Intelligent agent anomaly detection method, device, system and related equipment

Abstract

The application provides an agent anomaly detection method, device and system and related equipment, and relates to the technical field of artificial intelligence. A DNS behavior chain including multiple intent categories and their time sequence association relationships is constructed based on the query record of the domain name system (DNS) of the agent to be detected; baseline information indicating the historical trusted behavior of the agent and the corresponding time sequence features is obtained; an anomaly detection result is generated based on the behavior comparison result and the time sequence comparison result of the DNS behavior chain and the baseline information to determine whether the current behavior deviates from the normal behavior. Thus, the DNS query record generated externally to the agent can be used for anomaly detection without invading the internal part of the agent, and the internal model, business data and tool calling process of the agent do not need to be invaded.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, system and related equipment for detecting anomalies in intelligent agents. Background Technology

[0002] With the development of large language models, multi-agent collaboration, and automated tool invocation technologies, intelligent agents are increasingly being applied in scenarios such as financial transactions, government services, industrial control, security operations and maintenance, and enterprise office automation. In these scenarios, intelligent agents are typically able to autonomously plan according to task objectives and access network resources, invoke external tools, or interact with business systems during task execution.

[0003] Currently, in the process of security monitoring of intelligent agents, relevant operational information during the operation of the intelligent agent is usually obtained. For example, access control, permission management, log auditing, terminal detection and response, firewall rules or blacklist rules can be used to identify abnormal operations or security events in the intelligent agent's operating environment, which can reduce security risks during the operation of the intelligent agent.

[0004] However, this method of monitoring the security of intelligent agents can easily lead to privacy and compliance issues during their operation. Therefore, monitoring the security status of intelligent agents during operation has become an important technical requirement in intelligent agent applications. Summary of the Invention

[0005] In view of this, embodiments of this application provide a method, apparatus, system, computing device, computer-readable storage medium, and computer program product for detecting anomalies in intelligent agents. Taking a computing device as an example, unless otherwise specified, the following examples all use a computing device as the execution subject. The computing device is only one possible implementation and is not limited to only a computing device for execution. Other devices with the same function can also be used. Based on the domain name system (DNS) query records generated during the operation of the intelligent agent, the deviation of the current behavior of the intelligent agent from the historical normal behavior can be detected. Anomaly detection can be performed using DNS query records generated outside the intelligent agent without intruding into the internal workings of the intelligent agent.

[0006] Firstly, embodiments of this application provide a method for detecting anomalies in intelligent agents. Specifically, a DNS behavior chain can be constructed based on the DNS query records of the intelligent agent to be detected. The DNS behavior chain includes multiple intent categories and temporal relationships between these intent categories. The intent categories can be used to characterize the intent of the intelligent agent to perform a behavior corresponding to the queried domain name in the DNS query records, and the temporal relationships can be the order in which multiple intent categories are executed by the intelligent agent. Baseline information is obtained. The baseline information can be used to indicate multiple trusted behaviors formed by the intelligent agent's DNS query behavior within a historical time period, and the temporal characteristics of the execution of these trusted behaviors. Then, the DNS behavior chain can be compared with the baseline information, and an anomaly detection result for the intelligent agent can be generated based on the comparison result. The comparison result can include the behavior comparison result between the behaviors corresponding to multiple intent categories in the DNS behavior chain and the multiple trusted behaviors, as well as the temporal comparison result between the temporal relationships and the temporal characteristics. The anomaly detection result can be used to indicate whether the current behavior of the intelligent agent, characterized by the DNS behavior chain, deviates from the normal behavior indicated by the baseline information.

[0007] By leveraging the agent's external behavior, it's possible to determine whether the agent's current behavior deviates from normal behavior, thus eliminating the need to access the agent's internal state, business data, or tool calls. Simultaneously, this allows anomaly detection functionality to be implemented without altering the agent's original model operation, business processing flow, or tool call logic.

[0008] Furthermore, since the DNS query records upon which anomaly detection relies can be obtained during domain name resolution outside the agent, the anomaly detection system can reduce its acquisition and resolution of sensitive information within the agent, lowering the possibility of expanding the scope of internal business data access due to anomaly detection, and reducing the coupling between the anomaly detection mechanism and the agent's specific model structure, business data format, and tool invocation mechanism. Therefore, even when different agents employ different models, business processes, or tool invocation methods, anomaly detection can still be implemented based on the DNS query records generated during their operation, which helps improve the deployment adaptability of the anomaly detection solution.

[0009] Based on this, by converting multiple DNS query records into a DNS behavior chain that includes multiple intent categories and corresponding temporal relationships, and comparing the current DNS behavior chain with multiple trusted behaviors and their temporal characteristics formed in the history of the agent to be detected, features that reflect the semantics and order of behavior can be extracted from external DNS query behavior without obtaining the agent's internal operating information, thus providing a basis for judging whether the agent's current behavior deviates from normal behavior.

[0010] In one possible implementation, at least one of the following can be determined based on the DNS behavior chain and baseline information: sequence deviation, intent distribution deviation, and anomalous domain frequency. Sequence deviation can characterize the degree of deviation of the order of multiple intent categories relative to temporal characteristics; intent distribution deviation can characterize the degree of deviation of the intent category distribution in the DNS behavior chain relative to the intent category distribution corresponding to multiple trusted behaviors; and anomalous domain frequency can characterize the frequency of occurrence of anomalous domains in DNS query records.

[0011] The degree of credible deviation can be further determined based on at least one of sequence deviation, intent distribution deviation, and abnormal domain name frequency. The degree of credible deviation can characterize the degree of deviation of the current behavior corresponding to a DNS behavior chain from multiple credible behaviors, and the degree of deviation of the temporal association corresponding to the current behavior from the temporal features corresponding to multiple credible behaviors. Then, the anomaly detection result can be determined based on the degree of credible deviation.

[0012] In one possible implementation, the degree of sequence deviation can be the sequence distance determined between the current DNS action chain and at least one baseline DNS action chain. The sequence distance can be determined based on the order in which the agent executes operations corresponding to intent categories, the sequence position of each intent category in its corresponding DNS action chain, and differences in the overall arrangement structure. At least one baseline DNS action chain can be constructed based on multiple trusted actions and the temporal features corresponding to those trusted actions.

[0013] In one possible implementation, the degree of deviation in intent distribution can be determined based on the intent distribution to be detected and the baseline intent distribution. The intent distribution to be detected can be used to indicate the distribution of different intent categories in the current DNS behavior chain, while the baseline intent distribution can be used to indicate the distribution of different intent categories in the DNS behavior chain corresponding to multiple trusted behaviors formed based on DNS query behavior within a historical time period.

[0014] In one possible implementation, the number of anomalous domain names and the total number of domain names can also be determined based on the DNS behavior chain. The frequency of anomalous domain names can be determined based on the number of anomalous domain names and the total number of domain names in the DNS behavior chain. Anomalous domain names can be domain names that match risky domain name records, or domain names that are not recorded in historical trusted records.

[0015] In one possible implementation, multiple deviation levels can be determined based on the range of values ​​for the degree of trustworthy deviation, and a security governance policy corresponding to the anomaly detection result can be executed based on the deviation level to which the degree of trustworthy deviation lies. Multiple security governance policies can correspond to multiple deviation levels, and these policies can include at least one of the following: logging, delayed parsing, traffic auditing, access restrictions, function restrictions, task suspension, and alarm forensics.

[0016] In one possible implementation, the execution result of the security governance policy can be obtained. The execution result can be used to indicate whether the current behavior represented by the DNS behavior chain corresponding to the anomaly detection result satisfies the baseline update conditions. The baseline update conditions may include conditions under which the current behavior is determined to be trusted behavior.

[0017] If the current behavior meets the baseline update conditions, the current behavior can be used as a new trusted behavior, and the temporal characteristics corresponding to the new trusted behavior can be determined based on the temporal association relationship in the DNS behavior chain to obtain the updated baseline information.

[0018] In one possible implementation, a DNS query record may include the query time and the domain name. The DNS query records can be divided into behavior windows based on the query time, resulting in multiple behavior windows, which may include target windows. Then, the intent category corresponding to the domain name in the query records within the target window can be determined, and the intent categories can be sorted based on the chronological order of the query times indicated by the DNS query records within the target window, thus obtaining a DNS behavior chain.

[0019] In one possible implementation, DNS query records can be arranged according to the query time, and the query interval between adjacent DNS query records after arrangement can be determined. Then, based on the comparison between the query interval and an interval threshold, behavioral windows can be divided for the DNS query records. The interval threshold can be determined based on statistical information of historical query intervals.

[0020] In one possible implementation, the behavior window may have a corresponding number of DNS query records. If the behavior window meets the target window termination condition, the boundary of the behavior window can be determined based on the target window termination condition, and the DNS query records can be divided into behavior windows based on this boundary. The target window termination condition may include at least one of the following: the window duration reaches a duration threshold, and the number of query records in the behavior window reaches a number threshold. The window duration can be the time interval between the earliest queried DNS record and the latest queried DNS record within the behavior window.

