A terminal process behavior analysis method, device, equipment and medium

Abstract

The application discloses a terminal process behavior analysis method and device, equipment and medium, and relates to the technical field of computers, which comprises the following steps: performing context association and link aggregation on a plurality of behavior events represented by behavior event data of a target terminal to obtain a terminal process chain tree; the terminal process chain tree is a tree-shaped data structure formed by connecting a plurality of terminal process nodes according to the parent-child calling relationship between the terminal process nodes, each terminal process node corresponds to a process instance in the target terminal, and a behavior event is connected to the corresponding terminal process node according to a behavior attribution relationship; and a security semantic analysis is performed on the terminal process chain tree by an intelligent agent analysis module to obtain a target analysis result corresponding to the process behavior of the target terminal. The application reduces the limitations of single log or single behavior event analysis, and enables the target analysis result to better reflect the terminal behavior process and risk characteristics.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device and medium for analyzing terminal process behavior. Background Technology

[0002] As enterprise endpoint environments become increasingly complex, attackers' methods of launching attacks on the host side are constantly evolving. Traditional endpoint process behavior analysis methods typically rely on static signatures, blacklists / whitelists, rule base matching, or single behavioral event statistics. However, current attacks increasingly employ methods such as fileless execution, multi-level script interpreter launches, abuse of legitimate processes, registry persistence, and remote download execution, making it difficult for single logs or individual behavioral events to accurately reflect the complete attack process. Furthermore, for long or complex endpoint behavior chains, existing analysis methods often rely on manual judgment, resulting in low analysis efficiency, poor result consistency, and insufficient identification of risky intent. Therefore, these problems urgently need to be addressed by those in the field. Summary of the Invention

[0003] The purpose of this application is to provide a method, apparatus, device and medium for analyzing terminal process behavior, which can reduce the limitations of analyzing a single log or a single behavioral event, and enable the target analysis results to better reflect the terminal behavior process and its risk characteristics.

[0004] To address the above problems, this application provides a terminal process behavior analysis method, including: Acquire behavioral event data from the target terminal; Context association and link aggregation are performed on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree; wherein, the terminal process chain tree is a tree data structure formed by connecting multiple terminal process nodes according to the parent-child call relationship between the terminal process nodes, each terminal process node corresponds to a process instance in the target terminal, and the behavioral event is attached to the corresponding terminal process node according to the behavior affiliation relationship; The terminal process chain tree is input into the agent analysis module based on a large model, so that the agent analysis module determines the target analysis strategy corresponding to the terminal process chain tree according to the preset analysis target, and performs security semantic analysis on the terminal process chain tree according to the target analysis strategy to obtain the target analysis result corresponding to the process behavior of the target terminal; the target analysis result includes the determination result of whether the process behavior of the target terminal has security risks.

[0005] Optionally, acquiring the behavioral event data of the target terminal includes: Obtain the raw behavioral data generated by the target terminal; Perform at least one of the following processing steps on the raw behavioral data: For the original behavioral data, duplicate data records representing the same behavior within a preset time period are deduplicated; The time fields from different log sources in the original behavioral data are normalized to obtain data records in a unified time format. Map the data fields from different data sources in the original behavioral data to fields under a unified field model; Based on the context information in the original behavior data, the missing fields in the original behavior data are completed; Anomaly filtering processing is performed on the abnormal data records in the original behavioral data; The behavioral event data is generated based on the data processed through the at least one of the aforementioned processing steps.

[0006] Optionally, the step of performing context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree includes: Contextual association is performed on the multiple behavioral events to obtain the contextual association result; The context association includes: establishing a behavior timeline corresponding to the multiple behavior events according to the event time in the behavior event data; establishing a parent-child call relationship between the terminal process nodes based on the process identifier in the behavior event data; and attaching one or more of file behavior events, network behavior events, and registry behavior events to the corresponding terminal process nodes according to the behavior attribution relationship in the behavior event data, thereby obtaining the attachment relationship between the behavior events and the terminal process nodes. Based on the context association results, identify the behavioral events that are continuously triggered within the first preset time window and have context association relationships, form associated behavioral fragments, and perform behavioral link aggregation on the associated behavioral fragments and their corresponding terminal process nodes to obtain behavioral link aggregation results; Based on the behavior timeline, the parent-child call relationship, the attachment relationship, and the behavior link aggregation result, the terminal process chain tree is generated.

[0007] Optionally, the terminal process chain tree also records the temporal relationship between the behavioral events attached to the terminal process node, as well as the behavioral labels of the behavioral events.

[0008] Optionally, behavior link aggregation is performed on the associated behavior fragments and their corresponding terminal process nodes, including: Based on preset association rules and / or a second preset time window, behavior link aggregation is performed on the associated behavior segments and their corresponding terminal process nodes to obtain the behavior link aggregation result; wherein, the preset association rules are used to determine whether the associated behavior segments and their corresponding terminal process nodes belong to the same behavior link.

