Security defense method for terminal and electronic device

Abstract

A security defense method for a terminal and an electronic device relate to the technical field of computers, and the method comprises: acquiring a plurality of events, the plurality of events being acquired by the terminal, and the plurality of events comprising a first event; acquiring a first detection rule, the first detection rule comprising a first sequence and a plurality of first detection conditions, the first sequence indicating a sequence that needs to be met when the plurality of first detection conditions are matched with the events acquired by the terminal; matching the first event with a second detection condition, the plurality of first detection conditions comprising the second detection condition; and obtaining a first detection result in response to the plurality of events matching the first detection rule, the first detection result representing that the terminal has a security risk; wherein the plurality of events matching the first detection rule comprises: the plurality of first detection conditions successfully matching the plurality of events in the first sequence. Thus, the real-time performance and the accuracy of terminal security defense are taken into account.

Description

Technical Field

[0001] This article relates to the field of computer technology, specifically to a security defense method for terminals and electronic devices. Background Technology

[0002] As network attack methods continue to evolve, endpoint security faces increasingly complex attack behaviors, leading to the emergence of Endpoint Detection and Response (EDR) technology. EDR technology adopts an architecture of endpoint data collection and reporting, and server-side analysis and processing, which has the problem of response delay. Summary of the Invention

[0003] This content section is provided to briefly introduce the ideas, which will be described in detail in the examples section later. This content section is not intended to identify key or essential features of the claimed content, nor is it intended to limit the scope of the claimed content.

[0004] Firstly, a security defense method for terminals is provided, including: Multiple events are acquired by the terminal, and the multiple events include a first event; A first detection rule is obtained, which includes a first order and multiple first detection conditions. The first order indicates the order in which the multiple first detection conditions must be satisfied when they are matched with the events obtained by the terminal. The first event is matched with the second detection condition, wherein the plurality of first detection conditions include the second detection condition; In response to the multiple events matching the first detection rule, a first detection result is obtained, the first detection result indicating that the terminal has a security risk; wherein, the multiple events matching the first detection rule includes: the multiple first detection conditions successfully matching the multiple events in the first order.

[0005] Secondly, an electronic device is provided, comprising: A storage device on which computer programs are stored; A processing device for executing the computer program in the storage device to implement the method described in the first aspect.

[0006] The method described above involves a terminal acquiring multiple events and a first detection rule comprising multiple first detection conditions. The terminal then matches the first events among the multiple events with the second detection conditions among the multiple first detection conditions. Upon successful matching of the multiple first detection conditions with the multiple events in a first order, a first detection result indicating a security risk to the terminal is obtained. The first order indicates the sequence in which the multiple first detection conditions must be matched with the events acquired by the terminal. Using this method, after the terminal collects multiple events, it sequentially completes the matching verification according to the preset order of the multiple detection conditions. On one hand, relying on the preset order of the detection conditions can constrain the event sequence logic corresponding to the attack behavior, filtering out false positive samples where features are hit but the event occurrence order does not meet the attack chain, effectively reducing the false positive probability and improving the accuracy of terminal risk detection. On the other hand, the entire matching calculation process is completed on the terminal, reducing the data transmission resource consumption between the terminal and the server, and avoiding processing delays caused by network transmission latency and server queuing calculations, enabling rapid risk assessment after an event occurs. This balances the real-time performance and accuracy of terminal security defense.

[0007] Other features and advantages will be described in detail in the following examples section. Attached Figure Description

[0008] The above and other features, advantages, and aspects of this document will become more apparent when viewed in conjunction with the accompanying drawings and the following examples. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale. In the drawings: Figure 1 This is a schematic diagram illustrating an implementation environment according to an example.

[0009] Figure 2 This is a flowchart illustrating a security defense method for a terminal, based on an example.

[0010] Figure 3 This is a schematic diagram illustrating a security defense architecture for a terminal, based on an example.

[0011] Figure 4 This is a flowchart illustrating a rule-based pre-recall process, as shown in an example.

[0012] Figure 5 This is a flowchart illustrating a rule matching method as shown in an example.

[0013] Figure 6 This is a flowchart illustrating the cumulative number of times a bucketed event is triggered, based on an example.

[0014] Figure 7This is a schematic diagram of a security defense device for a terminal, as illustrated by an example.

[0015] Figure 8 This is a schematic diagram of the structure of an electronic device as illustrated by an example. Detailed Implementation

[0016] The following description will be given in more detail with reference to the accompanying drawings. While certain scenarios are shown in the drawings, it should be understood that this document can be implemented in various forms and should not be construed as limited to the scenarios described herein. Rather, these scenarios are provided to provide a more thorough and complete understanding of this document. It should be understood that the accompanying drawings and the scenarios depicted are for illustrative purposes only and are not intended to limit the scope of this document.

[0017] It should be understood that the steps described in the method may be performed in different orders and / or in parallel. Furthermore, the method may include additional steps and / or omit the steps shown. The scope of this document is not limited in this respect.

[0018] The term "comprising" and its variations can be open-ended, meaning "including but not limited to". The term "based on" can mean "at least partially based on". The term "one case" means "at least one case"; the term "another case" means "at least one additional case"; the term "some cases" means "at least some cases". Definitions of other terms will be given in the following description.

[0019] It should be noted that the concepts of "first" and "second" are only used to distinguish different devices, modules or units, and are not used to limit the order of the functions performed by these devices, modules or units or their interdependencies.

[0020] It should be noted that the modifiers “one” and “multiple” can be illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as “one or more”.

