Abnormal event detection method and electronic device

Abstract

This application discloses an anomaly event detection method and electronic device, relating to the fields of computer security and operational security. The method includes: acquiring event stream data obtained by performing detection on multiple events, wherein the events include events characterized by firmware triggering in a basic input / output system; constructing an anomaly causal graph based on anomaly event stream data from the multiple event stream data, wherein the anomaly causal graph indicates the causal relationships between multiple anomaly events corresponding to the multiple anomaly event stream data; and determining a comprehensive anomaly detection result based on the difference between the anomaly causal graph and a baseline causal graph, wherein the baseline causal graph indicates the causal relationships between normal events. This method solves the technical problems of limited scope and low accuracy in anomaly detection of basic input / output system firmware, achieving the technical effect of accurate detection of runtime anomalies in basic input / output system firmware.

Description

Technical Field

[0001] This application relates to the fields of computer security and operational security technology, and in particular to an abnormal event detection method and electronic device. Background Technology

[0002] With the continuous development of computer technology, the security and trustworthiness of computer devices are becoming increasingly important. The attack surface at the firmware layer is expanding at an unprecedented rate. For example, attack techniques targeting firmware have been classified as high-level threats of "persistence" and "defense evasion".

[0003] The Basic Input / Output System (BIOS) or Unified Extensible Firmware Interface (UEFI), as the first software to boot a modern computer system, is a crucial hub connecting hardware and the operating system. Its security forms the foundation of the entire computing trust chain—the "root of trust." However, BIOS firmware anomaly detection implemented through BIOS or UEFI typically only guarantees the static integrity of the firmware image before loading, making it difficult to detect anomalies occurring during firmware runtime. Furthermore, detecting only changes to the BIOS firmware itself easily generates numerous false alarms; for example, normal management operations may change configurations, but these configuration changes can lead to false BIOS firmware anomaly reports. Therefore, a solution is urgently needed to overcome the shortcomings of BIOS firmware runtime anomaly detection and achieve accurate anomaly detection. Summary of the Invention

[0004] This application provides an abnormal event detection method and electronic device to at least solve the technical problems of large limitations and low accuracy in the abnormal detection of BIOS firmware in related technologies, and achieves the technical effect of accurately detecting runtime abnormalities of BIOS firmware.

[0005] This application provides an abnormal event detection method, comprising: acquiring event stream data obtained by performing detection on multiple events, wherein the events include firmware-triggered events of a basic input / output system; constructing an abnormal causal graph based on abnormal event stream data in the multiple event stream data, wherein the abnormal causal graph indicates the causal relationship between multiple abnormal events corresponding to the multiple abnormal event stream data; and determining a comprehensive abnormal detection result for the abnormal causal graph based on the difference between the abnormal causal graph and a baseline causal graph, wherein the baseline causal graph indicates the causal relationship between normal events.

[0006] This application also provides an abnormal event detection device, comprising: an acquisition module for acquiring event stream data obtained by performing detection on multiple events, wherein the events include events characterizing the interaction between the basic input / output system and the firmware; a construction module for constructing an abnormal causal graph based on the abnormal event stream data in the multiple event stream data, wherein the abnormal causal graph indicates the causal relationship between multiple abnormal events corresponding to the multiple abnormal event stream data; and a detection module for determining a comprehensive abnormal detection result for the abnormal causal graph based on the difference between the abnormal causal graph and a baseline causal graph, wherein the baseline causal graph indicates the causal relationship between normal events.

[0007] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the steps of any of the above-described abnormal event detection methods when executing the computer program.

[0008] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described abnormal event detection methods.

[0009] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described abnormal event detection methods.

[0010] In this application, by collecting event stream data containing temporal relationships and performing temporal analysis on the event stream data, it is possible to detect whether any events exhibit abnormalities during runtime, thus achieving runtime anomaly detection for individual events. For abnormal event stream data, by constructing an abnormal cause-effect graph using multiple abnormal events and comparing the abnormal cause-effect graph with a baseline cause-effect graph, it is possible to distinguish abnormal causal relationships caused by attacks in the abnormal cause-effect graph based on the causal relationships between normal events in the baseline cause-effect graph. Therefore, this application, in addition to identifying whether a single event is abnormal, further achieves the detection of abnormal patterns involving multiple linked events, realizing the shift from "what abnormality occurred" to "what attack pattern these abnormalities signify." Thus, this application solves the technical problems of limited scope and low accuracy in anomaly detection of BIOS firmware in related technologies, achieving the technical effect of accurate detection of runtime anomalies in BIOS firmware. Attached Figure Description

[0011] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 An exemplary system architecture for applying an anomaly event detection method according to an embodiment of this application is shown.

[0013] Figure 2 A flowchart of an abnormal event detection method according to an embodiment of this application is shown.

[0014] Figure 3A An anomaly cause-effect graph according to an embodiment of this application is shown.

[0015] Figure 3B A baseline causal graph according to an embodiment of this application is shown.

[0016] Figure 4 A data flow diagram is shown for determining the comprehensive anomaly assessment value according to an embodiment of this application.

[0017] Figure 5 A data flow diagram of abnormal event detection according to an embodiment of this application is shown.

[0018] Figure 6 The multi-level baseline involved in the anomaly detection process according to an embodiment of this application is shown.

[0019] Figure 7 The flowchart illustrating the implementation of hierarchical parallel anomaly detection according to an embodiment of this application is shown.

[0020] Figure 8 A flowchart illustrating the acquisition and processing of runtime multi-source heterogeneous event stream data according to an embodiment of this application is shown.

[0021] Figure 9 An abnormal event detection apparatus according to an embodiment of this application is shown. Detailed Implementation

[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0023] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0024] Related technologies for signature-based firmware integrity verification include UEFI Secure Boot or Trusted Platform Module (TPM) metrics. Secure Boot is a security mechanism defined by the UEFI specification, which ensures that only signed, trusted code can be executed by verifying the digital signature of each firmware file during the boot process. TPM, on the other hand, uses a Measure Boot mechanism to extend the hash values ​​of the firmware code and configuration into the Platform Configuration Register (PCR) for remote authentication and integrity verification.

[0025] The detection of BIOS firmware in related technologies has the following "blind spots": 1) Limitations of static verification: Traditional signature-based integrity verification can only ensure the static integrity of the firmware image before loading, and cannot defend against runtime code reuse attacks, such as attacks that exploit UEFI runtime service vulnerabilities, return-oriented programming (ROP) or jump-oriented programming (JOP); it also cannot detect and defend against attacks in which the firmware is tampered with by malicious data (while the code segment remains unchanged).

[0026] 2) Limitations of single-point detection: Related technologies focus on detecting changes in configuration variables, but detecting only the configuration change itself is prone to generating a large number of false alarms (normal management operations will also change the configuration), and lacks semantic understanding of the "change context" and "change combination".

[0027] 3) Lack of Microarchitectural Event Detection: Related technologies generally neglect the detection of microarchitectural events during firmware runtime, such as System Management Interrupt (SMI) frequency, Advanced Configuration and Power Interface (ACPI) state transition delays, and Model-Specific Register (MSR) register access patterns. Advanced System Management Mode (SMM) backdoors exploit the transparency of SMM by manipulating timers to generate fixed-frequency SMIs to execute malicious payloads; this side-channel behavior is completely invisible from a traditional detection perspective.

[0028] 4) Blindness to runtime behavior and inability to detect fileless attacks: Attackers can achieve persistence by modifying in-memory data structures (such as SMM memory and ACPI tables) without modifying any firmware code stored in flash memory. These attacks completely bypass static verification. For example, they can exploit vulnerable bootloaders to bypass Secure Boot. Once signature verification is successful, malicious code can execute freely at runtime, with no mechanism to monitor its subsequent behavior.

[0029] 5) Lack of detection and response loop: Most solutions stop at alerts and fail to correlate and reason about multi-dimensional anomalies to form actionable threat intelligence and automated response strategies.

[0030] 6) High maintenance cost of signature database: Professional personnel are needed to continuously track the vulnerability patches and new feature modules released by the vendors. The workload of maintaining the signature database is huge and it is difficult to keep up with the rapid growth of malicious code.

[0031] Therefore, there is an urgent need in this field for a global perspective that can be built for firmware behavioral events, and by integrating startup behavior, runtime microarchitectural events, security features and compatibility performance, combined with time-series correlation analysis and situational awareness, to achieve runtime and complete detection of known and unknown firmware threats.

[0032] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. The specific application environment architecture or specific hardware architecture on which the execution of the abnormal event detection method depends will be described herein.

[0033] Figure 1 An exemplary system architecture for applying an anomaly event detection method according to embodiments of this application is shown. Figure 1 As shown, the system architecture 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired and / or wireless communication links. Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, and / or social platform software (for example only).

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers. In other fields, these terminal devices can also be Internet of Things (IoT) devices or server infrastructure for cloud service centers.

[0035] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0036] It should be noted that the abnormal event detection method provided in this application embodiment can generally be executed by the first terminal device 101, the second terminal device 102, and the third terminal device 103. Correspondingly, the abnormal event detection device provided in this application embodiment can generally be installed in the aforementioned terminal devices. Furthermore, the first terminal device 101, the second terminal device 102, and the third terminal device 103 can also be servers. In this case, the server 105 can act as a server interacting with the first terminal device 101, the second terminal device 102, and the third terminal device 103. It should be understood that... Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0037] Figure 2 A flowchart of an abnormal event detection method according to an embodiment of this application is shown. (In conjunction with...) Figure 2 The execution flow is described in detail, along with the abnormal event detection method. For example... Figure 2 As shown, the method 200 includes operations S210 to S230.

[0038] In operation S210, event stream data obtained by performing detection on multiple events is acquired, including events triggered by the firmware of the basic input / output system.

[0039] The firmware of the Basic Input / Output System (BIOS) can interact with the BIOS or UEFI. Events can be used to record the interactions between the BIOS firmware and the BIOS or UEFI. For example, events can include: SMI events, ACPI state transition events, module loading events, Power On Self Test (POST) events, configuration change events, hardware events, etc. Events can be detected sequentially to obtain event stream data. For example, for events like SMI and ACPI state transition events, which are triggered multiple times during runtime due to various reasons, the event stream data can record when and how intense the event occurred (this can be reflected through the parameters of each event). For POST events, configuration change events, and hardware events, the event stream data can record when, what operation was performed on which module / configuration, and the result of the operation.

[0040] In operation S220, an anomaly cause-effect graph is constructed based on the abnormal event stream data from multiple event stream data.

[0041] An anomaly cause-effect graph indicates the causal relationships between multiple anomaly events corresponding to multiple anomaly event stream data. In this embodiment, for the event stream data of each event, it can be determined whether each event stream data is an anomaly event stream data by performing single-point analysis and / or time-series analysis on the data's own values. The anomaly events corresponding to the anomaly event stream data can be used to construct an anomaly cause-effect graph.

[0042] For example, if every event in the event stream is normal and the timing of multiple events in the event stream is also normal, then the event stream is considered normal event stream data; conversely, if there are abnormal events or abnormal timing among multiple events, then the event stream is considered abnormal event stream data.

[0043] In some embodiments, the order of occurrence of abnormal events and the abnormal events themselves can be analyzed to determine whether there is a causal relationship between multiple abnormal events, and then multiple abnormal events can be constructed into an abnormal causal graph.