[0021] In one possible implementation, the intent category may include a target intent category. The domain name vector corresponding to the queried domain name can be determined based on a mapping model, which can be trained based on historical DNS query records. Then, the target intent category corresponding to the queried domain name can be obtained by querying the mapping relationship based on the domain name vector. The mapping relationship can be used to represent the correspondence between domain name vectors and target intent categories.

[0022] In one possible implementation, DNS query records generated by the agent within a historical time period can be obtained, and multiple historical DNS behavior chains can be constructed based on these records. Then, multiple trusted behaviors and the temporal characteristics of their execution can be determined from the behaviors represented by these historical DNS behavior chains to form baseline information.

[0023] In one possible implementation, multiple historical DNS behavior chains can be clustered to obtain clusters. Then, a target DNS behavior chain can be determined based on these clusters. The target DNS behavior chain can be a historical DNS behavior chain within a cluster whose average sequence distance to other historical DNS behavior chains within the cluster is less than a target threshold. Sequence distance can be used to characterize the differences between two historical DNS behavior chains in terms of intent category order, the sequence position of each intent category within its corresponding historical DNS behavior chain, and the overall arrangement structure. Furthermore, baseline information can be formed based on the target DNS behavior chain.

[0024] Secondly, embodiments of this application provide an intelligent agent anomaly detection device. The intelligent agent anomaly detection device may include a construction module, an acquisition module, and a generation module.

[0025] The building module can construct a DNS behavior chain based on the DNS query records of the agent to be detected. The DNS behavior chain includes multiple intent categories and the temporal relationships between these intent categories. Intent categories can be used to characterize the intent of the agent to perform the behavior corresponding to the queried domain name in the DNS query record. The temporal relationships can be the order in which multiple intent categories are executed by the agent in the corresponding operation process.

[0026] The acquisition module can acquire baseline information. Baseline information can be used to indicate multiple trusted actions formed by the agent based on DNS query behavior within a historical time period, as well as the temporal characteristics of the execution of these trusted actions.

[0027] The generation module can generate anomaly detection results for the agent based on the comparison results of the DNS behavior chain and baseline information. The comparison results can include behavioral comparisons between behaviors corresponding to multiple intent categories and multiple trusted behaviors in the DNS behavior chain, as well as temporal comparisons between temporal associations and temporal features. The anomaly detection results can be used to indicate whether the agent's current behavior, represented by the DNS behavior chain, deviates from the normal behavior indicated by the baseline information.

[0028] Thirdly, embodiments of this application provide an intelligent agent anomaly detection system. The intelligent agent anomaly detection system may include a DNS query acquisition device and an intelligent agent anomaly detection device.

[0029] The DNS query collection device can collect the DNS query records of the agent to be detected. The agent anomaly detection device can execute the agent anomaly detection method corresponding to the first aspect and any possible implementation of the first aspect based on the DNS query records collected by the DNS query collection device.

[0030] Fourthly, embodiments of this application provide a computing device. The computing device may include a processor and a memory. The memory may store program instructions, and the processor may execute the program instructions to cause the computing device to perform the intelligent agent anomaly detection method corresponding to the first aspect and any possible implementation of the first aspect.

[0031] Fifthly, embodiments of this application provide a computer-readable storage medium. The computer-readable storage medium can store program instructions, which, when executed by a processor, can implement the intelligent agent anomaly detection method corresponding to the first aspect and any possible implementation thereof.

[0032] Sixthly, embodiments of this application provide a computer program product. The computer program product may include program instructions, which, when executed by a processor, can implement the intelligent agent anomaly detection method corresponding to the first aspect and any possible implementation thereof.

[0033] The beneficial effects of the intelligent agent anomaly detection device, intelligent agent anomaly detection system, computing device, computer-readable storage medium, and computer program product provided in the second to sixth aspects above can be found in the relevant descriptions of the first aspect and various possible embodiments of the first aspect, which will not be repeated here.

[0034] Based on the implementation methods provided in this application, further combinations can be made to provide even more implementation methods. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a schematic diagram of the architecture of an intelligent agent anomaly detection system provided in an embodiment of this application;

[0037] Figure 2 A flowchart illustrating an anomaly detection method for an intelligent agent provided in an embodiment of this application;

[0038] Figure 3 A flowchart illustrating a DNS behavior chain construction method provided in an embodiment of this application;

[0039] Figure 4 A schematic flowchart illustrating a baseline information formation method provided in an embodiment of this application;

[0040] Figure 5 A flowchart illustrating a method for determining the degree of credible deviation and generating abnormal results, provided in an embodiment of this application;

[0041] Figure 6 A schematic flowchart illustrating a security management method provided in an embodiment of this application;

[0042] Figure 7 A schematic flowchart illustrating a baseline information update method provided in an embodiment of this application;

[0043] Figure 8 A schematic diagram of a model deployment, trusted execution, and layered governance structure provided in this application embodiment;

[0044] Figure 9 This is a schematic diagram of the structure of an intelligent agent anomaly detection device provided in an embodiment of this application;

[0045] Figure 10 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0047] To facilitate understanding, some of the terms used in the embodiments of this application will be explained below.

[0048] An intelligent agent can be a software program, software service, or a task execution entity formed by software and computing resources that can perform at least one of the following operations: planning, decision-making, network access, tool invocation, or business interaction, according to task objectives. The intelligent agent to be detected can correspond to a single intelligent agent or a group of intelligent agents managed uniformly within the same business scope.

[0049] The Domain Name System (DNS) is used to establish the resolution relationship between domain names and network addresses. When an agent accesses network resources through a domain name, it typically generates a DNS query corresponding to the domain name resolution.

[0050] A DNS query record is a record formed during the domain name resolution process. A DNS query record can include the query time and the domain name being queried, and may also include the query type, source network identifier, response status, or other domain name resolution information. Type A queries can be used to query Internet Protocol version 4 (IP4) addresses, type AAAA queries can be used to query IPC version 6 (IP6) addresses, and type TXT queries can be used to query text records.

[0051] Query time and query interval: Query time represents the time when a DNS query occurs. Query interval represents the difference in query times between two adjacent DNS query records arranged by query time, and is used to characterize the temporal continuity of adjacent queries.

[0052] Bypass collection can be achieved by copying DNS query traffic from network devices and providing it to a DNS query collection device for processing, without altering the normal forwarding path of the original DNS query traffic. For example, bypass collection can be performed through port mirroring or other methods that can replicate the target traffic.

[0053] A behavior window can be a group of DNS query records formed based on the temporal continuity between DNS query records or the window termination condition. Behavior windows are used to organize a group of DNS query records that are relatively consecutive in time, and it is not required that each behavior window strictly correspond to a predefined business task.

[0054] An intent category can be a category determined based on the semantics of the external network access behavior represented by the queried domain name. An intent category can correspond to one or a group of similar network access purposes, such as status collection and indicator reporting, configuration and policy retrieval, or software updates. The intent category is only used to describe the semantic attribution of external access behavior and does not require reading the agent's internal model parameters, prompts, or business data. In this embodiment, "intent" is mainly used to characterize the attribution of such external access behavior in a preset semantic category and does not require recovering the agent's internal reasoning content.

[0055] Temporal association can represent the sequential order in which multiple intent categories in a DNS action chain are executed by an agent. Temporal association can also be reflected through the position of the intent category in the sequence, the transition relationship between adjacent categories, or the overall arrangement structure.

[0056] A DNS behavior chain can be a sequence of actions formed by converting multiple DNS query records within the same behavior window into intent categories and arranging these intent categories in the order indicated by the query times. A DNS behavior chain contains both semantic information about the actions and the temporal structure between these semantic elements.

[0057] The historical time period can be the range of historical data used to form baseline information, such as the initial trust period after the deployment of the agent, or other time ranges that have been confirmed to reflect normal business behavior. The length of the historical time period can be set according to the stability of the business, the density of DNS queries, and the convergence of the baseline.

[0058] Trusted behavior can be any behavior within a historical timeframe that has been pre-trusted, manually verified, or confirmed through security governance feedback. Trusted behavior represents actions that can be used as a reference for normal behavior when forming baseline information, but it does not mean that the behavior is free from risk in any environment or at any time.

[0059] Temporal features can be temporal structural information exhibited when trusted behaviors are executed, such as the order of intent categories, the position of each intent category in the behavior sequence, and at least one of the overall arrangement structure.

[0060] Baseline information can be a set of information used to indicate the historical trusted behaviors and their temporal characteristics of the agent to be detected. Baseline information may include at least multiple trusted behaviors and the temporal characteristics of the execution of the multiple trusted behaviors, and may further include one or more baseline DNS behavior chains, baseline intent distributions, baseline intent entropies, or historical trusted domain name records.

[0061] A baseline DNS behavior chain can be a DNS behavior chain constructed or selected based on trusted behaviors and their temporal characteristics, and is used as a reference when comparing the DNS behavior chains to be tested. The baseline DNS behavior chain can directly adopt historical real DNS behavior chains, or it can adopt other sequence forms that can characterize the temporal structure of the corresponding trusted behaviors.