[0009] Optionally, a target analysis strategy corresponding to the terminal process chain tree is determined based on a preset analysis objective, and security semantic analysis is performed on the terminal process chain tree according to the target analysis strategy to obtain the target analysis results corresponding to the process behavior of the target terminal, including: Based on the analysis task type corresponding to the preset analysis target, determine the model configuration and inference depth used by the intelligent agent analysis module when performing security semantic analysis; The level of detail in the analysis summary is determined based on the process chain length of the terminal process chain tree. If the process chain length meets the preset ultra-long link condition, the terminal process chain tree is divided into multiple link segments, and security semantic analysis is performed on the multiple link segments based on the model configuration, the inference depth and the level of detail of the analysis summary. The analysis results of the corresponding segments are then summarized to obtain the target analysis result. If the process chain length does not meet the preset ultra-long link condition, then security semantic analysis is performed on the terminal process chain tree based on the model configuration, the inference depth, and the level of detail of the analysis summary to obtain the target analysis result.

[0010] Optionally, the terminal process behavior analysis method further includes: If a link segment that meets the preset risk conditions is identified among the multiple link segments during the security semantic analysis process, supplementary question content is generated, and a second security semantic analysis is performed on the link segment that meets the preset risk conditions based on the supplementary question content. The target analysis results are updated based on the corresponding secondary security semantic analysis results.

[0011] Optionally, inputting the terminal process chain tree into the agent analysis module based on a large model includes: Based on a preset prompt word template, the terminal process chain tree and the preset analysis target are encapsulated to obtain model input information; wherein, the preset prompt word template includes one or more of the following: role setting information, task constraint information, output format constraint information, and reasoning guidance information; The model input information is then fed into the agent analysis module based on the large model.

[0012] This application also provides a terminal process behavior analysis device, including: The data acquisition module is used to acquire behavioral event data of the target terminal; The process chain tree construction module is used to perform context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree; wherein, the terminal process chain tree is a tree data structure formed by connecting multiple terminal process nodes according to the parent-child call relationship between the terminal process nodes, each terminal process node corresponds to a process instance in the target terminal, and the behavioral event is attached to the corresponding terminal process node according to the behavior affiliation relationship; The process chain tree analysis module is used to input the terminal process chain tree into the large model-based agent analysis module, so that the agent analysis module determines the target analysis strategy corresponding to the terminal process chain tree according to the preset analysis target, and performs security semantic analysis on the terminal process chain tree according to the target analysis strategy to obtain the target analysis result corresponding to the process behavior of the target terminal; the target analysis result includes the determination result of whether the process behavior of the target terminal has security risks.

[0013] This application also provides a terminal process behavior analysis device, including: Memory, used to store computer programs; A processor is used to implement the terminal process behavior analysis method described above when executing the computer program.

[0014] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the terminal process behavior analysis method described above.

[0015] This application provides a terminal process behavior analysis method, comprising: acquiring behavioral event data of a target terminal; performing context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree; wherein, the terminal process chain tree is a tree-shaped data structure formed by connecting multiple terminal process nodes according to the parent-child call relationship between the terminal process nodes, each terminal process node corresponds to a process instance in the target terminal, and the behavioral events are attached to the corresponding terminal process nodes according to the behavior affiliation relationship; inputting the terminal process chain tree into a large model-based agent analysis module, so that the agent analysis module determines the target analysis strategy corresponding to the terminal process chain tree according to a preset analysis objective, and performs security semantic analysis on the terminal process chain tree according to the target analysis strategy to obtain the target analysis result corresponding to the process behavior of the target terminal; the target analysis result includes a determination result of whether the process behavior of the target terminal has security risks.

[0016] In summary, this application acquires behavioral event data from the target terminal and performs context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree. The terminal process chain tree is formed by connecting multiple terminal process nodes according to the parent-child call relationship between nodes. Each terminal process node corresponds to a process instance in the target terminal, and related behavioral events are attached to the corresponding terminal process node according to the behavior affiliation relationship. In this way, dispersed behavioral events can be organized according to process instances and the parent-child call relationship between process instances, forming a tree-shaped data structure that reflects the behavioral context and behavioral links of the terminal process. Based on this, the terminal process chain tree is input into a large-model-based agent analysis module, which determines the target analysis strategy according to the preset analysis objectives and performs security semantic analysis according to the target analysis strategy. In this way, analysis can be performed based on the terminal process chain tree containing context association relationships and link aggregation results, reducing the limitations caused by analyzing only a single log or a single behavioral event, and improving the accuracy of analyzing and judging the behavior of terminal processes and their security risks.

[0017] This application also provides a terminal process behavior analysis device, a terminal process behavior analysis equipment, and a computer-readable storage medium, which have the above-mentioned beneficial effects, and will not be elaborated here. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a terminal process behavior analysis method provided in this application embodiment; Figure 2 A schematic diagram of a terminal process behavior analysis device provided in an embodiment of this application; Figure 3 This is a schematic diagram of a terminal process behavior analysis device provided in an embodiment of this application. Detailed Implementation

[0020] The core of this application is to provide a method, apparatus, device, and medium for analyzing terminal process behavior, which can reduce the limitations of analyzing a single log or a single behavioral event, and enable the target analysis results to better reflect the terminal behavior process and its risk characteristics.

[0021] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] As enterprise endpoint environments become increasingly complex, attackers' methods of launching attacks on the host side are constantly evolving. Traditional endpoint security analysis methods typically rely on static signatures, blacklists / whitelists, rule base matching, or single behavioral event statistics. However, current attacks increasingly employ methods such as fileless execution, multi-level script interpreter launches, abuse of legitimate processes, registry persistence, and remote download execution, making it difficult for single logs or individual behavioral events to accurately reflect the complete attack process. Furthermore, for long or complex endpoint behavior chains, existing analysis methods often rely on manual judgment, resulting in low analysis efficiency, poor result consistency, and insufficient identification of risky intent. Therefore, these problems urgently need to be addressed by those in the field.

