Device behavior attack detection method and device, computer device, and storage medium

Abstract

The application relates to a device behavior attack detection method and device, computer equipment and a storage medium. The method comprises the following steps: obtaining original traffic data of a device to be analyzed; using a plurality of time windows with different time granularities to process the original traffic data respectively, so as to obtain multidimensional behavior feature data; comparing the multidimensional behavior feature data with a preset device behavior baseline, so as to obtain a target comparison result; and if the target comparison result meets a preset abnormal condition, determining that the device to be analyzed has an abnormal attack behavior. The application can avoid false positives or false negatives caused by a single fixed time window, and improve the accuracy of attack behavior detection.

Description

Technical Field

[0001] This application relates to the field of network information security technology, and in particular to a method, apparatus, computer device, and storage medium for detecting device behavior attacks. Background Technology

[0002] In the field of cybersecurity monitoring, attack reasoning based on time-series analysis is an important means of discovering persistent threats and advanced persistent threats (APTs).

[0003] In existing network security monitoring systems, attack inference based on time-series analysis mainly relies on the statistics and mining of network traffic or alarm logs. Currently, the mainstream technical solutions mainly include: statistical methods based on fixed time windows, which divide time into fixed-length segments and use traffic or alarm thresholds within the statistical window to determine anomalies.

[0004] While fixed-time-window statistical methods are simple to implement, the choice of window size has a significant impact on the results. For example, to reduce computational overhead, current techniques typically use large fixed-time windows (such as those on the minute or hour level). However, large fixed-time windows struggle to capture rapidly changing attack behaviors, and attack detection often requires waiting for the window to close before calculations can be performed. This results in significant delays in attack detection, making it impossible to accurately detect whether an attack has occurred. Furthermore, existing technologies analyze and judge based on detection data within a single fixed time window, making it difficult to discover attack chains that span across time windows, thus making the detection results of attack behaviors unreliable. Summary of the Invention

[0005] This application provides a method, apparatus, computer device, and storage medium for detecting device behavior attacks, aiming to solve the problem that traditional analysis and detection using a single fixed time window cannot accurately detect attack behavior.

[0006] In a first aspect, embodiments of this application provide a method for detecting device behavior attacks, the method comprising: Obtain the raw traffic data of the device to be analyzed; The original traffic data is processed using multiple time-series windows with different time granularities to obtain multi-dimensional behavioral feature data; The multi-dimensional behavioral feature data is compared with a preset device behavior baseline to obtain the target comparison result; If the target comparison result meets the preset abnormal conditions, it is determined that the device to be analyzed has abnormal attack behavior.

[0007] A further technical solution involves using multiple time-series windows with different time granularities, including a first period window, a second period window, a third period window, and a fourth period window. The durations of the first, second, third, and fourth period windows increase sequentially. The original data is then processed using these multiple time-series windows to obtain multi-dimensional behavioral feature data, including: The original data is processed using the first periodic window to obtain the first data; Determine whether the first data satisfies the triggering condition of the second periodic window; In response to the first data satisfying the triggering condition of the second periodic window, the first data is processed using the second periodic window to obtain the second data; In response to the first data not meeting the triggering condition of the second periodic window, it is determined whether the first data meets the triggering condition of the third periodic window. In response to the first data satisfying the triggering condition of the third periodic window, the first data is fingerprinted using the third periodic window to obtain the third data; Based on the second data and the third data, multi-dimensional behavioral feature data is obtained.

[0008] A further technical solution is that the multi-dimensional behavioral feature data includes feature data of multiple dimensions; the preset device behavior baseline includes multiple preset sub-baselines corresponding to the multiple dimensions; The step of comparing the multi-dimensional behavioral feature data with a preset device behavior baseline to obtain the target comparison result includes: The feature data of multiple dimensions are compared one by one with their corresponding preset sub-baselines to obtain multiple single comparison results; According to a preset weight allocation strategy, multiple single comparison results are weighted and fused to obtain the target comparison result.

[0009] A further technical solution is that the feature data of the multiple dimensions includes at least two of the following: IP address, MAC address, device type, device TTL value, device name, device port service information, banner information, operating system type, HTTP behavior, and real-time traffic.