[0021] The names of messages or information exchanged between multiple devices are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0022] It is understandable that the data involved in the technical solution (including but not limited to the data itself, the acquisition or use of the data) should comply with the requirements of relevant regulations.

[0023] In endpoint security attack scenarios, attacks are often multi-step, multi-source, or cross-process. Detection schemes based on single-event rules rely on the characteristics of the single event itself, such as hash values ​​or process command lines. However, once these static characteristics change, single-event rule-based detection schemes will fail to match, leading to missed detections. Server-side EDR technology, on the other hand, suffers from response delays due to data transmission and processing latency.

[0024] In view of this, this paper provides a security defense method and electronic device for terminals to solve the above-mentioned technical problems.

[0025] The security defense methods for terminals provided in this article can be executed by the terminal. Figure 1 This is an exemplary schematic diagram illustrating an implementation environment; see [link / reference]. Figure 1 The implementation environment includes: terminal 101 and server 102. The server 102 and terminal 101 are connected directly or indirectly through wired or wireless communication, and there is no limitation on this.

[0026] For example, server 102 can send preset detection rules to terminal 101, which then acquires multiple events and matches them against the detection rules. If multiple first detection conditions successfully match multiple events in a first order, it is determined that the terminal has a security risk. In other words, server 102 is responsible for storing and sending detection rules, while terminal 101 is responsible for real-time event collection and security defense.

[0027] The terminal 101 can be at least one of the following devices: smartphone, smartwatch, desktop computer, laptop, virtual reality terminal, augmented reality terminal, wireless terminal, and laptop computer. The server 102 can be a physical server, a server cluster consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud computing, and cloud storage.

[0028] Figure 2 This is a flowchart illustrating a security defense method for a terminal, as shown in the example. Figure 2 As shown, the method may include the following steps: In step 201, multiple events are acquired by the terminal, including the first event.

[0029] The terminal includes physical or virtual electronic devices that users directly operate on a daily basis. An event can be understood as a structured representation of a behavior or action triggered by the terminal. For example, a behavior could be starting process x, process x writing a file y, process x starting a child process z, etc., without any restrictions.

[0030] In step 202, a first detection rule is obtained. The first detection rule includes a first order and multiple first detection conditions. The first order indicates the order in which the multiple first detection conditions must be satisfied when they are matched with the events obtained by the terminal.

[0031] For example, such as Figure 3 As shown, the server is responsible for storing and distributing the preset detection rules, which include the first detection rule mentioned above. The terminal can deploy an event provider and a timing engine. The event provider is responsible for real-time collection of events on the terminal and distributing them to the timing engine. The timing engine is responsible for filtering the pre-rules, matching the detection rules, maintaining the status, and handling the events after the detection rules are hit.

[0032] For example, preset detection rules can be set based on one or more events that pose a security risk. The order of multiple detection conditions can be set according to the order in which the multiple events occur. The specific settings can be configured according to requirements and there are no restrictions on this.

[0033] In step 203, the first event is matched with the second detection condition, and the first detection condition includes the second detection condition.

[0034] For example, suppose the detection rule includes multiple detection conditions. First, it is necessary to determine the detection conditions that the current event needs to match, and then match the current event with the detection conditions to determine whether the current event meets or hits the detection conditions. If it meets or hits the conditions, the match is successful; otherwise, the match fails.

[0035] In step 204, in response to multiple events matching the first detection rule, a first detection result is obtained, and the first detection result indicates that the terminal has a security risk; wherein, multiple events matching the first detection rule includes: multiple first detection conditions successfully matching multiple events in a first order.

[0036] Using the above method, after the terminal collects multiple events, it sequentially completes matching and verification according to a preset order of multiple detection conditions. On the one hand, relying on the preset order of detection conditions can constrain the event sequence logic corresponding to the attack behavior, filtering out false positive samples where features are matched but the event occurrence order does not meet the attack chain, effectively reducing the false positive probability and improving the accuracy of terminal risk detection. On the other hand, the entire matching calculation process is completed on the terminal, reducing the data transmission resource consumption between the terminal and the server, and avoiding processing delays caused by network transmission latency and server queuing calculations, enabling rapid risk assessment after an event occurs. Thus, it balances the real-time performance and accuracy of terminal security defense.

[0037] It is worth noting that rule expressions that can express terminal attack behavior can be constructed based on the syntax that the timing engine can understand, i.e., configuration detection rules.

[0038] For example, a detection rule can be set as follows: Within the sliding time window T1, [Step 1] a process startup event occurs and the process path contains the field "fff"; [Step 2] the process continuously reads files whose file paths contain the field "kkk" n times within T2 seconds; [Step 3] the process initiates a network connection to port xxx. The security risk scenario detected by this rule is: a risky program capable of collecting information is downloaded to the terminal. This program starts a process whose process path contains "fff", which then reads files whose file paths contain "kkk" from various software on the terminal and packages the read information to send it to the specified port xxx. The above detection rule can be converted into a rule expression that the timing engine can understand.

[0039] In one scenario, multiple first detection conditions are successfully matched with multiple events in a first order, including: matching each first detection condition with multiple events sorted by trigger time in a first order until all multiple first detection conditions are successfully matched.

[0040] For example, the terminal collects multiple events in real time according to the time sequence to obtain time-series events. If the multiple detection conditions included in the detection rule are satisfied in a preset order, it can be determined that the terminal has the security risk corresponding to the detection rule.

