshold conditions, including whether the number of rounds reaches the minimum threshold, whether there are unresolved evidence conflicts, and whether the evidence confidence level is lower than the minimum requirement. If any hard threshold is not met, it is forcibly downgraded to a pending review prompt, and an evidence gap description containing specific reasons for the gap (such as insufficient rounds, evidence conflicts, or insufficient strength) is generated, ending this step.

[0131] Step S2053, Rule Matching. If the hard threshold check is passed, the feature packet is matched using a limited set of pattern rules. Step S2054, Hint Generation and Degradation. If a target rule is matched, a corresponding stage hint (stage_hint) is generated based on the matched rule. Figure 4 This is a schematic diagram illustrating the triggering of a processing stage prompt rule according to an embodiment of this application, such as... Figure 4 As shown, this demonstrates how the feature package undergoes hard threshold verification and matches specific pattern rules to trigger corresponding handling stage prompts. The pattern rules are defined based on the behavioral category change patterns after evidence constraints and the tampering rate threshold, such as matching specific patterns like persistent classes appearing for two consecutive rounds or a decrease in the high-sensitivity set in the later stage with a continuous decrease in the tampering rate.

[0132] like Figure 4 As shown, the tampering behavior chain is first compiled into features to obtain feature information, which includes a behavior type set sequence, a rule for the consecutive occurrence frequency of a specific behavior type, and an evidence strength threshold. Then, a judgment is performed. If the feature information does not meet the preset threshold conditions (such as insufficient rounds, conflicting evidence, evidence strength below the threshold, or missing key behaviors), a forced downgrade mechanism is triggered, directly outputting an unknown or need-review message, and generating a structured explanation of the evidence gap to block unfounded inferences.

[0133] If the feature information meets the threshold condition, the system enters the rule matching stage, matching the corresponding stage hint (stage_hint) based on the occurrence pattern and trend of the behavior category. The specific triggering logic is as follows:

[0134] Evidence preservation / initial hint: Triggered when a high-sensitivity behavior category is detected and the evidence strength reaches the medium / high threshold, but subsequent continuity rules have not yet been met, to prioritize ensuring that the evidence is not destroyed.

[0135] Isolation and Persistence Block Hint: This is triggered when persistence-related behaviors occur for ≥2 consecutive rounds or when the strength of evidence remains at a medium-high level. It prompts for priority host isolation and blocking of persistent entry points to prevent attacks from persisting for a long time.

[0136] Access path risk reduction hint: This hint is triggered if credential tampering is detected within the time window after isolation and persistence blocking are activated. It indicates that authentication and access path risks need to be reduced to prevent attackers from using the obtained credentials for lateral movement.

[0137] Observability recovery and concealment removal (visibility_restore_hint): Triggered when log obfuscation / destruction behavior occurs in combination with transformation patterns, or when it is adjacent to other control evidence, to remove the attacker's concealment methods and ensure the effectiveness of subsequent monitoring.

[0138] Cleanup and Verify Hint: Triggered when the set of highly sensitive behavior categories in the latter part of the window is significantly reduced or disappears, and the tampering rate shows a continuous downward trend. It prompts the entry into the cleanup and recovery phase and performs final verification to confirm that the threat has been eliminated.

[0139] In conclusion, Figure 4 This embodiment demonstrates how complex temporal evidence can be transformed into an actionable sequence of actions, while a mandatory degradation mechanism ensures that conservative review recommendations are output when evidence is insufficient, thereby achieving automation, structuring, and auditability of action decisions.

[0140] Step S206, impact assessment output.

[0141] Based on the generated prompts and behavior categories, the target object is mapped to an auditable object, including associated services, processes, ports, observable objects affected by tampering, and critical paths requiring review. The degree of impact is quantified based on the auditable object, behavior category, and strength of evidence. An impact causal description (impact_rationale) is generated, clearly indicating the tampering behavior chain nodes, specific behavior categories, and evolutionary relationships between nodes upon which the degree of impact is based, ensuring the traceability of the assessment conclusions.