[0023] Therefore, this application acquires behavioral event data of the target terminal and performs context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree. The terminal process chain tree is formed by connecting multiple terminal process nodes according to the parent-child call relationship between nodes. Each terminal process node corresponds to a process instance in the target terminal, and related behavioral events are attached to the corresponding terminal process node according to the behavior affiliation relationship. In this way, scattered behavioral events can be organized according to process instances and the parent-child call relationship between process instances, forming a tree-shaped data structure that reflects the behavioral context and behavioral links of the terminal process. Based on this, the terminal process chain tree is input into an agent analysis module based on a large model, which determines the target analysis strategy according to the preset analysis objectives and performs security semantic analysis according to the target analysis strategy. In this way, analysis can be performed based on the terminal process chain tree containing context association relationships and link aggregation results, reducing the limitations caused by analyzing only a single log or a single behavioral event, and improving the accuracy of analyzing and judging the behavior of terminal processes and their security risks.

[0024] The following embodiment illustrates a terminal process behavior analysis method provided in this application.

[0025] Please refer to Figure 1 , Figure 1 This is a flowchart of a terminal process behavior analysis method provided in an embodiment of this application.

[0026] In this embodiment, the method may include: S101: Obtain behavioral event data from the target terminal.

[0027] In this embodiment, the target terminal can be a terminal host capable of generating behavioral data such as process behavior, command execution, file operations, network connections, and registry operations. The target terminal can run a terminal operating system or deploy a terminal agent program, and can record relevant behavioral data during its operation through system log sources or security monitoring components. In terms of applicability, this embodiment is applicable not only to conventional office terminals but also to servers, cloud hosts, virtual desktops, industrial control terminals, and other scenarios. That is, the target terminal is not limited to a specific type of device; as long as it can generate raw behavioral data that can be used to construct a terminal process chain tree, it can be used as the target terminal in this step.

[0028] Furthermore, after identifying the target terminal, the raw behavioral data generated by that target terminal is obtained. This raw behavioral data may include basic process information, command execution records, file behavior information, network behavior information, registry behavior information, and file reading and image loading data. Specifically, basic process information may include process name, process identifier (PID), parent process identifier (PPID), start time, exit time, and user information; command execution records may include the executing user, executed command, command parameters, and execution path; file behavior information may include file creation, modification, deletion, renaming, and hash value; network behavior information may include the target Internet Protocol address (IP), domain name, port, protocol, connection time, and connection direction; and registry behavior information may include key paths, key value modification types, and operation times.

[0029] After acquiring the raw behavioral data, it is processed, and behavioral event data is generated based on the processed data. This behavioral event data can then be used for subsequent context association and link aggregation. The processing of the raw behavioral data includes: deduplicating duplicate data records representing the same behavior within a preset time period; normalizing time fields from different log sources to obtain data records in a unified time format; mapping data fields from different data sources to fields under a unified field model; completing missing fields based on context information in the raw behavioral data; and filtering abnormal data records. Any one of these processing steps can be performed, or a combination of steps can be executed depending on the actual situation of the raw behavioral data.

[0030] Based on the data processed through at least one of the above steps, behavioral event data is generated. This makes the behavioral event data more suitable for subsequent organization according to contextual and link relationships compared to the original behavioral data.

[0031] S102: Perform context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree; wherein, the terminal process chain tree is a tree data structure formed by connecting multiple terminal process nodes according to the parent-child call relationship between the terminal process nodes, each terminal process node corresponds to a process instance in the target terminal, and the behavioral event is attached to the corresponding terminal process node according to the behavior affiliation relationship.

[0032] After obtaining the behavioral event data, context association and link aggregation are performed on multiple behavioral events based on this data to obtain the terminal process chain tree. The terminal process chain tree is a tree-like data structure formed by connecting multiple terminal process nodes according to the parent-child call relationships between them. Each terminal process node corresponds to a process instance in the target terminal, and behavioral events are attached to the corresponding terminal process node according to their behavior affiliation. That is, the terminal process chain tree does not merely record single behavioral events, but rather organizes multiple behavioral events according to their corresponding process instances and the parent-child call relationships between them, thereby forming a tree-like data structure that can express the behavioral context of the terminal processes.

[0033] Specifically, the multiple behavioral events can be context-associated to obtain context association results.

[0034] When performing context association, a timeline of behavior events can be established based on the event times in the behavior event data. This timeline allows for the determination of the chronological order of each behavior event, enabling subsequent association of different types of behavior events, such as process behavior, file behavior, network behavior, and registry behavior, within a unified temporal framework.

[0035] Furthermore, parent-child call relationships between terminal process nodes can be established based on the process identifiers in the behavioral event data. The process identifier can include a process identifier (PID) and a parent process identifier (PPID). Each terminal process node can correspond to a process instance generated in the target terminal, and the parent-child call relationship can be determined based on the correspondence between the process identifier and the parent process identifier. In this way, previously scattered process-related behaviors can be organized according to process nodes and the call relationships between them.