[0062] The behavioral comparison results can reflect the differences between behaviors corresponding to multiple intent categories and multiple trusted behaviors in the DNS behavior chain to be detected.

[0063] The temporal comparison results can reflect the difference between the temporal correlation of the DNS behavior chain under investigation and the temporal characteristics corresponding to trusted behaviors. These two can be represented separately or jointly converted into one or more deviation representation information.

[0064] Sequence distance can be used to characterize the differences between two DNS behavior chains in terms of intent class order, sequence position, and overall arrangement structure.

[0065] The degree of sequence deviation can be a quantified result based on the sequence distance between the DNS behavior chain to be detected and at least one baseline DNS behavior chain. Dynamic time warping distance can be used as a specific implementation of sequence distance.

[0066] The distribution of intents to be detected can represent the frequency or proportion of different intent categories in the DNS behavior chain to be detected.

[0067] Baseline intent distribution can represent the frequency or proportion of different intent categories in a historical DNS behavior chain. Deviation in intent distribution can be used to quantify the difference between two intent distributions. Intent entropy difference can be used as a specific method to quantify the difference in intent distribution.

[0068] The records include abnormal domains, risky domain records, and historical trusted domain records. An abnormal domain can be a domain that matches a risky domain record or a domain not recorded in a historical trusted domain record. Risky domain records can include domain records based on local security rules, historical handling results, or risk information. Historical trusted domain records can include domain records from a historical period that have been confirmed as valid for normal access. Here, "abnormal domain" refers to a domain that meets preset detection conditions and does not necessarily mean that the domain has been confirmed as malicious.

[0069] Abnormal domain frequency indicates the degree to which abnormal domains appear in the DNS query records being checked. For example, it can be determined by the ratio between the number of abnormal domains and the total number of domains. The number of abnormal domains can be counted either by the number of queries or by the number of domains after deduplication.

[0070] Trust deviation can be a quantified result based on at least one of sequence deviation, intent distribution deviation, and anomalous domain frequency, used to represent the overall deviation of current behavior from historical trustworthy behavior and current temporal structure from historical temporal features. The trusted drift index (TDI) can be considered a specific form of trust deviation.

[0071] Deviation levels can be discrete levels set according to a range of values ​​representing the degree of credible deviation, used to distinguish different levels of behavioral deviation. The number of deviation levels, the value range, and the name of each level can all be set according to the deployment scenario.

[0072] Security governance strategies can be follow-up actions triggered by anomaly detection results, such as logging, traffic auditing, access restrictions, function restrictions, task suspension, or alarm forensics. Logging can save information related to the anomaly detection; traffic auditing can further examine network access records generated by the agent under test; access restrictions can limit the agent's access to certain network addresses or services; function restrictions can limit the agent's use of certain functions; task suspension can pause the currently executing task of the agent; and alarm forensics can generate anomaly alarms and save information related to the abnormal behavior for subsequent analysis. In practical applications, one or more of the above security governance strategies can be selected based on the severity of the anomaly.

[0073] The execution result can indicate whether the governance action has been completed, the detection status after governance, whether the current behavior has been confirmed as trustworthy, or other feedback information that can be used for subsequent processing.

[0074] Baseline update conditions can be used to determine whether a current behavior can be added to the baseline information. Baseline update conditions can at least include the current behavior being identified as a trusted behavior, and can also be determined by combining the stability of multiple consecutive behavior windows, governance feedback, or confirmation results provided by management devices.

[0075] A mapping model can be a model trained based on historical DNS query records, used to convert the queried domain name into a feature representation.

[0076] Domain name vectors can be continuous numerical vectors output by a mapping model.

[0077] The mapping relationship can represent the correspondence between domain name vectors and intent categories. For example, it can be represented by clustering results, category centers, classification boundaries, or other data structures that can determine the intent category based on the domain name vector.

[0078] A cluster can be a group of similar behavior chains formed by clustering multiple historical DNS behavior chains.

[0079] The target DNS behavior chain can be a representative historical DNS behavior chain in the cluster, such as a historical DNS behavior chain whose average sequence distance to other historical DNS behavior chains in the cluster is less than the target threshold.

[0080] The target threshold can be preset or determined based on the statistical distribution of sequence distances within a cluster.

[0081] Dynamic time warping (DTW) is a method for calculating distances between sequences of different lengths. DTW uses dynamic programming to find matching paths between two sequences with smaller cumulative local distances, thus obtaining the sequence distance. Local distances can be calculated using Euclidean distance or other distance metrics suitable for intent category representations.

[0082] Intent entropy can be a distribution statistic calculated based on the proportion of different intent categories appearing in a DNS behavior chain, reflecting the degree of dispersion in the distribution of intent categories. Shannon entropy can be considered a specific implementation of intent entropy.

[0083] Density-based spatial clustering of applications with noise (DBSCAN) is a clustering algorithm that forms clusters based on the distance and local density between samples and identifies noisy samples. DBSCAN is only used as an example of historical DNS behavior chain clustering.

[0084] A trusted execution environment (TEE) can be a protected execution area formed within a processor or computing platform, used to isolate execution detection logic, policy logic, or store critical data. The TEE is an optional deployment method in this application and is not a necessary condition for implementing the agent anomaly detection method.

[0085] It should be noted that the foregoing explanations of terms are used to illustrate exemplary meanings in the embodiments of this application. The specific data structures, parameter forms, implementation algorithms, and deployment methods of the terms can be adjusted according to actual applications, and the embodiments of this application do not limit them in this regard.

[0086] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0087] See Figure 1 , Figure 1 This is a schematic diagram of the architecture of an intelligent agent anomaly detection system 100 provided in an embodiment of this application. Figure 1As shown, the agent anomaly detection system 100 may include a DNS query acquisition device 110 and an agent anomaly detection device 120. Optionally, the agent anomaly detection system 100 may also include a security governance control device 130.

[0088] The DNS query acquisition device 110 can be connected to the agent anomaly detection device 120, thereby providing the acquired DNS query records to the agent anomaly detection device 120. The agent anomaly detection device 120 can be connected to the security governance control device 130, thereby providing at least one of the anomaly detection results, degree of trust deviation, or deviation level obtained during the anomaly detection process to the security governance control device 130. The security governance control device 130 can also provide the execution results of the security governance strategy to the agent anomaly detection device 120.

[0089] It should be noted that, Figure 1 The connection relationships in the code are used to represent data interaction or function call relationships between different functional entities, and do not limit the different functional entities to only following certain rules. Figure 1 Data is transmitted in the indicated direction, and there is no limitation on the specific physical connection method used between different functional entities.

[0090] The DNS query acquisition device 110 can be used to obtain DNS query information corresponding to the intelligent agent to be detected, and form DNS query records based on the obtained DNS query information.

[0091] The agent to be detected can run on servers, compute nodes, virtual machines, containers, or other computing environments capable of executing agent programs. During task execution, the agent can access network resources, obtain configuration information, invoke external services, or interact with business systems. When a network access locates a network resource via a domain name, the agent can generate a DNS lookup.

[0092] The DNS query collection device 110 can obtain corresponding DNS query information from the DNS query traffic generated by the network where the intelligent agent to be detected resides. For example, the DNS query collection device 110 can be deployed at the enterprise network egress, business network boundary, DNS security device, or network location corresponding to a recursive DNS server, and collect DNS query traffic through port mirroring, traffic replication, or other methods that can obtain DNS query information.

[0093] As an example, the DNS query collection device 110 can acquire DNS query traffic using a bypass collection method. When using the bypass collection method, the original DNS query traffic generated by the agent under test can continue to complete domain name resolution along the original network path, and the DNS query collection device 110 can form DNS query records based on the copied DNS query traffic. Therefore, the DNS query collection device 110 can obtain data for anomaly detection without changing the internal model, business data structure, or tool invocation logic of the agent under test.

[0094] In practical applications, as long as the DNS query record corresponding to the intelligent agent to be detected or the scope of the service to be detected can be obtained, the DNS query collection device 110 can also use other data acquisition methods, and this application embodiment does not limit this.

[0095] The intelligent agent anomaly detection device 120 can be used to detect anomalies in the current behavior of the intelligent agent to be detected based on the DNS query records provided by the DNS query collection device 110.

[0096] The intelligent agent anomaly detection device 120 can be implemented through software, hardware, or a combination of both. When implemented in software, the intelligent agent anomaly detection device 120 may include one or more processes running on a computing device. When implemented in hardware, the intelligent agent anomaly detection device 120 may include a processor, a programmable logic device, a dedicated computing circuit, or other hardware structure capable of performing corresponding data processing procedures. This application does not limit the specific implementation form of the intelligent agent anomaly detection device 120.

