An enterprise terminal abnormal behavior supervision method based on eBPF dynamic probe

Abstract

The application relates to the technical field of terminal exception supervision, and discloses an enterprise terminal exception behavior supervision method based on an eBPF dynamic probe, which is used for solving the problem that when terminal exception supervision is carried out, cross-process exception behavior missing detection is prone to occur in single-process-based exception identification, and comprises the following steps: process behavior statistical data is matched with preset exception behavior rules one by one to generate single-process exception identification results; the single-process exception identification results include single-process exceptions and non-single-process exceptions; terminal exception behavior supervision data corresponding to the processes with single-process exceptions is generated; process cooperation chains are extracted from the processes without single-process exceptions; the processes in the process cooperation chains are subjected to exception identification processing to generate process cooperation chain exception identification results, so that the accuracy of enterprise terminal exception behavior supervision results and the supervision reliability in complex terminal security scenarios are effectively improved.

Description

Technical Field

[0001] This invention relates to the field of terminal anomaly monitoring technology, and more specifically to a method for monitoring abnormal behavior of enterprise terminals based on eBPF dynamic probes. Background Technology

[0002] Enterprise endpoints, as crucial components of enterprise information systems, industrial control systems, and office automation systems, typically generate numerous system call events, file access events, process behavior events, and network communication events during operation. With the increasing variety of endpoint security threats, malicious programs, fileless attacks, advanced persistent attacks (APAs), and multi-stage coordinated attacks are becoming increasingly complex and covert. Therefore, enterprise endpoint anomaly behavior monitoring technology has become a key component of endpoint security protection systems. In recent years, endpoint behavior monitoring based on eBPF (Extended Berkeley Packet Filter) dynamic probes has emerged as a mainstream technology in the field of enterprise endpoint anomaly behavior monitoring. This approach can collect real-time data on system calls, file access, process execution, and network communication at the operating system kernel level, acquiring rich endpoint behavior information while maintaining low system overhead.

[0003] Existing enterprise endpoint anomaly monitoring systems typically rely on eBPF dynamic probes to collect system call events, file access events, process behavior events, and network communication events. These events are then categorized and statistically analyzed according to process identifier information, generating corresponding process behavior statistics. These statistics are then matched against preset anomaly behavior rules to identify anomaly behaviors on enterprise endpoints. In typical endpoint operation scenarios, this monitoring method can identify abnormal system calls, abnormal file accesses, abnormal network connections, and abnormal process behaviors, thus meeting the anomaly detection needs of most enterprise endpoint security monitoring scenarios.

[0004] However, the above-mentioned technologies have at least the following technical problems:

[0005] As endpoint attack techniques continue to evolve, some malware, advanced persistent attacks (APAs), and multi-stage coordinated attacks typically do not execute their entire attack through a single process. Instead, they distribute multiple execution stages, such as sensitive file access, data processing, network communication, and trace cleanup, across multiple interconnected processes, performing these actions sequentially. Since each process performs different functions, the number of system calls, file accesses, and network connections for a single process are usually within normal ranges. Existing monitoring methods, when performing statistical analysis on a process-by-process basis, easily break down multiple coordinated abnormal behaviors into multiple independent normal process behaviors, making it impossible to effectively reflect the correlation between cross-process coordinated behaviors.

[0006] Meanwhile, existing methods for identifying abnormal behavior based on single-process statistical results typically focus more on the behavioral characteristics of a single process, failing to comprehensively reflect the correlation characteristics among multiple processes in terms of continuity of behavior execution, resource usage, and functional coordination. When multiple processes jointly complete the same abnormal task, existing supervision methods struggle to accurately identify the collaborative behavioral relationships between them, easily leading to issues such as missed detection of cross-process abnormal behavior, reduced accuracy in identifying collaborative behavior, and insufficient completeness of terminal abnormal behavior supervision. This, in turn, affects the accuracy of enterprise terminal abnormal behavior supervision results and the reliability of supervision in complex terminal security scenarios. Summary of the Invention

[0007] To overcome the aforementioned deficiencies in the prior art, this invention provides a method for monitoring abnormal behavior of enterprise terminals based on eBPF dynamic probes, thereby addressing the problems existing in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] A method for monitoring abnormal behavior of enterprise terminals based on eBPF dynamic probes includes the following steps: Step 1: Obtain terminal identification information, operating system information, kernel version information, process information, and network connection information corresponding to the target enterprise terminal; load the corresponding eBPF runtime environment according to the kernel version information, and generate eBPF probe configuration data corresponding to the target enterprise terminal; Step 2: According to the eBPF probe configuration data, attach the corresponding eBPF dynamic probes to the system call interface, file access interface, process management interface, and network communication interface corresponding to the target enterprise terminal, respectively, to generate system call probes, file access probes, process behavior probes, and network behavior probes; Step 3: Collect system call events, file access events, process behavior events, and network communication events corresponding to the target enterprise terminal through the system call probes, file access probes, process behavior probes, and network behavior probes, respectively; aggregate and process the system call events, file access events, process behavior events, and network communication events according to the collection time order to generate terminal behavior event data; Step 4: Monitor the terminal... The behavioral event data undergoes field integrity verification, data format standardization, and time sequence processing. Relationships between behavioral events are established based on terminal and process identification information to generate standard terminal behavioral data. Step 5: The standard terminal behavioral data is categorized and statistically processed according to process identification information, including the number of system calls, file accesses, network connections, and process runtime, generating process behavioral statistics. Step 6: The process behavioral statistics are matched against preset abnormal behavior rules to generate single-process anomaly identification results. These results include whether a single-process anomaly exists or not. Step 7: Corresponding terminal abnormal behavior monitoring data is generated for processes with single-process anomalies; process collaboration chains are extracted for processes without single-process anomalies. Step 8: Anomaly identification processing is performed on each process collaboration chain to generate process collaboration chain anomaly identification results. Step 9: Terminal abnormal behavior monitoring results are generated based on the terminal abnormal behavior monitoring data and the process collaboration chain anomaly identification results, and then output.