[0010] A further technical solution is that the multiple time-series windows with different time granularities also include a fourth periodic window, the duration of which is greater than the duration of the third periodic window. The step of determining whether the first data meets the triggering condition of the third periodic window further includes: In response to the first data not meeting the triggering condition of the third periodic window, it is determined whether the first data meets the triggering condition of the fourth periodic window. In response to the first data meeting the trigger condition of the fourth period window, the first data is processed by traffic statistics and summary using the fourth period window to obtain the fourth data; and the fourth data is written in batches into a preset database. If the first data does not meet the triggering condition of the fourth cycle window, the process returns to the step of obtaining the original traffic data of the device to be analyzed.

[0011] A further technical solution is that, after obtaining multiple single comparison results, the method further includes: If the single comparison result meets the preset deviation conditions, the abnormal behavior of the single comparison result will be recorded as an attack event node. Construct temporal edges based on the temporal order and causal relationship between the attack event points; A time sequence graph is obtained based on the aforementioned time sequence edges; The target attack chain is identified in the time sequence diagram; Based on the target attack chain, the attack scenario is reconstructed according to a preset time sequence.

[0012] A further technical solution is that, after obtaining the target comparison result, the method further includes: If the target comparison result does not meet the preset abnormal conditions, the preset device behavior baseline will be updated.

[0013] Secondly, embodiments of this application also provide a device for detecting device behavior attacks, which includes a unit for performing the above-described method.

[0014] Thirdly, embodiments of this application also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0015] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described method.

[0016] This application provides a method, apparatus, computer device, and storage medium for detecting device behavior attacks. The method includes: acquiring raw traffic data of the device to be analyzed; processing the raw traffic data using multiple time-series windows with different time granularities to obtain multi-dimensional behavioral feature data; comparing the multi-dimensional behavioral feature data with a preset device behavior baseline to obtain a target comparison result; and determining that the device to be analyzed exhibits abnormal attack behavior if the target comparison result meets preset anomaly conditions.

[0017] This application embodiment sets multiple time-series windows with different time granularities, which can be used to process the original traffic data and obtain different detection information. Based on this, even if an attacker successfully circumvents a specific granularity (such as minute-level) detection rule, their abnormal behavior characteristics are still very likely to be detected in other granularity time-series windows. Thus, by combining the detection information from multiple time-series windows with different time granularities for comprehensive analysis and judgment, false alarms or missed alarms that occur in a single fixed time window can be avoided, thereby improving the accuracy of attack behavior detection. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0021] Figure 1 A flowchart illustrating the first embodiment of a device behavior attack detection method provided in this application; Figure 2 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0024] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0025] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0026] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0027] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0028] In the field of network security monitoring, attack reasoning based on time-series analysis is an important means of detecting persistent threats and advanced persistent threats (APTs). Existing technologies mainly employ the following time-series analysis methods: 1. Statistical method based on fixed time windows: Divide the time into fixed-length windows, count the number of alarms or traffic characteristics within each window, and determine whether it is abnormal by using a threshold. This method is simple to implement, but the choice of window size has a significant impact on the results.

[0029] 2. Sliding time window based method: This method uses a sliding window to continuously scan the time frame and calculate statistical indicators within the window. Compared to a fixed window, a sliding window can provide a smoother time series, but it has a higher computational cost.

[0030] 3. Sequence Pattern Mining Method: This method mines frequently occurring patterns from historical alarm sequences and matches newly generated alarm sequences with known patterns. While effective against known attack patterns, it struggles to detect novel attacks.

[0031] 4. Temporal Graph Neural Network-Based Approach: This approach utilizes graph neural networks to model temporally changing graph structures, learning the temporal evolution patterns of nodes and edges. While this method possesses strong expressive power, it requires a large amount of training data and significant computational resources.

[0032] However, existing network security detection technologies have the following shortcomings: 1) Traditional solutions often use coarse-grained time windows at the minute or hour level, which makes it difficult to capture instantaneous attack features, resulting in high detection latency; 2) Due to the lack of refined behavioral baseline modeling for individual devices, the system has difficulty accurately distinguishing between normal business fluctuations and real attack behavior.

