A host abnormal behavior detection method and device based on hierarchical baseline analysis, equipment and storage medium

Abstract

The application provides a host abnormal behavior detection method and device based on layered baseline analysis, equipment and storage medium, belonging to the technical field of computer data processing. By obtaining EDR data on the host side and splitting it into static data and dynamic behavior data, combining network side traffic data to convert it into asset snapshots, behavior events and access events, and then building asset historical baseline, behavior historical baseline and access historical baseline, respectively, and weighting and fusing the risk scores calculated in each layer to output the target risk level, the determination mode relying on a single rule or a global unified baseline in the traditional detection scheme is changed, multi-dimensional abnormal evidence is comprehensively analyzed and judged, asset portrait abnormality, host action abnormality and network interaction abnormality can be more accurately distinguished and located, the identification accuracy of unknown over-the-line behavior is improved, and false positives caused by misjudgment of a single data source or dimension are reduced.

Description

Technical Field

[0001] This invention relates to the field of computer data processing technology, and in particular to a method, apparatus, device, and storage medium for detecting abnormal host behavior based on hierarchical baseline analysis. Background Technology

[0002] As industrial control networks, such as power monitoring systems, increasingly demand continuous monitoring and anomaly detection capabilities, security detection of hosts and networks has become paramount. Current network security detection devices typically acquire host-side EDR data, command interaction data, standard logs, and network-side traffic data to construct asset models, connection models, and behavioral models. In practical anomaly detection, existing mainstream technologies primarily rely on static rule bases, fixed thresholds, or manually configured whitelists for protection. Examples include setting fixed port alarm rules, blocking rules for specific time periods, or manually maintaining lists of allowed network access relationships. Furthermore, some existing technologies build a globally unified baseline based on a single behavioral event stream for anomaly detection and judgment.

[0003] However, the aforementioned existing technologies have shortcomings when dealing with real-world environments characterized by diverse on-site assets, complex behaviors, and gradually changing business operations. First, solutions based on static rules or fixed thresholds have coarse-grained rules, failing to reflect the historical operational characteristics of each device. They lack the ability to identify newly emerging access relationships, abnormal time-based activities, and changes in frequency or traffic. Furthermore, fixed thresholds are prone to false alarms during business changes. Second, solutions based on manually configured whitelists have high maintenance costs, rely on human experience, and cannot promptly synchronize normal configuration changes on-site. If new behaviors are directly allowed to reduce false alarms, abnormal behaviors can be mislearned as normal behaviors, leading to historical baseline contamination. Finally, solutions based on building a unified baseline from a single event stream fail to distinguish the data hierarchy and analytical value between static configuration attributes, dynamic operational behaviors, and network interaction traffic. They lack the ability to comprehensively assess multi-dimensional anomaly evidence, making it difficult to fully characterize asset status deviations, local action deviations, and network communication deviations. This also results in weak interpretability of the final detection results and an inability to accurately pinpoint the source of anomaly risks. Summary of the Invention

[0004] This invention provides a host abnormal behavior detection method, apparatus, device, and storage medium based on hierarchical baseline analysis to address the problem of lacking comprehensive judgment capabilities on multi-dimensional abnormal evidence, which not only makes it difficult to fully characterize asset status deviations, local action deviations, and network communication deviations, but also leads to weak interpretability of the final detection results.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: Firstly, a host abnormal behavior detection method based on hierarchical baseline analysis is provided, which is applied to a host abnormal behavior detection system, including the following steps: Acquire host-side EDR data and network-side traffic data, and split the host-side EDR data into static data and dynamic behavior data; The static data, dynamic behavior data, and network-side traffic data are uniformly converted into asset snapshots, behavior events, and access events. An asset history baseline is constructed based on the historical asset snapshots, a behavioral history baseline is constructed based on the historical behavioral events, and an access history baseline is constructed based on the historical access events. The asset risk score is calculated by comparing the deviation of the current asset snapshot with the asset historical baseline, the behavior risk score is calculated by comparing the deviation of the current behavior event with the behavior historical baseline, and the access risk score is calculated by comparing the deviation of the current access event with the access historical baseline. A weighting coefficient is introduced to balance the impact of risks at each level. The asset risk score, the behavioral risk score, and the access risk score are weighted and fused to calculate the total risk score. The total risk score is matched with the boundary thresholds used to classify risk levels to output the corresponding target risk level; the target risk level includes normal, low risk deviation, suspicious cross-line, and high risk cross-line; Based on the target risk level, classification update control is performed on the asset historical baseline, the behavior historical baseline, and the access historical baseline.