[0142] Specifically, the types of objects impacting the assessment can be selected based on the platform's existing data capabilities to determine the output dimensions; at a minimum, the set of critical paths requiring manual review and their handling priorities should be output. When host exposure snapshots or mapping data are lacking, only an evidentiary-level impact description should be output with review requirements noted to avoid over-inference based on missing data. Combining impact severity indicators and stage prompts, a handling priority should be generated for each auditable object, indicating the specific order in which operations such as evidence collection, isolation, recovery, or review should be performed on the object.

[0143] Step S207, Operations dispatch suggestions: evidence collection / isolation / recovery / review.

[0144] Based on the processing priority and prompt information output in step S206, operational assignment suggestions for security operations personnel are automatically generated.

[0145] For high-priority objects indicated as requiring isolation and blocking, it is recommended to prioritize network isolation and persistent entry point blocking; for objects indicated as requiring observable recovery, it is recommended to prioritize repairing logs and monitoring components; for objects indicated as requiring cleanup and verification, it is recommended to perform data integrity review after handling; for objects marked as requiring review, it is recommended to manually intervene to verify evidence and adjust strategies, thereby forming a complete closed loop from detection and assessment to handling.

[0146] In addition, when the platform has tampered chain results from multiple agents, cross-host aggregation can be performed based on the same behavior_type or the same stage_hint. Within the same business group, host work orders with isolation_and_persistence_block_hint are dispatched first, and then review work orders with cleanup_and_verify_hint are processed. Aggregation does not change the core rules, but only changes the display and dispatch dimensions.

[0147] Figure 5 This is a structural diagram of a tampering processing apparatus according to an embodiment of this application, such as... Figure 5 As shown, the device includes:

[0148] The acquisition module 51 is used to acquire the results of multiple rounds of tampering detection of the protected object by the client within a preset period. The tampering detection results include a list of tampered content.

[0149] The first determining module 52 is used to determine the tampered content that appears repeatedly in multiple rounds and the round information of the occurrence of the tampered content.

[0150] The mapping module 53 is used to map the tampered content to at least one tampering behavior category and determine the evidence strength of each tampering behavior category based on the occurrence round information.

[0151] The first generation module 54 is used to organize the tampering behavior categories and their corresponding evidence strengths in multiple rounds into a node sequence. Between two adjacent nodes in the node sequence, the behavior change pattern of the tampering behavior category is determined as an edge, and a tampering behavior chain is generated based on the edge.

[0152] The second generation module 55 is used to match the tampering behavior categories and behavior change patterns in the tampering behavior chain with a preset set of decision rules, and generate prompt information based on the matching results.

[0153] The second determination module 56 is used to determine the target object affected by the tampering behavior category based on the prompt information and the tampering behavior category, and to determine the degree of impact index of the target object, wherein the degree of impact index is used to characterize the severity of the impact of the tampering behavior category.

[0154] It should be noted that the above Figure 5 The modules in can be program modules (e.g., a set of program instructions that implements a specific function) or hardware modules. For the latter, they can be represented in the following forms, but are not limited to these: each of the above modules is represented by a processor, or the functions of each of the above modules are implemented by a processor.

[0155] It should be noted that, Figure 5 Preferred embodiments of the shown examples can be found in [reference needed]. Figure 1 The relevant descriptions of the embodiments shown will not be repeated here.

[0156] Figure 6 A hardware block diagram of a computer terminal for implementing a tampering handling method is shown. Figure 6 As shown, the computer terminal 60 may include one or more processors (shown as 602a, 602b, ..., 602n in the figure) (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 604 for storing data, and a transmission module 606 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 6 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, the computer terminal 60 may also include... Figure 6 The more or fewer components shown, or having the same Figure 6 The different configurations shown.

[0157] It should be noted that the aforementioned one or more processors and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 60. As involved in the embodiments of this application, the data processing circuits serve as processor control (e.g., selection of a variable resistor termination path connected to an interface).