[0044] In operation S230, based on the difference between the abnormal cause-effect graph and the baseline cause-effect graph, a comprehensive anomaly detection result is determined for the abnormal cause-effect graph, where the baseline cause-effect graph indicates the causal relationship between normal events.

[0045] For example, when an electronic device is in a normal state, a baseline cause-effect graph can be constructed based on the various events that occur to distinguish whether a causal relationship exists between two normal events under normal conditions. For instance, if normal event A leads to normal event B under normal conditions, and the abnormal cause-effect graph shows a causal relationship between abnormal events A and B, then the co-occurrence of abnormal events A and B may not be a coordinated attack pattern, but rather a normal causal relationship within the electronic device. If there is no causal relationship between normal events C and D, but a causal relationship exists between abnormal events C and D, then the co-occurrence of abnormal events C and D may be a coordinated attack pattern.

[0046] It should be noted that a particular event may be caused by normal device behavior or by an attack. For example, under normal temperature control conditions, an electronic device may trigger an SMI event. When attacked, the electronic device may also trigger an SMI event. The SMI event itself cannot distinguish between abnormal and normal, but the frequency of the SMI event can be used to distinguish between normal and abnormal.

[0047] In this embodiment, the causal relationship can include a variety of factors: one event is the cause of another event, one event is the effect of another event, two events are independent of each other, two events are mutually causal, etc. Therefore, the abnormal causal graph can include at least one causal relationship between two or more events, and the comprehensive anomaly detection result can be regarded as a comprehensive anomaly detection result obtained by combining multiple causal relationships.

[0048] For example, comprehensive anomaly detection results can be used to indicate whether anomalies exist and / or the anomaly level in the anomaly cause-effect graph, so that anomaly detection and / or anomaly response can be implemented based on the comprehensive anomaly detection results.

[0049] In the embodiments of this application, by collecting event stream data containing temporal relationships and performing temporal analysis on the event stream data, it is possible to detect whether each event is abnormal during runtime, thus achieving runtime anomaly detection for a single event. For abnormal event stream data, by constructing an abnormal cause-effect graph using multiple abnormal events and comparing the abnormal cause-effect graph with a baseline cause-effect graph, it is possible to distinguish abnormal causal relationships caused by attacks in the abnormal cause-effect graph based on the causal relationships between normal events in the baseline cause-effect graph. Therefore, based on identifying whether a single event is abnormal, this application further achieves the detection of abnormal patterns of multiple events linked together, realizing the detection from "what abnormality occurred" to "what attack these abnormalities mean". Thus, this application solves the technical problems of large limitations and low accuracy in anomaly detection of BIOS firmware in related technologies, achieving the technical effect of accurate detection of runtime anomalies in BIOS firmware.

[0050] According to an embodiment of this application, a comprehensive anomaly detection result for an abnormal causal graph is determined based on the difference between the abnormal causal graph and the baseline causal graph, including: determining a first difference between a node in the abnormal causal graph and a corresponding node in the baseline causal graph; determining a second difference between a directed edge in the abnormal causal graph and a corresponding directed edge in the baseline causal graph; determining at least one abnormal causal type based on at least one of the first and second differences; and determining a comprehensive anomaly detection result based on at least one abnormal causal type.

[0051] An anomalous cause-effect graph consists of multiple nodes and multiple directed edges. Nodes indicate anomalous events, and the direction of a directed edge indicates the causal relationship between the two nodes connected to that edge. Similarly, a baseline cause-effect graph also consists of multiple nodes and multiple directed edges. Nodes indicate normal events, and the direction of a directed edge indicates the causal relationship between the two nodes connected to that edge, i.e., the causal relationship between normal events.

[0052] The nodes and directed edges in the anomalous causal graph have corresponding nodes and directed edges in the baseline causal graph. A corresponding node can be understood as a node that indicates the same event as a node in the anomalous causal graph, and a corresponding directed edge can be understood as a directed edge that indicates the causal relationship between two events as a directed edge in the anomalous causal graph.

[0053] Baseline cause-effect graphs typically exhibit the following characteristics: most events have clear causes or effects, there are few passive events (few isolated nodes), link lengths are usually short, and normal loop feedback mechanisms exist. Therefore, comparing anomaly cause-effect graphs with baseline cause-effect graphs can accurately identify anomalous causal relationships in the anomaly graphs. For example, Table 1 shows normal events with causal relationships and their causal relationship types and temporal relationships. Terms in Table 1 include: Universal Serial Bus (USB), System Control Interrupt (SCI), and other terms are described above.

[0054] Table 1

[0055]

[0056] For example, Table 1 shows that: after a USB insertion event, an ACPISCI interrupt event will inevitably be generated within 10 milliseconds; after an ACPISCI interrupt event, a USB controller-related SMI event will inevitably be triggered within 5 milliseconds; after the hardware temperature rises, a hardware event of increasing fan speed will be triggered within the range of 100 to 500 milliseconds; after a user input operation, there is a probability that the system load will increase within the range of 10 to 100 milliseconds. Timer interrupts will periodically generate timer-type SMI events at fixed intervals.

[0057] Figure 3A An anomaly cause-effect graph according to an embodiment of this application is shown. Figure 3B A baseline causal graph according to an embodiment of this application is shown. Figure 3A It includes nodes N11 to N19 and directed edges between multiple nodes. Figure 3B This includes nodes N21 to N29 and directed edges between multiple nodes. In this embodiment, nodes N21 to N29 in the baseline causal graph can serve as the corresponding nodes of nodes N11 to N19 in the anomalous causal graph.

[0058] For example, taking node N13 as an example, there is no directed edge pointing to node N13 in the abnormal cause-effect graph, while there is a directed edge pointing to node N23 (node ​​N23 is the corresponding node of node N13) in the baseline cause-effect graph. For example, there is a directed edge from node N21 to the corresponding directed edge of node N23. In this case, for node N13, it can be determined that there is a first difference between the abnormal cause-effect graph and the baseline cause-effect graph.

[0059] Taking nodes N16 and N19 as examples, the abnormal cause-effect graph has a directed edge from node N19 to node N16, and the baseline cause-effect graph has a corresponding directed edge (a directed edge from node N26 to node N29), and the two directed edges are in opposite directions. At this time, for the directed edge from node N19 to node N16, it can be determined that there is a second difference between the abnormal cause-effect graph and the baseline cause-effect graph.

[0060] Based on at least one of the first and second differences, the anomalous causal type for a node, for a directed edge, and for a link combining a node and a directed edge can be determined, thereby identifying multiple possible attacks based on at least one anomalous causal type.

[0061] Understandably, event stream data acquired at multiple time points may differ, and the abnormal event stream data and abnormal events identified through anomaly detection will also differ. Therefore, the constructed anomaly cause-effect graphs will differ. The number and specific types of abnormal cause-effect types that may exist in each anomaly cause-effect graph may also differ. At least one abnormal cause-effect type may co-occur in an anomaly cause-effect graph, and they together determine a certain type of attack. Therefore, the comprehensive anomaly detection result can be determined by combining at least one abnormal cause-effect type.

[0062] For example, each abnormal causal type can have a corresponding sub-evaluation value, and the comprehensive anomaly detection result is determined by combining the sub-evaluation values ​​of at least one abnormal causal type.

[0063] In the embodiments of this application, by comparing the differences in the topological structures such as nodes and directed edges of the abnormal causal graph and the baseline causal graph, and by combining at least one of the first difference and the second difference to determine the abnormal causal type, and then determining the comprehensive anomaly detection result, it is possible to accurately detect the correlation between abnormal events based on the causal relationship between abnormal events and the causal relationship between normal events, thereby improving the accuracy of anomaly detection.

[0064] According to embodiments of this application, determining at least one abnormal causal type based on at least one of a first difference and a second difference includes: for any node in the abnormal causal graph, determining a first abnormal causal type based on the second difference, wherein the first abnormal causal type indicates that the node is abnormal; for any directed edge in the abnormal causal graph, determining a second abnormal causal type based on the first difference, wherein the second abnormal causal type indicates that the directed edge is abnormal; and determining a third abnormal causal type based on the first difference and the second difference, wherein the third abnormal causal type indicates that both the node and the directed edge are abnormal.

[0065] For example, for Figure 3A Similar to node N13, node N19 in the anomaly cause-effect graph also lacks directed edges pointing to node N19. Figure 3B The baseline causal graph shown contains directed edges pointing to node N29 (node ​​N29 is the corresponding node of node N19), such as the directed edge from node N22 to N29. For node N19, there is a first difference between the anomalous causal graph and the baseline causal graph. A first anomalous causal type, used to indicate node anomalousness, can be determined based on this first difference.

[0066] For example, taking nodes N16 and N19 as examples, as stated above, there is a second difference between the anomalous causal graph and the baseline causal graph. The second anomalous causal type used to indicate directed edge anomalies can be determined based on the second difference.

[0067] For example, with Figure 3A Taking nodes N14, N15, N16, N17, and N18 as an example, in the anomaly cause-effect graph, nodes N14 to N18 form a loop-like link according to the order of directed edges. Figure 3B In the baseline causal graph shown, there are no loop links between nodes N24 and N28. Therefore, based on the first and second differences in the directed edges between nodes N14 and N18, a third anomalous causal type is determined to indicate that both the nodes and directed edges are anomalous.

[0068] In the embodiments of this application, based on the differences between nodes and directed edges, it is possible to make detailed judgments on directed edges between nodes, on whether a single node has a directed edge, and on the combination of nodes and directed edges, thereby enabling the determination of various abnormal causal types, and supporting more granular anomaly detection for various related abnormal events.

[0069] According to embodiments of this application, the first abnormal causal type includes at least one of the following: a source-less type and a result-less type; for any node in the abnormal causal graph, based on a second difference, the first abnormal causal type is determined to include at least one of the following: for a first node in the abnormal causal graph, if the second difference indicates that there is no directed edge pointing to the first node in the abnormal causal graph, and there is a corresponding directed edge in the baseline causal graph, the abnormal causal graph is determined to have a source-less type; for a second node in the abnormal causal graph, if the second difference indicates that there is no directed edge originating from the second node in the abnormal causal graph, and there is a corresponding directed edge in the baseline causal graph, the abnormal causal graph is determined to have a result-less type.

[0070] like Figure 3A and 3B As shown, the first node can be node N13 and node N19, and the anomaly cause-effect graph has a source-less type. The second node can be node N11 and node N12, and the anomaly cause-effect graph has a result-less type.

[0071] An orphan event, also known as an orphan event, refers to an anomaly where there are no directed edges pointing to that node in the anomaly cause-effect graph (i.e., no cause for the event), but a cause is expected (i.e., there should be directed edges pointing to that node in the baseline cause-effect graph). This can be determined by identifying all nodes with an in-degree of 0 in the anomaly cause-effect graph and checking if these nodes have directed edges pointing to their corresponding nodes in the baseline cause-effect graph. If there are directed edges pointing to the corresponding node in the baseline cause-effect graph, but not in the anomaly cause-effect graph (i.e., the anomaly event should have a cause but actually has no cause), then the anomaly cause-effect graph contains an orphan event, and this node can be marked as an orphan node with an orphan event.

[0072] In one specific embodiment, nodes N13 and N23 are both SMI events, and nodes N11 and N21 are both hardware events. SMI events should be triggered by hardware events, but in reality there are no preceding events. At this time, there may be malicious SMI events that are actively triggered in this passive type.