[0036] Furthermore, after establishing the terminal process nodes and their parent-child call relationships, one or more of the following can be attached to the corresponding terminal process nodes based on the behavior attribution relationships in the behavior event data: file behavior events, network behavior events, and registry behavior events. This yields the attachment relationship between the behavior events and the terminal process nodes. For example, file creation, modification, deletion, and renaming can be considered file behavior events, network connection-related behaviors can be considered network behavior events, and registry key path or key value modification-related behaviors can be considered registry behavior events.

[0037] Based on the above behavior timeline, parent-child call relationship, and attachment relationship, the context association result can be obtained.

[0038] Based on this, behavioral events that are continuously triggered and have contextual relationships within a first preset time window can be identified based on the context association results, forming associated behavioral fragments. These associated behavioral fragments and their corresponding terminal process nodes are then aggregated into behavioral link aggregation results. The associated behavioral fragments can be understood as a group of behavioral events that occur consecutively within a short time frame and are related in meaning. For example, related behaviors such as downloading, landing, executing, decompressing, starting, script interpretation, and child process launch can be aggregated into corresponding behavioral links. The first preset time window can be determined based on factors such as the trigger interval of the behavioral events; this embodiment does not limit this.

[0039] Furthermore, when aggregating related behavior segments and their corresponding terminal process nodes into behavior chains, a judgment can be made based on preset association rules and / or a second preset time window to obtain the corresponding behavior chain aggregation results. The preset association rules can be used to determine whether the related behavior segments and their corresponding terminal process nodes belong to the same behavior chain based on aspects such as behavior type, behavior sequence, process node affiliation, and call relationships between process nodes. For example, for behaviors such as downloading, logging, executing, decompressing, starting, script interpretation, and child process launch, a link association relationship can be determined based on their behavioral meaning and sequence. The second preset time window can be used to limit the time range for behavior chain aggregation. In other words, when determining whether related behavior segments and their corresponding terminal process nodes belong to the same behavior chain, in addition to considering whether there is a relationship between the behaviors, it is also possible to further consider whether the related behaviors occur within the second preset time window. The second preset time window can be determined based on actual needs.

[0040] In some embodiments, the terminal process chain tree may also record the temporal relationships between behavioral events attached to the terminal process nodes, as well as the behavioral tags of the behavioral events. The temporal relationships can be used to characterize the order of occurrence or time intervals between related behavioral events, and the behavioral tags can be used to characterize the behavioral type or behavioral characteristics of the corresponding behavioral events. Thus, by recording the temporal relationships corresponding to behavioral events in the terminal process chain tree, the order of occurrence and temporal association of different behavioral events can be reflected; by setting behavioral tags for behavioral events, the behavioral type or behavioral characteristics of the behavioral events can be reflected. Therefore, the terminal process chain tree can not only reflect the parent-child call relationships between process instances and the attribution relationships of behavioral events, but also reflect the association of behavioral events in the temporal and semantic dimensions, which is beneficial for subsequent security semantic analysis combining the behavioral occurrence process and behavioral characteristics.

[0041] In this way, the preset association rules can determine whether behavior segments are related based on the content and context of the behavior, while the second preset time window can constrain the aggregation range between behavior segments in terms of time. After obtaining the behavior link aggregation result based on the two, it can reduce the situation where behavior events with excessively large time spans or insufficient contextual relationships are aggregated into the same behavior link, so that the terminal process chain tree can more accurately reflect the association and time relationship between behavior events.

[0042] S103: Input the terminal process chain tree into the agent analysis module based on a large model, so that the agent analysis module determines the target analysis strategy corresponding to the terminal process chain tree according to the preset analysis target, and performs security semantic analysis on the terminal process chain tree according to the target analysis strategy to obtain the target analysis result corresponding to the process behavior of the target terminal; the target analysis result includes the determination result of whether the process behavior of the target terminal has security risks.

[0043] After generating the terminal process chain tree, it is input into the agent analysis module based on a large model. The large model can be a Large Language Model (LLM), and the agent analysis module is an agent analysis module based on the large model, using the large model as its core to perform security semantic analysis on the terminal process chain tree. Based on the foregoing analysis, since the terminal process chain tree is a tree-like data structure formed by connecting multiple terminal process nodes according to parent-child call relationships, and behavioral events are attached to corresponding terminal process nodes according to their behavior attribution relationships, the agent analysis module can analyze the process behavior and context of the target terminal based on the terminal process chain tree, rather than judging only a single log or a single behavioral event. In some embodiments, the terminal process chain tree may also include the temporal relationship between behavioral events and the behavioral labels of the behavioral events.

[0044] In this embodiment, before inputting the terminal process chain tree into the agent analysis module, the terminal process chain tree and the preset analysis target can be encapsulated based on a preset prompt word template to obtain model input information. The preset analysis target can be used to characterize the analysis purpose to be achieved in this security semantic analysis, such as including an overall description of process chain behavior, a description of the behavior of key process nodes, analysis of behavioral intent, extraction of key features, clarification of inter-process call relationships, and determination of whether the process behavior of the target terminal has security risks. The preset prompt word template can include one or a combination of role setting information, task constraint information, output format constraint information, and inference guidance information. In this way, the information input to the agent analysis module includes not only the terminal process chain tree to be analyzed, but also the task requirements and output requirements corresponding to this analysis. Subsequently, the model input information can be input into the agent analysis module based on a large model.