[0158] The memory 604 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the tampering processing method in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 604, thereby realizing the above-mentioned tampering processing method. The memory 604 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 604 may further include memory remotely located relative to the processor, and these remote memories can be connected to the computer terminal 60 via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0159] The transmission module 606 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 60. In one example, the transmission module 606 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission module 606 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0160] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 60.

[0161] It should be noted here that, in some optional embodiments, the above... Figure 6 The computer terminal shown may include hardware elements (including circuitry), software elements (including computer code stored on a computer-readable medium), or a combination of both hardware and software elements. It should be noted that... Figure 6 This is only one instance of a specific particular instance, and is intended to illustrate the types of components that may exist in the aforementioned computer terminal.

[0162] It should be noted that, Figure 6 The computer terminal shown is used to execute Figure 1 The tampering handling method shown above means that the relevant explanations in the above command execution method also apply to this electronic device, and will not be repeated here.

[0163] This application also provides a non-volatile storage medium, which includes a stored program, wherein the program, when running, controls the device where the storage medium is located to execute the above-mentioned tampering processing method.

[0164] A non-volatile storage medium performs the following functions: acquiring multiple rounds of tampering detection results from the client for the protected object within a preset period, wherein the tampering detection results include: a list of tampered content; determining the tampered content that recurs in multiple rounds and the round information of the occurrence of the tampered content; mapping the tampered content to at least one tampering behavior category, and determining the evidence strength of each tampering behavior category based on the round information; organizing the tampering behavior categories and their corresponding evidence strengths in multiple rounds into a node sequence, determining the behavior change pattern of the tampering behavior category as an edge between two adjacent nodes in the node sequence, and generating a tampering behavior chain based on the edge; matching the tampering behavior categories and behavior change patterns in the tampering behavior chain with a preset set of decision rules, and generating a prompt message based on the matching result; determining the target object affected by the tampering behavior category based on the prompt message and the tampering behavior category, and determining the degree of impact index of the target object, wherein the degree of impact index is used to characterize the severity of the impact of the tampering behavior category.

[0165] This application also provides an electronic device, including a memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the above-described tampering processing method during runtime.

[0166] The processor is used to run a program that performs the following functions: acquiring multiple rounds of tampering detection results from the client for the protected object within a preset period, wherein the tampering detection results include: a list of tampered content; determining the tampered content that recurs in multiple rounds and the round information of the occurrence of the tampered content; mapping the tampered content to at least one tampering behavior category, and determining the evidence strength of each tampering behavior category based on the round information of occurrence; organizing the tampering behavior categories and their corresponding evidence strengths in multiple rounds into a node sequence, determining the behavior change pattern of the tampering behavior category as an edge between two adjacent nodes in the node sequence, and generating a tampering behavior chain based on the edge; matching the tampering behavior categories and behavior change patterns in the tampering behavior chain with a preset set of decision rules, and generating a prompt message based on the matching result; determining the target object affected by the tampering behavior category based on the prompt message and the tampering behavior category, and determining the degree of impact index of the target object, wherein the degree of impact index is used to characterize the severity of the impact of the tampering behavior category.