[0006] Optionally, the step of comparing the current asset snapshot with the asset historical baseline to calculate the asset risk score includes: extracting hardware, software and network attributes from the current asset snapshot, and calculating the proportion of the number of differences between the current asset snapshot and the corresponding attributes in the asset historical baseline to the total number of items checked, to obtain the hardware deviation score, software deviation score and network attribute deviation score.

[0007] Optionally, the step of comparing the current asset snapshot with the historical baseline of the asset to calculate the asset risk score further includes: Extract the numerical features of the operating status from the current asset snapshot, calculate the degree to which the numerical features of the operating status deviate from the corresponding historical mean and historical standard deviation in the historical baseline of the asset, and combine them with a first threshold coefficient used to limit the sensitivity to change to obtain the operating status deviation score; wherein, the historical standard deviation is corrected by a constant used to smooth fluctuations so that the denominator is non-zero and to avoid the amplification of disturbances; The asset risk score is calculated by weighting and summing the hardware deviation score, the software deviation score, the network attribute deviation score, and the operating status deviation score, and then multiplying the sum by a first credibility coefficient that reflects the integrity of the host asset data.

[0008] Optionally, the step of comparing the current behavioral event with the historical baseline of the behavior to calculate the behavioral risk score includes: Using the behavior key, which includes the subject, action type, and object, as the primary key, retrieve whether the current behavior key exists in the behavior history baseline, and calculate the new behavior anomaly score; Based on the time bucket where the current behavioral event occurred, the historical occurrence probability of the behavioral key in the corresponding time bucket is matched with the historical baseline of the behavioral event, and the time anomaly score is calculated.

[0009] Optionally, the step of comparing the current behavioral event with the historical baseline of the behavior to calculate the behavioral risk score further includes: The frequency of occurrence of the behavioral event within the current statistical window is counted, the degree to which the frequency of occurrence deviates from the historical mean and historical standard deviation of the historical baseline of the behavior is calculated, and the frequency anomaly score is obtained by combining the second threshold coefficient used to control the sensitivity of frequency changes. Calculate the proportion by which the context attribute of the current behavioral event deviates from the historical common context attribute to obtain the context anomaly score; The new behavior anomaly score, the time anomaly score, the frequency anomaly score, and the context anomaly score are weighted and summed, and then multiplied by the second behavior layer data credibility coefficient to calculate the behavior risk score.

[0010] Optionally, the step of comparing the current access event with the access history baseline to calculate the access risk score includes: Using the access key containing subject, object, protocol and port as the primary key, retrieve whether the current access key exists in the access history baseline, and calculate the new relationship access deviation score; If the access key existed historically but a new protocol or port was used, then a protocol / port anomaly score is calculated.

[0011] Optionally, the step of comparing the current access event with the access history baseline to calculate the access risk score further includes: Based on the time of the current access event, calculate the historical probability deviation of its falling into the corresponding time bucket to obtain the access time anomaly score; Calculate the number of accesses, single communication traffic, and single communication duration corresponding to the access key in the current statistics window, and the degree of deviation from the corresponding historical mean and historical standard deviation in the access history baseline. Combine the corresponding access frequency deviation threshold coefficient, traffic deviation threshold coefficient, and duration deviation threshold coefficient to obtain access frequency abnormality score, traffic abnormality score, and duration abnormality score. The access risk score is calculated by weighting and summing the new relationship access deviation score, the protocol port abnormal score, the access time abnormal score, the access frequency abnormal score, the traffic abnormal score, and the duration abnormal score, and then multiplying the sum by the traffic layer data credibility coefficient.