[0010] Preferably, the process coordination chain acquisition step is as follows: processes without single-process anomalies are paired up in pairs and denoted as process association analysis data groups; process association information data of each process in each process association analysis data group is acquired; the process association information data includes process identifier information, parent process identifier information, process start time, process end time, file access record, network connection record, system object access record, system call type record, file access type record, and network behavior type record; the network connection record includes network target identifier, network connection start time, and network connection end time; the system object access record includes system object identifier, object access time, and object release time; based on the process identifier information, parent process identifier information, process start time, and process end time of each process in the process association analysis data group, the process association analysis data of each process is calculated. The process association analysis data group is calculated as follows: Behavioral continuity coefficient; Behavioral resource inheritance coefficient; Behavioral complementarity coefficient; Normalized coefficients; Process association index; Process collaboration chain;

[0011] Preferably, the steps for obtaining the behavior continuity coefficient are as follows: obtaining the process identifier information, parent process identifier information, process start time, and process end time corresponding to the first process and the second process in the process association analysis data group; determining whether there is a parent-child process relationship between the first process and the second process based on the process identifier information and parent process identifier information corresponding to the first process and the second process; calculating the time continuity value and life cycle overlap rate based on the process start time and process end time corresponding to the first process and the second process; when there is a parent-child process relationship between the first process and the second process, the parent-child connection mark value is recorded as one; when there is no parent-child process relationship between the first process and the second process, the parent-child connection mark value is recorded as zero; when the parent-child connection mark value is one, the larger value between the time continuity value and the life cycle overlap rate is used as the behavior continuity coefficient; when the parent-child connection mark value is zero and the life cycle overlap rate is greater than zero, the product between the time continuity value and the life cycle overlap rate is used as the behavior continuity coefficient; when the parent-child connection mark value is zero and the life cycle overlap rate is equal to zero, the time continuity value is used as the behavior continuity coefficient.

[0012] Preferably, the step of calculating the time-connection tightness value and lifecycle overlap rate based on the process start time and process end time of the first process and the second process is as follows: According to the order of process start time, the process with the earlier start time is recorded as the preceding process, and the process with the later start time is recorded as the succeeding process; the time interval between the process start time of the succeeding process and the process start time of the preceding process is calculated to obtain the process start time interval; the time interval between the process end time of the succeeding process and the process end time of the preceding process is calculated to obtain the process end time interval; the smaller value between the process start time interval and the process end time interval is used as the nearest neighbor connection interval, and the larger value between the process start time interval and the process end time interval is used as the span connection interval; when the span connection interval is zero, the time-connection tightness value is recorded as one; when the span connection interval is not zero, the ratio between the nearest neighbor connection interval and the span connection interval is calculated to obtain the time-connection tightness value; the lifecycle is determined based on the later time between the process start time of the preceding process and the process start time of the succeeding process. The lifecycle overlap start time is determined; the earlier of the preceding process's end time and the subsequent process's end time is used to determine the lifecycle overlap end time; when the lifecycle overlap end time is later than the lifecycle overlap start time, the time difference between the lifecycle overlap end time and the lifecycle overlap start time is calculated to obtain the lifecycle overlap duration; when the lifecycle overlap end time is not later than the lifecycle overlap start time, the lifecycle overlap duration is recorded as zero; the time difference between the preceding process's end time and the preceding process's start time is calculated to obtain the preceding process's lifecycle duration; the time difference between the subsequent process's end time and the subsequent process's start time is calculated to obtain the subsequent process's lifecycle duration; the smaller of the preceding process's lifecycle duration and the subsequent process's lifecycle duration is used as the reference lifecycle duration; when the reference lifecycle duration is zero, the lifecycle overlap rate is recorded as zero; when the reference lifecycle duration is not zero, the ratio between the lifecycle overlap duration and the reference lifecycle duration is calculated to obtain the lifecycle overlap rate.

[0013] Preferably, the steps for obtaining the behavioral resource inheritance coefficient are as follows: Based on the file access records, network connection records, and system object access records corresponding to the preceding and succeeding processes, a resource flow analysis result is generated, including file resource continuity rate, network resource continuity rate, and system object continuity rate; the maximum value among the file resource continuity rate, network resource continuity rate, and system object continuity rate is taken as the primary resource continuity rate; the number of values ​​greater than zero among the file resource continuity rate, network resource continuity rate, and system object continuity rate is counted to obtain the number of continuity resource types; when the primary resource continuity rate is zero, the behavioral resource inheritance coefficient is recorded as zero; when the primary resource continuity rate is not zero and the number of continuity resource types is one, the square of the primary resource continuity rate is calculated to obtain the behavioral resource inheritance coefficient; when the primary resource continuity rate is not zero and the number of continuity resource types is greater than one, the primary resource continuity rate is used as the behavioral resource inheritance coefficient.

[0014] Preferably, the steps for obtaining the resource flow analysis results are as follows: Extracting the set of preceding file resource identifiers from the file access records of the preceding process, and extracting the set of subsequent file resource identifiers from the file access records of the subsequent process; counting the number of file resource identifiers in the subsequent file resource identifier set that also exist in the preceding file resource identifier set, to obtain the number of file resource inheritances; counting the total number of file resource identifiers in the subsequent file resource identifier set; when the total number of file resource identifiers is zero, recording the file resource continuation rate as zero; when the total number of file resource identifiers is not zero, calculating the ratio between the number of file resource inheritances and the total number of file resource identifiers, to obtain the file resource continuation rate; extracting the preceding network target identifier and the preceding network connection end time from the network connection records of the preceding process, and extracting the subsequent network target identifier and the subsequent network connection start time from the network connection records of the subsequent process; counting the number of network target identifiers whose subsequent network target identifier is the same as the preceding network target identifier, whose subsequent network connection start time is later than or equal to the preceding network connection end time, and which are within a preset connection migration time range, to obtain the number of network connection migrations; counting the number of network connection records of the subsequent process... The total number of subsequent network target identifiers is calculated. When the total number of subsequent network target identifiers is zero, the network resource continuity rate is recorded as zero. When the total number of subsequent network target identifiers is not zero, the ratio between the number of network connection migrations and the total number of subsequent network target identifiers is calculated to obtain the network resource continuity rate. The preceding system object identifier and the preceding object release time are extracted from the system object access records of the preceding process, and the subsequent system object identifier and the subsequent object access time are extracted from the system object access records of the subsequent process. Statistics are compiled showing that if the subsequent system object identifier is the same as the preceding system object identifier, and the subsequent object... The number of system object identifiers whose access time is earlier than or equal to the release time of the preceding object is used to obtain the number of continuously accessed objects; the total number of subsequent system object identifiers in the system object access records of subsequent processes is counted; when the total number of subsequent system object identifiers is zero, the system object continuity rate is recorded as zero; when the total number of subsequent system object identifiers is not zero, the ratio between the number of continuously accessed objects and the total number of subsequent system object identifiers is calculated to obtain the system object continuity rate; the file resource continuity rate, network resource continuity rate, and system object continuity rate are organized according to their corresponding relationships to generate resource flow analysis results.