[0073] A "Dangling Event" is a type of event in the anomalous cause-effect graph where no directed edges point from a given node to other nodes (i.e., the event corresponding to that node has no result), but a result is expected (i.e., the baseline cause-effect graph should have directed edges pointing from that node to other nodes). This can be identified by finding all nodes in the anomalous cause-effect graph with an out-degree of 0 and checking if these nodes have corresponding directed edges pointing to other nodes in the baseline cause-effect graph. If the baseline cause-effect graph has directed edges pointing from that node to other nodes, but the anomalous cause-effect graph does not (i.e., the anomalous event should have a result but did not), it can be determined that the anomalous cause-effect graph contains a dangling event, and that node can be marked as an anomalous node with a dangling event.

[0074] In one specific embodiment, detecting an abnormal hardware event (such as a faulty hardware event) should trigger an error handling event. If there are no subsequent events in the anomaly cause-effect graph, the error of the hardware event may be hidden. Alternatively, for a configuration change event, a re-initialization event should be triggered, but if there are no subsequent events in the anomaly cause-effect graph, the configuration change of the configuration change event may not take effect or may be blocked.

[0075] In this embodiment, by judging whether there are directed edges for any node, it is possible to determine whether there are related abnormal events and whether there are any undiscovered abnormalities in the abnormal causal graph corresponding to the node, thereby achieving accurate detection of abnormal events.

[0076] According to embodiments of this application, the second abnormal causal type includes at least one of the following: causal reversal type and causal missing type; for any directed edge in the abnormal causal graph, based on a first difference, the second abnormal causal type is determined, including at least one of the following: for a first directed edge in the abnormal causal graph, if the first difference indicates that the two endpoints of the first directed edge correspond to the two endpoints of the corresponding directed edge in the baseline causal graph, and the directions of the first directed edge and the corresponding directed edge are opposite, the abnormal causal graph is determined to have a causal reversal type; if there is no second directed edge in the abnormal causal graph, and there is a corresponding directed edge in the baseline causal graph, the abnormal causal graph is determined to have a causal missing type.

[0077] Causal reversal refers to a causal direction that is opposite to the normal baseline (i.e., the directed edges in the anomalous causal graph are opposite in direction to the corresponding directed edges in the baseline causal graph). For each pair of nodes (A, B) forming a directed edge, it can be determined whether A→B exists in the baseline causal graph. If B→A exists in the anomalous causal graph, it can be marked as causal reversal.

[0078] like Figure 3A As shown, the first directed edge can be a directed edge from node N19 to node N16. Figure 3B The corresponding directed edges are those from node N26 to node N29. Node N16 corresponds to node N26, and node N19 corresponds to node N29. Furthermore, the directions of the two directed edges are opposite. Therefore, the abnormal cause-effect graph exhibits a causal reversal type. Correspondingly, Figure 3A The abnormal cause-effect graph does not contain a second directed edge from node N11 to node N13, but Figure 3B The baseline causal graph contains a corresponding directed edge from node N21 to N23. The anomalous causal graph is missing a second directed edge. Therefore, it is determined that the anomalous causal graph has a causal missing type.

[0079] In one specific embodiment, if Figure 3A and Figure 3B Nodes N16 and N26 are both ACPI events, while nodes N19 and N29 are both SMI events. Normally, ACPI events should point to SMI events, but the abnormal cause-effect graph shows a causal relationship between SMI events and ACPI events, meaning that SMI events actively trigger ACPI events. This may be due to an attack by SMM code simulating ACPI events. Therefore, this causal relationship analysis is used to determine what kind of attack exists.

[0080] In another embodiment, since the direction of the directed edges in the abnormal causal graph depends on the process of constructing the abnormal causal graph, the direction of the directed edge between two abnormal events may be misjudged as reversed due to uncertainty in the causal relationship. Therefore, if the directions of the first directed edge and the corresponding directed edge are opposite, and the strength of the first directed edge is greater than the strength threshold, a causal reversal type is determined to exist to improve the credibility of the causal reversal type. The method for determining the strength of the directed edge can be found in the section on constructing the abnormal causal graph below, and will not be repeated here. The strength threshold can be determined according to actual needs.

[0081] Missing causality refers to a situation where a causal relationship exists in the normal baseline causal graph, but is missing in the anomalous causal graph. For example, for each pair of directed edges (A, B), if A→B exists in the baseline causal graph, but nodes A and B exist in the anomalous causal graph, but A→B does not exist, this can be labeled as missing causality.

[0082] In one specific embodiment, for hardware events such as temperature rise events and fan acceleration events, the baseline causal graph may contain directed edges from the temperature rise event to the fan acceleration event. The baseline causal graph contains nodes corresponding to the temperature rise event and the fan acceleration event, but there is no directed edge between the two. This may be due to the fan control function being disabled when the temperature rises, thus identifying the anomaly.

[0083] In the embodiments of this application, by using two types of topological analysis based on directed edges, namely causal reversal type and causal missing type, it is possible to accurately identify the abnormal topology of multiple abnormal events that deviate from the baseline as a whole, which have causal relationships between them in the BIOS firmware, thereby realizing intuitive causal tracing.

[0084] According to embodiments of this application, the third abnormal causal type includes: an abnormal causal chain type and an abnormal feedback loop type; the third abnormal causal type is determined based on the first difference and the second difference, including at least one of the following: when the first difference and the second difference indicate that there is a first link in the abnormal causal graph and there is no corresponding link in the baseline causal graph, and the link length of the first link is greater than a length threshold, the abnormal causal graph is determined to have an abnormal causal chain type, wherein the first link is obtained by sequentially combining nodes and directed edges; when the first difference and the second difference indicate that there is a loop-shaped second link in the abnormal causal graph and there is no corresponding link in the baseline causal graph, the abnormal causal graph is determined to have an abnormal feedback loop type.

[0085] An anomalous chain type refers to a long link in an anomalous causal graph that is not present in the baseline causal graph. For example, all links consisting of nodes and directed edges in an anomalous causal graph can be identified, and the length of each link (e.g., the number of nodes traversed) can be calculated. If a link is not present in the baseline causal graph and its length exceeds a length threshold, it is marked as an anomalous causal chain. Furthermore, the length threshold can be determined based on specific circumstances, or it can be the maximum link length in the baseline causal graph.

[0086] For example, a baseline cause-effect graph may contain a link A→B→C with a link length of 3. An anomalous cause-effect graph may contain a first link A→B→C→D→E→F with a link length of 6. In this case, the link length is greater than the length threshold of 4, so the anomalous cause-effect chain type can be marked, indicating that there may be a complex attack chain in the anomalous cause-effect graph.

[0087] An anomalous feedback loop refers to a loop-like link (i.e., a causal loop) that exists in the anomalous causal graph but not in the baseline causal graph. For example, ... Figure 3B As shown, there are no loop links in the baseline causal graph, but Figure 3A There exists a loop-shaped second link N14→N15→N16→N17→N18→N14. At this point, there may be a malicious self-sustaining mechanism in the abnormal causal graph.

[0088] In the embodiments of this application, by analyzing the link topology structure composed of multiple nodes and directed edges, and determining the abnormal causal chain type and abnormal feedback loop type from two dimensions of link length and shape, the automatic identification and classification of the link topology structure is realized, identifying various possible attack intentions, which helps to quickly locate complex attacks or malicious self-sustaining attacks, and improves the accuracy and efficiency of abnormal event detection.

[0089] According to embodiments of this application, the abnormal causal types include multiple types; the abnormal causal types include at least one of abnormal nodes and abnormal directed edges; determining a comprehensive anomaly detection result based on at least one abnormal causal type includes: for each abnormal causal type, determining a sub-evaluation value for each abnormal causal type based on at least one of the number of abnormal nodes and the number of abnormal directed edges; weighted summing of the sub-evaluation values ​​for each abnormal causal type to obtain a causal anomaly evaluation value; and determining a comprehensive anomaly detection result based on the causal anomaly evaluation value and an anomaly threshold.

[0090] Anomaly causal graphs may contain a variety of anomalous attacks. For multiple anomalous events within the same time period obtained using multi-source heterogeneous data, various discrete anomalous causal types can be combined to determine the complex and multidimensional attacks that may exist within that time period.

[0091] For example, sub-evaluation values ​​can be determined based on each causal type of anomaly and its corresponding anomaly nodes and / or directed edges, and then weighted summed to obtain the causal anomaly evaluation value. The causal anomaly evaluation value is compared with an anomaly threshold. If the causal anomaly evaluation value is greater than the anomaly threshold, a comprehensive anomaly detection result indicating the presence of an anomaly can be determined; otherwise, a comprehensive anomaly detection result indicating the presence of an anomaly can be determined. Alternatively, the causal anomaly evaluation value can be compared with multiple anomaly thresholds to determine whether an anomaly exists while simultaneously achieving anomaly classification through multiple anomaly thresholds.

[0092] According to embodiments of this application, determining sub-evaluation values ​​for each abnormal causal type based on at least one of the number of abnormal nodes and the number of abnormal directed edges includes: in the case of a first abnormal causal type, determining a first sub-evaluation value based on the number of abnormal nodes in the first abnormal causal type and the total number of nodes in the abnormal causal graph; in the case of a second abnormal causal type, determining a second sub-evaluation value based on the number of abnormal directed edges in the second abnormal causal type and the total number of directed edges in the abnormal causal graph; and in the case of a third abnormal causal type, determining a third sub-evaluation value based on the number of abnormal links in the third abnormal causal type.

[0093] The first and second nodes mentioned above can be considered as anomalous nodes of the first anomalous causal type, the first and second directed edges can be considered as anomalous directed edges of the second anomalous causal type, and the first and second links can be considered as anomalous links of the third anomalous causal type. For specific anomalous causal types, the aforementioned nodes, directed edges, and links can have more specific correspondences with various anomalous causal types.

[0094] For example, the calculation methods and weights of various abnormal causal types and sub-evaluation values ​​can be referred to in Table 2 below:

[0095] Table 2

[0096]

[0097] Understandably, in Table 2, if the first abnormal causal type is either the source-less type or the effect-less type, the first sub-evaluation value can be respectively... and If the second abnormal causal type is either causal reversal type or causal loss type, the second sub-evaluator can be respectively... and If the third abnormal causal type is either an abnormal causal chain type or an abnormal feedback loop type, the third sub-evaluation value can be respectively... and .

[0098] In one specific embodiment, the weights of each abnormal causal type can be respectively: =0.20、 =0.15、 =0.25、 =0.15、 =0.15、 =0.10, ensuring that the weights of all abnormal causal types are combined to 1. The average reversal strength and length deviation factors can be determined according to the actual situation. The average reversal strength and length deviation factors are used to penalize the excessive length of the path and the number of reversals, respectively, and can be set to 0.8 and 0.6, respectively.

[0099] For example, causal anomaly assessment value It can reflect the degree of deviation between the abnormal causal relationship in the abnormal causal graph and the normal causal relationship in the baseline causal graph, and can be calculated by referring to the following formula (1):

[0100] (1).