[0041] It should be understood that, assuming multiple events include events A, B, C, and D, and the detection rules include detection conditions 0, 1, and 2, if event A matches detection condition 0, event B matches detection condition 1, and event D matches detection condition 2, then the detection rule can be determined to be a successful match. In other words, if all the detection rules included in the detection rule are matched in a preset order, then the detection rule can be determined to have been matched.

[0042] By relying on the preset order of detection conditions, the event sequence logic corresponding to the attack behavior can be constrained, which can filter out false alarm samples that hit the feature but whose event occurrence order does not meet the attack chain, effectively reducing the false alarm probability and improving the identification accuracy of terminal risk detection.

[0043] In one scenario, the first detection rule is at least one of the preset detection rules, which are configured based on preset keywords. The preset keywords include at least one of the following: a first function for determining whether the first string has a second string as a prefix; a second function for determining whether the third string has a fourth string as a suffix; and a third function for determining whether the fifth string contains a sixth string.

[0044] For example, preset detection rules can be flexibly configured on demand based on preset keywords. Keywords can include time sequence structure keywords, time sequence structure groups, time sequence structure time windows, time sequence structure event counts, filter clauses, set matching, Boolean logic, logical operators, event types, preset functions, etc., and can be adjusted accordingly according to the syntax that the time sequence engine can understand, as long as its core function can achieve the matching of time sequence events with ordered conditions. The detection rule configuration can be set according to risk detection needs, and there are no restrictions on it.

[0045] For example, detection rules can be configured according to security risk detection requirements and the syntax structure of the above rule expressions. For instance, preset functions can be set in advance. The first function includes a string prefix matching function that is case-sensitive or insensitive, the second function includes a string suffix matching function that is case-sensitive or insensitive, the third function includes a string inclusion matching function that is case-sensitive or insensitive, and so on, so that the corresponding function can be flexibly selected and the corresponding matching conditions can be configured according to string matching requirements.

[0046] This effectively improves the accuracy and flexibility of the detection rules, thereby enhancing the accuracy and real-time performance of terminal rule detection.

[0047] In one scenario, obtaining the first detection rule includes: obtaining the first event type, where the first event type is the event type of the first event; and obtaining the first detection rule based on the first event type.

[0048] For example, each preset detection condition corresponds to an event type, used to detect events belonging to that event type. Preset event types can be obtained based on the event types corresponding to all preset detection rules, and all preset detection rules can be grouped according to event type. (The following is an example...) Figure 3 As shown, whenever the timing engine receives an event, it can perform pre-filtering rules based on the event type corresponding to that event.

[0049] Furthermore, such as Figure 4 As shown, taking the receipt of event 1 as an example, the event type corresponding to event 1 is first determined, assuming it is event type P. If the above-mentioned preset event types do not include event type P, then event 1 does not need to undergo rule detection and can be directly discarded. If the above-mentioned preset event types include event type P, then the preset detection rules under event type P can be determined as the detection rules to be matched, that is, the detection rule corresponding to the first event type is taken as the first detection rule. In this way, event 1 does not need to be matched with every preset detection rule. That is, the event can be sent to the rule instance corresponding to the preset detection rule under the same event type for subsequent rule matching process, thereby reducing the number of events entering the rule matching process.

[0050] This combines rule-based pre-filtering with time-series event-based rule detection, improving the real-time performance and accuracy of terminal security defense while reducing the terminal's computational resource consumption and performance pressure.

[0051] In one scenario, obtaining a first detection rule based on a first event type includes: obtaining candidate detection rules from preset detection rules based on the first event type, wherein the candidate detection rules include multiple third detection conditions; if all the multiple third detection conditions include a first detection item and each first detection item has the same preset value, in response to the first event satisfying the first preset condition, the candidate detection rule is adopted as the first detection rule; wherein the first event includes a first feature, and the first preset condition includes: the first feature is consistent with the first detection item and the feature value corresponding to the first feature is consistent with the preset value.

[0052] For example, detection items and their values ​​can be understood as fields and their values ​​in detection conditions. If multiple detection conditions in some preset detection rules have the same detection items and the same values, an inverted index can be built in advance for the preset detection rules with the same detection items and the same values, so as to find matching detection rules based on events. For example, all detection conditions of preset detection rule F include "process_name==MM" (the process name is "MM"). The specific details can be determined according to the actual situation and there is no restriction on this.

[0053] like Figure 4 As shown, continuing with event 1 as an example, assuming the preset event type includes event type P corresponding to event 1, and event type P includes the aforementioned preset detection rule F, a reverse index search can be performed based on the features in event 1 and the corresponding feature values ​​in the preset detection rule of event type P. Features can be processes, files, etc., and feature values ​​are the corresponding process names, file names, etc., which can be determined according to the actual situation. For example, if event 1 includes the process name "MM", then it satisfies the constraint of preset detection rule F, and preset detection rule F can be used as the detection rule to be matched; otherwise, the preset detection rule F is skipped.

[0054] It should be understood that if the candidate detection rules corresponding to event type P do not include preset detection rules that have the same detection items and the same constraints, such as preset detection rule G, then preset detection rule G needs to be used as the detection rule to be matched. In other words, the event can be sent to the rule instances corresponding to preset detection rules that satisfy the constraints and those that do not have constraints for subsequent rule matching processes, further reducing the number of events entering the rule matching process.

[0055] This combines rule-based pre-filtering with time-series event-based rule detection, improving the real-time performance and accuracy of terminal security defense while further reducing the terminal's computing resource consumption and performance pressure.