[0033] 3) Existing mechanisms are mostly single-point analyses, lacking the ability to reason across time windows, making it difficult to effectively reconstruct a complete attack chain.

[0034] 4) When facing large-scale network environments and hundreds of billions of point-edge data, existing solutions not only have limited single-machine resource scalability, but also have low execution efficiency of graph association rule mining algorithms, which seriously restricts the real-time detection capability in massive data scenarios.

[0035] To address the aforementioned problems, this application provides a method for detecting device behavior attacks. (See also...) Figure 1 , Figure 1 This is a flowchart illustrating a first embodiment of a device behavior attack detection method provided in this application. The method may include the following steps: Step 110: Obtain the raw traffic data of the device to be analyzed.

[0036] Step 120: Process the original traffic data using multiple time-series windows with different time granularities to obtain multi-dimensional behavioral feature data.

[0037] Step 130: Compare the multi-dimensional behavioral feature data with the preset device behavior baseline to obtain the target comparison result.

[0038] Step 140: If the target comparison result meets the preset abnormal conditions, it is determined that the device to be analyzed has abnormal attack behavior.

[0039] This embodiment sets multiple time-series windows with different time granularities, which can be used to process the raw traffic data and obtain different detection information. Based on this, even if an attacker successfully circumvents a specific granularity (such as minute-level) detection rule, their abnormal behavior characteristics are still very likely to be detected in other granularity time-series windows. Thus, by combining the detection information from multiple time-series windows with different time granularities for comprehensive analysis and judgment, false alarms or missed alarms that occur with a single fixed time window can be avoided, thereby improving the accuracy of attack behavior detection.

[0040] In some embodiments, multiple time-series windows with different time granularities include a first period window, a second period window, a third period window, and a fourth period window, wherein the durations of the first period window, the second period window, the third period window, and the fourth period window increase sequentially. The original data is processed using multiple time-series windows with different time granularities to obtain multi-dimensional behavioral feature data, including: Step 121: Process the original data using the first periodic window to obtain the first data.

[0041] The first period window can be a short period window, such as processing network data traffic at 20 millisecond intervals to achieve near real-time traffic processing.

[0042] Step 122: Determine whether the first data meets the triggering conditions of the second periodic window.

[0043] Step 123: In response to the first data satisfying the triggering condition of the second periodic window, process the first data using the second periodic window to obtain the second data.

[0044] The second periodic window can be a medium periodic window, such as collecting and summarizing device type identification information in a 5-second period, including TTL value, traffic rule identification type, and HTTP UserAgent information.

[0045] Step 124: In response to the first data not meeting the triggering condition of the second periodic window, determine whether the first data meets the triggering condition of the third periodic window.

[0046] Step 125: In response to the first data satisfying the trigger condition of the third periodic window, the first data is fingerprinted using the third periodic window to obtain the third data.

[0047] The third periodic window can be a long periodic window, such as processing TCP SYN fingerprint information and MDNS resolution information with a period of 60 seconds.

[0048] Step 126: Based on the second data and the third data, obtain multi-dimensional behavioral feature data.

[0049] In some embodiments, the plurality of time-series windows with different time granularities further include a fourth periodic window, the duration of which is longer than that of the third periodic window, and the step of determining whether the first data meets the triggering condition of the third periodic window further includes: Step 127: In response to the fact that the first data does not meet the triggering condition of the third periodic window, determine whether the first data meets the triggering condition of the fourth periodic window.

[0050] Step 128: In response to the first data meeting the trigger condition of the fourth periodic window, the first data is processed by traffic statistics and summary using the fourth periodic window to obtain the fourth data; and the fourth data is written in batches into a preset database.

[0051] In step 128, the fourth periodic window can be an ultra-long periodic window, such as summarizing traffic statistics every 15 minutes, and writing the summary results into the database in batches.

[0052] Step 129: In response to the first data not meeting the triggering condition of the fourth cycle window, return to the step of obtaining the original traffic data of the device to be analyzed.