[0097] exist Figure 1 In the agent anomaly detection system 100 shown, the DNS query acquisition device 110 can obtain the DNS query records generated by the agent under test during operation and provide the DNS query records to the agent anomaly detection device 120. The agent anomaly detection device 120 can analyze the behavior of the agent under test based on the DNS query records to determine whether the current behavior of the agent under test deviates from normal behavior.

[0098] In practical applications, intelligent agents can autonomously plan and make dynamic decisions based on task objectives, and can continuously invoke external tools, access network resources, or interact with business systems during task execution. Because the task execution process of intelligent agents is highly autonomous and dynamic, when affected by factors such as prompt word injection or abnormal configuration, the actual behavior of the intelligent agent may gradually deviate from the behavioral patterns formed during normal task execution, thus causing a decrease in the credibility of the agent's behavior.

[0099] In practical methods of detecting intelligent agents, the detection device can analyze the behavior of the intelligent agent by acquiring the internal information generated during the execution of tasks. For example, the detection device can acquire at least one of the following information: model parameters or model status, business data, and task execution logs within the intelligent agent. Based on the acquired internal information, it can determine which operations the intelligent agent has performed and whether there are any abnormalities in the corresponding operations.

[0100] However, this type of detection method heavily relies on acquiring and parsing information within the intelligent agent. The detection device needs to enter the intelligent agent's model operation process, business processing process, or tool invocation process, and establish data interaction relationships with the corresponding internal mechanisms. For application scenarios involving sensitive business information, such as financial transactions, government services, energy dispatch, and industrial control, the data processed internally by the intelligent agent may involve business content, user data, model internal states, or other sensitive information. In the process of acquiring and parsing the above information, the anomaly detection system expands the range of internal data it can access, thereby increasing the possibility of sensitive information exposure and bringing privacy and compliance risks.

[0101] Furthermore, these detection methods rely on the internal model structure, business data format, or tool invocation mechanism of the agent. When the internal implementation of different agents changes, the anomaly detection system may need to be adapted accordingly. Therefore, anomaly detection capabilities are easily coupled with the specific internal implementation of the agent, making it difficult to continuously determine the trustworthiness of the agent's behavior without changing the original business operation process. In contrast, this solution can obtain behavioral information from DNS query traffic outside the agent, thus avoiding data collection from entering the agent's internal system and reducing the coupling between the anomaly detection process and the agent's internal implementation.

[0102] Therefore, how to obtain information reflecting the agent's behavior without acquiring the agent's internal model state, business data, and tool call process, and how to determine whether the agent's current behavior deviates from normal behavior based on this information, is a problem that needs to be solved in the process of agent anomaly detection.

[0103] This application embodiment considers that, during the execution of a task, when an intelligent agent needs to access network resources, obtain configuration, call external services, or interact with a business system, the corresponding network access process can generate DNS queries. Unlike the intelligent agent's internal model state, business data, and tool call processes, DNS queries can be obtained during network resolution processes outside the intelligent agent.

[0104] Based on this Figure 1The DNS query acquisition device 110 shown can obtain the DNS query records corresponding to the agent under test from outside the agent under test, and provide the DNS query records to the agent anomaly detection device 120. In this way, the agent anomaly detection system 100 can obtain data related to the network access behavior of the agent under test without entering the internal operation link of the agent under test to obtain model status, business data or tool call process.

[0105] exist Figure 1 In the agent anomaly detection system 100 shown, the agent anomaly detection device 120 can construct a DNS behavior chain based on the DNS query records provided by the DNS query collection device 110. The DNS behavior chain can include multiple intent categories and the temporal correlation between multiple intent categories. The intent category can be used to characterize the intent of the agent to be detected to perform the behavior corresponding to the queried domain name in the DNS query record, and the temporal correlation can be used to characterize the order in which multiple intent categories are executed by the agent to be detected in the corresponding behavior.

[0106] The agent anomaly detection device 120 can also acquire baseline information corresponding to the agent under test. The baseline information can be used to indicate multiple trusted behaviors formed by the agent under test based on DNS query behavior within a historical time period, as well as the temporal characteristics of the execution of these trusted behaviors. Then, the agent anomaly detection device 120 can compare the DNS behavior chain with the baseline information and generate anomaly detection results for the agent under test based on the comparison results, to determine whether the current behavior represented by the DNS behavior chain deviates from the normal behavior indicated by the baseline information.

[0107] Thus, the agent anomaly detection device 120 can convert the DNS query records generated during the operation of the agent under test into DNS behavior chains with behavioral semantics and temporal structure, and use the trusted behaviors formed in the past of the agent under test as a comparison benchmark to detect whether the current behavior of the agent under test deviates from normal behavior. Since the DNS query records can be obtained from outside the agent under test by the DNS query collection device 110, the agent anomaly detection system 100 does not need to obtain the model state, business data or tool call process inside the agent under test to complete the agent anomaly detection, thereby avoiding the intrusion of the anomaly detection process into the internal operation of the agent and reducing the privacy and compliance risks caused by obtaining internal business data during the anomaly detection process.

[0108] Optionally, when the agent anomaly detection system 100 includes a security governance control device 130, the agent anomaly detection device 120 can provide the information obtained during the anomaly detection process to the security governance control device 130. The security governance control device 130 can determine a security governance strategy based on the relevant information and execute or control the corresponding implementing entity to execute the security governance strategy.

[0109] Understandable, Figure 1 The architecture of the agent anomaly detection system 100 shown is merely an example of an architecture provided in this application embodiment. In other implementations, the DNS query acquisition device 110, the agent anomaly detection device 120, and the security governance control device 130 can be deployed in different computing devices, or two or more of the functional entities can be integrated into the same computing device. The agent anomaly detection system 100 may also include other devices, units, or modules with corresponding functions, which are not limited in this application embodiment.

[0110] In addition, the security governance control device 130 is an optional functional component. Even when the agent anomaly detection system 100 does not include the security governance control device 130, the DNS query acquisition device 110 and the agent anomaly detection device 120 can still perform anomaly detection of the agent under test based on DNS query records.

[0111] For ease of understanding, embodiments of the intelligent agent anomaly detection method provided in this application are described below with reference to the accompanying drawings.

[0112] See Figure 2 , Figure 2 This is a flowchart illustrating an anomaly detection method for an intelligent agent provided in an embodiment of this application. Figure 2 The agent anomaly detection method shown can be applied to Figure 1 The agent anomaly detection system 100 shown can also be applied to other applicable agent anomaly detection systems. For ease of explanation, this embodiment uses... Figure 2 The agent anomaly detection method shown is applied to Figure 1 The intelligent agent anomaly detection system 100 shown is used as an example for illustrative purposes. Among them, Figure 2 Steps S201 to S203 constitute the main process of anomaly detection. Steps S204 and S205 can be optional processing after anomaly detection.

[0113] Overall, in Figure 2In the agent anomaly detection method shown, the agent anomaly detection device 120 can construct a DNS behavior chain based on the DNS query records of the agent to be detected, and obtain baseline information to characterize the historical credible behavior and corresponding temporal characteristics of the agent to be detected. The agent anomaly detection device 120 can compare the current DNS behavior chain with the baseline information, and generate anomaly detection results based on the behavioral differences and temporal differences between the current behavior and the historical credible behavior, thereby determining whether the current behavior deviates from normal behavior. The above steps S201 to S203 constitute the main processing procedure of agent anomaly detection.

[0114] After obtaining the anomaly detection results, the agent anomaly detection system 100 can further perform security governance and baseline updates. Specifically, upon obtaining the degree of trustworthy deviation and the corresponding deviation level, the security governance control device 130 can determine and execute the security governance strategy corresponding to the anomaly detection results based on the deviation level, forming an execution result. The agent anomaly detection device 120 can also determine whether the current behavior meets the baseline update conditions based on the execution result, and if the baseline update conditions are met, add the confirmed trustworthy current behavior to the historical trustworthy behavior to update the baseline information. Steps S204 and S205 are optional processing after anomaly detection and do not affect the independent completion of anomaly detection of the current behavior by steps S201 to S203. Figures 3 to 7 Used for respectively Figure 2 The following is a further explanation of a specific implementation of each process step shown. Figure 3 Used to illustrate the process of constructing DNS behavior chains, Figure 4 Used to illustrate the process of forming baseline information. Figure 5 Used to illustrate the process of determining the degree of confidence deviation and the results of anomaly detection. Figure 6 Used to illustrate the safety management process. Figure 7 This is used to illustrate the process of updating baseline information.

[0115] S201: The intelligent agent anomaly detection device 120 constructs a DNS behavior chain based on the DNS query records of the intelligent agent to be detected.

[0116] In general, the process of constructing a DNS behavior chain can include forming a behavior window, determining intent categories, and organizing intent categories according to temporal relationships. Through the above processing, the agent anomaly detection device 120 can convert multiple discrete DNS query records into a behavior sequence with behavioral semantics and temporal structure. The following section combines... Figure 3 Explain a specific implementation of step S201.