[0101] For example, if the total number of nodes in the abnormal cause-effect graph is 20, the total number of directed edges is 30, the total number of links is 50, the number of first nodes (also called passive nodes) is 3, the number of second nodes (also called fruitless nodes) is 2, the number of first directed edges (also called reversed directed edges) is 5, the number of second directed edges (also called missing directed edges) is 8, the number of first links is 10, the number of second links in a loop is 1, the average reversal strength is 0.8, and the length deviation factor is 0.6, then 3 / 20 = 0.15 2 / 20 = 0.10 (5 / 30) × 0.8 = 0.133 8 / 30 = 0.267 (10 / 50) × 0.6 = 0.12 =1, =0.20×0.15+0.15×0.10+0.25×0.133+0.15×0.267+0.15×0.12+0.10×1=0.03+0.015+0.033+0.03+0.018+0.10=0.236.

[0102] In the embodiments of this application, by comprehensively considering various abnormal causal types for nodes, directed edges, and links, a more accurate and comprehensive abnormal causal structure score can be obtained, thereby more accurately identifying abnormal events and their causal relationships, improving the accuracy and reliability of abnormal event detection, and meeting the needs of abnormal event detection in complex scenarios.

[0103] According to another embodiment of this application, determining a comprehensive anomaly detection result based on a causal anomaly assessment value and an anomaly threshold includes: determining at least one additional assessment value; weighting and summing the causal anomaly assessment value and the at least one additional assessment value to obtain a comprehensive anomaly assessment value; and determining the comprehensive anomaly detection result based on a comparison between the comprehensive anomaly assessment value and the anomaly threshold.

[0104] In this embodiment, in addition to evaluating the correlation between anomalous events from the causal anomaly evaluation value of the causal dimension, it is also possible to combine anomaly analysis from other dimensions and integrate the additional evaluation values ​​obtained from the anomaly analysis of multiple dimensions with the causal anomaly evaluation value to achieve a comprehensive anomaly detection result.

[0105] For example, the assessment can be conducted in several dimensions, such as the severity of the event itself, its similarity to known attack patterns, and its concentration over time, to obtain additional assessment values.

[0106] According to embodiments of this application, the additional evaluation value includes: an anomalous pattern evaluation value. Determining at least one additional evaluation value includes: determining a target anomalous pattern baseline map from multiple anomalous pattern baseline maps based on the similarity between the anomalous causal graph and multiple anomalous pattern baseline maps, wherein the anomalous pattern baseline maps indicate anomalous patterns of a predetermined basic input / output system; determining a pattern confidence for the target anomalous pattern baseline map; and determining the anomalous pattern evaluation value based on the pattern confidence and the similarity between the target anomalous pattern baseline map and the anomalous causal graph.

[0107] Anomaly pattern evaluation values ​​indicate the similarity between an anomaly cause-effect graph and known attack patterns. The anomaly pattern baseline graph indicates pre-determined BIOS anomaly patterns, i.e., known attack patterns. For example, anomaly pattern baseline graphs can be constructed by referencing publicly available cases such as firmware attack techniques from the MITREATT&CK knowledge base and framework, BlackLotus, and SMM handles (rootkits). For each anomaly pattern baseline graph, its similarity to the anomaly cause-effect graph can be calculated. The anomaly pattern baseline graph with the highest similarity is then selected as the target anomaly pattern baseline graph. The anomaly pattern in the target anomaly pattern baseline graph is the anomaly pattern most similar to the anomaly cause-effect graph.

[0108] Anomaly patterns typically include multiple types, corresponding to multiple pattern confidence levels. Pattern confidence levels can be determined based on historical experience, with each anomaly pattern corresponding to a specific pattern confidence level. In a specific implementation example, the pattern confidence level for known mature attack patterns ranges from 0.9 to 1.0, the confidence level for newly discovered attack patterns ranges from 0.6 to 0.8, and the confidence level for experimental attack patterns ranges from 0.3 to 0.5.

[0109] For example, anomaly pattern evaluation value It can be calculated using formula (2):

[0110] (2);

[0111] in, This refers to the similarity between the anomaly cause-effect graph and the baseline graphs of each anomaly pattern, that is, the similarity between the target anomaly pattern baseline graph and the anomaly cause-effect graph. The scaling factor can be 0.2. Confidence refers to the pattern confidence, and its specific value can be determined based on the specific anomaly pattern.

[0112] In one specific embodiment, the similarity between the anomalous cause-effect graph and the anomalous pattern baseline graph is calculated as follows: Based on the minimum and maximum number of operations required to transform the anomalous cause-effect graph into the anomalous pattern baseline graph, the graph edit distance similarity is determined. Determine the graph embedding similarity between the anomaly cause-effect graph and the anomaly pattern baseline graph. The isomorphism similarity is determined based on the number of nodes in the subgraph that is isomorphic to the baseline graph of the anomaly cause-effect graph. ; Edit distance similarity of graphs Graph embedding similarity and isomorphic similarity The similarity between the abnormal cause-effect graph and the abnormal pattern baseline graph is obtained by weighted summation.

[0113] For example, the anomaly pattern baseline map of the i-th anomaly pattern. For example, graph edit distance similarity Graph embedding similarity and isomorphic similarity The following formulas (3) to (5) can be used to calculate the results respectively:

[0114] (3);

[0115] (4);

[0116] (5);

[0117] in, and These represent the transformation from the anomalous cause-effect graph G to the anomalous pattern baseline graph. Minimum and maximum number of operations required; These represent the anomaly cause-effect graph G and the anomaly pattern baseline graph, respectively. The graph embedding vectors can be determined by the topological structure of each graph, and cos() represents the cosine similarity. These represent the points found in the abnormal cause-effect graph G that correspond to the baseline graph of the abnormal pattern. The number of nodes in an isomorphic subgraph. Baseline plot representing abnormal patterns The total number of nodes can be determined from the abnormal causal graph G and the baseline graph of the abnormal patterns using a subgraph isomorphism algorithm. Isomorphic subgraphs It represents the absolute value.

[0118] The similarity between the anomaly cause-effect graph and the anomaly pattern baseline graph can be calculated using the following formula (6):

[0119] Similarity = (6);

[0120] Among them, graph edit distance similarity Graph embedding similarity and isomorphic similarity The weight can be determined according to the requirements.

[0121] In this embodiment, by comparing the similarity between the abnormal cause-effect graph and all abnormal pattern baseline graphs, the target abnormal pattern baseline graph with the highest similarity is selected. Based on the pattern confidence and similarity of the target abnormal pattern baseline graph, abnormal event detection can be achieved from the attack pattern characteristics presented by the overall multiple associated abnormal events, thereby realizing the detection of "what attacks these anomalies mean".

[0122] According to embodiments of this application, the additional evaluation value further includes at least one of the following: a time-based evaluation value and an event severity evaluation value; determining at least one additional evaluation value includes at least one of the following: for each anomalous event in the anomaly causal graph, determining a time-based evaluation value based on the distribution information of the event flow data of each anomalous event relative to time; determining a maximum level evaluation value and an average level evaluation value based on the level evaluation values ​​of each anomalous event in the anomaly causal graph; and determining an event severity evaluation value based on the maximum level evaluation value and the average level evaluation value; wherein the level evaluation value is predetermined based on the type of the anomalous event.

[0123] The time-focused assessment value is used to indicate the distribution characteristics of events on the timeline. In fact, some attacks manifest as sudden concentrations in time, and these attacks can be accurately identified through the time-focused assessment value. For example, the time-focused assessment value can be calculated using formula (7). :

[0124] (7);

[0125] For each event, H is the Shannon Entropy, determined based on the time when the event was triggered in the event stream data, used to indicate its distribution information relative to time. This represents the maximum entropy assuming a uniform distribution of events. In this embodiment, for SMI events, ACPI events, hardware events, etc., it can be calculated based on the above formula (7); for other event stream data detected at startup (such as the event stream data of POST events), it can be defaulted to a certain fixed value.

[0126] The event severity assessment value indicates the severity of the detected anomalous event itself, without considering the correlation between anomalous events. The severity assessment value for each anomalous event can be predetermined. For example, anomalous events are generally divided into five levels: CRITICAL, HIGH, MEDIUM, LOW, and INFO, with severity assessment values ​​of 0.9–1.0, 0.7–0.89, 0.4–0.69, 0.2–0.39, and 0.0–0.19 respectively. Specific severity assessment values ​​can be determined based on experience. For example, firmware tampering and SMM backdoor confirmation are typically CRITICAL events, with typical events being TPM PCR mismatch, PCR alteration, and hidden devices. Suspicious SMI activity and configuration tampering are typically HIGH events, with typical events being abnormal SMI frequency and SecureBoot configuration shutdown. Timing anomalies and resource conflicts are typically classified as medium risk (MEDIUM), with typical events including driver loading delays and Peripheral Component Interconnect Express (PCIE) conflicts. Single out-of-bounds incidents and suspicious but common incidents are typically classified as low risk (LOW), with typical events including brief temperature spikes and single data acquisition failures. Informational events are typically classified as unknown (INFO), with typical events including normal configuration changes and device hot-plugging.

[0127] For example, the severity assessment value of an event can be calculated using formula (8). :

[0128] (8);

[0129] in, This represents the severity rating of each anomalous event in the cause-effect graph, where there are a total of n anomalous events. and These represent the maximum and average grade assessment values, respectively.

[0130] In the embodiments of this application, by analyzing the temporal distribution characteristics of each abnormal event and its degree of harm to electronic devices, abnormal event detection can be achieved by comprehensively considering the information of the abnormal events themselves in a formula that takes into account the causal relationship of each abnormal event.

[0131] In one specific embodiment, the comprehensive anomaly assessment value is obtained by weighted summation of the comprehensive causal anomaly assessment value and at least one additional assessment value, which can be achieved by the following formula (9):

[0132] (9);

[0133] in, For comprehensive anomaly assessment values, , , , These are the severity assessment values ​​for the events. Causal anomaly assessment value Abnormal pattern evaluation value Time-based assessment value The weights are used to characterize the importance of the severity of the event itself, the importance of causal anomalies, the importance of matching known attack patterns, and the importance of time-series features, respectively. , , , The sum is 1. For example, the weights can be 0.3, 0.3, 0.3, and 0.1 respectively. , , Each accounting for 30% reflects the balanced importance of the three core dimensions. As an auxiliary judgment dimension, it accounts for only 10%.

[0134] Figure 4 A data flow diagram illustrating the determination of the comprehensive anomaly assessment value according to an embodiment of this application is shown. For example... Figure 4 As shown, after analyzing the event stream data of multiple events to identify anomalous event stream data and constructing an anomaly causal graph, for anomalies commonly exhibited by multiple anomalous events: the anomaly causal graph can be compared with a baseline causal graph to determine the causal anomaly assessment value; the anomaly causal graph can also be compared with multiple anomaly pattern baseline graphs to determine the target anomaly pattern baseline graph and its anomaly pattern assessment value. For anomalies of a single anomalous event itself, a time-series assessment value and an event severity assessment value can be determined based on the event stream data. The weighted sum of these four assessment values ​​yields the final comprehensive anomaly assessment value, which is then used for comprehensive anomaly detection.

[0135] In the embodiments of this application, by comprehensively considering the time distribution and harm distribution of the abnormal events themselves, the causal relationship between multiple abnormal events, and the overall similarity with the attack pattern, it is possible to fully and perfectly realize the end-to-end anomaly detection of "what anomaly occurred", "what causal relationship exists between these anomalies", and "what attack caused these anomalies", thereby improving the accuracy and intuitiveness of anomaly detection.