[0015] Preferably, the step of obtaining the behavior complementarity coefficient is as follows: Merging the system call type records, file access type records, and network behavior type records corresponding to the preceding process to obtain a preceding behavior type set; merging the system call type records, file access type records, and network behavior type records corresponding to the following process to obtain a following behavior type set; matching each preceding behavior type in the preceding behavior type set with each following behavior type in the following behavior type set according to a preset behavior complementarity relationship table, counting the number of behavior type pairs that satisfy the behavior complementarity relationship, and obtaining the number of complementary behavior type pairs; counting the total number of behavior type pairs between the preceding behavior type set and the following behavior type set; when the total number of behavior type pairs is zero, the type complementarity matching rate is recorded as zero. When the total number of behavior type pairs is not zero, calculate the ratio between the number of complementary behavior type pairs and the total number of behavior type pairs to obtain the type complementarity matching rate; according to the preset behavior stage mapping relationship, determine the preceding behavior stage number corresponding to the preceding behavior type and the following behavior stage number corresponding to the following behavior type in each complementary behavior type pair; count the number of complementary behavior type pairs whose following behavior stage number is greater than the preceding behavior stage number to obtain the number of progressive complementary type pairs; when the number of complementary behavior type pairs is zero, record the stage progressive efficiency as zero; when the number of complementary behavior type pairs is not zero, calculate the ratio between the number of progressive complementary type pairs and the total number of complementary behavior type pairs to obtain the stage progressive efficiency; calculate the product between the type complementarity matching rate and the stage progressive efficiency to obtain the behavior complementarity coefficient.

[0016] Preferably, the step of generating a process collaboration chain based on the process association index of each process association analysis data group is as follows: comparing the process association index with a preset process association threshold; if the process association index is greater than or equal to the preset process association threshold, it is determined that the process association analysis data group has an association relationship; if the process association index is less than the preset process association threshold, it is determined that the process association analysis data group does not have an association relationship; merging the process association analysis data groups with association relationships, merging multiple process association analysis data groups with common processes into the same process set, generating several process sets; sorting according to the process start time order of each process in each process set, generating the corresponding process collaboration chain.

[0017] Preferably, the step of performing anomaly identification processing on each process collaboration chain and generating process collaboration chain anomaly identification results is as follows: According to the process startup time order of each process in each process collaboration chain, the system call type records, file access type records, and network behavior type records corresponding to each process are sequentially concatenated to generate a corresponding collaboration behavior sequence; the number of system call types, file access types, network behavior types, and adjacent behavior switching times corresponding to each process collaboration chain are counted according to the collaboration behavior sequence to generate collaboration behavior statistics; the behavior connection relationship between adjacent behavior types is identified according to the collaboration behavior sequence, and the number of behavior connections that meet the preset behavior connection rules is counted to generate behavior connection statistics; the collaboration behavior statistics and behavior connection statistics are matched item by item with the preset collaboration behavior anomaly rules; when the collaboration behavior statistics and behavior connection statistics meet the preset collaboration behavior anomaly rules, it is determined that the corresponding process collaboration chain has collaboration behavior anomalies; when the collaboration behavior statistics and behavior connection statistics do not meet the preset collaboration behavior anomaly rules, it is determined that the corresponding process collaboration chain does not have collaboration behavior anomalies; and the process collaboration chain anomaly identification results are generated based on the collaboration behavior anomaly determination results corresponding to each process collaboration chain.

[0018] The technical effects and advantages of this invention are as follows:

[0019] The process behavior statistics are matched item by item with preset abnormal behavior rules to generate single-process anomaly identification results. The single-process anomaly identification results include the presence of single-process anomalies and the absence of single-process anomalies. For processes with single-process anomalies, corresponding terminal abnormal behavior supervision data is generated. For processes without single-process anomalies, process collaboration chains are extracted, and anomaly identification processing is performed on each process collaboration chain to generate process collaboration chain anomaly identification results. This effectively improves the accuracy of enterprise terminal abnormal behavior supervision results and the reliability of supervision in complex terminal security scenarios. Attached Figure Description

[0020] Figure 1 A flowchart of an enterprise terminal abnormal behavior monitoring method based on eBPF dynamic probe provided in this application embodiment. Detailed Implementation

[0021] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. In addition, the forms of the various structures described in the following embodiments are merely illustrative. The enterprise terminal abnormal behavior monitoring method based on eBPF dynamic probe involved in the present invention is not limited to the structures described in the following embodiments. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] This invention provides a method for monitoring abnormal behavior of enterprise terminals based on eBPF dynamic probes, such as... Figure 1 As shown, it includes the following steps:

[0023] Step 1: Obtain the terminal identification information, operating system information, kernel version information, process information, and network connection information corresponding to the target enterprise terminal; load the corresponding eBPF runtime environment according to the kernel version information, and generate eBPF probe configuration data corresponding to the target enterprise terminal; the eBPF probe configuration data includes monitoring event type information and corresponding probe mounting location information;

[0024] It should be noted that when loading the corresponding eBPF runtime environment based on the kernel version information, an eBPF runtime environment compatible with the current kernel version can be loaded based on the operating system information and kernel version information of the target enterprise terminal. This ensures that the subsequent eBPF dynamic probes can be properly mounted and collect events. Furthermore, when generating the corresponding eBPF probe configuration data based on the monitoring event type information, the corresponding probe mounting position can be determined according to the kernel interface type corresponding to different monitoring events, and a correspondence between the monitoring event type information and the probe mounting position information can be established to generate the corresponding eBPF probe configuration data. Since the eBPF runtime environment loading method and probe configuration method are both existing technologies, this embodiment does not impose specific limitations on them.

[0025] Step 2: Based on the eBPF probe configuration data, attach the corresponding eBPF dynamic probes to the system call interface, file access interface, process management interface, and network communication interface of the target enterprise terminal, and generate system call probes, file access probes, process behavior probes, and network behavior probes.

[0026] It should be noted that when mounting the corresponding eBPF dynamic probe according to the eBPF probe configuration data, the corresponding eBPF dynamic probe can be mounted to the system call interface, file access interface, process management interface, and network communication interface of the target enterprise terminal according to the probe mounting location information corresponding to the monitoring event type information, so as to realize the real-time collection of the corresponding behavioral events. Since the eBPF dynamic probe mounting method is existing technology, this embodiment does not make specific limitations on it.

[0027] Step 3: Collect system call events, file access events, process behavior events, and network communication events corresponding to the target enterprise terminal using system call probes, file access probes, process behavior probes, and network behavior probes respectively; aggregate and process the system call events, file access events, process behavior events, and network communication events according to the collection time order to generate terminal behavior event data;

[0028] Step 4: Perform field integrity verification, data format standardization, and time sequence processing on the terminal behavior event data; establish the correlation between each behavior event based on the terminal identification information and process identification information to generate standard terminal behavior data;

[0029] It should be noted that when establishing the association between various behavioral events based on terminal identification information and process identification information, behavioral events corresponding to the same enterprise terminal can be aggregated according to the terminal identification information, and system call events, file access events, process behavioral events, and network communication events corresponding to the same process can be associated and processed according to the process identification information to generate corresponding standard terminal behavioral data. Since the behavioral event association processing method is existing technology, this embodiment does not specifically limit it.