[0117] See Figure 3 , Figure 3 This is a flowchart illustrating a DNS behavior chain construction method provided in an embodiment of this application. Figure 3 Steps S301 to S305 shown can together constitute one implementation of step S201, and each step can be executed by the intelligent agent anomaly detection device 120.

[0118] S301: The intelligent agent anomaly detection device 120 acquires DNS query records including the query time and the queried domain name.

[0119] DNS query records can be generated by the DNS query collection device 110 based on the collected DNS query traffic and provided to the intelligent agent anomaly detection device 120. A DNS query record may include the query time and the queried domain name, and may also include at least one of the following: query type, source network identifier, or response status. For example, a DNS query record may include the query time, the queried domain name, and the query type. In different deployment scenarios, the fields included in the DNS query record can be set according to the data used in subsequent processing.

[0120] S302: The intelligent agent anomaly detection device 120 arranges DNS query records according to the query time and determines the query interval between adjacent DNS query records.

[0121] The intelligent agent anomaly detection device 120 can arrange DNS query records from first to last according to their query times, and can determine the query interval as the time difference between the query time of a later DNS query record and the query time of a previous DNS query record. For example, if the query times of two adjacent DNS query records are 10:00:05 and 10:00:09 respectively, the corresponding query interval can be 4 seconds. The query interval can be used to reflect the temporal continuity of adjacent DNS queries.

[0122] S303: The intelligent agent anomaly detection device 120 forms a behavior window based on the query interval and window termination conditions.

[0123] In general, the intelligent agent anomaly detection device 120 can determine the boundary of the behavior window based on one of the dimensions of time continuity, window duration, and number of query records within the window, or it can determine the boundary of the behavior window based on any combination of multiple dimensions of time continuity, window duration, and number of query records within the window.

[0124] In a first possible implementation, the agent anomaly detection device 120 can compare the query interval between adjacent DNS query records with an interval threshold. When the query interval is greater than the interval threshold, the agent anomaly detection device 120 can determine the position between the two adjacent DNS query records that generated the query interval as the dividing position of the behavior window, and divide the DNS query records based on this dividing position, so that the DNS query records located on both sides of the dividing position are assigned to different behavior windows. For example, the agent anomaly detection device 120 can take the next DNS query record as the first DNS query record in the next behavior window, and continue to determine the dividing position of the subsequent behavior window based on the query interval between subsequent adjacent DNS query records. The interval threshold can be determined based on the statistical information of historical query intervals. As an implementation example, the average value of historical query intervals can be μ, the standard deviation can be σ, and the interval threshold Tsplit can be determined according to... Determined. For example, μ could be 5.0 seconds, σ could be 1.2 seconds, then Tsplit could be 8.6 seconds. μ plus 3σ could be a statistical implementation of the interval threshold, which could also be determined based on other statistical information that reflects the distribution of historical query intervals.

[0125] In a second possible implementation, the agent anomaly detection device 120 can divide DNS query records into behavior windows based on a comparison between the time span corresponding to consecutively arranged DNS query records and a duration threshold. The time span can be the time interval between the earliest and latest DNS query records among those to be assigned to the same behavior window. When the time span reaches the duration threshold, the agent anomaly detection device 120 can determine the division position of the corresponding behavior window and, based on this division position, assign the corresponding DNS query records to different behavior windows. As an example, the duration threshold can be 600 seconds, or it can be set to other durations according to the agent's task cycle.

[0126] In a third possible implementation, the agent anomaly detection device 120 can determine the boundary of the behavior window based on the number of DNS query records to be assigned to the same behavior window. When the number of DNS query records reaches a threshold, the agent anomaly detection device 120 can determine the corresponding behavior window division position and divide the DNS query records into behavior windows based on this division position. For example, the threshold can be 30 records; for business areas with high DNS query frequency, the threshold can also be other positive integers. Furthermore, the agent anomaly detection device 120 can combine any two or three of the following conditions: query interval, window duration, and number of query records, and determine the boundary of the behavior window when the corresponding conditions are met, so as to divide the DNS query records into behavior windows based on the determined boundary. The agent anomaly detection device 120 can also set a minimum number of query records or a minimum duration corresponding to an effective behavior window, and merge, temporarily store, or otherwise pre-process records that do not meet the effective window conditions. These various implementations allow the behavior window to be adjusted according to the DNS query rhythm and data scale.

[0127] S304: The intelligent agent anomaly detection device 120 determines the intent category corresponding to the queried domain name within the target window.

[0128] In general, intent categories can be used to characterize the intent of the agent performing the behavior corresponding to the queried domain name. The agent anomaly detection device 120 can determine the intent category based on the feature representation of the queried domain name and the correspondence between intent categories.

[0129] As an implementation example, the intelligent agent anomaly detection device 120 can determine the domain name vector corresponding to the queried domain name based on a mapping model, and then obtain the target intent category by querying the mapping relationship based on the domain name vector. The mapping model can be a model trained based on historical DNS query records. The domain name vector can be a feature representation of the queried domain name in a continuous vector space, and the mapping relationship can be the correspondence between the domain name vector and the intent category.

[0130] More specifically, the mapping model can be used to convert the queried domain name into a domain name vector, and determine the intent category corresponding to the queried domain name based on the domain name vector. The domain name vector can be data representing the characteristics of the queried domain name using multiple numerical values, enabling comparisons between different domain names based on their respective domain name vectors.

[0131] As an example, the mapping model can use the Domain2Vec model and be trained using the Skip-gram model of Word2Vec. During training, if multiple domains frequently appear in similar DNS access processes, the corresponding domains can have relatively similar domain vectors. The domain vector can be a 128-dimensional vector or a vector of other dimensions. Here, 128 dimensions means using 128 values ​​to jointly represent the features of a domain, not that there are 128 intent categories.

[0132] Furthermore, after obtaining the domain vectors corresponding to multiple domains, the agent anomaly detection device 120 can determine the intent category based on the similarity between different domain vectors. For example, the agent anomaly detection device 120 can use K-means clustering to cluster multiple domain vectors, grouping domain vectors with similar features into the same cluster, and determining the corresponding intent category based on the business meaning of the domains in the cluster. The number of categories K can be 20, or it can be set to other numbers according to the actual business. For example, when the domain vectors corresponding to multiple domains used for reporting operational status or collecting metrics are relatively similar, the agent anomaly detection device 120 can determine the corresponding domains as the "status collection and metric reporting" category; when the domain vectors corresponding to multiple domains used for obtaining configuration or policy information are relatively similar, the agent anomaly detection device 120 can determine the corresponding domains as the "configuration and policy retrieval" category.

[0133] Therefore, when the agent anomaly detection device 120 obtains a new DNS query record, it can first determine the domain name vector corresponding to the queried domain name, and then determine the corresponding intent category based on the mapping relationship between the domain name vector and the intent category. For example, if the queried domain name corresponds to the status reporting service, the agent anomaly detection device 120 can determine the corresponding intent category as C3. Some intent categories can be shown in Table 1. In the implementation that retains the query type, a DNS query that has completed the mapping can also be represented as a triple consisting of the query time, the domain name vector, and the query type, such as (timestamp, domain_vector, query_type), where timestamp is the query time, domain_vector is the domain name vector, and query_type is the query type. When constructing the DNS behavior chain subsequently, the agent anomaly detection device 120 can use the domain name vector or a label used to indicate the intent category.

[0134] Table 1. Examples of Intent Categories and Corresponding Domain Name Meanings

[0135] Category Identifier Intent Category Examples Domain name meaning examples Query type examples C1 Trustworthy Public Services Public infrastructure services and public cloud service domain names A or AAAA C2 Self-renewal and upgrading Software update and component upgrade service domain A C3 Status collection and indicator reporting Operation status reporting and indicator collection service domain A C4 Configuration and policy retrieval Configuration service, policy service domain A or TXT C5 abnormal resource usage Abnormal computing resource service domain A C6 Vulnerability Detection Test backlinks and probe service domains A or TXT C7 Command and Control Abnormal remote control service domain A or TXT C8 Abnormal data transmission Abnormal encoding data transmission service domain TXT or A

[0136] The number of categories, category names, domain names, and query types in Table 1 are merely examples to illustrate intent categories. In this application, intent categories can also be directly represented using cluster tags. Different enterprises, industries, agent types, or business scopes can adopt other category systems, and categories within the same category system can be added, merged, or adjusted.

[0137] S305: The intelligent agent anomaly detection device 120 arranges the intent categories according to the order indicated by the query time to obtain the DNS behavior chain.

[0138] The agent anomaly detection device 120 can maintain the query time order of each DNS query record within the target window and write the corresponding intent categories into the sequence sequentially. For example, when state collection and indicator reporting correspond to C3, and configuration and policy retrieval correspond to C4, a set of related DNS query records appearing sequentially in time can form a DNS behavior chain, i.e., [C3, C4, C3, C4]. Accordingly, the DNS behavior chain formed based on related DNS query records can be used to characterize a relatively continuous external access behavior process; in this example, the external access behavior process can cover the state collection and indicator reporting, configuration and policy retrieval, and other operation stages in one task cycle of the agent. Among them, the category content can characterize the semantics of the external access behavior, and the order of the categories can characterize the temporal correlation of the corresponding behaviors.