[0045] Furthermore, the agent analysis module can determine the model configuration and inference depth used when performing security semantic analysis based on the analysis task type corresponding to the preset analysis target. The model configuration characterizes the model-related settings used by the agent analysis module in this analysis, such as the type of large model used or configurations related to model input and output. The inference depth characterizes the depth to which the agent analysis module performs semantic analysis on the terminal process chain tree, such as whether it performs an overall description of process chain behavior or further describes the behavior of key process nodes, analyzes behavioral intent, extracts key features, analyzes inter-process call relationships, and determines security risks. Simultaneously, the agent analysis module can also determine the level of detail in the analysis summary based on the process chain length of the terminal process chain tree. The process chain length characterizes the number of process nodes, behavioral events, or link levels in the terminal process chain tree; the level of detail in the analysis summary characterizes the level of detail in the description of the terminal process chain tree in the target analysis results. In other words, when the process chain is short, the process nodes, behavioral events, and call relationships can be described relatively completely in the target analysis results; when the process chain is long, the key link segments and their analysis conclusions can be described in detail, while the non-key link segments can be described in a general way to avoid the target analysis results being too lengthy.

[0046] In some embodiments, if the process chain length meets a preset ultra-long link condition, the terminal process chain tree can be divided into multiple link segments. Based on the model configuration, inference depth, and analysis summary detail, security semantic analysis is performed on each of the multiple link segments. The analysis results of the corresponding segments are then summarized to obtain the target analysis result. In this way, when the process chain is long, complex links can be broken down into multiple relatively independent link segments for analysis, and an overall analysis conclusion can be formed by summarizing the segment analysis results, thereby reducing the complexity of directly analyzing ultra-long links.

[0047] In other embodiments, if the process chain length does not meet the preset ultra-long link condition, the terminal process chain tree can be directly subjected to overall security semantic analysis based on the model configuration, inference depth, and analysis summary detail to obtain the target analysis result. In this way, the terminal process chain tree can be directly analyzed as a whole when the process chain length is moderate, thereby reducing unnecessary link division and result aggregation processes and improving the simplicity of the analysis and processing.

[0048] Furthermore, during the security semantic analysis process, if a link segment that meets preset risk conditions is identified, supplementary questions can be generated, and a second security semantic analysis can be performed on the link segment that meets the preset risk conditions based on the supplementary questions. The preset risk conditions can be understood as triggering conditions used to determine whether a link segment needs further analysis, and do not necessarily indicate that the link segment has been identified as malicious behavior. For example, when a link segment contains relatively critical behavioral features, the behaviors have strong contextual relationships, or the initial security semantic analysis results show that the behavioral intent of the link segment still needs further confirmation, the link segment can be considered to meet the preset risk conditions. The supplementary questions can be generated based on the identified link segments and are used to further confirm the analysis issues that still need to be clarified in the link segment. For example, the supplementary questions can be used to confirm the call relationships between process nodes, the temporal relationships between behavioral events, the behavioral features reflected by behavioral tags, or the behavioral intent corresponding to the link segment. It should be noted that the similarity between the second and first security semantic analyses is that both are based on the terminal process chain tree or its link segments for security semantic analysis. The difference lies in the fact that the initial security semantic analysis primarily focuses on the overall analysis of the terminal process chain tree or link segments, and its results can serve as the initial analysis results. The secondary security semantic analysis, on the other hand, builds upon the results of the initial security semantic analysis and conducts further analysis on link segments that meet preset risk conditions. Subsequently, the results of the secondary security semantic analysis can be used to supplement or correct the results of the initial security semantic analysis, so that the corrected security semantic analysis results can more fully reflect the behavioral characteristics, contextual relationships, and risk situations of the relevant link segments.

[0049] In this embodiment, the target analysis results are used to characterize the security semantic analysis conclusions corresponding to the process behavior of the target terminal, and include the determination results of whether the process behavior of the target terminal has security risks. In some embodiments, the target analysis results may also include one or more of the following: overall description of process chain behavior, description of key process node behavior, behavior intent analysis results, key features, inter-process call relationships, risk attribution results, and handling suggestions.

[0050] This application provides a terminal process behavior analysis method, comprising: acquiring behavioral event data of a target terminal; performing context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree; wherein, the terminal process chain tree is a tree-shaped data structure formed by connecting multiple terminal process nodes according to the parent-child call relationship between the terminal process nodes, each terminal process node corresponds to a process instance in the target terminal, and the behavioral events are attached to the corresponding terminal process nodes according to the behavior affiliation relationship; inputting the terminal process chain tree into a large model-based agent analysis module, so that the agent analysis module determines the target analysis strategy corresponding to the terminal process chain tree according to a preset analysis objective, and performs security semantic analysis on the terminal process chain tree according to the target analysis strategy to obtain the target analysis result corresponding to the process behavior of the target terminal; the target analysis result includes a determination result of whether the process behavior of the target terminal has security risks.