[0136] In another specific embodiment, the comprehensive anomaly assessment value is obtained by weighted summation of the causal anomaly assessment value and at least one additional assessment value, including: determining the dynamic weights of the causal anomaly assessment value and the additional assessment value based on the comparison results between the causal anomaly assessment value and the additional assessment value and their respective corresponding system state thresholds; and weighted summation of the causal anomaly assessment value and the additional assessment value with their respective dynamic weights to obtain the comprehensive anomaly assessment value.

[0137] In this embodiment, the weights of the causal anomaly assessment value and the additional assessment value can also be dynamically adjusted. Event severity assessment value. Causal anomaly assessment value Abnormal pattern evaluation value Time-based assessment value The dynamic weights can be respectively , , , .

[0138] For example, in the causal anomaly assessment value When the system state threshold is exceeded, some suspicious anomalies with causal relationships may have occurred. In this state, the system is in an attack warning state. The dynamic weight of the causal anomaly assessment value is increased to raise its proportion in the overall anomaly assessment value and to promptly identify anomalies with potential causal relationships. For example, the event severity assessment value can be reduced. The corresponding dynamic weights increase the causal anomaly assessment value. The corresponding dynamic weights are set to ensure that the sum of the dynamic weights is 1. , , , .

[0139] For example, in the evaluation value of abnormal patterns When the system state threshold is exceeded, an attack that hits a known attack pattern occurs. At this point, the system state is a known attack frequent state, which can improve the anomaly pattern evaluation value. Dynamic weighting. For example, it can reduce the severity assessment value of an event. and causal anomaly assessment value The corresponding dynamic weights are used to increase the evaluation value of abnormal patterns. The corresponding dynamic weights are set to ensure that the sum of the dynamic weights is 1. , , , .

[0140] The two embodiments described above can be viewed as balancing dynamic weights among three key dimensions.

[0141] For example, in time-centralized evaluation values When the system state threshold is exceeded, frequent attacks occur, and the system state becomes a time-sensitive business state. Therefore, the time-based assessment value can be increased. Dynamic weights. For example, they can reduce the causal anomaly assessment value. and abnormal pattern evaluation value The corresponding dynamic weights are added to the time-centralized evaluation value. The corresponding dynamic weights are set to ensure that the sum of the dynamic weights is 1. , , , .

[0142] In this embodiment, by adjusting the dynamic weights of different dimensions, the comprehensive anomaly detection results can better reflect the actual operating state of the current system, avoiding detection bias caused by fixed weights and improving the accuracy and adaptability of anomaly detection.

[0143] Figure 5 A data flow diagram for abnormal event detection according to an embodiment of this application is shown. Figure 5 As shown, multi-level baselines can be pre-built. When anomaly detection is required, multi-source heterogeneous event stream data is collected and processed at runtime. After anomaly detection, anomaly event stream data from multiple event streams can be obtained, and causal relationship analysis can be performed based on this. Subsequently, the anomaly causal graph constructed during the causal analysis process can be compared with the anomaly pattern baseline graph to achieve anomaly pattern recognition. In the above process, the event severity assessment value and time settling assessment value can also be determined simultaneously. By combining the four dimensions of anomalies, a comprehensive anomaly assessment can be achieved, resulting in a comprehensive anomaly detection result. Afterward, a graded response can be performed based on the comprehensive anomaly detection result.

[0144] Causal relationship analysis can include a causal discovery layer for performing causal relationship analysis and a causal graph construction layer for constructing anomaly causal graphs. Furthermore, Figure 5 The operations following the causal relationship analysis can be implemented by the attack chain identification layer, and can also be regarded as part of the causal relationship analysis.

[0145] According to an embodiment of this application, an abnormal causal graph is constructed based on abnormal event stream data in multiple event stream data, including: performing causal analysis on any two abnormal event stream data in multiple abnormal event stream data to obtain causal analysis results; when the causal analysis results indicate that there is a causal relationship between the two abnormal event stream data, constructing an abnormal causal graph by taking the abnormal events corresponding to the two abnormal event stream data as nodes and the causal relationship as directed edges.

[0146] Granger causality tests can be used to perform pairwise causal analysis on two anomalous event streams, yielding causal analysis results that characterize whether a causal relationship exists between the two anomalous event streams. For multiple anomalous event streams, performing a full pairwise causal analysis can determine whether a causal relationship exists among the multiple anomalous events, and an anomalous causal graph can be constructed based on this. The Granger causality test is a statistical hypothesis test used to determine whether one time series can predict another time series.

[0147] For example, taking the event stream data of both SMI and ACPI events as anomalous event stream data, we assume that the ACPI event is not the cause of the SMI event, that is, we assume that there is no causal relationship from the ACPI event to the SMI event. Under this assumption, the anomalous event stream data of the SMI and ACPI events constitute a pair of event sequences. Regression predictions are then performed on this event sequence using both restricted and unrestricted models. The restricted model relies solely on historical SMI events to predict the frequency of future SMI events, completely ignoring ACPI events. The unrestricted model, on the other hand, uses both historical ACPI and historical SMI events to predict the SMI event.

[0148] The F-statistic is calculated using the following formula (10):

[0149] (10);

[0150] in, and represents the sum of squared residuals for the constrained and unconstrained models, respectively; m represents the total number of samples in the data stream for each event; and p represents the lag order, which can be determined according to the actual situation.

[0151] If the F-statistic is greater than the critical value or the significance probability (p-value) obtained from the table based on the F-statistic is less than the corresponding probability threshold, it indicates that the hypothesis is not valid, and the null hypothesis (ACPI event is not the cause of SMI event) is rejected, thus obtaining the causal relationship that ACPI event is the cause of SMI event.

[0152] In this embodiment, to ensure a uniform total sample size *m* in each abnormal event data stream, the abnormal event stream data for each abnormal event can be processed first. For example, an equally spaced counting sequence can be constructed within a time window, where each sequence value represents the number of times the event occurred within the time window, and the window length is 100 ms. Alternatively, for events with intensity attributes (such as the specific degree Celsius the temperature exceeded in a temperature increase event), an event intensity sequence can be constructed, where each sequence value represents the product of the number of times the event occurred within the window duration and the event intensity. Then, the Granger causality test is performed using these multiple sequences. It should be noted that when constructing these multiple sequences and using them for causal analysis, the chronological order of the time windows in each event sequence must be maintained to ensure the correct temporal sequence between sequences. After analyzing the causal relationships between multiple abnormal event stream data, an abnormal causal graph can be constructed.

[0153] In one specific embodiment, when constructing the directed edges in the abnormal cause-effect graph, the strength of the directed edge from node i to node j can also be determined simultaneously based on the following formula (11). :

[0154] (11);

[0155] Among them, strength This represents the percentage decrease in prediction error for anomalous event j after introducing another anomalous event corresponding to node i. For example, introducing an ACPI event to predict an SMI event represents the percentage decrease in prediction error, and its intensity. The value of is [0,1], and the intensity is . The larger the value, the stronger the causal relationship.

[0156] Furthermore, after constructing the abnormal cause-effect graph, operations such as redundant edge removal can be performed. For example, if there is a directed edge and multiple indirect directed edges between two nodes, and the strength of the directed edge is less than the strength of all indirect directed edges, then the directed edge between the two nodes is removed. Multiple indirect directed edges can form a causal relationship between the two nodes.

[0157] For example, if an abnormal cause-effect graph contains a directed edge from node A to node C, an indirect directed edge from node A to node B, and an indirect directed edge from node B to node C, and the strength of the directed edge from node A to node C is less than that of the indirect directed edges A→B and B→C, then the directed edge A→C is essentially a pseudo-direct correlation. Therefore, the directed edge A→C should be removed, and only the A→B→C portion should be retained. Alternatively, the minimum strength of all indirect directed edges can be taken. If the strength of a directed edge is less than half of the minimum value, then the directed edge between the two nodes should be removed.

[0158] In other embodiments, after constructing the abnormal cause graph, information such as the total number of nodes, the total number of directed edges, the total number of links, the in-degree, and the out-degree in the abnormal cause graph can be recorded synchronously to facilitate comparison with the baseline cause graph.

[0159] In the embodiments of this application, by constructing an abnormal causal graph using an abnormal event stream and pruning the abnormal causal graph to obtain the final abnormal causal graph, redundant pseudo-direct association edges can be removed, making the structure of the abnormal causal graph more closely resemble the real causal relationship, reducing the computational differences in subsequent difference comparisons, and improving the accuracy of causal analysis.

[0160] According to an embodiment of this application, the event stream data includes detection data at multiple time points, and the detection data includes parameters that trigger the event. The method further includes: for any event stream data in the multiple event stream data, performing anomaly detection on the parameters in the event stream data based on a parameter baseline corresponding to the parameters, to obtain a first anomaly detection result; performing anomaly detection on the event stream data using a time-series-based machine learning model, to obtain a second anomaly detection result; performing anomaly detection on the execution order of parameters for the same event in the event stream data, to obtain a third anomaly detection result; and determining whether the event stream data is abnormal event stream data based on at least one of the first anomaly detection result, the second anomaly detection result, and the third anomaly detection result.

[0161] Multiple event stream data can be subjected to hierarchical parallel anomaly detection in various ways. For example, if any one of the first, second, and third anomaly detection results indicates an anomaly, then the event stream data is determined to be an anomalous event stream data.

[0162] Figure 6 The multi-level baseline involved in the anomaly detection process according to an embodiment of this application is shown. Figure 7 The flowchart illustrating hierarchical parallel anomaly detection according to an embodiment of this application is shown. Figure 6 As shown, multi-level baselines can include time-series baselines, spectral baselines, topology baselines, integrity baselines, and configuration baselines. Figure 7 As shown, hierarchical parallel anomaly detection can include a single-point detection layer, a pattern detection layer, and a graph detection layer.

[0163] For example, such as Figure 7 As shown, anomaly detection of parameters in event stream data can be achieved through a single-point detection layer. The single-point detection layer includes a hash verification engine, a whitelist check engine, and a range check engine. The hash verification engine...

[0164] The parameters being detected can be the hash values ​​of various modules loaded during a module load event or the hash values ​​of configuration variables during a configuration change event, such as the hash value of the firmware image, the hash values ​​of various firmware modules, the hash value of the current value of the TPM PCR register, and the hash values ​​of configuration variables. The hash verification engine can look up the corresponding parameter baseline (the hash value corresponding to the normal state) from the baseline library based on the module identifier or PCR index, and compare the parameter baseline and the real-time parameters byte-by-byte. If they are the same, a first anomaly detection result indicating normality is obtained; otherwise, a first anomaly detection result indicating an anomaly is obtained.

[0165] In some embodiments, the firmware image includes: the entire firmware image in the Serial Peripheral Interface (SPI) flash memory, each individual firmware volume, each firmware file, each UEFI driver and application, etc. Configuration variables can be configuration variables in the UEFI's Non-Volatile Random Access Memory (NVRAM), including but not limited to: security-related variables, such as SecureBoot (on / off state) and SetupMode (setup mode state); boot configuration variables, such as BootOrder (boot order list) and detailed configuration of each boot item; and hardware configuration variables, such as ConIn (console input device) and ConOut (console output device), etc.

[0166] The whitelist checking engine can detect parameters such as the name (ID) of the driver loaded in the module loading event, the name of the running UEFI application, the name of the configuration variable, the address of the registered callback function, and the device name of the PCIe device. Similar to the hash verification engine, anomaly detection can be achieved by determining whether the above parameters are in the corresponding whitelist. The whitelist can be dynamic, including administrator updates and temporary permissions. Whitelist matching supports various methods such as exact character-by-character matching, wildcard fuzzy matching, and address range matching.