[0053] It should be noted that each periodic window is advanced in a sliding manner, and the new window inherits some state information from the previous window to ensure the continuity of behavior analysis.

[0054] In this way, through a multi-granularity time window mechanism (multi-level windows ranging from 20 milliseconds to 15 minutes), comprehensive coverage of device network behavior from real-time to long-term is achieved, enabling the capture of both fast and slow attacks.

[0055] In some embodiments, the multi-dimensional behavioral feature data includes feature data in multiple dimensions; the preset device behavior baseline includes multiple preset sub-baselines corresponding to the multiple dimensions; the step of comparing the multi-dimensional behavioral feature data with the preset device behavior baseline to obtain a target comparison result includes: Step 131: Compare the feature data of multiple dimensions with their corresponding preset sub-baselines one by one to obtain multiple single comparison results.

[0056] In step 131, the preset device behavior baseline may include TTL baseline, port service baseline, network behavior baseline, HTTP behavior baseline, and device name baseline, etc.

[0057] Specifically, the various baselines are as follows: TTL baseline: This is a set of IP packet TTL values ​​for statistical devices, establishing a baseline for the distribution of TTL values ​​across devices. Devices operating systems have different TTL value characteristics (e.g., Windows devices typically have 128 TTL values, while Linux devices typically have 64 TTL values). Port service baseline: Collect information on the open ports of the device and their corresponding service banners to establish a port service characteristic baseline for the device; Network behavior baseline: Record the normal network access behavior patterns of the device by matching access control list rules, including frequently accessed destination IPs and destination ports; HTTP Behavior Baseline: Extract the UserAgent field from the device's HTTP requests to establish a baseline of the device's browser and operating system characteristics; Device Name Baseline: Record the device's NetBIOS name and host name information to establish a device identity baseline.

[0058] Thus, the behavioral baseline established through multi-dimensional device fingerprint features can accurately characterize the normal network behavior of devices, providing a reliable reference standard for attack detection.

[0059] In some embodiments, the feature data of the multiple dimensions includes at least two of IP address, MAC address, device type, device TTL value, device name, device port service information, banner information, operating system type, HTTP behavior, and real-time traffic.

[0060] For example, the device TTL value is compared with a preset TTL baseline to obtain a first comparison result; the device type is compared with a preset device name baseline to obtain a second comparison result; the real-time traffic is compared with a preset network behavior baseline to obtain a third comparison result; the HTTP behavior is compared with a preset HTTP behavior baseline to obtain a fourth comparison result; the device port service information is compared with a preset port service baseline to obtain a fifth comparison result; the real-time IP address is compared with the baseline IP address to obtain a sixth comparison result; the real-time MAC address is compared with the baseline MAC address to obtain a seventh comparison result; the real-time device name is compared with the baseline device name to obtain an eighth comparison result; the real-time banner information is compared with the baseline banner information to obtain a ninth comparison result; and the real-time operating system type is compared with the baseline operating system type to obtain a tenth comparison result.

[0061] Step 132: According to the preset weight allocation strategy, perform weighted fusion processing on multiple single comparison results to obtain the target comparison result.

[0062] In its implementation, the system can synthesize comparison results from various dimensions and employ a weighted voting mechanism to determine whether a device exhibits counterfeit or attack behavior. Specifically, firstly, initial weights can be set for each detection dimension, with all weights remaining equal in the initial stage. Secondly, an adaptive optimization mechanism is introduced, allowing the system to dynamically adjust and optimize the weights based on feedback data such as historical false alarm rates for each dimension. Finally, a weighted score is calculated for each dimension's individual comparison results. When this weighted score exceeds a preset security threshold, the system determines that the device exhibits abnormal attack behavior.

[0063] In some embodiments, after obtaining multiple single alignment results, the method further includes: Step 210: If the single comparison result meets the preset deviation conditions, then the abnormal behavior of the single comparison result is recorded as an attack event node.