[0051] In summary, this application acquires behavioral event data from the target terminal and performs context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree. The terminal process chain tree is formed by connecting multiple terminal process nodes according to the parent-child call relationship between nodes. Each terminal process node corresponds to a process instance in the target terminal, and related behavioral events are attached to the corresponding terminal process node according to the behavior affiliation relationship. In this way, dispersed behavioral events can be organized according to process instances and the parent-child call relationship between process instances, forming a tree-shaped data structure that reflects the behavioral context and behavioral links of the terminal process. Based on this, the terminal process chain tree is input into a large-model-based agent analysis module, which determines the target analysis strategy according to the preset analysis objectives and performs security semantic analysis according to the target analysis strategy. In this way, analysis can be performed based on the terminal process chain tree containing context association relationships and link aggregation results, reducing the limitations caused by analyzing only a single log or a single behavioral event, and improving the accuracy of analyzing and judging the behavior of terminal processes and their security risks.

[0052] The terminal process behavior analysis method provided in this application is illustrated below with a specific example: In an enterprise office network, the target terminal is an employee's office host, running an operating system and equipped with a terminal agent. During operation, this terminal generates raw behavioral data, including process behavior, command execution behavior, file operation behavior, network connection behavior, registry operation behavior, and image loading behavior. The data acquisition module obtains this raw behavioral data from the terminal operating system, the terminal agent, system log sources, or security monitoring components. This raw behavioral data can include basic process information, command execution records, file behavior information, network behavior information, registry behavior information, file read information, and image loading information. Specifically, basic process information includes process name, process identifier, parent process identifier, start time, exit time, and user information; command execution records include the executing user, executed command, command parameters, and execution path; file behavior information includes file creation, modification, deletion, renaming, and hash values; network behavior information includes the target internet protocol address, domain name, port, protocol, connection time, and connection direction; and registry behavior information includes key paths, key value modification types, and operation times. This raw behavioral data is used to construct a terminal process chain tree corresponding to the target terminal and to perform security analysis on the target terminal's process behavior.

[0053] (1) Preprocess and filter the raw behavioral data to generate behavioral event data. Specifically, duplicate data records representing the same behavior within a short period of time can be deduplicated; time fields from different log sources can be normalized to form a unified time format; data from different sources can be converted into a unified field model; missing fields can be supplemented according to contextual relationships; and obviously damaged, invalid, or incomplete data can be filtered. Through the above processing, the raw behavioral data is converted into behavioral event data that can participate in subsequent contextual association and link aggregation.

[0054] (2) The context reconstruction module sorts various behavioral events based on event time and establishes a basic behavioral timeline; it establishes parent-child process associations based on the correspondence between process identifiers and parent process identifiers; and it attaches file behavior, network behavior, registry behavior, and image loading behavior to the corresponding process nodes. For example, when a script interpreter process triggers command execution behavior, network connection behavior, and file write behavior in a short period of time, these behavioral events can be attached to the process node corresponding to the script interpreter, and their behavior types can be identified by behavior tags.

[0055] (3) The context reconstruction module identifies behavioral events that are triggered consecutively within a short period of time and have contextual relationships, forms related behavioral fragments, and aggregates related processes and behavioral events into behavioral chains according to preset rules or time windows. For example, within the same time range, if a process first triggers a remote download behavior, then generates a file write behavior, and then triggers a new process start behavior, it can be aggregated into a download-write-execute behavior chain; if a compressed file is released and the executable file in it is immediately started, it can be aggregated into a decompression-start behavior chain; if the script interpreter process launches a child process, it can be aggregated into a script interpretation-child process launch behavior chain. Based on the behavioral timeline, parent-child process association, behavioral attachment relationship, behavioral labels, and behavioral chain aggregation results, a terminal process chain tree with tree structure, time relationship, and behavioral labels is output.

[0056] (4) Input the terminal process chain tree into the agent analysis module based on a large language model. Before input, the terminal process chain tree and the preset analysis target can be encapsulated by a preset prompt template to obtain the model input information. The prompt template may include role setting information, task constraint information, output format constraint information, and reasoning guidance information, so that the agent analysis module can analyze the process chain tree according to the security analysis task. The preset analysis target may include an overall description of the process chain behavior, a description of the behavior of key process nodes, behavioral intent analysis, key feature extraction, sorting out the inter-process call relationship, and judging whether the process behavior of the target terminal has security risks, etc.

[0057] (5) After receiving the model input information, the agent analysis module can select different model configurations or different inference depths according to the analysis task type, and control the level of summary detail according to the process chain length, so as to perform security semantic analysis on the process behavior of the target terminal. When the process chain is long, the terminal process chain tree can be segmented for analysis, and the analysis results of each link segment can be summarized; when the process chain length does not meet the ultra-long link condition, the terminal process chain tree can be directly analyzed as a whole. If a high-risk segment is identified during the analysis, supplementary questions can be generated for the segment, and secondary security semantic analysis or multiple rounds of review can be performed to further confirm the meaning of key behaviors, call relationships, time relationships, behavioral characteristics, and behavioral intentions. For different analysis tasks, the corresponding model or inference depth can also be selected through model routing to adapt to the analysis needs of different complexities.

[0058] (6) The intelligent agent analysis module outputs the target analysis results corresponding to the process behavior of the target terminal. The target analysis results can be structured or semi-structured data, and include the determination results of whether the process behavior of the target terminal has security risks. In some embodiments, the target analysis results may also include an overall description of the process chain behavior, a description of the behavior of key process nodes, behavioral intent analysis, key features, inter-process call relationships, security attributes, threat attributes, risk conclusions, and handling suggestions. The analysis results can be called by the Endpoint Detection and Response (EDR) system, threat hunting system, threat intelligence production system, model training system, or automated handling system. For example, the Endpoint Detection and Response system can generate detection strategies based on the analysis results, the threat intelligence system can supplement threat intelligence based on key features, the model training system can construct training features based on structured attributes, and the automated handling system can execute subsequent responses according to risk conclusions and handling suggestions.