[0012] Secondly, a host abnormal behavior detection device based on hierarchical baseline analysis is provided, including: The data acquisition module is used to collect host-side EDR data and network-side traffic data, and to split the host-side EDR data into static data and dynamic behavior data. The standardization and model mapping module is used to uniformly convert the static data, the dynamic behavior data, and the network-side traffic data into asset snapshots, behavior events, and access events. The baseline analysis layer is used to construct an asset history baseline based on the historical asset snapshots, a behavior history baseline based on the historical behavior events, and an access history baseline based on the historical access events. The hierarchical scoring module is used to calculate an asset risk score by comparing the deviation of the current asset snapshot with the asset historical baseline, to calculate a behavior risk score by comparing the deviation of the current behavior event with the behavior historical baseline, and to calculate an access risk score by comparing the deviation of the current access event with the access historical baseline. The comprehensive risk fusion module is used to introduce weighting coefficients to balance the impact of risks at each level, and to weight and fuse the asset risk score, the behavioral risk score, and the access risk score to calculate the total risk score. The risk assessment module is used to perform interval matching between the total risk score and the boundary threshold used to classify risk levels, and output the corresponding target risk level; The learning control module is used to perform classification update control on the asset historical baseline, the behavioral historical baseline, and the access historical baseline according to the target risk level. Thirdly, an electronic device is provided, comprising: a processor and a memory; the memory is used to store a computer program, which, when executed by the processor, causes the electronic device to perform the host abnormal behavior detection method based on hierarchical baseline analysis described in the first aspect.

[0013] In one possible design, the electronic device described in the third aspect may further include a transceiver. This transceiver may be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the electronic device described in the third aspect and other electronic devices.

[0014] In the embodiments of the present invention, the electronic device described in the third aspect may be a terminal, or a chip (system) or other component or assembly disposed in the terminal, or a system containing the terminal.

[0015] Fourthly, a computer-readable storage medium is provided, comprising: a computer program or instructions; when the computer program or instructions are executed on a computer, the computer causes the computer to perform the host abnormal behavior detection method based on hierarchical baseline analysis described in the first aspect.

[0016] In summary, the above methods and systems have the following technical effects: 1. In this invention, host-side EDR data is acquired and split into static data and dynamic behavior data. Combined with network-side traffic data, it is uniformly converted into asset snapshots, behavior events, and access events. Then, asset historical baselines, behavior historical baselines, and access historical baselines are constructed respectively. The risk scores calculated at each layer are weighted and fused to output the target risk level. This changes the judgment mode of traditional detection schemes that rely on a single rule or a globally unified baseline. It realizes the comprehensive judgment of multi-dimensional abnormal evidence, which can more accurately distinguish and locate abnormal asset profiles, abnormal host actions, and abnormal network interactions, improve the accuracy of identifying unknown overstepping behaviors, and reduce false alarms caused by misjudgment due to a single data source or dimension. 2. In this invention, by calculating the proportion difference of static configuration attributes in the current asset snapshot when calculating asset risk, and extracting the deviation of values ​​from the dynamic operating status, and performing multi-dimensional fusion calculation by correcting the historical standard deviation with a constant used to smooth fluctuations, it is possible to accurately depict the static steady state of the host while dynamically filtering false deviations caused by short-term local resource fluctuations, thereby improving the accuracy of identifying abnormal asset status and reducing false alarms caused by occasional resource spikes. 3. In this invention, when calculating the behavioral risk score, the behavioral key, which includes the subject, action type, and object, is used as the primary key. The novelty of the behavior itself, the regularity of its occurrence time, the change in execution frequency, and the contextual attributes are associated and a deviation comparison score is calculated. This enables the simultaneous auditing of single isolated operation behaviors and multi-dimensional temporal features, thereby improving the sensitivity of capturing unknown control behaviors and suppressing false alarms caused by a single frequency exceeding the standard. Attached Figure Description

[0017] Figure 1 This is a flowchart provided for an embodiment of the present invention; Figure 2This is a schematic diagram of a scenario provided for an embodiment of the present invention; Figure 3 The algorithm principle diagram provided for the embodiments of the present invention; Figure 4 This is a schematic diagram for the judgment provided in an embodiment of the present invention. Detailed Implementation

[0018] The following will be combined with the appendix Figures 1-4 The technical solutions in this invention will be described below.

[0019] In this embodiment of the invention, descriptions such as "when," "under the circumstances," "if," and "if" all refer to the device making corresponding processing under certain objective circumstances, and are not limited to a specific time. They do not require the device to make a judgment action during implementation, nor do they imply any other limitations.

[0020] In the description of the embodiments of the present invention, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can represent A or B. "And / or" in the embodiments of the present invention is merely a description of the relationship between the related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone, where A and B can be singular or plural. Furthermore, in the description of the embodiments of the present invention, unless otherwise stated, "multiple" refers to two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple. Additionally, to facilitate a clear description of the technical solutions of the embodiments of the present invention, the terms "first" and "second" are used in the embodiments of the present invention to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or order of execution, and that "first," "second," etc., are not necessarily different. Furthermore, in the embodiments of this invention, words such as "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or description. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this invention should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner for ease of understanding.