[0064] For example, the real-time acquired device TTL value can be compared with the baseline TTL value set to determine whether the TTL has deviated. If the real-time TTL value is not in the baseline set, it is determined that the TTL value has deviated and recorded as a TTL abnormal event. If the TTL value does not deviate, the device type identified by the traffic rules will be compared with the baseline device type to determine whether the device type has deviated. If they are inconsistent, the device type will be determined to have deviated and recorded as a device type abnormal event. If the device type does not deviate, the real-time traffic is compared with the device's network behavior baseline to determine whether the network behavior has deviated. If a destination IP or destination port not recorded in the baseline is accessed, it is determined that the network behavior has deviated and is recorded as an abnormal network behavior event; otherwise, the behavior can be considered normal.

[0065] Step 220: Construct temporal edges based on the temporal order and causal relationship between the attack event points.

[0066] For steps 210-220, attack events can be extracted from the spoofing detection records of each time window, and time-series edges can be constructed between attack events in adjacent time windows. Each attack event can contain key attribute information, such as event timestamp, event type (e.g., IP change, device type change, abnormal network behavior), identification of involved devices (MAC address and IP address), attack source information, and scope of impact.

[0067] Specifically, when constructing time-series edges between attack events in adjacent time-series windows, it is necessary to comprehensively consider three dimensions: device correlation, time proximity, and behavioral similarity. Device correlation indicates that the two events involve the same device or have a clear IP and MAC correspondence; time proximity indicates that the time interval between the two events falls within the system's preset threshold range; and behavioral similarity indicates that the two events belong to the same type of attack behavior or have a known attack stage progression relationship.

[0068] Step 230: Obtain the timing graph based on the timing edges.

[0069] Step 240: Identify the target attack chain in the timing diagram.

[0070] Specifically, paths matching known attack chain patterns can be searched in the sequence graph to achieve attack chain pattern matching. For example, typical attack chain patterns may include the following: Attack chain pattern 1: Device identity change (IP / MAC change) → Device type change → Abnormal network behavior; Attack chain pattern two: Port scanning → Abnormal access → Data leakage → C2 communication; Attack chain pattern three: TTL anomaly → Operating system change → Service change → Behavior spoofing.

[0071] In some embodiments, the correlation strength of the identified attack chains can be calculated. Specifically, the factors for calculating the correlation strength may include the temporal continuity of events in the attack chain, device consistency, and the reasonableness of behavioral progression. Attack chains with a correlation strength higher than a preset threshold can be retained as target attack chains, while attack chains with a correlation strength lower than the threshold can be directly filtered out.

[0072] Step 250: Based on the target attack chain, reconstruct the attack scenario according to the preset time sequence.

[0073] The retained attack chains (i.e., target attack chains) are organized chronologically into complete attack scenarios. Specifically, each attack stage is marked with detailed information, such as the attack time, affected device, attack type, attack impact, and recommended countermeasures.

[0074] In this way, by reasoning along attack chains across time windows, persistent attack behaviors that are difficult to detect within a single time window can be discovered, thus improving the completeness of attack scenario reconstruction.

[0075] In some embodiments, after obtaining the target comparison result, the method further includes: if the target comparison result does not meet the preset abnormal conditions, then updating the preset device behavior baseline.

[0076] Based on the above embodiments, this application also provides a device behavior attack detection system. The system adopts a layered time-series processing architecture, including a time-series data acquisition module, a time-series window management module, a behavior baseline modeling module, a behavior deviation detection module, a time-series correlation reasoning module, and an attack scenario reconstruction module.

[0077] The time-series data acquisition module is configured to collect multi-dimensional fingerprint features and traffic data of the device in chronological order.

[0078] In some embodiments, the time-series window management module is configured to manage multiple time windows of different granularities, including a 20-millisecond short-period window, a 5-second medium-period window, a 60-second long-period window, and a 15-minute ultra-long-period window. Specifically, the time-series window management module adopts a multi-granularity time-series window management mechanism, and the specific execution mechanism of each time-series window is as follows: 20-millisecond short-cycle window: This window is designed to ensure near real-time traffic processing. The traffic processing thread is woken up at fixed intervals of 20 milliseconds to process network traffic data arriving during this period. Operations performed within the window include: extracting quintuple information, merging duplicate traffic, performing fast rule matching, and updating the traffic statistics counter.