[0167] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0168] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0169] In the above embodiments of this application, the information collected is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with relevant laws, regulations and standards, take necessary protective measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0170] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0171] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0172] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0173] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to related technologies, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0174] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for handling tampering, characterized in that, include: The client obtains multiple rounds of tampering detection results for the protected object within a preset period, wherein the tampering detection results include: a list of tampered content; Identify the tampered content that appears repeatedly in multiple rounds and the round information of the occurrence of the tampered content; The altered content is mapped to at least one type of alteration behavior, and the strength of evidence for each type of alteration behavior is determined based on the occurrence round information. The tampering behavior categories and their corresponding evidence strengths in the multiple rounds are organized into a node sequence. Between two adjacent nodes in the node sequence, the behavior change pattern of the tampering behavior category is determined as an edge, and a tampering behavior chain is generated based on the edge. The tampering behavior categories and behavior change patterns in the tampering behavior chain are matched with a preset set of decision rules, and a prompt message is generated based on the matching result. Based on the prompt information and the tampering behavior category, the target object affected by the tampering behavior category is determined, and the degree of impact index of the target object is determined, wherein the degree of impact index is used to characterize the severity of the impact of the tampering behavior category; The tampering behavior categories and their corresponding evidence strengths across multiple rounds are organized into a node sequence. Between adjacent nodes in this node sequence, the behavioral change pattern of the tampering behavior category is determined as an edge. This process includes: sorting the rounds according to the chronological order of the scan times of the tampering detection results in each round to obtain an ordered round sequence; generating a corresponding node in the node sequence for each round in the ordered round sequence, wherein the node includes the scan time of the current round, the set of behavioral categories composed of the tampering behavior categories in the current round, and a summary value of evidence strength; the summary value of evidence strength is obtained by aggregating the evidence strengths corresponding to each tampering behavior category in the set of behavioral categories in the current round according to a preset aggregation rule; determining the behavioral change pattern of the tampering behavior category between the preceding and following nodes in the node sequence based on the relationship between the behavioral category sets of the preceding and following nodes; and defining the behavioral change pattern of the tampering behavior category between the preceding and following nodes as an edge between the preceding and following nodes.

2. The method according to claim 1, characterized in that, Determining the tampered content that recurs in multiple rounds and the round information of the tampered content, including: For each piece of content in the list of tampered content, perform the following processing: If the tampered content is a file path, the file path is normalized to obtain a normalized path, and the normalized path is used as the identifier of the tampered content. In the case where the tampered content is a software package, a package identifier is generated based on the attribute information of the software package, and the package identifier is used as the identifier of the tampered content; If the tampered content has the same identifier in multiple rounds, the tampered content with the same identifier is identified as the same tampered content, and an evidence node is generated for the same tampered content. The evidence node is a data node that associates and stores the identifier of the same tampered content with the observation records corresponding to the same tampered content in each round. The observation records include the scan time and verification information of the current round, and the observation records are used to characterize the round information of the occurrence of the tampered content. If, in subsequent rounds, tampered content with the same identifier as the evidence node appears in the list of tampered content, an observation record is added under the evidence node.

3. The method according to claim 1, characterized in that, Mapping the tampered content to at least one category of tampering behavior, including: The fields in the list of tampered content are normalized to obtain a normalized list of tampered content. The tampered content in the normalized list of tampered content is matched with preset path-sensitive rules to obtain path matching results; The attribute information of the tampered content is matched with a preset software benchmark library to obtain the identity matching result; The verification information of the tampered content is matched with a preset benchmark to obtain an integrity matching result; Based on the path matching result, the identity matching result, and the integrity matching result, the tampered content is mapped to at least one tampering behavior category in a preset set of tampering behavior categories.

4. The method according to claim 3, characterized in that, The tampered content in the normalized list of tampered content is matched with preset path-sensitive rules to obtain path matching results, including: For the file path of the tampered content, a first path and a second path are determined respectively, wherein the first path is a normalized path and the second path is a normalized path obtained after resolving symbolic links in the normalized path. The first path and the second path are matched with the path sensitivity rules respectively to obtain the first path sensitivity level and the second path sensitivity level, wherein the first path sensitivity level and the second path sensitivity level are used to characterize the sensitivity of the region where the corresponding path is located. If the first path sensitivity level and the second path sensitivity level are the same, the path matching result is determined as the first path sensitivity level; If the first path sensitivity level and the second path sensitivity level are inconsistent, a path conflict identifier is set, and the path matching result is determined to be the higher of the first path sensitivity level and the second path sensitivity level, or the tampered content is marked as an object to be reviewed.