[0167] The range checking engine can detect specific parameter values ​​from various events. For example, it can detect module initialization time (whether it exceeds the normal range), SMI frequency (whether it exceeds the physically possible range), temperature / voltage sensor readings (whether they exceed the safe range), memory address access (whether they are within the allowed range), interrupt vector number (whether they are within the valid range), etc. If any of these parameters exceeds their respective normal ranges, a first anomaly detection result indicating an anomaly is obtained; conversely, a first anomaly detection result indicating normality is obtained. Furthermore, even if the parameters do not exceed their respective normal ranges, but their values ​​rapidly approach the boundary, a trend warning can be triggered.

[0168] Regarding module initialization time, a timing baseline can be pre-established by collecting the initialization times of at least 100 normal boots and determining the normal range. Specifically, the modules being initialized can include all EFI pre-initialization modules and Driver Execution Environment (DXE) modules, such as CPU initialization modules, memory initialization modules, PCIe enumeration modules, and storage controller drivers. In the firmware embedded agent, timestamp collection code can be inserted at the entry and exit points of each module. Timestamp counters are used to record the module entry and exit times T_entry and T_exit, and the difference between the two is the module initialization time, which is then used to define the normal range. Alternatively, a kernel density estimation can be performed based on the initialization times of 100 normal boots to obtain the probability density distribution function, and the normal range can be determined based on the probability density distribution function.

[0169] For example, such as Figure 7 As shown, anomaly detection in event stream data can be achieved through a pattern detection layer. For example, the machine learning model can be a Long Short-Term Memory (LSTM) network, an isolation forest, or a spectrum analysis model. The pattern detection layer can include an LSTM time-series detection engine, an isolation forest detection engine, and a spectrum analysis engine corresponding to the aforementioned models, respectively. For instance, the LSTM can detect event stream data such as POST events, module loading events, ACPI events, and configuration change events. After each event stream data is input into the LSTM, a second anomaly detection result is output, indicating whether it is an anomaly. Alternatively, the isolation forest can detect event stream data of ACPI events, where the parameters of this event stream data can include event type, trigger frequency, execution time, interval time, CPU cores, etc. These parameters can serve as multi-dimensional features to identify whether there are abnormal time points in the entire event stream data. If an anomaly exists, the ACPI event can be determined as an anomalous event, and the specific event type at the abnormal time point can be recorded.

[0170] Alternatively, the object of the spectrum analysis model can be the event stream data of SMI events, and the parameter at each time point can be the number of times the SMI event is triggered. For example, the event stream data can be uniformly sampled at fixed time windows (e.g., 1 ms), and then Fast Fourier Transform (FFT) and Continuous Wavelet Transform (CWT) can be performed on the uniformly sampled event stream data. Time-domain features can be collected from the uniformly sampled event stream data. Time-domain features can include: the average occurrence rate of SMI events (times / second), the time series of SMI event occurrence rates (used to detect burst patterns), the statistical distribution of SMI event intervals (mean, variance, skewness, kurtosis), and the distribution proportion of SMI event sources (how much timer, how much USB, etc.). After performing the FFT operation, frequency-domain features can be collected, such as power spectral density, dominant frequency components (frequency whose peak frequency amplitude in the power spectrum exceeds three times the background noise), spectral centroid, and spectral bandwidth. Wherein, the power spectral density P(f) = |S(f)|², where S(f) is the frequency domain representation of the uniformly sampled event stream data after FFT, and f is the frequency.

[0171] After performing CWT on the uniformly sampled event stream data, time-frequency features can be collected. These features can include a time-frequency spectrogram (horizontal axis: time, vertical axis: frequency, values ​​representing energy intensity), energy ridges (the path with the highest energy on the time-frequency spectrogram), and a scale map (an image showing how wavelet coefficients change with scale). For example, Morlet wavelets can be chosen as the basis function, and CWT can be performed using formula (12):

[0172] (12);

[0173] in, This represents the event stream data after uniform sampling. Let represent the complex conjugate of the basis functions, 'a' represent the scale factor, controlling the frequency scaling of the wavelet, 'b' represent the translation factor, controlling the position of the wavelet on the time axis, and 't' represent time. After mapping the scale factor to the corresponding physical frequency, the time-spectrum diagram can be obtained by taking the square of the modulus of the complex wavelet coefficients.

[0174] By comparing the spectral baselines corresponding to the aforementioned time-domain features, frequency-domain features, and time-frequency features, it can be determined whether the SMI event is abnormal. In a specific embodiment, the spectral baseline can be a baseline feature determined under multiple load conditions. During comparison, the spectral baseline under the same load condition as the event stream data can be obtained. Load conditions can include: idle state, light load state, medium load state, heavy load state, input / output load state, power management state, hot-plug state, etc.

[0175] For example, if a persistent fixed frequency peak appears, and this fixed frequency peak is not present in the baseline spectrum, then the SMI event is determined to have a periodic anomaly. A typical example is the triggering of an SMM timer backdoor. Periodic anomalies can be identified by checking whether the baseline features have a corresponding fixed frequency peak and whether these frequencies are persistent (e.g., whether the fixed frequency peak is present in several consecutive windows).

[0176] If a brief high-energy region appears on the time-spectrum graph, or if the incidence of short-term SMI events is significantly higher than the baseline mean of the spectrum, then the SMI event is determined to be a sudden anomaly. A typical example is a one-time SMM load execution. The brief high-energy region can be determined by calculating the energy distribution at each time point, and the burst time, frequency, and energy intensity can be recorded simultaneously.

[0177] If the KL divergence exceeds a threshold, it indicates a change in the overall spectrum, thus confirming a spectral shift in the SMI event. A typical example is a change in firmware behavior patterns. KL divergence It can be calculated using the following formula (13):

[0178] (13);

[0179] in, and These represent the power spectral density calculated based on the current data and the baseline power density under the same load conditions, respectively, where f is the frequency. The larger the KL divergence, the greater the difference in spectral characteristics.

[0180] If the energy of a certain frequency band is significantly higher than the energy of the corresponding frequency band of the spectral baseline, then an energy anomaly is identified in the SMI event; a typical example is abnormal SMI activity. Here, the difference in frequency bands can be found by performing structural similarity calculations between the time-spectrum plot and the baseline time-spectrum plot in the spectral baseline; alternatively, frequency bands can be directly divided according to a fixed bandwidth.

[0181] For example, such as Figure 7 As shown, a graph detection layer can be used to detect anomalies in the execution order of parameters for the same event in event stream data, resulting in a third anomaly detection result. The graph detection layer can analyze anomalies that appear normal at individual points and in terms of timing, but whose overall structure has changed. The graph detection layer can include: a resource topology graph detection engine, a dependency graph detection engine, and a control flow graph detection engine. The resource topology graph detection engine detects objects including: system resource allocation graphs (PCIe topology, memory allocation, interrupt allocation) and periodic constructions (e.g., every 10 minutes).

[0182] The resource topology graph detection engine can construct a resource topology graph by integrating event stream data from multiple events. Nodes in the resource topology graph include processor nodes, chipset nodes, bus nodes, device nodes, and memory nodes; edges include physical connection edges, resource allocation edges, interrupt allocation edges, Direct Memory Access (DMA) relationship edges, and power relationship edges. A third anomaly detection result can be determined based on the similarity between the embedding vectors of the resource topology graph and a baseline resource topology graph (which can be called the topology baseline). If the similarity is less than a threshold, a third anomaly detection result representing an anomaly is obtained, and all events are treated as anomalous events; otherwise, a third anomaly detection result representing normality is obtained.

[0183] The dependency graph detection engine can construct a dependency graph based on the dependencies between modules loaded during a module loading event and the basic code blocks within those modules. This could include graphs corresponding to driver loading order, protocol dependencies, function call relationships, etc. Similarly, the control flow graph detection engine can construct a control flow graph based on the loading order of various firmware components during a module loading event. The dependency graph and control flow graph can be compared with their corresponding baseline graphs (which can be called the integrity baseline) using embedding vector similarity calculations to determine if any anomalies exist. If the similarity is less than a threshold, a third anomaly detection result representing an anomaly is obtained, and the module loading event is treated as an anomalous event; otherwise, a third anomaly detection result representing normality is obtained.

[0184] The embedding vectors of each graph targeted by the graph detection layer and the embedding vectors of the abnormal causal graph can both be calculated using graph neural networks or graph models. For example, the embedding vector of each node in the graph can be calculated using the following formula (14), and the embedding vector of the entire graph can be calculated by combining the embedding vectors of multiple nodes in the graph using formula (15):

[0185] (14);

[0186] (15);

[0187] in, is the embedding vector of node v at level k. When k=1, the embedding vector uses initial features, such as the attributes of each node. For example, the attributes of nodes (basic blocks) in the control flow graph include: basic block size (number of bytes), number of instructions, number of call instructions, number of arithmetic instructions, number of memory access instructions, etc. N(v) is the set of neighbors of node v, which can be obtained by sampling a fixed number of nodes from its neighbors, such as sampling 10 first-order neighbors and 5 second-order neighbors. This represents the embedding vector of all neighboring nodes u of node v at layer k-1. This represents the mean aggregator, used to average the embedding vector of node v at level k-1 and the embedding vectors of all its neighboring nodes u at level k-1. It is the trainable weight matrix of the k-th layer, which can be obtained through training. It is a non-linear activation function, such as ReLU. h represents the embedding vector of the graph. This represents the readout function. h can be obtained by reading the embedding vectors of all nodes v in the node set V of the graph at the k-th layer. The readout function can be a mean readout function, a summation readout function, a maximum value readout function, an attention readout function, etc.

[0188] The aforementioned three-tiered anomaly detection can utilize time-series baselines, spectral baselines, topology baselines, integrity baselines, and configuration baselines for multi-dimensional anomaly detection. Layered anomaly detection prevents attackers from simultaneously evading all dimensions of detection; anomalies in any one dimension will expose attack behavior, and anomalies in different dimensions can corroborate each other. Therefore, layered anomaly detection can improve detection coverage, especially enabling the detection of SMM stealth activities that are completely imperceptible to traditional methods, and distinguishing between normal power management events and malicious SMI activities.

[0189] In some embodiments, the detection architecture may include a data acquisition layer, a detection layer, and a decision layer. A data acquisition layer may be configured in the firmware layer, system management mode memory region, or hardware management engine of the electronic device. This layer is used to acquire characteristic data of BIOS firmware runtime from multiple heterogeneous dimensions in an out-of-band manner in a bare-metal environment without operating system dependence, ensuring the immutability of the acquisition channel. The hardware management engine may include a Baseboard Management Controller (BMC) and a Platform Security Processor (PSP). The data acquisition layer can connect to the detection layer, transmitting the acquired event stream data to the detection layer. The detection layer performs anomaly detection on multiple event stream data and obtains anomalous event stream data. The decision layer analyzes the anomalous event stream data to obtain a comprehensive anomaly detection result. Furthermore, the detection architecture may also include a response layer, used to execute corresponding anomaly response strategies based on the comprehensive anomaly detection result, such as isolation, blocking, recovery, and forensics.