[0056] In one scenario, each of the multiple events has a first event identifier, and the method further includes: in response to a state machine associated with a first detection rule including a first state machine, obtaining a first position identifier; wherein the first state machine is associated with a first event identifier, the first state machine is used to record the first position identifier, and the first position identifier is used to indicate the first first detection condition to be matched in a first order; in response to a state machine associated with a first detection rule not including a first state machine, creating a first state machine based on the first event identifier, and pointing the first position identifier to the first first detection condition in a first order; and using the first detection condition pointed to by the first position identifier as a second detection condition.

[0057] It's important to understand that an event identifier can be viewed as an attribute field of an event, used to characterize the relationships between events. Events belonging to the same time-series event (attack behavior chain) can be marked with the same event identifier; that is, multiple events with the same event identifier belong to the same time-series event sequence. For example, multiple consecutive actions triggered by the same process can be marked with the same identifier. Specific judgment rules can be set according to requirements, and there are no restrictions on this. In this way, events with the same event identifier will be chained together into the same event sequence and entered into the same rule instance for rule matching.

[0058] For example, such as Figure 5 As shown, a preset detection rule corresponds to a rule instance. This rule instance is used to maintain the state information of all events that can match this detection rule. Assuming an event enters this rule instance, we first determine the event identifier corresponding to the event. If the rule instance does not have a state machine associated with the same event identifier, it means that the event is entering the rule instance for the first time, so a state machine corresponding to the event identifier is created. Otherwise, it means that the event is not entering the rule instance for the first time, so the state machine corresponding to the event identifier is queried. Different events may match the same rule instance. Therefore, events entering the same rule instance are grouped according to their event identifiers, i.e., the sequence of events they belong to, and a corresponding state machine is created. The state machines corresponding to different event identifiers are used to maintain the event state and rule matching state of the corresponding identifier. The rule matching state includes a position identifier, which indicates the position of the current detection condition to be matched in the preset order of multiple detection conditions.

[0059] Furthermore, assume that the preset detection rules include multiple detection conditions (which can be numbered starting from 0, i.e., position identifiers), such as Figure 5As shown, the state machine can record the position number of the current detection condition to be matched among multiple detection conditions in a preset order. For example, the position number corresponding to a newly created or reset state machine is 0. If detection condition 0 has been successfully matched, the position number is updated to 1, and so on. This is equivalent to recording the matching progress of each time-series event for the detection rule, so that rule matching can be performed separately for different time-series events within the same rule instance.

[0060] By introducing a state machine into the terminal to perform rule detection based on time-series events, the rule matching efficiency of the terminal can be effectively improved, thereby enhancing the timeliness of terminal security defense.

[0061] In one scenario, the first detection rule further includes a first time interval, which represents the maximum permissible time interval between the second event and the third event. The second event is the event that matches the first first detection condition, and the third event is the event that matches the last first detection condition. The first state machine also records a first time, which is the trigger time of the fourth event. The fourth event is the event that matches the first first detection condition, and multiple events include the fourth event. Using the first detection condition pointed to by the first position identifier as the second detection condition includes: in response to the second time interval being less than the first time interval, using the first detection condition pointed to by the first position identifier as the second detection condition, where the second time interval is the time interval between the first time and the second time is the trigger time of the first event. The method further includes: in response to the second time interval being greater than or equal to the first time interval, resetting the first state machine; the reset includes: setting the first position identifier to the first first detection condition and setting the first time to zero.

[0062] For example, such as Figure 5 As shown, in addition to maintaining the position identifier of the current condition to be matched for the same time sequence event, the state machine can also maintain the trigger time corresponding to the event that matches the first detection condition within the same time sequence event. Thus, if the current detection rule is configured with a window threshold verification condition, such as setting a maximum allowed trigger time interval between two events matching the first and last detection conditions, a timeout check can be performed first. If the trigger time of the first matching event (the fourth event) recorded by the state machine is greater than or equal to the trigger time of the current event, it means that the time sequence event corresponding to the event identifier recorded by the state machine does not meet the detection rule. In this case, the state machine can be completely reset, including resetting the sequence number, trigger time, and count value, or the state machine can be deleted. Otherwise, the current detection condition to be matched is determined based on the position identifier stored in the state machine, and the subsequent matching process continues.

[0063] It should be noted that when an event successfully matches the first detection event of a detection rule, a state machine is started to record it. When another event successfully matches the first detection condition, another state machine is started to record it.

[0064] For example, such as Figure 5 As shown, if the position number of the detection condition to be matched corresponding to the current event is 0, then the state machine checks whether the current event meets the detection condition. If it does, it records the trigger time of the current event and the number of times the current detection condition has been matched, i.e., increments the count by 1. It should be understood that if the detection condition to be matched does not include a hit count constraint, the state machine may not record the count corresponding to that detection condition. This can be set according to requirements and is not restricted. After each matching condition ends, for detection conditions that include a hit count constraint, it is necessary to check whether the count meets the requirements (i.e., whether the count is greater than or equal to the threshold). If the requirements are met, the position number is incremented by 1, indicating that the matching process for the next detection condition should begin. Additionally, if the current event does not meet the current detection condition, the state machine is reset and returns 0 (indicating matching failure).

[0065] It should be understood that the security defense methods for terminals provided in this article can be applied not only to risk detection of multiple events, but also to risk detection of single events.

[0066] like Figure 5 As shown, it can be determined whether the total number of conditions for the detection rule is 1. If it is 1 and the first detection condition has been successfully matched, it can be determined that the current event has matched the detection rule, and 1 is returned (indicating that the rule has been matched), and the state machine is completely reset. Otherwise, 0 is returned, indicating that the detection rule has not been fully matched. In addition, 0 can also be returned when the detection rule fails to match.