[0030] Step 5: Classify and statistically process the standard terminal behavior data according to the process identification information, and respectively count the number of system calls, file accesses, network connections, and process runtime to generate process behavior statistics.

[0031] Step 6: Match the process behavior statistics with the preset abnormal behavior rules item by item to generate single process anomaly identification results; the single process anomaly identification results include whether a single process anomaly exists or not.

[0032] It should be noted that the preset abnormal behavior rules can be established in advance according to the enterprise's terminal security monitoring needs, and are used to characterize the judgment conditions corresponding to different abnormal behaviors. When the process behavior statistics are matched with the preset abnormal behavior rules item by item, it can be determined whether each process behavior statistics meets the corresponding preset abnormal behavior rule in turn; when the corresponding preset abnormal behavior rule is met, it is determined that the corresponding process has a single-process abnormality; when the corresponding preset abnormal behavior rule is not met, it is determined that the corresponding process does not have a single-process abnormality. Since the preset abnormal behavior rules and their matching methods are both existing technologies, this embodiment does not impose specific limitations on them.

[0033] Step 7: Generate corresponding terminal abnormal behavior monitoring data for processes with single-process anomalies; extract process coordination chains for processes without single-process anomalies;

[0034] In this embodiment, it should be specifically explained that the steps for obtaining the process cooperation chain are as follows:

[0035] Processes without single-process exceptions are paired up and denoted as process association analysis data groups. Process association information data for each process in each data group is obtained. This data includes process identifier, parent process identifier, process start time, process end time, file access records, network connection records, system object access records, system call type records, file access type records, and network behavior type records. Network connection records include network target identifier, network connection start time, and network connection end time. System object access records include system object identifier, object access time, and object release time.

[0036] Based on the process identifier information, parent process identifier information, process start time, and process end time of each process in the process correlation analysis data group, the behavioral continuity coefficient of each process correlation analysis data group is calculated.

[0037] The behavioral resource inheritance coefficient of each process association analysis data group is calculated based on the file access records, network connection records, and system object access records of each process in the process association analysis data group.

[0038] The behavioral complementarity coefficient of each process association analysis data group is calculated based on the system call type record, file access type record, and network behavior type record of each process in the process association analysis data group.

[0039] The behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient are normalized to obtain normalized behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient. It should be noted that in this embodiment, vector normalization can be used for normalization of these coefficients. Specifically, the behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient are combined to form a three-dimensional vector. The norm value is obtained by calculating the square root of the sum of squares of each component of the three-dimensional vector, and each coefficient is divided by the norm value to complete the normalization process under a unified scale. Since the behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient reflect different dimensions of correlation characteristics between processes, their numerical ranges and variation amplitudes differ. Normalization can eliminate the influence of differences in the dimensions and value ranges of different coefficients on the subsequent process correlation index calculation results, improving the stability and comparability of the process correlation index calculation results. Since vector normalization is an existing technology, its specific calculation process will not be described in detail in this embodiment.

[0040] The process correlation index is calculated based on the normalized behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient. The specific steps for obtaining the index are as follows:

[0041] ;

[0042] In the formula, Represented as a process correlation index, This is represented by the normalized behavioral continuity coefficient. The behavioral continuity coefficient is directly proportional to the process association index; that is, the larger the behavioral continuity coefficient, the more continuous the behavior between the two processes, and the higher the probability of collaborative behavior between the processes, thus resulting in a larger process association index. Conversely, the smaller the behavioral continuity coefficient, the lower the degree of behavioral continuity between the two processes, and the lower the probability of collaborative behavior between the processes, thus resulting in a smaller process association index. This is represented as the normalized behavioral resource inheritance coefficient. The behavioral resource inheritance coefficient characterizes the degree of continued use of the same resource between two processes. A larger coefficient indicates a stronger resource inheritance relationship between the two processes; that is, resources such as file resources, network resources, or system objects used by the preceding process can continue to be accessed or manipulated by the following process. This indicates a higher probability of collaborative behavior between the two processes, and therefore a larger process association index. Conversely, a smaller coefficient indicates a weaker resource inheritance relationship between the two processes, a lower probability that they belong to the same collaborative behavior chain, and therefore a smaller process association index. This is represented by the normalized behavioral complementarity coefficient. The behavioral complementarity coefficient characterizes the degree of synergy between the behavioral functions of two processes. A larger coefficient indicates a stronger complementary relationship between the behaviors performed by the two processes; that is, the processes perform different execution steps in the same behavioral chain and can jointly complete the same goal task. The higher the probability that they belong to the same collaborative behavioral chain, the larger the corresponding process correlation index. Conversely, a smaller coefficient indicates a lower degree of correlation between the behavioral functions of the two processes; the lower the probability that they belong to the same collaborative behavioral chain, the smaller the corresponding process correlation index. , , This represents the weighted coefficients of the normalized continuity coefficient, the normalized behavioral resource inheritance coefficient, and the normalized behavioral complementarity coefficient. , , , The process correlation index can be obtained using the Analytic Hierarchy Process (AHP). Specifically, in this embodiment, when fusing the behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient, the AHP can be used to determine the weight values ​​corresponding to each coefficient. Specifically, a judgment matrix is ​​established based on the behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient. The weight values ​​corresponding to each coefficient are calculated using the AHP, and a consistency check is performed on the judgment matrix. After the consistency check passes, the normalized behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient are weighted and summed according to the weight values ​​corresponding to each coefficient to obtain the corresponding process correlation index. Since the AHP is existing technology, its specific calculation process will not be described in detail in this embodiment.

[0043] Process collaboration chains are generated based on the process association index of each process association analysis data group.

[0044] In this embodiment, it should be specifically explained that the steps for obtaining the behavioral continuity coefficient are as follows:

[0045] Obtain the process identifier information, parent process identifier information, process start time, and process end time of the first and second processes in the process correlation analysis data group;

[0046] Based on the process identifier information and parent process identifier information corresponding to the first process and the second process, determine whether there is a parent-child process relationship between the first process and the second process;

[0047] It should be noted that when determining the parent-child process relationship based on the process identifier information and parent process identifier information corresponding to the first and second processes, it can be determined whether the parent process identifier information of the first process is the same as the process identifier information of the second process, or whether the parent process identifier information of the second process is the same as the process identifier information of the first process. If either condition is met, it is determined that a parent-child process relationship exists between the first and second processes; otherwise, it is determined that no parent-child process relationship exists between the first and second processes. Since the method for determining the parent-child process relationship is existing technology, this embodiment does not specifically limit it.