[0079] 5-Second Periodic Window: The system performs a summary processing of device type identification information every 5 seconds. The summary includes: device type identified through traffic rule matching, a set of statistically obtained TTL values, collected HTTPUserAgent information, and a set of IPv6 Hop Limit values. The summary results are organized into a device identification information structure and sent to the device information processing thread for further analysis.

[0080] 60-second long-term window: The system processes TCP SYN fingerprint information and MDNS information every 60 seconds. The TCP SYN fingerprint information includes: IP TTL value, IP fragmentation flag, TCP window size, TCP flags, and TCP option field sequence. The MDNS information includes: device name, operating system model, and operating system kernel version. This information is used to supplement and update the device's behavioral baseline.

[0081] 15-Minute Extended Periodic Window: Every 15 minutes, the system aggregates and batch-writes the accumulated traffic statistics to the database. The aggregated data includes: the number of data packets and total bytes for each quintuple, the start and end times of communication, and whether it was during working hours. Batch writing reduces the frequency of database operations and improves the overall system throughput.

[0082] In addition, the timing window management module is also configured to: dynamically adjust the window granularity according to the traffic density of the network environment, automatically shrink the window during peak traffic periods to improve detection sensitivity, and automatically expand the window during low traffic periods to reduce computational overhead; and configure differentiated window parameters for different device types, using a finer-grained window for high-risk devices and a coarser-grained window for low-risk devices.

[0083] In some embodiments, the behavior baseline modeling module is configured to establish a normal behavior baseline for the device based on historical time-series data. Specifically, the behavior baseline modeling module is configured to: normalize the collected behavior feature data to eliminate dimensional differences; use a moving average method to smoothly update the baseline to avoid excessive impact of single abnormal data on the baseline; and set a confidence interval for each baseline, with only behavior changes significantly exceeding the confidence interval being considered abnormal.

[0084] In the behavior baseline modeling module, the behavior baseline of a device can be established according to the following steps: 1) Initial baseline acquisition: When a device is first identified, the system acquires the device's initial fingerprint feature information, which may include: IP address, MAC address, device type, operating system type, TTL value, device name, port service information, banner information, HTTPUserAgent, device serial number, device model, and device version number. 2) Baseline group management: Devices are managed by fingerprint groups, and each group is configured with independent feature detection dimensions. The baseline only records feature information for the group whose detection dimensions have been selected. 3) Baseline dynamic update: In subsequent time-series windows, the system continuously acquires the device's fingerprint feature information. For features already recorded in the baseline, if the newly acquired value matches the baseline value, the baseline remains unchanged; if they do not match, the system decides whether to update the baseline or mark it as abnormal based on the configuration. 4) Baseline confidence assessment: A confidence value is set for each baseline record. The confidence value is dynamically adjusted based on the acquisition frequency and consistency of the feature information. High-frequency and consistent features have higher confidence, while low-frequency or changing features have lower confidence.

[0085] In some embodiments, the behavior deviation detection module is configured to compare real-time behavior with a behavior baseline to accurately detect deviations. Its specific execution includes: 1) Detection cycle triggering mechanism: The spoofing detection thread periodically starts detection tasks at fixed time intervals (e.g., 300 seconds). Before each detection, the system loads all device fingerprint information collected within the detection period into the detection queue as the data basis for subsequent analysis. 2) Target device filtering mechanism: Before entering the formal detection process, the system pre-screens and cleans the devices in the queue, specifically removing devices corresponding to the local MAC address, devices outside the topology discovery range, and terminal devices with management assistants installed. Only devices retained after the above filtering process enter the formal deviation detection stage. 3) Multi-dimensional joint judgment; 4) Time-series record generation: The detection results are organized into a time-series spoofing detection record according to detection time, device identifier, detection dimension, and changed content, providing a data basis for subsequent attack chain correlation reasoning.

[0086] The behavior deviation detection module can detect time-series behavior deviations, including but not limited to TTL deviation detection, device type deviation detection, network behavior deviation detection, and port service deviation detection.