[0059] In other optional implementations, the aforementioned agent analysis module can employ a single agent approach or a multi-agent collaborative approach. For example, different agents can respectively undertake functions such as initial link screening, in-depth analysis, result verification, and attribution output; alternatively, a hybrid decision-making process combining a rule engine and a large model can be introduced, with the rule engine performing some deterministic judgments and the large model performing complex contextual semantic analysis. All of these methods can be used to perform semantic analysis on the terminal process chain tree to achieve process behavior analysis and security risk assessment of the target terminal, and output reusable, structured, and transferable analytical conclusions.

[0060] The terminal process behavior analysis device provided in the embodiments of this application is described below.

[0061] Please refer to Figure 2 , Figure 2 This is a schematic diagram of the structure of a terminal process behavior analysis device provided in an embodiment of this application.

[0062] In this embodiment, the device may include: Data acquisition module 100 is used to acquire behavioral event data of the target terminal; The process chain tree construction module 200 is used to perform context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree; wherein, the terminal process chain tree is a tree data structure formed by connecting multiple terminal process nodes according to the parent-child call relationship between the terminal process nodes, each terminal process node corresponds to a process instance in the target terminal, and the behavioral event is attached to the corresponding terminal process node according to the behavior attribution relationship; The process chain tree analysis module 300 is used to input the terminal process chain tree into the agent analysis module based on a large model, so that the agent analysis module determines the target analysis strategy corresponding to the terminal process chain tree according to the preset analysis target, and performs security semantic analysis on the terminal process chain tree according to the target analysis strategy to obtain the target analysis result corresponding to the process behavior of the target terminal; the target analysis result includes the determination result of whether the process behavior of the target terminal has security risks.

[0063] Figure 3 This is a schematic diagram of the structure of a terminal process behavior analysis device provided in an embodiment of this application.

[0064] This application embodiment also provides a terminal process behavior analysis device, which includes: Memory, used to store computer programs; A processor is used to implement the steps of the terminal process behavior analysis method as described in the above embodiments when executing the computer program.

[0065] like Figure 3 The diagram shows the structural composition of a terminal process behavior analysis device. The terminal process behavior analysis device may include: a processor 10, a memory 11, a communication interface 12, and a communication bus 13. The processor 10, memory 11, and communication interface 12 all communicate with each other via the communication bus 13.

[0066] In this embodiment, the processor 10 may be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic devices.

[0067] The processor 10 can call programs stored in the memory 11. Specifically, the processor 10 can execute operations in the embodiments of the terminal process behavior analysis method.

[0068] The memory 11 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment, the memory 11 stores at least a program for implementing the following functions: Acquire behavioral event data from the target terminal; Context association and link aggregation are performed on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree; wherein, the terminal process chain tree is a tree data structure formed by connecting multiple terminal process nodes according to the parent-child call relationship between the terminal process nodes, each terminal process node corresponds to a process instance in the target terminal, and the behavioral event is attached to the corresponding terminal process node according to the behavior affiliation relationship; The terminal process chain tree is input to a large-model-based agent analysis module, which determines a target analysis strategy corresponding to the terminal process chain tree based on a preset analysis objective. The module then performs security semantic analysis on the terminal process chain tree according to the target analysis strategy to obtain the target analysis result corresponding to the process behavior of the target terminal. The target analysis result includes a determination of whether the process behavior of the target terminal poses a security risk. In one possible implementation, the memory 11 may include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a given function; the data storage area may store data created during use.

[0069] In addition, memory 11 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0070] Communication interface 12 can be an interface for the communication module, used to connect with other devices or systems.

[0071] Of course, it should be noted that, Figure 3 The structure shown does not constitute a limitation on the terminal process behavior analysis device in the embodiments of this application. In practical applications, the terminal process behavior analysis device may include more than Figure 3 More or fewer components as shown, or combinations of certain components.

[0072] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the terminal process behavior analysis method described in the above embodiments.

[0073] The computer-readable storage medium may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0074] For a description of the computer-readable storage medium provided in this application, please refer to the above method embodiments; further details will not be repeated here.

[0075] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0076] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0077] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0078] The present application provides a detailed description of a terminal process behavior analysis method, apparatus, device, and medium. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for analyzing terminal process behavior, characterized in that, include: Acquire behavioral event data from the target terminal; Context association and link aggregation are performed on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree; wherein, the terminal process chain tree is a tree data structure formed by connecting multiple terminal process nodes according to the parent-child call relationship between the terminal process nodes, each terminal process node corresponds to a process instance in the target terminal, and the behavioral event is attached to the corresponding terminal process node according to the behavior affiliation relationship; The terminal process chain tree is input into the agent analysis module based on a large model, so that the agent analysis module determines the target analysis strategy corresponding to the terminal process chain tree according to the preset analysis target, and performs security semantic analysis on the terminal process chain tree according to the target analysis strategy to obtain the target analysis result corresponding to the process behavior of the target terminal; the target analysis result includes the determination result of whether the process behavior of the target terminal has security risks.