[0021] Figure 1This is a flowchart illustrating the method provided in an embodiment of the present invention. A host abnormal behavior detection method based on hierarchical baseline analysis, applied to a host abnormal behavior detection system, includes the following steps: Acquire host-side EDR data and network-side traffic data, and split the host-side EDR data into static data and dynamic behavior data; The static data, dynamic behavior data, and network-side traffic data are uniformly converted into asset snapshots, behavior events, and access events. An asset history baseline is constructed based on the historical asset snapshots, a behavioral history baseline is constructed based on the historical behavioral events, and an access history baseline is constructed based on the historical access events. The asset risk score is calculated by comparing the deviation of the current asset snapshot with the asset historical baseline, the behavior risk score is calculated by comparing the deviation of the current behavior event with the behavior historical baseline, and the access risk score is calculated by comparing the deviation of the current access event with the access historical baseline. A weighting coefficient is introduced to balance the impact of risks at each level. The asset risk score, the behavioral risk score, and the access risk score are weighted and fused to calculate the total risk score. The total risk score is matched with the boundary thresholds used to classify risk levels to output the corresponding target risk level; the target risk level includes normal, low risk deviation, suspicious cross-line, and high risk cross-line; Based on the target risk level, classification update control is performed on the asset historical baseline, the behavior historical baseline, and the access historical baseline.

[0022] Based on a multi-source data fusion architecture, raw data from the host and network sides is collected and transformed into a unified, standardized snapshot and event model, constructing three independent logical baselines for assets, behaviors, and access. Subsequently, a deviation comparison method is used to calculate the independent risk score for each layer, and then weight parameters are introduced to perform a comprehensive fusion calculation of multi-dimensional features. The total risk score calculation satisfies the formula: In this system, TotalRiskScore represents the total risk score, AssetRiskScore represents the asset risk score, BehaviorRiskScore represents the behavioral risk score, and AccessRiskScore represents the access risk score. A, B, and C represent the weighting coefficients used to balance the impact of asset, behavioral, and access risks, and the sum of the three is equal to one. Finally, the target risk level is output by matching the boundary threshold, and this classification drives the learning and updating of the baseline. This system enables collaborative analysis and unified measurement of safety operation data of heterogeneous devices, overcomes the shortcomings of single-dimensional detection with limited field of view and poor correlation, and can block the pollution of the identification model by high-risk disturbances while adapting to normal business changes on site, thereby improving the reliability of the overall defense system and the comprehensiveness of unknown anomaly capture.

[0023] The step of comparing the current asset snapshot with the historical baseline of the asset to calculate the asset risk score includes: Extract the hardware, software, and network attributes from the current asset snapshot, and calculate the proportion of the number of differences between these attributes and the corresponding attributes in the asset's historical baseline to the total number of items checked, to obtain the hardware deviation score, software deviation score, and network attribute deviation score.

[0024] For calculating asset risk scores based on host configuration and status, deviations in hardware, software, and network attributes are calculated using a proportional anomaly score, satisfying the formula... in Indicates proportional outlier scores. Indicates the number of anomalies. This indicates the total number of items checked; the deviation of numerical characteristics in the operating status is calculated using a numerical deviation score combined with smoothing correction, satisfying the formula: in This represents the numerical deviation score, where x represents the current observation value. Indicates the historical average. Let T represent the historical standard deviation, e represent the deviation threshold coefficient, and e represent a small positive smoothing value to prevent the denominator from being too small or zero. The weighted total asset risk based on multi-dimensional deviations satisfies the formula: That This represents the reliability coefficient of the asset-layer data. to This indicates that the weights of each item sum to one. , , and These represent the deviations from the hardware, software, and network attributes and operating status, respectively.

[0025] Specifically, it achieves the goal of accurately depicting the steady state of the host's static configuration while dynamically filtering out false feature deviations caused by short-term system resource fluctuations through a smoothing constant within the mathematical model. This improves the accuracy of identifying abnormal asset states and reduces the frequency of false alarms caused by occasional resource peaks.