[0087] In some embodiments, the temporal correlation reasoning module is configured to perform correlation reasoning on the detection results of multiple time windows to construct an attack temporal chain. In one embodiment, the process of the temporal correlation reasoning module implementing cross-temporal window attack chain correlation reasoning may include: 1) Attack event serialization: Recording abnormal behaviors detected within each time window as attack event nodes, with node attributes including attack time, attack type, involved devices, and scope of impact; 2) Temporal edge construction: Constructing temporal edges based on the temporal order and causal relationship between attack events. The direction of the temporal edge represents the direction of attack evolution, and the time interval and correlation strength are recorded on the edge; 3) Attack chain identification: Searching for paths that match the attack chain pattern in the temporal graph. A typical attack chain pattern includes: reconnaissance phase (port scanning) → delivery phase (malicious traffic) → exploitation phase (abnormal access) → control phase (C2 communication); 4) Association strength calculation: Calculate the association strength based on the device association, time proximity, and behavioral similarity between attack events, and filter out false associations with low association strength; 5) Attack scenario reconstruction: Organize the identified attack chains into a complete attack scenario in chronological order, and label the attack behavior and victim device at each stage. The attack scenario reconstruction module is configured to reconstruct a complete attack scenario based on the temporal association reasoning results.

[0088] Thus, by using multidimensional joint deviation judgment and correlation strength filtering, the false alarm rate can be effectively reduced.

[0089] In some embodiments, the system may further include a deviation trend analysis module, which is configured to: analyze the time trend of device behavior deviation, identify the gradual process of deviation degree; predict the deviation trend, and provide early warning of possible attack behaviors.

[0090] Thus, through the aforementioned time window management, behavior baseline modeling, deviation detection, and correlation reasoning mechanisms, the system achieves refined time-series analysis and attack reasoning of device network behavior, and can effectively detect persistent attack behaviors across time windows.

[0091] In some embodiments, the system may also employ a high-performance processing mechanism for large-scale time series graphs, wherein the system achieves high-performance processing of large-scale time series graphs in the following manner: 1) Time-series data partitioning: Time-series data is partitioned in two dimensions according to time range and device identifier, and each partition is stored and processed independently; 2) Incremental map update: At the end of each time window, only the data that has changed within this window is updated to the time series map to avoid full reconstruction; 3) Rule pre-compilation caching: Frequently used association rules are pre-compiled into executable rule objects and cached in memory to avoid the overhead of repeated compilation; 4) Parallel inference execution: Distribute inference tasks from different time windows or different devices to multiple parallel execution units to improve overall inference throughput.

[0092] Thus, through time-series data partitioning, incremental graph updates, and parallel inference execution mechanisms, graph association rule mining can be supported on a single machine with a scale of tens of billions of points and edges. Furthermore, the inference and matching speed of a single rule is controlled within 1 millisecond, meeting the requirements of real-time threat detection.

[0093] Corresponding to the above-described methods for detecting device behavior attacks, this application also provides a device behavior attack detection apparatus. This apparatus includes a unit for executing the aforementioned methods for detecting device behavior attacks, and can be configured in terminals such as desktop computers, tablet computers, and laptops.

[0094] like Figure 2 As shown in the figure, this application provides a computer device including a processor 111, a communication interface 112, a memory 113, and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114. Memory 113 is used to store computer programs; In one embodiment of this application, when the processor 111 executes the program stored in the memory 113, it implements the device behavior attack detection method provided in any of the foregoing method embodiments, including: Obtain the raw traffic data of the device to be analyzed; The original traffic data is processed using multiple time-series windows with different time granularities to obtain multi-dimensional behavioral feature data; The multi-dimensional behavioral feature data is compared with a preset device behavior baseline to obtain the target comparison result; If the target comparison result meets the preset abnormal conditions, it is determined that the device to be analyzed has abnormal attack behavior.

[0095] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0096] Therefore, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon, wherein when the computer program is executed by a processor, it implements the steps of the device behavior attack detection method provided in any of the foregoing method embodiments, including: Obtain the raw traffic data of the device to be analyzed; The original traffic data is processed using multiple time-series windows with different time granularities to obtain multi-dimensional behavioral feature data; The multi-dimensional behavioral feature data is compared with a preset device behavior baseline to obtain the target comparison result; If the target comparison result meets the preset abnormal conditions, it is determined that the device to be analyzed has abnormal attack behavior.