[0048] Based on the start time and end time of the first and second processes, the time coherence value and lifecycle overlap rate are calculated.

[0049] When there is a parent-child process relationship between the first process and the second process, the parent-child connection flag value is recorded as one; when there is no parent-child process relationship between the first process and the second process, the parent-child connection flag value is recorded as zero.

[0050] When the parent-child connection flag value is one, the larger of the time connection tightness value and the life cycle overlap rate is used as the behavior connection continuity coefficient; when the parent-child connection flag value is zero and the life cycle overlap rate is greater than zero, the product between the time connection tightness value and the life cycle overlap rate is used as the behavior connection continuity coefficient; when the parent-child connection flag value is zero and the life cycle overlap rate is equal to zero, the time connection tightness value is used as the behavior connection continuity coefficient.

[0051] In this embodiment, it should be specifically explained that the steps for calculating the time coherence value and lifecycle overlap rate based on the process start time and process end time of the first process and the second process are as follows:

[0052] Based on the order in which processes are started, processes that start earlier are designated as preceding processes, and processes that start later are designated as subsequent processes.

[0053] Calculate the time interval between the start time of the subsequent process and the start time of the preceding process to obtain the process start time interval; calculate the time interval between the end time of the subsequent process and the end time of the preceding process to obtain the process end time interval.

[0054] The smaller of the process start time interval and the process end time interval is used as the nearest neighbor connection interval, and the larger of the process start time interval and the process end time interval is used as the span connection interval. When the span connection interval is zero, the time connection tightness value is recorded as one. When the span connection interval is not zero, the ratio between the nearest neighbor connection interval and the span connection interval is calculated to obtain the time connection tightness value.

[0055] The lifecycle overlap start time is determined based on the later of the process start time of the preceding process and the process start time of the following process; the lifecycle overlap end time is determined based on the earlier of the process end time of the preceding process and the process end time of the following process.

[0056] When the end time of the lifecycle overlap is later than the start time of the lifecycle overlap, the time difference between the end time and the start time of the lifecycle overlap is calculated to obtain the lifecycle overlap duration; when the end time of the lifecycle overlap is not later than the start time of the lifecycle overlap, the lifecycle overlap duration is recorded as zero.

[0057] Calculate the time difference between the termination time and the start time of the preceding process to obtain the lifecycle duration of the preceding process; calculate the time difference between the termination time and the start time of the following process to obtain the lifecycle duration of the following process.

[0058] The smaller of the lifetime duration of the preceding process and the lifetime duration of the following process is used as the reference lifetime duration. When the reference lifetime duration is zero, the lifetime overlap rate is recorded as zero. When the reference lifetime duration is not zero, the ratio between the lifetime overlap duration and the reference lifetime duration is calculated to obtain the lifetime overlap rate.

[0059] In this embodiment, it should be specifically explained that the steps for obtaining the behavioral resource inheritance coefficient are as follows:

[0060] Based on the file access records, network connection records, and system object access records corresponding to the preceding and subsequent processes, resource flow analysis results are generated, including file resource continuity rate, network resource continuity rate, and system object continuity rate.

[0061] The maximum value among file resource sustainability rate, network resource sustainability rate, and system object sustainability rate is taken as the main resource sustainability rate.

[0062] The number of file resource continuity rate, network resource continuity rate, and system object continuity rate values ​​that are greater than zero is used to obtain the number of continuity resource types.

[0063] When the main resource continuation rate is zero, the behavior resource inheritance coefficient is recorded as zero; when the main resource continuation rate is not zero and the number of continuation resource types is one, the square of the main resource continuation rate is calculated to obtain the behavior resource inheritance coefficient; when the main resource continuation rate is not zero and the number of continuation resource types is greater than one, the main resource continuation rate is used as the behavior resource inheritance coefficient.

[0064] In this embodiment, it should be specifically explained that the steps for obtaining the resource flow analysis results are as follows:

[0065] Extract the set of preceding file resource identifiers from the file access records of the preceding process, and extract the set of subsequent file resource identifiers from the file access records of the subsequent process; count the number of file resource identifiers in the subsequent file resource identifier set that also exist in the set of preceding file resource identifiers to obtain the number of file resource inheritances;

[0066] The total number of file resource identifiers in the subsequent file resource identifier set is counted; when the total number of file resource identifiers is zero, the file resource continuation rate is recorded as zero; when the total number of file resource identifiers is not zero, the ratio between the number of inherited file resources and the total number of file resource identifiers is calculated to obtain the file resource continuation rate.

[0067] Extract the preceding network target identifier and the preceding network connection end time from the network connection record of the preceding process, and extract the subsequent network target identifier and the subsequent network connection start time from the network connection record of the subsequent process; count the number of network target identifiers that are the same as the preceding network target identifier, whose subsequent network connection start time is later than or equal to the preceding network connection end time, and are within the preset connection migration time range, to obtain the number of network connection migrations.

[0068] It should be noted that the preset connection migration time range can be determined using an adaptive threshold method based on the network connection migration time intervals between historical normal processes. Since the adaptive threshold method is existing technology, this embodiment does not impose specific limitations on it.

[0069] The total number of subsequent network target identifiers in the network connection records of subsequent processes is counted; when the total number of subsequent network target identifiers is zero, the network resource sustainability rate is recorded as zero; when the total number of subsequent network target identifiers is not zero, the ratio between the number of network connection migrations and the total number of subsequent network target identifiers is calculated to obtain the network resource sustainability rate.

[0070] Extract the identifier and release time of the preceding system object from the system object access record of the preceding process, and extract the identifier and access time of the subsequent system object from the system object access record of the subsequent process. Count the number of system object identifiers whose subsequent system object identifier is the same as the preceding system object identifier and whose subsequent object access time is earlier than or equal to the preceding object release time to obtain the number of continuously accessed objects.

[0071] The system object access record of subsequent processes is counted to determine the total number of subsequent system object identifiers. When the total number of subsequent system object identifiers is zero, the system object continuity rate is recorded as zero. When the total number of subsequent system object identifiers is not zero, the ratio between the number of continuously accessed objects and the total number of subsequent system object identifiers is calculated to obtain the system object continuity rate.

[0072] The file resource continuity rate, network resource continuity rate, and system object continuity rate are organized according to their corresponding relationships to generate resource flow analysis results.