[0067] For example, for risk detection involving multiple events, the system continues to wait for the next event to enter the rule instance. After each matching condition, it checks whether the position number is greater than or equal to the total number of conditions. If so, it means the corresponding detection rule has been hit, returns 1, and resets the state machine; otherwise, it returns 0. If the current event does not meet the current matching detection condition, the count value corresponding to that condition in the state machine is reset (meaning the count constraint has not been reached within the constraint time), while maintaining the position number and the trigger time of the first event.

[0068] This enables security risk detection based on time-series events on the terminal, improving the terminal security risk detection rate and effectively enhancing the real-time performance of terminal security defense.

[0069] In one scenario, the second detection condition is that the cumulative number of triggers of the first event within the sliding window is greater than or equal to a first threshold. The first state machine also records the cumulative number of triggers. The method further includes: dividing the sliding window into a first number of time periods, with each of the first number of time periods corresponding to a slot in a circular array, and each slot storing a count value of the first event within the corresponding time period; in response to receiving the first event, for the expired first time period within the first number of time periods, subtracting the count value of the first time period from the cumulative number of triggers, and clearing the count value of the first time period to zero; based on the trigger time of the first event, obtaining a second time period from the first number of time periods, incrementing the count value of the second time period by 1, and incrementing the cumulative number of triggers by 1.

[0070] For example, such as Figure 6 As shown, the sliding window with the detection conditions is cut into N (the first number, where N is a positive integer) time buckets (time periods) of fixed duration at an adaptive granularity. These time buckets are stored in a fixed-length circular array of length N (using physical slots modulo N). Each time bucket can accumulate the number of events falling within that time period, thus fixing the memory required to count the cumulative number of triggers for each event. The first number and the first threshold can be set according to requirements and are not restricted.

[0071] For example, when a new event arrives, expired time buckets that have already slipped out of the time window are first discarded, and the count of expired time buckets is deducted from the cumulative trigger count. Then, the count of the current time bucket is incremented by 1, and the cumulative event trigger count is incremented by 1. In this way, the cumulative event trigger count is always equal to the total number of events within the current time window.

[0072] By combining the sliding window bucketing method with time-series event-based rule detection, we can reduce the terminal's memory usage and performance pressure while ensuring the accuracy of the statistical count.

[0073] In one scenario, a first detection rule is associated with a first handling strategy, which is used to handle a first risky behavior, including risky behaviors triggered by multiple events; the first handling strategy includes at least one of the following handling operations: isolating or deleting released data, which poses a security risk; terminating newly created processes; deleting created scheduled tasks and / or service startup items; and blocking data outgoing operations.

[0074] For example, when a detection rule is hit, the intermediate state event stored in the state machine can be obtained, that is, the event corresponding to the detection rule is hit, and the risk behavior triggered by the corresponding event can be obtained. Then, the risk behavior can be handled according to the handling strategy corresponding to the detection rule. For example, the risk file released by the process can be isolated, the new process created by the process can be terminated, the scheduled tasks and service startup items created by the process can be deleted, and the data outgoing operation can be blocked, etc. The specifics are determined according to the actual situation and there are no restrictions on this.

[0075] This enables a complete security defense loop at the terminal, from event collection to rule matching to risk handling, thereby improving the terminal security risk detection rate and the real-time performance of terminal security defense.

[0076] In addition, the terminal can report information such as time-series events and hit detection rules to the server so that the server can continuously optimize or update the detection rules, enabling the detection rules to have dynamic evolution capabilities.

[0077] This paper provides a security defense method for a terminal, comprising: acquiring multiple events, wherein the multiple events are acquired by the terminal, and the multiple events include a first event; acquiring a first detection rule, wherein the first detection rule includes a first order and multiple first detection conditions, the first order indicating the order in which the multiple first detection conditions must be satisfied when matching with the events acquired by the terminal; matching the first event with second detection conditions, wherein the multiple first detection conditions include the second detection conditions; and obtaining a first detection result in response to the multiple events matching with the first detection rule, wherein the first detection result indicates that the terminal has a security risk; wherein, the multiple events matching with the first detection rule includes: sequentially matching each of the first detection conditions with the multiple events sorted by trigger time according to the first order, until all of the multiple first detection conditions are successfully matched; and in response to the second detection condition including that the cumulative number of triggers of the first event in a sliding window is greater than or equal to a first threshold, dividing the sliding window into a first number of time periods, wherein the first number of time periods correspond one-to-one with slots in a circular array, and each slot stores the first event in the corresponding time period. The count value within; in response to receiving the first event, for the first time period that has expired in the first number of time periods, the cumulative trigger count is subtracted from the count value of the first time period, and the count value of the first time period is cleared to zero; based on the trigger time of the first event, a second time period is obtained from the first number of time periods, the count value of the second time period is incremented by 1, and the cumulative trigger count is incremented by 1; wherein, each of the plurality of events has a first event identifier, and the second detection condition is determined in the following manner: in response to the state machine associated with the first detection rule including the first state machine, a first position identifier is obtained; wherein, the first state machine is associated with the first event identifier, the first state machine is used to record the first position identifier, and the first position identifier is used to indicate the first first detection condition to be matched in the first order; in response to the state machine associated with the first detection rule not including the first state machine, the first state machine is created based on the first event identifier, and the first position identifier is pointed to the first first detection condition in the first order; the first detection condition pointed to by the first position identifier is used as the second detection condition.