[0139] In conclusion, Figure 3 The illustrated process can be a complete implementation of step S201. The query record fields, behavior window boundaries, mapping model, domain name vector dimension, number of intent categories, and specific category system can all be adjusted according to the actual deployment scenario. As long as the intelligent agent anomaly detection device 120 can form a DNS behavior chain based on DNS query records, including multiple intent categories and corresponding temporal relationships, it can be used as an implementation of step S201. This application embodiment does not limit the specific construction method of the DNS behavior chain.

[0140] S202: The intelligent agent anomaly detection device 120 acquires baseline information.

[0141] In general, baseline information can serve as a historical comparison reference for DNS behavior chains. Step S202 can be implemented in several ways. In the first possible implementation, the baseline information can be formed before real-time detection begins, and the agent anomaly detection device 120 can directly read the baseline information from local storage or other accessible data storage. In the second possible implementation, the agent anomaly detection device 120 can form the baseline information based on DNS query records generated within a historical time period. In the third possible implementation, the already formed baseline information can also be incrementally updated based on subsequently confirmed trustworthy new behaviors. The following will combine... Figure 4 This describes one implementation for forming baseline information based on historical DNS query records.

[0142] See Figure 4 , Figure 4 This is a flowchart illustrating a baseline information formation method provided in an embodiment of this application. Figure 4 Steps S401 to S405 shown can constitute one implementation of step S202. Figure 4 The behavior chains formed within a historical time period are recorded as historical DNS behavior chains, and the historical DNS behavior chains determined from the clusters are recorded as target DNS behavior chains.

[0143] S401: Intelligent agent anomaly detection device 120 acquires DNS query records generated within a historical time period.

[0144] The historical time period can be the initial trust period after the deployment of the agent under test, or a trusted time range determined based on the confirmation results provided by the management device. As an example, the initial trust period can be a continuous 30 days. The historical time period can also be set to other durations based on business cycles, DNS query density, or baseline stability.

[0145] S402: The intelligent agent anomaly detection device 120 constructs multiple historical DNS behavior chains based on DNS query records generated within a historical time period.

[0146] The intelligent agent anomaly detection device 120 can follow Figure 3 The method for constructing the DNS behavior chain shown processes DNS query records generated within a historical time period. Specifically, the intelligent agent anomaly detection device 120 can form multiple historical behavior windows for historical DNS query records, determine the intent category corresponding to each queried domain name in each historical behavior window, and then arrange the multiple intent categories according to the chronological order of the query times indicated by the corresponding DNS query records, thereby obtaining the historical DNS behavior chain corresponding to each historical behavior window.

[0147] For example, when three historical behavior windows are formed within a historical time period, the agent anomaly detection device 120 can construct three historical DNS behavior chains based on the DNS query records in the three historical behavior windows respectively. Different historical behavior windows can correspond to different task execution processes or different task cycles of the agent to be detected within the historical time period.

[0148] Among them, the construction process of historical DNS behavior chains and Figure 3 The process of constructing a DNS behavior chain based on the current DNS query records in the intelligent agent anomaly detection device 120 is similar, the main difference being that the data processed comes from a historical time period. For details on the specific implementation of behavior window formation, intent category determination, and intent category sorting, please refer to [link to relevant documentation]. Figure 3 The corresponding steps S301 to S305 will not be repeated here.

[0149] S403: The intelligent agent anomaly detection device 120 performs clustering processing on multiple historical DNS behavior chains to obtain one or more clusters.

[0150] In general, clustering can group historical DNS behavior chains with similar intent categories and temporal structures into corresponding clusters based on the degree of similarity between different historical DNS behavior chains. The agent anomaly detection device 120 can first determine the sequence distance between any two historical DNS behavior chains, and then perform clustering operations based on the sequence distance.

[0151] As an implementation example, sequence distance can be achieved using dynamic time-warped distance. Since the number of DNS query records contained in different historical behavior windows may vary, the sequence lengths of different historical DNS behavior chains may also differ. DTW can match the intent categories in two historical DNS behavior chains while maintaining the order of intent categories, and determine the sequence distance between the two historical DNS behavior chains based on the matching results. The smaller the sequence distance, the more similar the two historical DNS behavior chains are in terms of the composition and order of intent categories.

[0152] To reduce the impact of different DNS behavior chain lengths on sequence distance, the agent anomaly detection device 120 can normalize the DTW distance, enabling the sequence distances between different historical DNS behavior chains to be compared on a uniform scale.

[0153] After obtaining the normalized sequence distances between multiple historical DNS behavior chains, the agent anomaly detection device 120 can cluster these chains based on the sequence distances. For example, the agent anomaly detection device 120 can use the DBSCAN algorithm for clustering. The DBSCAN algorithm can group multiple historical DNS behavior chains that are close in sequence distance and appear in a concentrated manner into the same cluster, and identify historical DNS behavior chains that differ significantly from other historical DNS behavior chains as noise samples.

[0154] For example, the neighborhood radius eps in DBSCAN can be 0.3, which limits the distance range between two historical DNS behavior chains when they are considered close to each other; the minimum number of samples min_samples can be 3, which limits the minimum number of samples that need to be included in the corresponding neighborhood when forming a cluster. When the normalized sequence distance between multiple historical DNS behavior chains meets the corresponding clustering conditions, the agent anomaly detection device 120 can classify these historical DNS behavior chains into the same cluster.

[0155] In this way, the intelligent agent anomaly detection device 120 can group together historical DNS behavior chains that recur within a historical time period and have similar behavioral composition and temporal structure, providing a basis for subsequently identifying target DNS behavior chains that can characterize historical trustworthy behavior from the clusters. DTW, DBSCAN, and eps of 0.3 and min_samples of 3 are all specific implementation examples. The method for determining the sequence distance, the clustering algorithm, and the corresponding parameters can also adopt other implementation methods that can form clusters based on the similarity between historical DNS behavior chains.

[0156] S404: Intelligent agent anomaly detection device 120 determines the target DNS behavior chain based on clustering.

[0157] In one possible implementation, the agent anomaly detection device 120 can determine the sequence distance between any historical DNS behavior chain within a cluster and other historical DNS behavior chains, and calculate the average of multiple sequence distances. When the average value is less than a preset threshold, the agent anomaly detection device 120 can identify the corresponding historical DNS behavior chain as the target DNS behavior chain. The preset threshold can be set in advance or determined based on the statistical distribution of sequence distances within the cluster.

[0158] Building upon the aforementioned implementation, if multiple historical DNS behavior chains satisfying a preset threshold exist within the same cluster, the agent anomaly detection device 120 can further identify a more representative target DNS behavior chain from these chains. For example, the agent anomaly detection device 120 can identify the true historical DNS behavior chain with the smallest average sequence distance to other historical DNS behavior chains within the cluster as the central representative chain. A cluster can correspond to one target DNS behavior chain or multiple target DNS behavior chains.

[0159] S405: The intelligent agent anomaly detection device 120 forms baseline information based on the target DNS behavior chain.

[0160] The intelligent agent anomaly detection device 120 can determine multiple trusted behaviors and the temporal characteristics of the execution of these trusted behaviors based on the target DNS behavior chain, and write the above information into baseline information. The baseline information may also include at least one of one or more baseline DNS behavior chains, baseline intent distribution, baseline intent entropy, and historical trusted domain name records. For example, the baseline intent distribution can be determined based on the frequency or proportion of different intent categories in the historical DNS behavior chain; the baseline intent entropy can be determined based on the intent category distribution in the historical DNS behavior chain; and the historical trusted domain name records may include queried domain names that have been confirmed as valid references for normal access within a historical time period.

[0161] As a specific implementation, the target DNS behavior chains corresponding to one or more clusters can form a normal behavior pattern library, where each target DNS behavior chain can serve as a typical sequence representative of the corresponding historical trusted behavior. The agent anomaly detection device 120 can also calculate the intent entropy corresponding to multiple historical behavior windows within a trusted time range, and determine the average of the multiple intent entropies as the baseline intent entropy. The baseline information may also include at least one of the baseline intent distribution and historical trusted domain name records.

[0162] In conclusion, Figure 4 The baseline formation process shown can be one implementation of step S202. The historical time period, clustering algorithm, preset threshold, number of target DNS behavior chains, and additional components of the baseline information can all be set based on the business behavior and historical data of the agent to be detected. As long as the baseline information can indicate multiple trusted behaviors and corresponding temporal characteristics, it can provide a historical comparison reference for the current DNS behavior chain.

[0163] S203: The intelligent agent anomaly detection device 120 generates anomaly detection results based on the comparison results of DNS behavior chain and baseline information.

[0164] In general, there are at least two ways to implement step S203.

[0165] In the first type of implementation, the intelligent agent anomaly detection device 120 can directly generate behavior comparison results and time sequence comparison results, and generate anomaly detection results based on the behavior comparison results and time sequence comparison results.