[0073] In this embodiment, it should be specifically explained that the steps for obtaining the behavioral complementarity coefficient are as follows:

[0074] Merge the system call type records, file access type records, and network behavior type records corresponding to the preceding process to obtain the preceding behavior type set; merge the system call type records, file access type records, and network behavior type records corresponding to the following process to obtain the following behavior type set.

[0075] According to the preset behavior complementarity table, each preceding behavior type in the preceding behavior type set is matched with each subsequent behavior type in the subsequent behavior type set, and the number of behavior type pairs that satisfy the behavior complementarity relationship is counted to obtain the number of complementary behavior type pairs.

[0076] The total number of behavior type pairs between the preceding behavior type set and the following behavior type set is counted. When the total number of behavior type pairs is zero, the type complementarity matching rate is recorded as zero. When the total number of behavior type pairs is not zero, the ratio between the number of complementary behavior type pairs and the total number of behavior type pairs is calculated to obtain the type complementarity matching rate.

[0077] According to the preset behavior stage mapping relationship, determine the preceding behavior stage number and the subsequent behavior stage number of each complementary behavior type pair; count the number of complementary behavior type pairs where the subsequent behavior stage number is greater than the preceding behavior stage number to obtain the number of progressive complementary type pairs.

[0078] When the number of complementary behavior type pairs is zero, the stage-progressive efficiency is recorded as zero; when the number of complementary behavior type pairs is not zero, the ratio between the number of progressive complementary type pairs and the number of complementary behavior type pairs is calculated to obtain the stage-progressive efficiency.

[0079] The behavioral complementarity coefficient is obtained by multiplying the type complementarity matching rate with the stage progression efficiency.

[0080] It should be noted that the preset behavior complementarity table is used to characterize the functional connection relationship between different system call types, file access types and network behavior types, and the preset behavior stage mapping relationship is used to characterize the correspondence between each behavior type and the corresponding behavior execution stage. Both can be implemented by pre-established rule mapping methods, which are existing technologies, and this embodiment does not make specific limitations on them.

[0081] For example, process creation type and file reading type can form a complementary relationship, file writing type and network sending type can form a complementary relationship, and privilege escalation type and remote communication type can form a complementary relationship. This embodiment does not limit this. The above complementary relationships are only examples. In different business scenarios, corresponding complementary relationships can be established according to the actual behavior types. This embodiment does not limit this.

[0082] In this embodiment, it should be specifically explained that the step of generating a process collaboration chain based on the process association index of each process association analysis data group is as follows:

[0083] The process correlation index is compared with a preset process correlation threshold. If the process correlation index is greater than or equal to the preset process correlation threshold, it is determined that there is a correlation between the process correlation analysis data groups; if the process correlation index is less than the preset process correlation threshold, it is determined that there is no correlation between the process correlation analysis data groups.

[0084] It should be noted that the preset process association threshold is used to determine whether two processes have reached a degree of association that allows them to be merged into the same process collaboration chain. The preset process association threshold can be predetermined using an adaptive thresholding method based on the distribution of normal process association indices and abnormal collaborative process association indices in historical terminal behavior samples. Since the adaptive thresholding method is existing technology, its specific calculation process will not be described in detail in this embodiment.

[0085] The correlation analysis data groups of processes with related relationships are merged, and the correlation analysis data of multiple processes with common processes are combined into the same process set to generate several process sets;

[0086] It should be specifically noted that, in this embodiment, the merging process refers to establishing corresponding association relationships based on the common processes among different process association analysis data groups, and combining multiple process association analysis data groups with common processes into the same process set. The merging process can be implemented using existing technologies commonly used in the field, such as graph traversal, connected component search, or disjoint set union, and this embodiment does not specifically limit it in this regard.

[0087] The processes are sorted according to their startup time in each process set to generate corresponding process collaboration chains.

[0088] It should be noted that in this embodiment, the sorting is performed according to the start time order of each process in each process set in order to reflect the actual sequential execution relationship between multiple processes. The specific sorting method can be implemented using sorting algorithms commonly used in the field, such as quicksort, mergesort, and heapsort. This embodiment does not make specific limitations on this.

[0089] Step 8: Perform anomaly identification processing on each process collaboration chain and generate process collaboration chain anomaly identification results;

[0090] In this embodiment, it is necessary to specifically explain the steps for performing anomaly identification processing on each process collaboration chain and generating process collaboration chain anomaly identification results:

[0091] Based on the process startup time order of each process in the process coordination chain, the system call type record, file access type record and network behavior type record corresponding to each process are sequentially concatenated to generate the corresponding coordination behavior sequence.

[0092] Based on the cooperative behavior sequence, the number of system call types, file access types, network behavior types, and the number of adjacent behavior switching corresponding to each process's cooperative chain are counted to generate cooperative behavior statistics.

[0093] Based on the collaborative behavior sequence, identify the behavioral connection relationship between adjacent behavior types, count the number of behavioral connections that meet the preset behavioral connection rules, and generate behavioral connection statistics.

[0094] Based on the statistical data of collaborative behavior and the statistical data of behavior connection, a matching process is performed item by item with the preset collaborative behavior anomaly rules; when the statistical data of collaborative behavior and the statistical data of behavior connection meet the preset collaborative behavior anomaly rules, it is determined that the corresponding process collaborative chain has collaborative behavior anomalies; when the statistical data of collaborative behavior and the statistical data of behavior connection do not meet the preset collaborative behavior anomaly rules, it is determined that the corresponding process collaborative chain does not have collaborative behavior anomalies.

[0095] It should be noted that the preset collaborative behavior anomaly rules are used to determine whether abnormal collaborative behavior exists among multiple processes in the same process collaborative chain. These preset collaborative behavior anomaly rules can be pre-established based on historical collaborative behavior samples. The rules include anomaly judgment conditions corresponding to collaborative behavior statistics and anomaly judgment conditions corresponding to behavior connection statistics, and a rule mapping method is used to match the collaborative behavior statistics and behavior connection statistics. Since the rule mapping method is existing technology, this embodiment does not specifically limit it.

[0096] Based on the abnormal judgment results of the collaborative behavior corresponding to each process collaboration chain, an abnormal identification result of the process collaboration chain is generated.

[0097] Step 9: Generate terminal abnormal behavior supervision results based on terminal abnormal behavior supervision data and process collaboration chain abnormal identification results, and output the terminal abnormal behavior supervision results. The terminal abnormal behavior supervision data is used to reflect single-process abnormal behavior, and the process collaboration chain abnormal identification results are used to reflect cross-process collaboration behavior. The two are combined to form the terminal abnormal behavior supervision results, so as to achieve complete supervision of enterprise terminal abnormal behavior.