[0078] By using the above method, the current matching progress of each event sequence is recorded by a state machine, so that the matching process strictly proceeds in the preset order of the detection conditions, avoiding the skipping or repeated execution of conditions. It is difficult for attackers to bypass the detection of the complete behavior chain by changing the characteristics of a single event. Furthermore, a circular array is used to maintain the count within the sliding window, and the storage space is fixed. Thus, while taking into account the real-time performance and accuracy of terminal security defense, the consumption of terminal computing resources and performance pressure are effectively reduced.

[0079] Figure 7 This is a schematic diagram of a security defense device for a terminal, as illustrated by an example. Figure 7 As shown, the security defense device 700 for a terminal includes: The first acquisition module 701 is used to acquire multiple events, which are acquired by the terminal, and the multiple events include the first event; The second acquisition module 702 is used to acquire a first detection rule, the first detection rule including a first order and multiple first detection conditions, the first order indicating the order in which the multiple first detection conditions must be satisfied when matching the events acquired by the terminal; The matching module 703 is used to match the first event with the second detection conditions, wherein the plurality of first detection conditions include the second detection conditions; Result module 704 is used to obtain a first detection result in response to the multiple events matching the first detection rule, wherein the first detection result indicates that the terminal has a security risk; wherein, the multiple events matching the first detection rule includes: the multiple first detection conditions successfully matching the multiple events in the first order.

[0080] Using the aforementioned device, after the terminal collects multiple events, it sequentially completes matching and verification according to a preset order of multiple detection conditions. On the one hand, relying on the preset order of detection conditions can constrain the event sequence logic corresponding to the attack behavior, filtering out false positive samples where features are matched but the event occurrence order does not meet the attack chain, effectively reducing the false positive probability and improving the accuracy of terminal risk detection. On the other hand, the entire matching calculation process is completed on the terminal, reducing the data transmission resource consumption between the terminal and the server, and avoiding processing delays caused by network transmission latency and server queuing calculations, enabling rapid risk assessment after an event occurs. Thus, it balances the real-time performance and accuracy of terminal security defense.

[0081] Optionally, the second acquisition module 702 is used for: Obtain the first event type, where the first event type is the event type of the first event; Based on the first event type, the first detection rule is obtained.

[0082] Optionally, the second acquisition module 702 is used for: Based on the first event type, candidate detection rules are obtained from preset detection rules, and the candidate detection rules include multiple third detection conditions; If all of the plurality of third detection conditions include a first detection item and each of the first detection items has the same preset value, in response to the first event satisfying the first preset condition, the candidate detection rule is used as the first detection rule; wherein, the first event includes a first feature, and the first preset condition includes: the first feature is consistent with the first detection item and the feature value corresponding to the first feature is consistent with the preset value.

[0083] Optionally, each of the plurality of events has a first event identifier, and the security defense device 700 for the terminal further includes a state machine module for: In response to the state machine associated with the first detection rule, including the first state machine, a first position identifier is obtained; wherein, the first state machine is associated with the first event identifier, the first state machine is used to record the first position identifier, and the first position identifier is used to indicate the first first detection condition to be matched in the first order; In response to the state machine associated with the first detection rule not including the first state machine, the first state machine is created based on the first event identifier, and the first position identifier is pointed to the first first detection condition in the first order; The first detection condition pointed to by the first location identifier is used as the second detection condition.

[0084] Optionally, the first detection rule further includes a first time interval, which represents the maximum allowed time interval between the second event and the third event, the second event being the event matching the first first detection condition, the third event being the event matching the last first detection condition, and the first state machine also records a first time, which is the trigger time of a fourth event, the fourth event being the event matching the first first detection condition, and the plurality of events including the fourth event; the state machine module is used for: In response to the second time interval being less than the first time interval, the first detection condition pointed to by the first location identifier is used as the second detection condition, the second time interval being the time interval between the first time and the second time, and the second time being the trigger time of the first event; The security defense device 700 for the terminal also includes a reset module, used for: In response to the second time interval being greater than or equal to the first time interval, the first state machine is reset; the reset includes: pointing the first position identifier to the first first detection condition and setting the first time to zero.

[0085] Optionally, the second detection condition includes that the cumulative number of times the first event is triggered within the sliding window is greater than or equal to a first threshold. The first state machine also records the cumulative number of triggers. The security defense device 700 for the terminal further includes a counting module for: The sliding window is divided into a first number of time periods, and the first number of time periods correspond one-to-one with the slots of the circular array. Each slot stores the count value of the first event within the corresponding time period. In response to receiving the first event, for the first time period that has expired in the first number of time periods, the cumulative number of triggers is subtracted from the count value of the first time period, and the count value of the first time period is cleared to zero; Based on the trigger time of the first event, a second time period is obtained from the first number of time periods, the count value of the second time period is incremented by 1, and the cumulative number of triggers is incremented by 1.

[0086] Optionally, the first detection conditions being successfully matched with the multiple events in the first order includes: matching each of the first detection conditions with the multiple events sorted by trigger time in the first order until all the first detection conditions are successfully matched.

[0087] Optionally, the first detection rule is at least one of preset detection rules, which are configured based on preset keywords, and the preset keywords include at least one of the following: The first function is used to determine whether the first string is prefixed with the second string; The second function is used to determine whether the third string has the fourth string as a suffix. The third function is used to determine whether the fifth string contains the sixth string.