[0026] The step of comparing the current asset snapshot with the historical baseline of the asset to calculate the asset risk score also includes: Extract the numerical features of the operating status from the current asset snapshot, calculate the degree to which the numerical features of the operating status deviate from the corresponding historical mean and historical standard deviation in the historical baseline of the asset, and combine them with a first threshold coefficient used to limit the sensitivity to change to obtain the operating status deviation score; wherein, the historical standard deviation is corrected by a constant used to smooth fluctuations so that the denominator is non-zero and to avoid the amplification of disturbances; The asset risk score is calculated by weighting and summing the hardware deviation score, the software deviation score, the network attribute deviation score, and the operating status deviation score, and then multiplying the sum by a first credibility coefficient that reflects the integrity of the host asset data.

[0027] Specifically: New behavioral anomaly scores are derived by retrieving the novelty of the action. The time anomaly scores are calculated based on the time distribution probability, satisfying the formula: in Classified by time anomalies, Let the probability of a behavior occurring in the history of the k-th time bucket be given; the frequency anomaly score is calculated based on the occurrence frequency, satisfying the formula: in Classified by frequency anomalies, This represents the frequency of actions within the current statistical window. and The frequency is the historical mean and standard deviation. The frequency deviation threshold coefficient is used; and the context anomaly score is obtained by comparing the proportion of context anomalies. Sequence anomaly .

[0028] The overall weighted evaluation result satisfies the formula: The BehaviorRiskScore represents the behavioral risk score. This represents the credibility coefficient of the behavioral layer data. to The weighting coefficients for each term are summed to one.

[0029] It achieves synchronous quantitative auditing of host single action behavior patterns and multi-dimensional time-series complex environments, improves the sensitivity of automatic capture of unknown control commands and unauthorized execution operations, and suppresses the detection mechanism error caused by the frequency of a single operation exceeding the limit through a distribution probability model.

[0030] The step of comparing the current behavioral event with the historical baseline of the behavior to calculate the behavioral risk score includes: Using the behavior key, which includes the subject, action type, and object, as the primary key, retrieve whether the current behavior key exists in the behavior history baseline, and calculate the new behavior anomaly score; Based on the time bucket where the current behavioral event occurred, the historical occurrence probability of the behavioral key in the corresponding time bucket is matched with the historical baseline of the behavioral event, and the time anomaly score is calculated.

[0031] Specifically: Extract new relationship deviation scores based on network access relationships. Related to protocol port abnormalities The time anomaly score is calculated based on the time bucket probability, satisfying the formula: in Let be the probability of the access key appearing in the k-th time bucket; for a single communication traffic, the traffic anomaly score is calculated according to the formula: For communication duration calculation anomalies, the following formula is satisfied: Where x, , T and T correspond to the current value, historical mean, standard deviation, and deviation threshold coefficient of traffic and duration, respectively.

[0032] Multidimensional feature association fusion satisfies the formula: AccessRiskScore represents the access risk score. Here, c1 represents the credibility coefficient of the traffic layer data, and c6 represents the weighted coefficients of each dimension, which sum to one. This is an abnormal score for access frequency calculated by combining the threshold coefficient.

[0033] A mathematical closed-loop fusion of static network boundary defense strategies and fine-grained dynamic communication behavior feature auditing is achieved, which can accurately capture the movement trajectory of hidden networks while avoiding misjudgments caused by natural dynamic fluctuations in traffic or communication duration during normal business peak periods.

[0034] The step of comparing the current behavioral event with the historical baseline of the behavior to calculate the behavioral risk score also includes: The frequency of occurrence of the behavioral event within the current statistical window is counted, the degree to which the frequency of occurrence deviates from the historical mean and historical standard deviation of the historical baseline of the behavior is calculated, and the frequency anomaly score is obtained by combining the second threshold coefficient used to control the sensitivity of frequency changes. Calculate the proportion by which the context attribute of the current behavioral event deviates from the historical common context attribute to obtain the context anomaly score; The new behavior anomaly score, the time anomaly score, the frequency anomaly score, and the context anomaly score are weighted and summed, and then multiplied by the second behavior layer data credibility coefficient to calculate the behavior risk score.