[0190] Multiple event streams during runtime are typically multi-source heterogeneous data. Therefore, the acquisition layer can continuously acquire raw data from various acquisition dimensions during normal device operation and process the raw data into standardized event stream data that can be analyzed by the detection layer.

[0191] Figure 8A flowchart illustrating the acquisition and processing of runtime multi-source heterogeneous event stream data according to an embodiment of this application is shown. Figure 8 As shown, the acquisition layer can collect raw data through periodic polling and event-triggered modes. These two modes work together to ensure that no critical events are missed, while also preventing excessive data collection from impacting system performance. The basic strategy of periodic polling is to actively query each acquisition point (such as each BIOS firmware and its internal parameters) at fixed time intervals (e.g., 100ms) to obtain current snapshot data, which is then used as the raw data. Periodic polling is typically suitable for metrics that change relatively slowly and require continuous monitoring. The basic strategy of event-triggered mode is that when a specific event occurs, the event source actively notifies the acquisition layer, which immediately records the event and its related context, using it as raw data. Event-triggered mode is suitable for critical events requiring immediate response.

[0192] The raw data collected often contains issues such as missing data, duplicates, and inconsistent formats, requiring data preprocessing to obtain event stream data for subsequent analysis. For example... Figure 8 As shown, data preprocessing can include: data cleaning, interpolation, and normalization.

[0193] For missing data, such as data loss due to sensor malfunction or data read failure due to bus congestion, the data cleaning process marks truly missing data as NaN and ignores it in subsequent analysis. It also uses the previous successful value as the data for failed acquisition, performs deduplication on duplicate data, and issues an alarm for consecutive failed acquisitions of periodic data. For example, deduplication can include: retaining only the earliest timestamp for identical records to achieve precise deduplication; merging multiple very close records (time difference less than 1ms and identical content) into one record to achieve approximate deduplication; and sampling and compressing a large number of recurring events within a short period (such as interruption storms) to achieve burst deduplication. Furthermore, outliers can be removed from values ​​exceeding the physically possible range (such as negative time intervals or extremely high temperatures); values ​​exceeding the 3σ range can be removed based on the distribution characteristics of event stream data; and outliers can also be filtered out using low-pass filtering, median filtering, Kalman filtering, and other filtering methods.

[0194] After data cleaning, the irregular raw data can be transformed into regular time-series data, facilitating subsequent spectral analysis and time-series modeling. Different interpolation methods can be used for different data sources. For example, nearest neighbor interpolation is suitable for discrete states (such as SMI occurrence / non-occurrence); linear interpolation is suitable for continuous values ​​(such as temperature and voltage); spline interpolation is suitable for smoothly changing curves, such as CPU load trends; and forward imputation is suitable for variables that maintain their state (such as configuration values ​​that are only updated when they change). For long data gap windows (such as during system hibernation), special marking is used instead of interpolation: the interval is marked as a "GAP" range, the start time and duration of the GAP are recorded, and a connection is established between data points before and after the GAP.

[0195] For data that has undergone interpolation, parameter values ​​of various types can be normalized. For example, Min-Max normalization can be used to map discrete parameter values ​​to the [0,1] interval. The mapped parameter value x_norm = (x - x_min) / (x_max - x_min), where x_min and x_max represent the minimum and maximum values ​​of the same parameter, and x_norm represents the normalized standard value. Alternatively, Z-score normalization can be used to convert continuous parameter values ​​into a distribution with a mean of 0 and a variance of 1. The mapped parameter value x_std = (x - μ) / σ1, where μ represents the mean, σ1 represents the variance, and x_std represents the normalized standard value.

[0196] For the response layer, the response level and handling strategy for the anomaly can be determined based on the range of evaluation values ​​that the comprehensive anomaly detection evaluation value falls into. For example, the response layer can implement a tiered response according to Table 3, which avoids overreacting to low-risk events while ensuring timely blocking of high-risk attacks.

[0197] Table 3

[0198]

[0199] As shown in Table 3, when the comprehensive anomaly detection evaluation value falls within the range of 0.0-0.2, the response level is 0, indicating an ignored state where no response is required and only internal recording is performed. When the comprehensive anomaly detection evaluation value falls within the range of 0.2-0.4, the response level is 1, indicating an observation state where enhanced monitoring and more information can be collected to confirm the threat without interfering with normal system operation. When the comprehensive anomaly detection evaluation value falls within the range of 0.4-0.6, the response level is 2, indicating an alarm state where the security administrator can be notified and sufficient information can be provided for manual decision-making. When the comprehensive anomaly detection evaluation value falls within the range of 0.6-0.8, the response level is 3, indicating a blocking state where attacks can be blocked non-intrusively without restarting the system or affecting normal business operations. This can be achieved by locating and precisely blocking anomaly events according to the anomaly causal relationship diagram. When the comprehensive anomaly detection evaluation value falls within the range of 0.8-1.0, the response level is 4, indicating an isolation state where hardware isolation and recovery can be performed when an attack is confirmed and cannot be blocked by non-intrusive means, until the system is brought to a trusted state. Values ​​falling within the boundaries of the above intervals can be considered to fall within the smaller interval range.

[0200] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0201] Figure 9 An abnormal event detection apparatus according to an embodiment of this application is shown. Figure 9 As shown, the abnormal event detection device 900 includes: an acquisition module 910, used to acquire event stream data obtained by performing detection on multiple events, wherein the events include events characterizing the interaction between the basic input / output system and the firmware; a construction module 920, used to construct an abnormal causal graph based on the abnormal event stream data in the multiple event stream data, wherein the abnormal causal graph indicates the causal relationship between multiple abnormal events corresponding to the multiple abnormal event stream data; and a detection module 930, used to determine the comprehensive abnormal detection result for the abnormal causal graph based on the difference between the abnormal causal graph and the baseline causal graph, wherein the baseline causal graph indicates the causal relationship between normal events.

[0202] According to an embodiment of this application, an abnormal cause-effect graph includes multiple nodes and multiple directed edges. Nodes indicate abnormal events, and the direction of a directed edge indicates a causal relationship between two nodes connected to the directed edge. The detection module 930 is configured to: determine a first difference between a node in the abnormal cause-effect graph and a corresponding node in the baseline cause-effect graph; determine a second difference between a directed edge in the abnormal cause-effect graph and a corresponding directed edge in the baseline cause-effect graph; determine at least one abnormal cause-effect type based on at least one of the first and second differences; and determine a comprehensive abnormal detection result based on at least one abnormal cause-effect type.

[0203] According to embodiments of this application, determining at least one abnormal causal type based on at least one of a first difference and a second difference includes: for any node in the abnormal causal graph, determining a first abnormal causal type based on the second difference, wherein the first abnormal causal type indicates that the node is abnormal; for any directed edge in the abnormal causal graph, determining a second abnormal causal type based on the first difference, wherein the second abnormal causal type indicates that the directed edge is abnormal; and determining a third abnormal causal type based on the first difference and the second difference, wherein the third abnormal causal type indicates that both the node and the directed edge are abnormal.

[0204] According to embodiments of this application, the first abnormal causal type includes at least one of the following: a source-less type and a result-less type; for any node in the abnormal causal graph, based on a second difference, the first abnormal causal type is determined to include at least one of the following: for a first node in the abnormal causal graph, if the second difference indicates that there is no directed edge pointing to the first node in the abnormal causal graph, and there is a corresponding directed edge in the baseline causal graph, the abnormal causal graph is determined to have a source-less type; for a second node in the abnormal causal graph, if the second difference indicates that there is no directed edge originating from the second node in the abnormal causal graph, and there is a corresponding directed edge in the baseline causal graph, the abnormal causal graph is determined to have a result-less type.

[0205] According to embodiments of this application, the second abnormal causal type includes at least one of the following: causal reversal type and causal missing type; for any directed edge in the abnormal causal graph, based on a first difference, the second abnormal causal type is determined, including at least one of the following: for a first directed edge in the abnormal causal graph, if the first difference indicates that the two endpoints of the first directed edge correspond to the two endpoints of the corresponding directed edge in the baseline causal graph, and the directions of the first directed edge and the corresponding directed edge are opposite, the abnormal causal graph is determined to have a causal reversal type; if there is no second directed edge in the abnormal causal graph, and there is a corresponding directed edge in the baseline causal graph, the abnormal causal graph is determined to have a causal missing type.

[0206] According to embodiments of this application, the third abnormal causal type includes: an abnormal causal chain type and an abnormal feedback loop type; the third abnormal causal type is determined based on the first difference and the second difference, including at least one of the following: when the first difference and the second difference indicate that there is a first link in the abnormal causal graph and there is no corresponding link in the baseline causal graph, and the link length of the first link is greater than a length threshold, the abnormal causal graph is determined to have an abnormal causal chain type, wherein the first link is obtained by sequentially combining nodes and directed edges; when the first difference and the second difference indicate that there is a loop-shaped second link in the abnormal causal graph and there is no corresponding link in the baseline causal graph, the abnormal causal graph is determined to have an abnormal feedback loop type.

[0207] According to embodiments of this application, the abnormal causal types include multiple types; the abnormal causal types include at least one of abnormal nodes and abnormal directed edges; determining a comprehensive anomaly detection result based on at least one abnormal causal type includes: for each abnormal causal type, determining a sub-evaluation value for each abnormal causal type based on at least one of the number of abnormal nodes and the number of abnormal directed edges; weighted summing of the sub-evaluation values ​​for each abnormal causal type to obtain a causal anomaly evaluation value; and determining a comprehensive anomaly detection result based on the causal anomaly evaluation value and an anomaly threshold.

[0208] According to embodiments of this application, determining sub-evaluation values ​​for each abnormal causal type based on at least one of the number of abnormal nodes and the number of abnormal directed edges includes: in the case of a first abnormal causal type, determining a first sub-evaluation value based on the number of abnormal nodes in the first abnormal causal type and the total number of nodes in the abnormal causal graph; in the case of a second abnormal causal type, determining a second sub-evaluation value based on the number of abnormal directed edges in the second abnormal causal type and the total number of directed edges in the abnormal causal graph; and in the case of a third abnormal causal type, determining a third sub-evaluation value based on the number of abnormal links in the third abnormal causal type.

[0209] According to an embodiment of this application, determining a comprehensive anomaly detection result based on a causal anomaly assessment value and an anomaly threshold includes: determining at least one additional assessment value; weighting and summing the causal anomaly assessment value and the at least one additional assessment value to obtain a comprehensive anomaly assessment value; and determining the comprehensive anomaly detection result based on a comparison between the comprehensive anomaly assessment value and the anomaly threshold.

[0210] According to embodiments of this application, the additional evaluation value includes: an anomalous pattern evaluation value. Determining at least one additional evaluation value includes: determining a target anomalous pattern baseline map from multiple anomalous pattern baseline maps based on the similarity between the anomalous causal graph and multiple anomalous pattern baseline maps, wherein the anomalous pattern baseline maps indicate anomalous patterns of a predetermined basic input / output system; determining a pattern confidence for the target anomalous pattern baseline map; and determining the anomalous pattern evaluation value based on the pattern confidence and the similarity between the target anomalous pattern baseline map and the anomalous causal graph.