[0098] It should be specifically noted that, in this embodiment, when generating the terminal abnormal behavior supervision result based on the terminal abnormal behavior supervision data and the process collaboration chain abnormal identification result, a result fusion method commonly used in the art can be employed. Specifically, the terminal abnormal behavior supervision data and the process collaboration chain abnormal identification result are merged, and the corresponding terminal abnormal behavior supervision result is generated according to a preset output format. When the same terminal corresponds to multiple abnormal behavior supervision results, duplicate abnormal records can be merged to avoid duplicate output. Since the result fusion processing method is existing technology, this embodiment does not specifically limit it.

[0099] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0100] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for monitoring abnormal behavior of enterprise terminals based on eBPF dynamic probes, characterized in that, Includes the following steps: Step 1: Obtain the terminal identification information, operating system information, kernel version information, process information, and network connection information corresponding to the target enterprise terminal; load the corresponding eBPF runtime environment according to the kernel version information, and generate the eBPF probe configuration data corresponding to the target enterprise terminal; Step 2: Based on the eBPF probe configuration data, attach the corresponding eBPF dynamic probes to the system call interface, file access interface, process management interface, and network communication interface of the target enterprise terminal, and generate system call probes, file access probes, process behavior probes, and network behavior probes. Step 3: Collect system call events, file access events, process behavior events, and network communication events corresponding to the target enterprise terminal using system call probes, file access probes, process behavior probes, and network behavior probes, respectively. System call events, file access events, process behavior events, and network communication events are aggregated and processed according to the collection time sequence to generate terminal behavior event data. Step 4: Perform field integrity verification, data format standardization, and time sequence sorting on the terminal behavior event data; Establish the correlation between various behavioral events based on terminal identification information and process identification information, and generate standard terminal behavior data; Step 5: Classify and statistically process the standard terminal behavior data according to the process identification information, and respectively count the number of system calls, file accesses, network connections, and process runtime to generate process behavior statistics. Step 6: Match the process behavior statistics with the preset abnormal behavior rules item by item to generate single-process abnormal identification results; The single-process anomaly identification results include whether a single-process anomaly exists or not. Step 7: Generate corresponding terminal abnormal behavior monitoring data for processes with single-process anomalies; extract process coordination chains for processes without single-process anomalies; Step 8: Perform anomaly identification processing on each process collaboration chain and generate process collaboration chain anomaly identification results; Step 9: Generate terminal abnormal behavior monitoring results based on terminal abnormal behavior monitoring data and process coordination chain abnormal identification results, and output the terminal abnormal behavior monitoring results; The steps for obtaining the process cooperation chain are as follows: Processes without single-process exceptions are paired up and denoted as process association analysis data groups. Process association information data for each process in each data group is obtained. This data includes process identifier, parent process identifier, process start time, process end time, file access records, network connection records, system object access records, system call type records, file access type records, and network behavior type records. Network connection records include network target identifier, network connection start time, and network connection end time. System object access records include system object identifier, object access time, and object release time. Based on the process identifier information, parent process identifier information, process start time, and process end time of each process in the process correlation analysis data group, the behavioral continuity coefficient of each process correlation analysis data group is calculated. The behavioral resource inheritance coefficient of each process association analysis data group is calculated based on the file access records, network connection records, and system object access records of each process in the process association analysis data group. The behavioral complementarity coefficient of each process association analysis data group is calculated based on the system call type record, file access type record, and network behavior type record of each process in the process association analysis data group. The behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient are normalized to obtain the normalized behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient. The process correlation index is calculated based on the normalized behavioral continuity coefficient, behavioral resource inheritance coefficient, and behavioral complementarity coefficient. Generate process collaboration chains based on the process association indices of each process association analysis data group; The step of generating a process collaboration chain based on the process association index of each process association analysis data group is as follows: The process correlation index is compared with a preset process correlation threshold. If the process correlation index is greater than or equal to the preset process correlation threshold, it is determined that there is a correlation between the process correlation analysis data groups; if the process correlation index is less than the preset process correlation threshold, it is determined that there is no correlation between the process correlation analysis data groups. The correlation analysis data groups of processes with related relationships are merged, and the correlation analysis data of multiple processes with common processes are combined into the same process set to generate several process sets; The processes in each process set are sorted according to their startup time order to generate corresponding process collaboration chains. The steps for performing anomaly identification processing on each process collaboration chain and generating process collaboration chain anomaly identification results are as follows: Based on the process startup time order of each process in the process coordination chain, the system call type record, file access type record and network behavior type record corresponding to each process are sequentially concatenated to generate the corresponding coordination behavior sequence. Based on the cooperative behavior sequence, the number of system call types, file access types, network behavior types, and the number of adjacent behavior switching corresponding to each process's cooperative chain are counted to generate cooperative behavior statistics. Based on the collaborative behavior sequence, identify the behavioral connection relationship between adjacent behavior types, count the number of behavioral connections that meet the preset behavioral connection rules, and generate behavioral connection statistics. Based on the statistical data of collaborative behavior and the statistical data of behavior connection, each item is matched and processed against the preset collaborative behavior anomaly rules; When the statistical data of collaborative behavior and the statistical data of behavior connection meet the preset collaborative behavior anomaly rules, it is determined that there is a collaborative behavior anomaly in the corresponding process collaborative chain; When the statistical data of collaborative behavior and the statistical data of behavior connection do not meet the preset collaborative behavior anomaly rules, it is determined that there is no collaborative behavior anomaly in the corresponding process collaborative chain; Based on the abnormal judgment results of the collaborative behavior corresponding to each process collaboration chain, an abnormal identification result of the process collaboration chain is generated.