[0035] By using the target risk level derived from comprehensive judgment to reverse control the baseline evolution path, the total risk is divided into different threshold intervals. For low-risk deviation objects, a continuous observation period judgment logic is introduced to record the number of times they occur and the number of consecutive days they occur. After verifying that they meet the steady-state conditions, they are moved into the formal baseline. For suspicious and high-risk objects that exceed the upper limit of the risk threshold, learning update circuit breaker instructions are implemented and they are marked as static isolation samples. A controlled evolution and anomaly defense adaptive feedback mechanism of dynamic detection model is constructed. While ensuring that the underlying algorithm mechanism can continuously adapt to the natural changes in business, it cuts off the evolution path of unknown anomalies probing in and changing the historical security baseline through gradual actions.

[0036] The step of comparing the current access event with the access history baseline to calculate the access risk score includes: Using the access key containing subject, object, protocol and port as the primary key, retrieve whether the current access key exists in the access history baseline, and calculate the new relationship access deviation score; If the access key existed historically but a new protocol or port was used, then a protocol / port anomaly score is calculated.

[0037] Specifically, the hierarchical baseline analysis theory is solidified into a hardware logic device, including an interface unit responsible for data acquisition, transformation, and mapping; a baseline analysis layer responsible for hierarchical model construction; a hierarchical scoring module and a comprehensive risk fusion module responsible for formula deviation calculation; and a risk determination module and a learning control module responsible for state determination. Each physical unit relies on internal data links to complete the modular extraction and transmission of multi-dimensional risk features. By converting the abstract hierarchical risk detection algorithm into a physical parallel monitoring component with high cohesion, the rigor of data flow between multi-level baseline comparison links and the hardware-level response efficiency are ensured, providing structural support for nodes deployed in complex data monitoring networks.

[0038] The step of comparing the current access event with the access history baseline to calculate the access risk score also includes: Based on the time of the current access event, calculate the historical probability deviation of its falling into the corresponding time bucket to obtain the access time anomaly score; Calculate the number of accesses, single communication traffic, and single communication duration corresponding to the access key in the current statistics window, and the degree of deviation from the corresponding historical mean and historical standard deviation in the access history baseline. Combine the corresponding access frequency deviation threshold coefficient, traffic deviation threshold coefficient, and duration deviation threshold coefficient to obtain access frequency abnormality score, traffic abnormality score, and duration abnormality score. The access risk score is calculated by weighting and summing the new relationship access deviation score, the protocol port abnormal score, the access time abnormal score, the access frequency abnormal score, the traffic abnormal score, and the duration abnormal score, and then multiplying the sum by the traffic layer data credibility coefficient.

[0039] Based on the underlying memory and processor hardware architecture, the risk deviation comparison computer program instruction sequence is statically loaded and compiled in memory. The processor chip reads and calls the instructions in sequence at high speed. The underlying computing unit drives the logical operation of multi-source data parsing and hierarchical feature scoring quantification. By providing physical computing carrier support for the dynamic hierarchical baseline detection mechanism, it ensures the high-speed throughput and concurrent feature comparison requirements of host status characteristics and high-frequency network traffic data in the industrial control environment, and meets the instruction execution timeliness of the real-time monitoring system.

[0040] In another embodiment, a host abnormal behavior detection device based on hierarchical baseline analysis is provided, comprising: The data acquisition module is used to collect host-side EDR data and network-side traffic data, and to split the host-side EDR data into static data and dynamic behavior data. The standardization and model mapping module is used to uniformly convert the static data, the dynamic behavior data, and the network-side traffic data into asset snapshots, behavior events, and access events. The baseline analysis layer is used to construct an asset history baseline based on the historical asset snapshots, a behavior history baseline based on the historical behavior events, and an access history baseline based on the historical access events. The hierarchical scoring module is used to calculate an asset risk score by comparing the deviation of the current asset snapshot with the asset historical baseline, to calculate a behavior risk score by comparing the deviation of the current behavior event with the behavior historical baseline, and to calculate an access risk score by comparing the deviation of the current access event with the access historical baseline. The comprehensive risk fusion module is used to introduce weighting coefficients to balance the impact of risks at each level, and to weight and fuse the asset risk score, the behavioral risk score, and the access risk score to calculate the total risk score. The risk assessment module is used to perform interval matching between the total risk score and the boundary threshold used to classify risk levels, and output the corresponding target risk level; The learning control module is used to perform classification update control on the asset historical baseline, the behavior historical baseline, and the access historical baseline according to the target risk level.

[0041] The electronic device provided in this embodiment of the invention, exemplarily, can be a network device, or a chip (system) or other component or assembly that can be disposed in a network device. The electronic device may include a processor. Optionally, the electronic device may also include a memory and / or a transceiver. The processor is coupled to the memory and transceiver, for example, by means of a communication bus connection.