[0088] Optionally, the first detection rule is associated with a first handling strategy, which is used to handle a first risky behavior, including risky behaviors triggered by the plurality of events; the first handling strategy includes at least one of the following handling operations: The released data is being isolated or deleted, as the data poses a security risk. Terminate the newly created process; Perform deletion operations on the created scheduled tasks and / or service startup items; Block outgoing data transmission operations.

[0089] Regarding the security defense device 700 for terminals mentioned above, the method logic executed by each functional module has been explained in detail in the section on methods, and will not be repeated here.

[0090] Based on the same concept, a computer-readable medium is also provided, on which a computer program is stored, which, when executed by a processing device, implements any of the above-described security defense methods for terminals.

[0091] In this way, after the terminal collects multiple events, it sequentially completes matching and verification according to a preset order of multiple detection conditions. On the one hand, relying on the preset order of detection conditions can constrain the event sequence logic corresponding to the attack behavior, filtering out false positive samples that match features but whose event occurrence order does not meet the attack chain, effectively reducing the probability of false positives and improving the accuracy of terminal risk detection. On the other hand, the entire matching calculation process is completed on the terminal, reducing the data transmission resource consumption between the terminal and the server, and avoiding processing delays caused by network transmission latency and server queuing calculations, enabling rapid risk assessment after an event occurs. Thus, it balances the real-time performance and accuracy of terminal security defense.

[0092] Based on the same concept, an electronic device is also provided, which may include: A storage device on which computer programs are stored; A processing device for executing a computer program stored in a storage device to implement any of the aforementioned security defense methods for a terminal.

[0093] In this way, after the terminal collects multiple events, it sequentially completes matching and verification according to a preset order of multiple detection conditions. On the one hand, relying on the preset order of detection conditions can constrain the event sequence logic corresponding to the attack behavior, filtering out false positive samples that match features but whose event occurrence order does not meet the attack chain, effectively reducing the probability of false positives and improving the accuracy of terminal risk detection. On the other hand, the entire matching calculation process is completed on the terminal, reducing the data transmission resource consumption between the terminal and the server, and avoiding processing delays caused by network transmission latency and server queuing calculations, enabling rapid risk assessment after an event occurs. Thus, it balances the real-time performance and accuracy of terminal security defense.

[0094] Based on the same concept, a computer program product is also provided, including a computer program that, when executed by a processor, implements any of the above-described security defense methods for terminals.

[0095] After the terminal collects multiple events, it sequentially performs matching and verification based on a preset order of multiple detection conditions. On the one hand, the preset order of detection conditions constrains the event sequence logic corresponding to the attack behavior, filtering out false positive samples where features are matched but the event occurrence order does not meet the attack chain, effectively reducing the false positive probability and improving the accuracy of terminal risk detection. On the other hand, the entire matching calculation process is completed on the terminal, reducing the data transmission resource consumption between the terminal and the server, and avoiding processing delays caused by network transmission latency and server queuing calculations, enabling rapid risk assessment after an event occurs. Thus, it balances the real-time performance and accuracy of terminal security defense.

[0096] The following is for reference. Figure 8 The diagram illustrates the structure of an electronic device 800 suitable for implementing the above-described method. The terminal device may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Tablet Personal Computers), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs (Televisions), desktop computers, etc. Figure 8 The electronic device shown is merely an example and should not be construed as limiting its functionality or scope of use.

[0097] like Figure 8 As shown, the electronic device 800 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 into a random access memory (RAM) 803. The RAM 803 also stores various programs and data required for the operation of the electronic device 800. The processing unit 801, the read-only memory 802, and the RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0098] Typically, the following devices can be connected to the input / output interface 805: input devices 806 including, for example, a touchscreen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; output devices 807 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 808 including, for example, magnetic tape, hard disk, etc.; and communication devices 809. Communication device 809 allows electronic device 800 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 8 An electronic device 800 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0099] In particular, depending on certain circumstances, the process described in the flowchart above can be implemented as a computer software program. For example, a computer program product is provided, comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowchart. This computer program can be downloaded and installed from a network via a communication device 809, or installed from a storage device 808, or installed from a read-only memory 802. When the computer program is executed by a processing device 801, it performs the functions defined in the above-described method.

[0100] It should be noted that the aforementioned computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM, or flash memory), optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In one case, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In another case, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. The transmitted data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (Radio Frequency), etc., or any suitable combination thereof.

[0101] In some cases, communication can be conducted using any currently known or future-developed network protocol, such as HTTP (Hypertext Transfer Protocol), and can be interconnected with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include Local Area Networks (LANs), Wide Area Networks (WANs), Internets (e.g., the Internet), and peer-to-peer networks (e.g., ad-hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0102] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0103] The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: acquire multiple events, the multiple events being acquired by the terminal, the multiple events including a first event; acquire a first detection rule, the first detection rule including a first order and multiple first detection conditions, the first order indicating the order in which the multiple first detection conditions must be satisfied when matching with the events acquired by the terminal; match the first event with second detection conditions, the multiple first detection conditions including the second detection conditions; and, in response to the multiple events matching with the first detection rule, obtain a first detection result, the first detection result indicating that the terminal has a security risk; wherein, the multiple events matching with the first detection rule includes: the multiple first detection conditions successfully matching with the multiple events in the first order.

[0104] Computer program code for performing the above operations can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages, as well as conventional procedural programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0105] The flowcharts and block diagrams in the accompanying figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products under various scenarios. Each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that, in some alternative cases, the functions indicated in the blocks may occur in a different order than those indicated in the figures. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0106] The modules mentioned above can be implemented in software or hardware. In some cases, the name of a module does not necessarily limit the functionality of that module.