2. The method for monitoring abnormal behavior of enterprise terminals based on eBPF dynamic probes according to claim 1, characterized in that, The steps for obtaining the continuity coefficient of the behavior connection are as follows: Obtain the process identifier information, parent process identifier information, process start time, and process end time of the first and second processes in the process correlation analysis data group; Based on the process identifier information and parent process identifier information corresponding to the first process and the second process, determine whether there is a parent-child process relationship between the first process and the second process; Based on the start time and end time of the first and second processes, the time coherence value and lifecycle overlap rate are calculated. When there is a parent-child process relationship between the first process and the second process, the parent-child connection flag value is recorded as one; when there is no parent-child process relationship between the first process and the second process, the parent-child connection flag value is recorded as zero. When the parent-child connection flag value is one, the larger of the time connection tightness value and the life cycle overlap rate is used as the behavior connection continuity coefficient; when the parent-child connection flag value is zero and the life cycle overlap rate is greater than zero, the product between the time connection tightness value and the life cycle overlap rate is used as the behavior connection continuity coefficient; when the parent-child connection flag value is zero and the life cycle overlap rate is equal to zero, the time connection tightness value is used as the behavior connection continuity coefficient. The steps for calculating the time coherence value and lifecycle overlap rate based on the process start time and process end time of the first process and the second process are as follows: Based on the order in which processes are started, processes that start earlier are designated as preceding processes, and processes that start later are designated as subsequent processes. Calculate the time interval between the start time of the subsequent process and the start time of the preceding process to obtain the process start time interval; calculate the time interval between the end time of the subsequent process and the end time of the preceding process to obtain the process end time interval. The smaller of the process start time interval and the process end time interval is used as the nearest neighbor connection interval, and the larger of the process start time interval and the process end time interval is used as the span connection interval. When the span connection interval is zero, the time connection tightness value is recorded as one. When the span connection interval is not zero, the ratio between the nearest neighbor connection interval and the span connection interval is calculated to obtain the time connection tightness value. The lifecycle overlap start time is determined based on the later of the process start time of the preceding process and the process start time of the following process; the lifecycle overlap end time is determined based on the earlier of the process end time of the preceding process and the process end time of the following process. When the end time of the lifecycle overlap is later than the start time of the lifecycle overlap, the time difference between the end time and the start time of the lifecycle overlap is calculated to obtain the lifecycle overlap duration; when the end time of the lifecycle overlap is not later than the start time of the lifecycle overlap, the lifecycle overlap duration is recorded as zero. Calculate the time difference between the termination time and the start time of the preceding process to obtain the lifecycle duration of the preceding process; calculate the time difference between the termination time and the start time of the following process to obtain the lifecycle duration of the following process. The smaller of the lifecycle duration of the preceding process and the lifecycle duration of the following process is used as the reference lifecycle duration. When the reference lifetime duration is zero, the lifetime overlap rate is recorded as zero; when the reference lifetime duration is not zero, the ratio between the lifetime overlap duration and the reference lifetime duration is calculated to obtain the lifetime overlap rate.

3. The method for monitoring abnormal behavior of enterprise terminals based on eBPF dynamic probes according to claim 1, characterized in that: The steps for obtaining the behavioral resource inheritance coefficient are as follows: Based on the file access records, network connection records, and system object access records corresponding to the preceding and subsequent processes, resource flow analysis results are generated, including file resource continuity rate, network resource continuity rate, and system object continuity rate. The maximum value among file resource continuity rate, network resource continuity rate and system object continuity rate is taken as the main resource continuity rate. The number of file resource continuity rate, network resource continuity rate, and system object continuity rate values ​​that are greater than zero is used to obtain the number of continuity resource types. When the main resource continuation rate is zero, the behavior resource inheritance coefficient is recorded as zero; when the main resource continuation rate is not zero and the number of continuation resource types is one, the square of the main resource continuation rate is calculated to obtain the behavior resource inheritance coefficient; when the main resource continuation rate is not zero and the number of continuation resource types is greater than one, the main resource continuation rate is used as the behavior resource inheritance coefficient. The steps for obtaining the resource flow analysis results are as follows: Extract the set of preceding file resource identifiers from the file access records of the preceding process, and extract the set of subsequent file resource identifiers from the file access records of the subsequent process; count the number of file resource identifiers in the subsequent file resource identifier set that also exist in the set of preceding file resource identifiers to obtain the number of file resource inheritances; Count the total number of file resource identifiers in the subsequent file resource identifier set; when the total number of file resource identifiers is zero, record the file resource continuity rate as zero; When the total number of file resource identifiers is not zero, calculate the ratio of the number of inherited file resources to the total number of file resource identifiers to obtain the file resource continuity rate; Extract the preceding network target identifier and the preceding network connection end time from the network connection record of the preceding process; extract the subsequent network target identifier and the subsequent network connection start time from the network connection record of the subsequent process. The number of network connection migrations is obtained by counting the number of network target identifiers that are the same as the target identifier of the preceding network, the start time of the subsequent network connection is later than or equal to the end time of the preceding network connection, and are within the preset connection migration time range. Count the total number of subsequent network target identifiers in the network connection records of subsequent processes; When the total number of subsequent network target identifiers is zero, the network resource continuity rate is recorded as zero; when the total number of subsequent network target identifiers is not zero, the ratio between the number of network connection migrations and the total number of subsequent network target identifiers is calculated to obtain the network resource continuity rate. Extract the identifier and release time of the preceding system object from the system object access record of the preceding process, and extract the identifier and access time of the following system object from the system object access record of the following process. The number of continuously accessed objects is obtained by counting the number of system object identifiers that are the same as the previous system object identifiers and whose access time is earlier than or equal to the release time of the previous object. Count the total number of subsequent system object identifiers in the system object access records of subsequent processes; when the total number of subsequent system object identifiers is zero, record the system object continuation rate as zero; When the total number of subsequent system object identifiers is not zero, calculate the ratio between the number of continuously accessed objects and the total number of subsequent system object identifiers to obtain the system object continuity rate; The file resource continuity rate, network resource continuity rate, and system object continuity rate are organized according to their corresponding relationships to generate resource flow analysis results.

4. The method for monitoring abnormal behavior of enterprise terminals based on eBPF dynamic probes according to claim 1, characterized in that: The steps for obtaining the behavioral complementarity coefficient are as follows: Merge the system call type records, file access type records, and network behavior type records corresponding to the preceding process to obtain the preceding behavior type set; merge the system call type records, file access type records, and network behavior type records corresponding to the following process to obtain the following behavior type set. According to the preset behavior complementarity table, each preceding behavior type in the preceding behavior type set is matched with each subsequent behavior type in the subsequent behavior type set, and the number of behavior type pairs that satisfy the behavior complementarity relationship is counted to obtain the number of complementary behavior type pairs. The total number of behavior type pairs between the preceding behavior type set and the following behavior type set is counted. When the total number of behavior type pairs is zero, the type complementarity matching rate is recorded as zero. When the total number of behavior type pairs is not zero, the ratio between the number of complementary behavior type pairs and the total number of behavior type pairs is calculated to obtain the type complementarity matching rate. According to the preset behavior stage mapping relationship, determine the preceding behavior stage number and the subsequent behavior stage number of each complementary behavior type pair; count the number of complementary behavior type pairs where the subsequent behavior stage number is greater than the preceding behavior stage number to obtain the number of progressive complementary type pairs. When the number of complementary behavior type pairs is zero, the stage-progressive efficiency is recorded as zero; when the number of complementary behavior type pairs is not zero, the ratio between the number of progressive complementary type pairs and the number of complementary behavior type pairs is calculated to obtain the stage-progressive efficiency. The behavioral complementarity coefficient is obtained by multiplying the type complementarity matching rate with the stage progression efficiency.

Images