[0166] In the second implementation, the intelligent agent anomaly detection device 120 can further convert the above comparison results into one or more quantified deviation representation information, and then generate anomaly detection results based on the quantification results. The following is in conjunction with... Figure 5 Explain the second type of implementation.

[0167] See Figure 5 , Figure 5 This is a flowchart illustrating a method for determining the degree of credible deviation and generating anomaly detection results, provided in an embodiment of this application. Figure 5 Steps S501 to S503 shown can constitute a quantitative implementation of step S203. Figure 5 The degree of sequence deviation is denoted as sequence deviation degree, the degree of intention distribution deviation is denoted as intention distribution deviation degree, and the frequency of abnormal domain names is denoted as abnormal domain name frequency.

[0168] S501: The intelligent agent anomaly detection device 120 determines at least one of the following based on DNS behavior chain and baseline information: sequence deviation degree, intention distribution deviation degree, and abnormal domain name frequency.

[0169] The first type of deviation representation can be the degree of sequence deviation. The degree of sequence deviation can be used to characterize the change in the order of multiple intent categories in the current DNS behavior chain relative to the order of historically reliable behaviors. Specifically, the agent anomaly detection device 120 can compare the current DNS behavior chain with at least one baseline DNS behavior chain and determine the sequence distance between them. This sequence distance can comprehensively reflect the differences in the order of intent categories, the sequence position of each intent category in the DNS behavior chain, and the overall arrangement structure. Generally speaking, the smaller the sequence distance, the closer the current DNS behavior chain is to the corresponding baseline DNS behavior chain; the larger the sequence distance, the more significant the difference in the order of behavior execution between the two.

[0170] As an implementation example, the sequence distance can be a dynamically time-warped distance. The agent anomaly detection device 120 can compare the current DNS behavior chain with multiple baseline DNS behavior chains, and use the minimum sequence distance as the degree of sequence deviation, or determine the degree of sequence deviation based on other statistical results of multiple sequence distances. For example, if the current DNS behavior chain is [C3, C4, C3, C4], and a certain baseline DNS behavior chain is also [C3, C4, C3, C4], the degree of sequence deviation between the two can be small; if the current DNS behavior chain changes to [C3, C7, C8, C4], the difference between the two in terms of intent category and its order increases, and the corresponding degree of sequence deviation can increase.

[0171] The second type of deviation representation can be the degree of intention distribution deviation. The degree of intention distribution deviation can be used to characterize the proportion of various intention categories appearing in the current DNS behavior chain, and whether this proportion has changed compared to the proportion of various intention categories appearing in historical trusted behaviors. The agent anomaly detection device 120 can count the number of occurrences or the proportion of different intention categories in the current DNS behavior chain to form a distribution of intentions to be detected, and form a baseline intention distribution based on the historical DNS behavior chain, and then determine the degree of intention distribution deviation based on the difference between the two.

[0172] For example, C3 and C4 mainly appear in historical trusted behaviors, and their occurrence ratio is relatively stable; if the current DNS behavior chain is still mainly composed of C3 and C4, the degree of intention distribution deviation can be small; if a large number of C7 or C8 are added to the current DNS behavior chain, causing a significant change in the occurrence ratio of each intention category, the degree of intention distribution deviation can increase.

[0173] As an implementation example, the agent anomaly detection device 120 can calculate the current intent entropy and the baseline intent entropy separately, and determine the degree of intent distribution deviation based on the difference between the two. The intent entropy can be used to characterize the distribution of multiple intent categories in the DNS behavior chain. The greater the difference between the current intent entropy and the baseline intent entropy, the more significant the change in the current intent category distribution relative to historical reliable behavior. The intent entropy can be Shannon entropy, or other statistical measures that can characterize the distribution features of intent categories.

[0174] The third type of deviation representation can be the frequency of abnormal domain names. The frequency of abnormal domain names can be used to represent the proportion of abnormal domain names appearing during the current DNS query process. Abnormal domain names can be domain names that match pre-obtained risk domain name records, or domain names not recorded in historical trusted domain name records. The intelligent agent anomaly detection device 120 can count the number of abnormal domain names and the total number of domain names in the current behavior window, and determine the frequency of abnormal domain names based on the ratio of the two.

[0175] For example, if a behavior window includes 5 domain name queries, and 2 of those queries correspond to domains that meet the abnormal domain name criteria, then when counting by the number of queries, the abnormal domain name frequency can be 2 / 5, or 0.4. A higher abnormal domain name frequency indicates that abnormal domain names appear more frequently during the current behavior. For the same domain name that appears repeatedly, the number of abnormal domain names can be counted either by the number of queries or by the number of deduplicated domain names.

[0176] It should be noted that the three deviation representations described above focus on different behavioral characteristics. For example, even if the intent categories contained in the current DNS behavior chain are basically the same as those of historical trusted behaviors, the degree of sequence deviation may still increase when the order of intent categories changes; even if the change in order is small, the degree of intent distribution deviation may increase when the proportion of each intent category changes significantly. Therefore, the agent anomaly detection device 120 can use one of the above deviation representations, or it can combine two or three deviation representations to describe the changes in current behavior relative to historical trusted behavior from different perspectives.

[0177] S502: The intelligent agent anomaly detection device 120 determines the degree of credible deviation based on at least one deviation characterization information.

[0178] In the first possible implementation, when the agent anomaly detection device 120 determines only one deviation representation information, the agent anomaly detection device 120 can use the normalized result of the deviation representation information as the degree of credible deviation, or determine the degree of credible deviation based on the deviation representation information and the preset mapping relationship.

[0179] In the second possible implementation, when the agent anomaly detection device 120 determines two or three deviation representation information, the agent anomaly detection device 120 can fuse the different deviation representation information. The trusted drift index (TDI) can be used as a specific form of trusted deviation degree and can be calculated using the following TDI weighting formula.

[0180] ;

[0181] Where α, β, and γ represent the weights corresponding to the three deviation components, and satisfy α + β + γ = 1. Represents the current action chain. Represents sequence distance. Intention entropy drift can be considered a specific form of the degree of deviation from the intention distribution. This represents the frequency of rare domain names.

[0182] TDI can be normalized to a continuous value from 0 to 1. A larger value indicates a greater overall deviation of the current behavior from the baseline information, and allows for a comprehensive comparison of different deviation components on a uniform scale. As an example, α, β, and γ can be 0.5, 0.3, and 0.2, respectively. The agent anomaly detection device 120 can also adjust the corresponding weights according to the deployment scenario, for example, by dynamically adjusting the weights based on historical detection results through reinforcement learning. When only one or two deviation components are involved in the calculation, the corresponding weights can be renormalized.

[0183] To determine the degree of sequence deviation, one specific implementation could be using sequence distance. The intelligent agent anomaly detection device 120 can calculate the current DNS behavior chain separately. With normal behavior pattern library The minimum DTW distance between each baseline sequence B is normalized.

[0184] ;

[0185] d;

[0186] ;

[0187] In the above formula, Indicates the current DNS behavior chain; B represents a library of normal behavior patterns formed based on historically reliable behavior; B represents... Any baseline sequence in; L_max represents the DTW distance between the current DNS behavior chain and the corresponding baseline sequence; L_max represents the maximum length of the behavior window used for normalization. In this context, 'd' represents the dimension of the domain name embedding vector. In the recursive formula, D(i,j) represents the minimum cumulative distance up to the current position, and d(i,j) represents the local distance between the intent vectors of two corresponding positions. The local distance can be expressed using Euclidean distance. This recursive relationship can serve as a concrete implementation for DTW computation.

[0188] ;

[0189] To determine the degree of deviation in intent distribution, one specific implementation could employ intent entropy drift. The intelligent agent anomaly detection device 120 can statistically analyze the current DNS behavior chain. The frequency of occurrence of different intent categories is calculated, and the current intent entropy is calculated according to the Shannon entropy formula mentioned above. .in, This indicates that the intent category Cj is in the current DNS behavior chain. The frequency of occurrence in the formula; 20 represents the number of intent categories in a specific implementation, and the summation range can be adjusted accordingly when the number of categories changes. This represents the current intent entropy corresponding to the current DNS behavior chain. The current intent entropy can be calculated based on the occurrence ratio of each intent category in the current DNS behavior chain. This represents the baseline intent entropy, which can be the average of the intent entropies corresponding to multiple historical behavior windows within a credible time range.

[0190] ;

[0191] In the above formula, ε represents a parameter used to avoid the denominator being zero. As an example implementation, ε can be 0.01. When When the calculated result is greater than 1.0, the intelligent agent anomaly detection device 120 can truncate the result to 1.0 after the formula calculation is completed. This truncation is part of the numerical processing after formula calculation and does not change the... The calculation relationship. In subsequent numerical examples, The value is approximately 0.9129, which is less than 1.0, therefore no truncation was triggered.