[0107] The functions described above can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field-Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application-Specific Standard Parts (ASSPs), Systems on Chips (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0108] In this context, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0109] The above description is merely illustrative and illustrates the technical principles employed. Those skilled in the art should understand that the scope of this document is not limited to the specific combinations of the above-described technical features, but also includes any combination of the above-described technical features or their equivalents without departing from the above concept.

[0110] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. Multitasking and parallel processing may be advantageous in certain environments. Similarly, while some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of this paper. Certain features described in the context of a single example can also be implemented in combination in a single example. Conversely, various features described in the context of a single example can also be implemented individually or in any suitable sub-combination in multiple examples.

[0111] Although this document has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims. Regarding the aforementioned apparatus, the specific manner in which the various modules perform their operations has already been described in detail in the section concerning the method, and will not be elaborated upon here.

Claims

1. A security defense method for a terminal, comprising: Multiple events are acquired by the terminal, and the multiple events include a first event; A first detection rule is obtained, which includes a first order and multiple first detection conditions. The first order indicates the order in which the multiple first detection conditions must be satisfied when they are matched with the events obtained by the terminal. The first event is matched with the second detection condition, wherein the plurality of first detection conditions include the second detection condition; In response to the multiple events matching the first detection rule, a first detection result is obtained, and the first detection result indicates that the terminal has a security risk; The matching of the multiple events with the first detection rule includes: the multiple first detection conditions successfully matching the multiple events in the first order.

2. The method according to claim 1, wherein obtaining the first detection rule includes: Obtain the first event type, where the first event type is the event type of the first event; Based on the first event type, the first detection rule is obtained.

3. The method according to claim 2, wherein obtaining the first detection rule based on the first event type includes: Based on the first event type, candidate detection rules are obtained from preset detection rules, and the candidate detection rules include multiple third detection conditions; If all of the plurality of third detection conditions include a first detection item and each of the first detection items has the same preset value, in response to the first event satisfying the first preset condition, the candidate detection rule is used as the first detection rule; wherein, the first event includes a first feature, and the first preset condition includes: the first feature is consistent with the first detection item and the feature value corresponding to the first feature is consistent with the preset value.

4. The method according to any one of claims 1-3, wherein each of the plurality of events has a first event identifier, and the method further comprises: In response to the state machine associated with the first detection rule, including the first state machine, a first position identifier is obtained; wherein, the first state machine is associated with the first event identifier, the first state machine is used to record the first position identifier, and the first position identifier is used to indicate the first first detection condition to be matched in the first order; In response to the state machine associated with the first detection rule not including the first state machine, the first state machine is created based on the first event identifier, and the first position identifier is pointed to the first first detection condition in the first order; The first detection condition pointed to by the first location identifier is used as the second detection condition.

5. The method according to claim 4, wherein the first detection rule further includes a first time interval, the first time interval representing the maximum allowable time interval between the second event and the third event, the second event being an event matching the first first detection condition, the third event being an event matching the last first detection condition, the first state machine further recording a first time, the first time being the trigger time of the fourth event, the fourth event being an event matching the first first detection condition, and the plurality of events including the fourth event; The step of using the first detection condition pointed to by the first location identifier as the second detection condition includes: In response to the second time interval being less than the first time interval, the first detection condition pointed to by the first location identifier is used as the second detection condition, the second time interval being the time interval between the first time and the second time, and the second time being the trigger time of the first event; The method further includes: In response to the second time interval being greater than or equal to the first time interval, the first state machine is reset; the reset includes: pointing the first position identifier to the first first detection condition and setting the first time to zero.

6. The method according to claim 4, wherein the second detection condition includes that the cumulative number of times the first event is triggered within the sliding window is greater than or equal to a first threshold, the first state machine further records the cumulative number of triggers, and the method further includes: The sliding window is divided into a first number of time periods, and the first number of time periods correspond one-to-one with the slots of the circular array. Each slot stores the count value of the first event within the corresponding time period. In response to receiving the first event, for the first time period that has expired in the first number of time periods, the cumulative number of triggers is subtracted from the count value of the first time period, and the count value of the first time period is cleared to zero; Based on the trigger time of the first event, a second time period is obtained from the first number of time periods, the count value of the second time period is incremented by 1, and the cumulative number of triggers is incremented by 1.

7. The method according to any one of claims 1-3, wherein the plurality of first detection conditions successfully match the plurality of events in the first order, comprising: Each of the first detection conditions is matched with the plurality of events sorted by trigger time in the first order until all of the plurality of first detection conditions are successfully matched.

8. The method according to any one of claims 1-3, wherein the first detection rule is at least one of preset detection rules, the preset detection rule being configured based on preset keywords, and the preset keywords including at least one of the following: The first function is used to determine whether the first string is prefixed with the second string; The second function is used to determine whether the third string has the fourth string as a suffix. The third function is used to determine whether the fifth string contains the sixth string.

9. The method according to any one of claims 1-3, wherein the first detection rule is associated with a first handling strategy, the first handling strategy being used to handle a first risky behavior, the first risky behavior including risky behaviors triggered by the plurality of events; The first handling strategy includes at least one of the following handling operations: The released data is being isolated or deleted, as the data poses a security risk. Terminate the newly created process; Perform deletion operations on the created scheduled tasks and / or service startup items; Block outgoing data transmission operations.

10. An electronic device, comprising: A storage device on which computer programs are stored; A processing apparatus for executing the computer program in the storage device to implement the method of any one of claims 1-9.

Images