[0042] The following is a detailed introduction to the various components of the electronic device: In this context, the processor is the control center of the electronic device. It can be a single processor or a collective term for multiple processing elements. For example, a processor can be one or more central processing units (CPUs), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0043] Alternatively, the processor can perform various functions of the electronic device, such as the methods described above, by running or executing software programs stored in memory and by calling data stored in memory.

[0044] In a specific implementation, as one example, the processor may include one or more CPUs, such as CPU0 and CPU1.

[0045] In a specific implementation, as one example, the electronic device may also include multiple processors. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). Here, a processor may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0046] The memory is used to store the software program that executes the solution of the present invention, and the execution is controlled by the processor. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0047] Optionally, the memory can be read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory can be integrated with the processor or exist independently and coupled to the processor through the interface circuit of the electronic device; the embodiments of the present invention do not specifically limit this.

[0048] A transceiver is used for communication with other electronic devices. For example, if the electronic device is a terminal, the transceiver can be used to communicate with a network device or with another terminal device. As another example, if the electronic device is a network device, the transceiver can be used to communicate with a terminal or with another network device.

[0049] Optionally, the transceiver may include a receiver and a transmitter. The receiver is used to implement the receiving function, and the transmitter is used to implement the sending function.

[0050] Optionally, the transceiver can be integrated with the processor or exist independently and coupled to the processor through the interface circuit of the electronic device. This embodiment of the invention does not specifically limit this.

[0051] It is understood that the structure of the electronic device in this embodiment does not constitute a limitation on the electronic device. The actual electronic device may include more or fewer components, or combine certain components, or have different component arrangements.

[0052] Furthermore, the technical effects of the electronic device can be referred to the technical effects of the method described in the above method embodiments, and will not be repeated here.

[0053] It should be understood that the processor in the embodiments of the present invention can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0054] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0055] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0056] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0057] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0058] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0059] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0060] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0061] In the embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0062] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0063] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0064] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0065] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A host abnormal behavior detection method based on hierarchical baseline analysis, applied to a host abnormal behavior detection system, characterized in that, Includes the following steps: Acquire host-side EDR data and network-side traffic data, and split the host-side EDR data into static data and dynamic behavior data; The static data, dynamic behavior data, and network-side traffic data are uniformly converted into asset snapshots, behavior events, and access events. An asset history baseline is constructed based on the historical asset snapshots, a behavioral history baseline is constructed based on the historical behavioral events, and an access history baseline is constructed based on the historical access events. The asset risk score is calculated by comparing the deviation of the current asset snapshot with the asset historical baseline, the behavior risk score is calculated by comparing the deviation of the current behavior event with the behavior historical baseline, and the access risk score is calculated by comparing the deviation of the current access event with the access historical baseline. A weighting coefficient is introduced to balance the impact of risks at each level. The asset risk score, the behavioral risk score, and the access risk score are weighted and fused to calculate the total risk score. The total risk score is matched with the boundary threshold used to classify risk levels, and the corresponding target risk level is output. The target risk levels include normal, low-risk deviation, suspicious cross-line, and high-risk cross-line; Based on the target risk level, classify and update the asset historical baseline, the behavioral historical baseline, and the access historical baseline. The step of comparing the current asset snapshot with the asset historical baseline to calculate the asset risk score includes: extracting the hardware, software and network attributes from the current asset snapshot, and calculating the proportion of the number of differences between the current asset snapshot and the corresponding attributes in the asset historical baseline to the total number of items checked, to obtain the hardware deviation score, software deviation score and network attribute deviation score. The step of comparing the current asset snapshot with the historical baseline of the asset to calculate the asset risk score also includes: Extract the numerical features of the operating status from the current asset snapshot, calculate the degree to which the numerical features of the operating status deviate from the corresponding historical mean and historical standard deviation in the historical baseline of the asset, and combine them with a first threshold coefficient used to limit the sensitivity to change to obtain the operating status deviation score; wherein, the historical standard deviation is corrected by a constant used to smooth fluctuations so that the denominator is non-zero and to avoid the amplification of disturbances; The asset risk score is calculated by weighting and summing the hardware deviation score, the software deviation score, the network attribute deviation score, and the operating status deviation score, and then multiplying the sum by a first credibility coefficient that reflects the integrity of the host asset data.