5. The method according to claim 3, characterized in that, Based on the path matching result, the identity matching result, and the integrity matching result, the tampered content is mapped to at least one tampering behavior category from a preset set of tampering behavior categories, including: Based on the path matching results, the path sensitivity level of the tampered content is determined, wherein the path sensitivity level is used to characterize the sensitivity of the region where the file path of the tampered content is located; Based on the identity matching result, the matching status of the tampered content is determined, wherein the matching status is used to characterize the degree of matching between the tampered content and the package entries in the software benchmark library; Based on the integrity matching result, an integrity matching identifier for the tampered content is determined, wherein the integrity matching identifier includes consistent, inconsistent, and unknown; The triple consisting of the path sensitivity level, the matching status, and the integrity matching identifier is input into a preset mapping matrix to obtain the tampering behavior category corresponding to the tampered content. The mapping matrix is ​​used to record the correspondence between multiple predefined triples and the tampering behavior categories. If the integrity matching identifier is unknown or the software benchmark library is unavailable for the tampered content, the output of the mapping matrix is ​​the application anomaly replacement candidate category in the tampering behavior category set, or the tampered content is marked as an object to be reviewed.

6. The method according to claim 1, characterized in that, The behavior change patterns include addition, disappearance, persistence, and transformation; based on the relationship between the behavior category set of the previous node and the behavior category set of the next node, the behavior change pattern of the tampering behavior category between the previous node and the next node is determined, including: If the behavior category set of the next node contains a tampering behavior category that does not belong to the behavior category set of the previous node, the behavior change pattern of the tampering behavior category between the previous node and the next node is determined as a new addition; If there is a tampering behavior category in the behavior category set of the preceding node that does not belong to the behavior category set of the following node, the behavior change pattern of the tampering behavior category between the preceding node and the following node is determined to be disappearance; When there is an intersection between the behavior category set of the previous node and the behavior category set of the next node, the behavior change pattern of the tampering behavior category between the previous node and the next node is determined to be continuous for the tampering behavior category in the intersection. If neither the behavior category set of the preceding node nor the behavior category set of the following node is empty and the intersection is empty, then the behavior change pattern of the tampering behavior category between the preceding node and the following node is determined as a transformation.

7. The method according to claim 5, characterized in that, Based on the aforementioned edge, a chain of tampering behavior is generated, including: The tampering behavior categories contained in the union of the behavior category sets of each node in the node sequence are determined as the first category set; For each tampering behavior category in the first category set, a trajectory sequence corresponding to the tampering behavior category is determined on the ordered round sequence, wherein the trajectory sequence records the occurrence status of the tampering behavior category in each round according to the round order of the ordered round sequence; the occurrence status includes occurrence and non-occurrence; For each adjacent round in the trajectory sequence, obtain the occurrence status of the tampering behavior category in the previous round and the occurrence status in the next round; Based on the occurrence status of the tampering behavior category in the previous round and the occurrence status in the next round, determine the behavior change pattern of the tampering behavior category between the previous round and the next round; The behavior change pattern is defined as a type-level edge on the trajectory sequence between the previous round and the next round; The type-level edges on the trajectory sequence corresponding to each tampering behavior category are used as type-level components in the tampering behavior chain.

8. The method according to claim 1, characterized in that, Matching the tampering behavior categories and behavior change patterns in the tampering behavior chain with a preset set of decision rules includes: Obtain the target tampering behavior category and the target behavior change pattern corresponding to the target tampering behavior category between adjacent nodes from the tampering behavior chain; Based on the target tampering behavior category, the target behavior change pattern, the evidence strength corresponding to the target tampering behavior category, and the tampering rate, feature information corresponding to the tampering behavior chain is generated. Each item in the feature information is compared with the preset matching conditions of each rule in the decision rule set to obtain the target rule in the decision rule set that matches the feature information, and the target rule is determined as the matching result. Each rule in the decision rule set corresponds to a kind of prompt information in the preset prompt information set.