[0097] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.

[0098] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0099] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0100] The steps in the methods of this application embodiment can be adjusted, merged, or deleted according to actual needs. The units in the apparatus of this application embodiment can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0101] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0102] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0103] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Since these modifications and variations fall within the scope of the claims and their equivalents, this application also intends to include these modifications and variations.

[0104] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting device behavior attacks, characterized in that, The method includes: Obtain the raw traffic data of the device to be analyzed; The original traffic data is processed using multiple time-series windows with different time granularities to obtain multi-dimensional behavioral feature data; The multi-dimensional behavioral feature data is compared with a preset device behavior baseline to obtain the target comparison result; If the target comparison result meets the preset abnormal conditions, it is determined that the device to be analyzed has abnormal attack behavior.

2. The method according to claim 1, characterized in that, Multiple time-series windows with different time granularities include a first period window, a second period window, a third period window, and a fourth period window, wherein the durations of the first period window, the second period window, the third period window, and the fourth period window increase sequentially. The original data is processed using these multiple time-series windows with different time granularities to obtain multi-dimensional behavioral feature data, including: The original data is processed using the first periodic window to obtain the first data; Determine whether the first data satisfies the triggering condition of the second periodic window; In response to the first data satisfying the triggering condition of the second periodic window, the first data is processed using the second periodic window to obtain the second data; In response to the first data not meeting the triggering condition of the second periodic window, it is determined whether the first data meets the triggering condition of the third periodic window. In response to the first data satisfying the triggering condition of the third periodic window, the first data is fingerprinted using the third periodic window to obtain the third data; Based on the second data and the third data, multi-dimensional behavioral feature data is obtained.

3. The method according to claim 2, characterized in that, The multi-dimensional behavioral feature data includes feature data in multiple dimensions; the preset device behavior baseline includes multiple preset sub-baselines corresponding to the multiple dimensions; The step of comparing the multi-dimensional behavioral feature data with a preset device behavior baseline to obtain the target comparison result includes: The feature data of multiple dimensions are compared one by one with their corresponding preset sub-baselines to obtain multiple single comparison results; According to a preset weight allocation strategy, multiple single comparison results are weighted and fused to obtain the target comparison result.

4. The method according to claim 2, characterized in that, The multi-dimensional feature data includes at least two of the following: IP address, MAC address, device type, device TTL value, device name, device port service information, banner information, operating system type, HTTP behavior, and real-time traffic.

5. The method according to claim 2, characterized in that, The multiple time-series windows with different time granularities also include a fourth periodic window, the duration of which is longer than the duration of the third periodic window. The step of determining whether the first data satisfies the triggering condition of the third periodic window further includes: In response to the first data not meeting the triggering condition of the third periodic window, it is determined whether the first data meets the triggering condition of the fourth periodic window. In response to the first data meeting the trigger condition of the fourth period window, the first data is processed by traffic statistics and summary using the fourth period window to obtain the fourth data; and the fourth data is written in batches into a preset database. If the first data does not meet the triggering condition of the fourth cycle window, the process returns to the step of obtaining the original traffic data of the device to be analyzed.

6. The method according to claim 3, characterized in that, After obtaining multiple single alignment results, the method further includes: If the single comparison result meets the preset deviation conditions, the abnormal behavior of the single comparison result will be recorded as an attack event node. Construct temporal edges based on the temporal order and causal relationship between the attack event points; A timing graph is obtained based on the aforementioned timing edges; The target attack chain is identified in the time sequence diagram; Based on the target attack chain, the attack scenario is reconstructed according to a preset time sequence.

7. The method according to claim 1, characterized in that, After obtaining the target comparison result, the method further includes: If the target comparison result does not meet the preset abnormal conditions, the preset device behavior baseline will be updated.

8. A device for detecting device behavior attacks, characterized in that, Includes a unit for performing the method as described in any one of claims 1-7.

9. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, can implement the method as described in any one of claims 1-7.

Images