2. The host abnormal behavior detection method based on hierarchical baseline analysis according to claim 1, characterized in that, The step of comparing the current behavioral event with the historical baseline of the behavior to calculate the behavioral risk score includes: Using the behavior key, which includes the subject, action type, and object, as the primary key, retrieve whether the current behavior key exists in the behavior history baseline, and calculate the new behavior anomaly score; Based on the time bucket where the current behavioral event occurred, the historical occurrence probability of the behavioral key in the corresponding time bucket is matched with the historical baseline of the behavioral event, and the time anomaly score is calculated.

3. The host abnormal behavior detection method based on hierarchical baseline analysis according to claim 2, characterized in that, The step of comparing the current behavioral event with the historical baseline of the behavior to calculate the behavioral risk score also includes: The frequency of occurrence of the behavioral event within the current statistical window is counted, the degree to which the frequency of occurrence deviates from the historical mean and historical standard deviation of the historical baseline of the behavior is calculated, and the frequency anomaly score is obtained by combining the second threshold coefficient used to control the sensitivity of frequency changes. Calculate the proportion by which the context attribute of the current behavioral event deviates from the historical common context attribute to obtain the context anomaly score; The new behavior anomaly score, the time anomaly score, the frequency anomaly score, and the context anomaly score are weighted and summed, and then multiplied by the second behavior layer data credibility coefficient to calculate the behavior risk score.

4. The host abnormal behavior detection method based on hierarchical baseline analysis according to claim 1, characterized in that, The step of comparing the current access event with the access history baseline to calculate the access risk score includes: Using the access key containing subject, object, protocol and port as the primary key, retrieve whether the current access key exists in the access history baseline, and calculate the new relationship access deviation score; If the access key existed historically but a new protocol or port was used, then a protocol / port anomaly score is calculated.

5. The host abnormal behavior detection method based on hierarchical baseline analysis according to claim 4, characterized in that, The step of comparing the current access event with the access history baseline to calculate the access risk score also includes: Based on the time of the current access event, calculate the historical probability deviation of its falling into the corresponding time bucket to obtain the access time anomaly score; Calculate the number of accesses, single communication traffic, and single communication duration corresponding to the access key in the current statistics window, and the degree of deviation from the corresponding historical mean and historical standard deviation in the access history baseline. Combine the corresponding access frequency deviation threshold coefficient, traffic deviation threshold coefficient, and duration deviation threshold coefficient to obtain access frequency abnormality score, traffic abnormality score, and duration abnormality score. The access risk score is calculated by weighting and summing the new relationship access deviation score, the protocol port abnormal score, the access time abnormal score, the access frequency abnormal score, the traffic abnormal score, and the duration abnormal score, and then multiplying the sum by the traffic layer data credibility coefficient.

6. A host abnormal behavior detection device based on hierarchical baseline analysis, applied to the host abnormal behavior detection method based on hierarchical baseline analysis as described in any one of claims 1-5, characterized in that, include: The data acquisition module is used to collect host-side EDR data and network-side traffic data, and to split the host-side EDR data into static data and dynamic behavior data. The standardization and model mapping module is used to uniformly convert the static data, the dynamic behavior data, and the network-side traffic data into asset snapshots, behavior events, and access events. The baseline analysis module is used to construct an asset history baseline based on the historical asset snapshots, a behavior history baseline based on the historical behavior events, and an access history baseline based on the historical access events. The hierarchical scoring module is used to calculate an asset risk score by comparing the deviation of the current asset snapshot with the asset historical baseline, to calculate a behavior risk score by comparing the deviation of the current behavior event with the behavior historical baseline, and to calculate an access risk score by comparing the deviation of the current access event with the access historical baseline. The comprehensive risk fusion module is used to introduce weighting coefficients to balance the impact of risks at each level, and to weight and fuse the asset risk score, the behavioral risk score, and the access risk score to calculate the total risk score. The risk assessment module is used to perform interval matching between the total risk score and the boundary threshold used to classify risk levels, and output the corresponding target risk level; The learning control module is used to perform classification update control on the asset historical baseline, the behavior historical baseline, and the access historical baseline according to the target risk level.

7. A host abnormal behavior detection device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of a host abnormal behavior detection method based on hierarchical baseline analysis as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of a host abnormal behavior detection method based on hierarchical baseline analysis as described in any one of claims 1 to 5.

Images