9. The method according to claim 8, characterized in that, Based on the matching results, a prompt message is generated, including: Determine whether the feature information meets a preset threshold condition, wherein the threshold condition includes at least one of the following: the number of rounds in the tampering behavior chain is not less than a preset round threshold; there are no evidence nodes with conflict flags in the tampering behavior chain; the high or low evidence strength flag corresponding to the target tampering behavior category indicates that the evidence strength is not lower than a preset strength threshold. If the feature information satisfies the threshold condition and there exists a target rule in the decision rule set that matches the feature information, a prompt message is generated based on the matching result. If the feature information does not meet the threshold condition, or if there is no target rule in the decision rule set that matches the feature information, a prompt message to be reviewed is generated, and an evidence gap description is generated. The evidence gap description is used to indicate the item in the feature information that does not meet the threshold condition, or to indicate that there is no target rule in the decision rule set that matches the feature information.

10. The method according to claim 1, characterized in that, Determining the impact level index of the target object includes: identifying the target object as an auditable object based on the prompt information and the tampering behavior category, wherein the auditable object includes at least one of the following: service objects, process objects, and port objects associated with the target object, observably affected objects caused by the tampering of the target object, and critical path objects to be reviewed triggered by the tampering of the target object; and determining the impact level index of the auditable object based on the auditable object, the tampering behavior category, and the evidence strength corresponding to the tampering behavior category. After determining the impact level index of the target object, the method further includes: generating an impact cause description corresponding to the impact level index, wherein the impact cause description is used to indicate the nodes in the tampering behavior chain on which the impact level index is based, the tampering behavior category corresponding to the node, and the edges between the nodes; and generating a handling priority for the auditable object based on the impact level index and the prompt information, wherein the handling priority is used to indicate the order in which handling operations are performed on the auditable object.

11. A tampering processing device, characterized in that, include: The acquisition module is used to acquire the results of multiple rounds of tampering detection of the protected object by the client within a preset period, wherein the tampering detection results include: a list of tampered content; The first determining module is used to determine the tampered content that appears repeatedly in multiple rounds and the round information of the occurrence of the tampered content; A mapping module is used to map the tampered content to at least one type of tampering behavior, and to determine the strength of evidence for each type of tampering behavior based on the occurrence round information; The first generation module is used to organize the tampering behavior categories and the corresponding evidence strengths of the multiple rounds into a node sequence, and between two adjacent nodes in the node sequence, determine the behavior change pattern of the tampering behavior category as an edge, and generate a tampering behavior chain based on the edge; The second generation module is used to match the tampering behavior categories and behavior change patterns in the tampering behavior chain with a preset set of decision rules, and generate prompt information based on the matching results; The second determining module is used to determine the target object affected by the tampering behavior category based on the prompt information and the tampering behavior category, and to determine the degree of impact index of the target object, wherein the degree of impact index is used to characterize the severity of the impact of the tampering behavior category; The first generation module is further configured to perform the following steps: sorting the rounds according to the chronological order of the scanning time of the tampering detection results in each round of the plurality of rounds to obtain an ordered round sequence; generating a corresponding node in the node sequence for each round in the ordered round sequence, wherein the node includes the scanning time of the current round, the set of behavior categories composed of the tampering behavior categories in the current round, and a summary value of evidence strength; the summary value of evidence strength is the value obtained by aggregating the evidence strength corresponding to each tampering behavior category in the set of behavior categories in the current round according to a preset aggregation rule; for adjacent preceding and following nodes in the node sequence, determining the behavior change pattern of the tampering behavior categories between the preceding and following nodes according to the relationship between the set of behavior categories of the preceding node and the set of behavior categories of the following node; and determining the behavior change pattern of the tampering behavior categories between the preceding and following nodes as an edge between the preceding and following nodes.

12. An electronic device, characterized in that, include: A memory and a processor, the processor being configured to run a program stored in the memory, wherein the program, when running, executes the tampering processing method according to any one of claims 1 to 10.

13. A non-volatile storage medium, characterized in that, The non-volatile storage medium includes a stored program, wherein, when the program is executed, it controls the device containing the non-volatile storage medium to perform the tampering processing method according to any one of claims 1 to 10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the tampering processing method according to any one of claims 1 to 10.

Images