2. The terminal process behavior analysis method according to claim 1, characterized in that, The acquisition of behavioral event data of the target terminal includes: Obtain the raw behavioral data generated by the target terminal; Perform at least one of the following processing steps on the raw behavioral data: For the original behavioral data, duplicate data records representing the same behavior within a preset time period are deduplicated; The time fields from different log sources in the original behavioral data are normalized to obtain data records in a unified time format. Map the data fields from different data sources in the original behavioral data to fields under a unified field model; Based on the context information in the original behavior data, the missing fields in the original behavior data are completed; Anomaly filtering processing is performed on the abnormal data records in the original behavioral data; The behavioral event data is generated based on the data processed through the at least one of the aforementioned processing steps.

3. The terminal process behavior analysis method according to claim 1, characterized in that, The step of performing context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree includes: Contextual association is performed on the multiple behavioral events to obtain the contextual association result; The context association includes: establishing a behavior timeline corresponding to the multiple behavior events according to the event time in the behavior event data; establishing a parent-child call relationship between the terminal process nodes based on the process identifier in the behavior event data; and attaching one or more of file behavior events, network behavior events, and registry behavior events to the corresponding terminal process nodes according to the behavior attribution relationship in the behavior event data, thereby obtaining the attachment relationship between the behavior events and the terminal process nodes. Based on the context association results, identify the behavioral events that are continuously triggered within the first preset time window and have context association relationships, form associated behavioral fragments, and perform behavioral link aggregation on the associated behavioral fragments and their corresponding terminal process nodes to obtain behavioral link aggregation results; Based on the behavior timeline, the parent-child call relationship, the attachment relationship, and the behavior link aggregation result, the terminal process chain tree is generated.

4. The terminal process behavior analysis method according to claim 1, characterized in that, The terminal process chain tree also records the temporal relationships between the behavioral events attached to the terminal process nodes, as well as the behavioral labels of the behavioral events.

5. The terminal process behavior analysis method according to claim 3, characterized in that, The step of aggregating the behavior links of the associated behavior segments and their corresponding terminal process nodes includes: Based on preset association rules and / or a second preset time window, behavior link aggregation is performed on the associated behavior segments and their corresponding terminal process nodes to obtain the behavior link aggregation result; wherein, the preset association rules are used to determine whether the associated behavior segments and their corresponding terminal process nodes belong to the same behavior link.

6. The terminal process behavior analysis method according to claim 1, characterized in that, Based on the preset analysis objectives, a target analysis strategy corresponding to the terminal process chain tree is determined, and security semantic analysis is performed on the terminal process chain tree according to the target analysis strategy to obtain the target analysis results corresponding to the process behavior of the target terminal, including: Based on the analysis task type corresponding to the preset analysis target, determine the model configuration and inference depth used by the intelligent agent analysis module when performing security semantic analysis; The level of detail in the analysis summary is determined based on the process chain length of the terminal process chain tree. If the process chain length meets the preset ultra-long link condition, the terminal process chain tree is divided into multiple link segments, and security semantic analysis is performed on the multiple link segments based on the model configuration, the inference depth and the level of detail of the analysis summary. The analysis results of the corresponding segments are then summarized to obtain the target analysis result. If the process chain length does not meet the preset ultra-long link condition, then security semantic analysis is performed on the terminal process chain tree based on the model configuration, the inference depth, and the level of detail of the analysis summary to obtain the target analysis result.

7. The terminal process behavior analysis method according to claim 6, characterized in that, Also includes: If a link segment that meets the preset risk conditions is identified among the multiple link segments during the security semantic analysis process, supplementary question content is generated, and a second security semantic analysis is performed on the link segment that meets the preset risk conditions based on the supplementary question content. The target analysis results are updated based on the corresponding secondary security semantic analysis results.

8. The terminal process behavior analysis method according to any one of claims 1 to 7, characterized in that, The step of inputting the terminal process chain tree into the agent analysis module based on a large model includes: Based on a preset prompt word template, the terminal process chain tree and the preset analysis target are encapsulated to obtain model input information; wherein, the preset prompt word template includes one or more of the following: role setting information, task constraint information, output format constraint information, and reasoning guidance information; The model input information is then fed into the agent analysis module based on the large model.

9. A terminal process behavior analysis device, characterized in that, include: The data acquisition module is used to acquire behavioral event data of the target terminal; The process chain tree construction module is used to perform context association and link aggregation on multiple behavioral events represented by the behavioral event data to obtain a terminal process chain tree; wherein, the terminal process chain tree is a tree data structure formed by connecting multiple terminal process nodes according to the parent-child call relationship between the terminal process nodes, each terminal process node corresponds to a process instance in the target terminal, and the behavioral event is attached to the corresponding terminal process node according to the behavior affiliation relationship; The process chain tree analysis module is used to input the terminal process chain tree into the large model-based agent analysis module, so that the agent analysis module determines the target analysis strategy corresponding to the terminal process chain tree according to the preset analysis target, and performs security semantic analysis on the terminal process chain tree according to the target analysis strategy to obtain the target analysis result corresponding to the process behavior of the target terminal; the target analysis result includes the determination result of whether the process behavior of the target terminal has security risks.

10. A device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the terminal process behavior analysis method as described in any one of claims 1 to 8 when executing the computer program.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the terminal process behavior analysis method as described in any one of claims 1 to 8.

Images