[0211] According to embodiments of this application, the additional evaluation value further includes at least one of the following: a time-based evaluation value and an event severity evaluation value; determining at least one additional evaluation value includes at least one of the following: for each anomalous event in the anomaly causal graph, determining a time-based evaluation value based on the distribution information of the event flow data of each anomalous event relative to time; determining a maximum level evaluation value and an average level evaluation value based on the level evaluation values ​​of each anomalous event in the anomaly causal graph; and determining an event severity evaluation value based on the maximum level evaluation value and the average level evaluation value; wherein the level evaluation value is predetermined based on the type of the anomalous event.

[0212] According to an embodiment of this application, a comprehensive anomaly assessment value is obtained by weighted summation of the causal anomaly assessment value and at least one additional assessment value, including: determining the dynamic weights of the causal anomaly assessment value and the additional assessment value based on the comparison results between the causal anomaly assessment value and the additional assessment value and their respective corresponding system state thresholds; and weighted summation of the causal anomaly assessment value and the additional assessment value with their respective dynamic weights to obtain the comprehensive anomaly assessment value.

[0213] According to an embodiment of this application, the construction module 920 is configured to: perform causal analysis on any two abnormal event streams from a plurality of abnormal event streams to obtain causal analysis results; and, if the causal analysis results indicate that there is a causal relationship between the two abnormal event streams, construct an abnormal causal graph by taking the abnormal events corresponding to the two abnormal event streams as nodes and the causal relationship as directed edges.

[0214] According to an embodiment of this application, the event stream data includes detection data at multiple time points. The detection data includes parameters that trigger the event. The abnormal event detection device 900 further includes an abnormal detection module, configured to: perform anomaly detection on the parameters in the event stream data based on a parameter baseline corresponding to the parameters for any event stream data in the multiple event stream data, to obtain a first anomaly detection result; perform anomaly detection on the event stream data using a time-series-based machine learning model, to obtain a second anomaly detection result; perform anomaly detection on the execution order of parameters for the same event in the event stream data, to obtain a third anomaly detection result; and determine whether the event stream data is abnormal event stream data based on at least one of the first anomaly detection result, the second anomaly detection result, and the third anomaly detection result.

[0215] For a description of the features in the corresponding embodiments of the apparatus, please refer to the relevant descriptions in the corresponding embodiments of the method; they will not be repeated here.

[0216] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above embodiments of the abnormal event detection method.

[0217] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described embodiments of the abnormal event detection method when running.

[0218] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0219] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described abnormal event detection method embodiments.

[0220] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described abnormal event detection method embodiments.

[0221] Any of the components, modules, units, parts, methods, and operations described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or any combination thereof. Alternatively or additionally, any functionality described herein can be executed at least in part by one or more hardware logic components, such as, but not limited to, a central processing unit (CPU), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), an application-specific standard product (ASSP), a system-on-a-chip (SoC), a complex programmable logic device (CPLD), a microprocessor (MCU), etc. The terms "system," "computing device," or "apparatus" as used herein encompass various means, devices, and machines for processing data, including, for example, one or more programmable processors, computers, SoCs, or combinations thereof. The apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or one or more combinations thereof. The aforementioned computer program (also known as a program, software, software application, app, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for a computing environment.

[0222] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments claimed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0223] The above provides a detailed description of the abnormal event detection method and electronic device provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. An abnormal event detection method, characterized in that, include: Acquire event stream data obtained by performing detection on multiple events, wherein the events include events triggered by the firmware of the basic input / output system; Based on the abnormal event stream data in the multiple event stream data, an abnormal cause-effect graph is constructed, wherein the abnormal cause-effect graph indicates the causal relationship between multiple abnormal events corresponding to the multiple abnormal event stream data respectively; Based on the difference between the anomalous causal graph and the baseline causal graph, a comprehensive anomaly detection result is determined for the anomalous causal graph, wherein the baseline causal graph indicates causal relationships between normal events; the comprehensive anomaly detection result is determined using anomalous causal types in the following manner: Based on at least one of the first difference and the second difference, determine at least one abnormal causal type; For each of the aforementioned abnormal causal types, a sub-evaluation value for each abnormal causal type is determined based on at least one of the number of abnormal nodes and the number of abnormal directed edges; wherein, the abnormal causal types include multiple types; and each abnormal causal type corresponds to at least one of the number of abnormal nodes and the number of abnormal directed edges. The weighted summation of the sub-evaluation values ​​for each abnormal causal type yields the causal anomaly evaluation value. Determine at least one additional evaluation value; By combining the aforementioned causal anomaly assessment value and at least one additional assessment value, a comprehensive anomaly assessment value is obtained; The comprehensive anomaly detection result is determined based on the comparison between the comprehensive anomaly assessment value and the anomaly threshold.

2. The method according to claim 1, characterized in that, The abnormal cause-effect graph includes multiple nodes and multiple directed edges. The nodes indicate abnormal events, and the direction of the directed edges indicates the causal relationship between the two nodes connected to the directed edges. The first difference and the second difference are determined in the following manner: Determine the first difference between a node in the abnormal causal graph and its corresponding node in the baseline causal graph, and determine the second difference between a directed edge in the abnormal causal graph and its corresponding directed edge in the baseline causal graph.

3. The method according to claim 1, characterized in that, Determining at least one anomalous causal type based on at least one of the first difference and the second difference includes: For any node in the abnormal cause-effect graph, a first abnormal cause-effect type is determined based on the second difference, wherein the first abnormal cause-effect type indicates that the node is abnormal; For any directed edge in the abnormal cause-effect graph, a second abnormal cause-effect type is determined based on the first difference, wherein the second abnormal cause-effect type indicates that the directed edge is abnormal; Based on the first difference and the second difference, a third abnormal causal type is determined, wherein the third abnormal causal type indicates that both the node and the directed edge are abnormal.

4. The method according to claim 3, characterized in that, The first abnormal causal type includes at least one of the following: source-less type, result-less type; for any node in the abnormal causal graph, determining the first abnormal causal type based on the second difference includes at least one of the following: For the first node in the abnormal causal graph, if the second difference indicates that there is no directed edge pointing to the first node in the abnormal causal graph, and there is a corresponding directed edge in the baseline causal graph, then it is determined that the abnormal causal graph has the passive type. For the second node in the abnormal causal graph, if the second difference indicates that there is no directed edge originating from the second node in the abnormal causal graph, and there is a corresponding directed edge in the baseline causal graph, then it is determined that the abnormal causal graph has the fruitless type.

5. The method according to claim 3, characterized in that, The second abnormal causal type includes at least one of the following: causal reversal type, causal missing type; the determination of the second abnormal causal type based on the first difference for any directed edge in the abnormal causal graph includes at least one of the following: For the first directed edge in the abnormal causal graph, if the first difference indicates that the two ends of the first directed edge correspond to the two ends of the corresponding directed edge in the baseline causal graph, and the directions of the first directed edge and the corresponding directed edge are opposite, it is determined that the abnormal causal graph has the causal reversal type. If there is no second directed edge in the abnormal causal graph and there is a corresponding directed edge in the baseline causal graph, then the abnormal causal graph is determined to have the causal missing type.

6. The method according to claim 3, characterized in that, The third abnormal causal type includes at least one of the following: abnormal causal chain type, abnormal feedback loop type; the determination of the third abnormal causal type based on the first difference and the second difference includes at least one of the following: If the first difference and the second difference indicate that a first link exists in the abnormal causal graph, and there is no corresponding link in the baseline causal graph, and the link length of the first link is greater than a length threshold, then the abnormal causal graph is determined to have the abnormal causal chain type, wherein the first link is obtained by sequentially combining nodes and directed edges; If the first difference and the second difference indicate that there is a loop-like second link in the abnormal causal graph and there is no corresponding link in the baseline causal graph, then the abnormal causal graph is determined to have the abnormal feedback loop type.

7. The method according to claim 1, characterized in that, The sub-evaluation value for each anomaly causality type, determined based on at least one of the number of anomaly nodes and the number of anomaly directed edges, includes: In the presence of a first abnormal causal type, a first sub-evaluation value is determined based on the number of abnormal nodes of the first abnormal causal type and the total number of nodes in the abnormal causal graph. In the presence of a second abnormal causal type, a second sub-evaluation value is determined based on the number of abnormal directed edges of the second abnormal causal type and the total number of directed edges in the abnormal causal graph. In the presence of a third abnormal causal type, a third sub-evaluation value is determined based on the number of abnormal links of the third abnormal causal type.

8. The method according to claim 1, characterized in that, The comprehensive anomaly assessment value is determined in the following manner: The comprehensive anomaly assessment value is obtained by weighting and summing the causal anomaly assessment value with at least one of the additional assessment values.

9. The method according to claim 1, characterized in that, The additional evaluation value includes: anomaly pattern evaluation value, and determining at least one additional evaluation value includes: Based on the similarity between the abnormal cause-effect graph and multiple abnormal pattern baseline graphs, a target abnormal pattern baseline graph is determined from the multiple abnormal pattern baseline graphs, wherein the abnormal pattern baseline graphs indicate the predetermined abnormal patterns of the basic input-output system. Determine the pattern confidence for the target anomaly pattern baseline map; The evaluation value of the abnormal pattern is determined based on the pattern confidence and the similarity between the target abnormal pattern baseline map and the abnormal causal map.

10. The method according to claim 1, characterized in that, The additional evaluation value also includes at least one of the following: a time-focused evaluation value and an event severity evaluation value; determining at least one additional evaluation value includes at least one of the following: For each anomalous event in the aforementioned anomaly causal graph, the time-based evaluation value is determined based on the distribution information of the event stream data of each anomalous event relative to time. Based on the level assessment values ​​of each abnormal event in the abnormal causal graph, a maximum level assessment value and an average level assessment value are determined; and based on the maximum level assessment value and the average level assessment value, an event severity assessment value is determined; wherein the level assessment value is predetermined based on the type of the abnormal event.

11. The method according to claim 8, characterized in that, The step of weighted summing of the causal anomaly assessment value with at least one of the additional assessment values ​​to obtain a comprehensive anomaly assessment value includes: Based on the comparison results between the causal anomaly assessment value and the additional assessment value and their respective corresponding system state thresholds, the dynamic weights of the causal anomaly assessment value and the additional assessment value are determined. The comprehensive anomaly assessment value is obtained by weighting and summing the causal anomaly assessment value and the additional assessment value with their respective dynamic weights.

12. The method according to any one of claims 1 to 11, characterized in that, The construction of an anomaly cause-effect graph based on the abnormal event stream data from multiple event stream data includes: Perform causal analysis on any two abnormal event streams from the multiple abnormal event streams to obtain the causal analysis results; If the causal analysis results indicate that there is a causal relationship between the two abnormal event streams, the abnormal events corresponding to the two abnormal event streams are used as nodes and the causal relationship is used as directed edges to construct the abnormal causal graph.

13. The method according to any one of claims 1 to 11, characterized in that, The event stream data includes detection data at multiple time points, and the detection data includes parameters that triggered the event. The method further includes: For any event stream data in the plurality of event stream data, based on the parameter baseline corresponding to the parameter, anomaly detection is performed on the parameter in the event stream data to obtain a first anomaly detection result; Anomaly detection is performed on the event stream data using a time-series-based machine learning model to obtain a second anomaly detection result; Anomaly detection is performed on the execution order of parameters for the same event in the event stream data to obtain a third anomaly detection result; Based on at least one of the first anomaly detection result, the second anomaly detection result, and the third anomaly detection result, determine whether the event stream data is the abnormal event stream data.

14. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the abnormal event detection method as described in any one of claims 1 to 13 when executing the computer program.

Images