[0192] ;

[0193] For abnormal domain name frequencies, one specific implementation can be the aforementioned rare domain name frequencies. .in, Indicates the current DNS behavior chain The number of domains that meet the criteria for rare domains. Indicates the current DNS behavior chain The length. In step S501, the abnormal domain name can also be judged more broadly using either the condition of "matching a risky domain name record" or "not recorded in the historical trusted domain name record"; rare domain names that simultaneously meet the risky record matching requirement and do not appear in the historical trusted domain name record are only... One specific implementation. To illustrate the relationship between the above formulas, assume a normal behavior pattern library. One baseline sequence in the chain is [C3, C4, C3, C4], representing the current DNS behavior chain. Given [C3, C2, C7, C8, C3], assuming the minimum DTW cumulative distance between them is 25.456, L_max is 5 and the embedding vector dimension d is 8, we can calculate... =25.456 / 40=0.6364.

[0194] In the same numerical example, Approximately 1.9220, =1.00 and ε is 0.01; Current DNS behavior chain This includes 5 DNS queries, 2 of which correspond to domains that meet the criteria for rare domains. =|1.9220−1.00| / 1.01≈0.9129.

[0195] Based on the current DNS behavior chain By analyzing the number of rare domain name queries and the current chain length, the intelligent agent anomaly detection device 120 can obtain the corresponding rare domain name frequency. = 2 / 5 = 0.4

[0196] When α is 0.5, β is 0.3, and γ is 0.2, the intelligent agent anomaly detection device 120 can fuse the above three deviation components according to the TDI weighting formula. Wherein, TDI = 0.5 × 0.6364 + 0.3 × 0.9129 + 0.2 × 0.4 = 0.6721.

[0197] The above calculations show that the current DNS behavior chain... The corresponding TDI is approximately 0.6721. The agent anomaly detection device 120 can use this TDI as the degree of confidence deviation and provide it to step S503 to generate anomaly detection results. It should be noted that the above-mentioned normal behavior pattern library, current DNS behavior chain, vector dimension, distance value, intent entropy, ε, number of rare domain names, weight, and calculation results are only used to illustrate a specific numerical implementation. In practical applications, the agent anomaly detection device 120 can use other sequence distances, distribution statistics, anomaly domain name statistical calibers, normalization scales, or fusion methods to determine the degree of confidence deviation. Specific parameters can be set according to the deployment scenario.

[0198] S503: The intelligent agent anomaly detection device 120 generates anomaly detection results based on the degree of credibility deviation.

[0199] In one possible implementation, the agent anomaly detection device 120 can compare the degree of credible deviation with the anomaly judgment threshold and determine whether the current behavior deviates from normal behavior based on the comparison result.

[0200] In another possible implementation, the agent anomaly detection device 120 can first determine the deviation level based on the range of values ​​for the degree of credible deviation, and then determine the anomaly detection result based on the deviation level. The anomaly detection result can be used to indicate whether the current behavior deviates from normal behavior, and can also include at least one of the degree of credible deviation, the deviation level, or deviation characterization information that caused the deviation.

[0201] In summary, step S203 can generate anomaly detection results either directly based on the behavior comparison results and the time sequence comparison results, or it can be achieved through... Figure 5 The quantization method shown generates anomaly detection results. The sequence distance algorithm, intent distribution comparison method, anomaly domain statistics method, fusion method, and anomaly judgment rules can all be configured according to the actual deployment scenario, and are not limited to... Figure 5 The specific example in the document serves as the only implementation.

[0202] Optionally, Figure 2 The intelligent agent anomaly detection method shown may further include step S204.

[0203] S204: The safety management control device 130 determines and executes a safety management strategy corresponding to the anomaly detection result based on the deviation level.

[0204] In general, security governance strategies can be matched with the degree of behavioral deviation reflected by the level of trust deviation. Multiple deviation levels can correspond to multiple policy groups, and a one-to-one correspondence can be established between multiple deviation levels and multiple policy groups. Each policy group can include one or more governance actions. Governance actions can be at least one of the following: logging, latency parsing, traffic auditing, access restrictions, function restrictions, task suspension, and alarm forensics. The following section combines... Figure 6 This illustrates the implementation of a hierarchical governance model.

[0205] See Figure 6 , Figure 6 This is a flowchart illustrating a security management method provided in an embodiment of this application.

[0206] S601: The intelligent agent anomaly detection device 120 determines the deviation level at which the degree of credible deviation is located.

[0207] Multiple deviation levels can be set according to the value range of the confidence deviation degree. For example, the intelligent agent anomaly detection device 120 can be set with four deviation levels. A confidence deviation degree greater than or equal to 0 and less than 0.25 corresponds to the first level; greater than or equal to 0.25 and less than 0.55 corresponds to the second level; greater than or equal to 0.55 and less than 0.80 corresponds to the third level; and greater than or equal to 0.80 and less than or equal to 1 corresponds to the fourth level. The four levels and 0.25, 0.55, and 0.80 are examples, and the number and boundaries of deviation levels can be set according to historical detection results or management strategies.

[0208] S602: Safety management control device 130 determines safety management strategy based on deviation level.

[0209] As an example of the correspondence, the security governance policies corresponding to the first level may include logging; the security governance policies corresponding to the second level may include delayed parsing or traffic auditing; the security governance policies corresponding to the third level may include access restrictions or function restrictions; and the security governance policies corresponding to the fourth level may include task suspension or alarm forensics. Each deviation level can correspond to a policy group, and each policy group can include one or more governance actions. In different business scenarios, the governance actions corresponding to each deviation level can be configured according to security risks and business continuity requirements.

[0210] S603: The relevant governance implementation entity implements the security governance strategy and forms the implementation results.

[0211] The security governance control device 130 can directly execute governance actions performed by itself, or it can control other execution entities to execute security governance policies based on the type of governance action. For example, access restrictions can be implemented by the network policy execution entity through network access control policies, function restrictions or task suspension can be implemented by the execution entity corresponding to the operating environment of the carrying intelligent agent, and log recording or traffic auditing can be performed by the corresponding security device. Multiple governance execution entities can be deployed separately or implemented by different functional modules in the same device.

[0212] The execution result can include at least one of the following: whether the governance action was successfully executed, the post-governance detection status, and whether the current behavior has been confirmed as trustworthy. For example, after the security governance policy is executed, the execution result can indicate that the access restrictions have taken effect, or it can indicate that the current behavior has been confirmed as a new normal business behavior after governance feedback.

[0213] In conclusion, Figure 6 The deviation level number, level boundary, specific actions of the security governance strategy, and the governance execution entity shown are all exemplary. Security governance processing is an optional process after anomaly detection, and steps S201 to S203 do not require the execution of the security governance strategy as a necessary condition for completing anomaly detection.

[0214] Furthermore, Figure 2 The intelligent agent anomaly detection method shown may also include step S205.

[0215] S205: The agent anomaly detection device 120 acquires the execution result and updates the baseline information when the current behavior meets the baseline update conditions.

[0216] In general, baseline updates allow confirmed normal changes to be gradually incorporated into historical comparisons. Baseline updates can be performed incrementally or in batches periodically. The following section will discuss this in conjunction with... Figure 7 This describes an implementation of baseline updates based on execution results.

[0217] See Figure 7 , Figure 7 This is a flowchart illustrating a baseline information update method provided in an embodiment of this application. Figure 7 The current behavior that will be added to the baseline information is recorded as the newly added trusted behavior, and the timing information of the execution of the newly added trusted behavior is recorded as the timing feature.

[0218] S701: The intelligent agent anomaly detection device 120 acquires the execution results of the security governance strategy.

[0219] The execution results can be provided by the security governance control device 130, the governance execution entity, or the management equipment. The execution results may include the identifier of the DNS behavior chain, the execution status of the governance action, the trusted status of the current behavior, or other information used to determine the baseline update conditions.

[0220] S702: The agent anomaly detection device 120 determines whether the current behavior meets the baseline update conditions.

[0221] Baseline update conditions may include the current behavior being determined to be a trusted behavior. For example, confirmation results provided by the management device may indicate that the current behavior belongs to a newly added normal business behavior; or, detection results from multiple consecutive subsequent behavior windows may indicate that the corresponding behavior occurs stably and meets preset judgment conditions. In the above cases, the agent anomaly detection device 120 can determine that the current behavior meets the preset update conditions. Behaviors that do not meet the preset judgment conditions may not be added to the baseline information.

[0222] S703: If the current behavior meets the baseline update conditions, the agent anomaly detection device 120 determines the current behavior as a new trusted behavior and determines the temporal characteristics corresponding to the new trusted behavior.

[0223] The agent anomaly detection device 120 can identify the current behavior represented by the DNS behavior chain as a newly added trusted behavior, and can identify at least one of the following as temporal features: the order of intent categories in the DNS behavior chain, the sequence position of each intent category, or the overall arrangement structure. Furthermore, the agent anomaly detection device 120 can also generate intent distribution, intent entropy, or trusted domain name records corresponding to the newly added trusted behavior.

[0224] S704: If the current behavior does not meet the baseline update conditions, the agent anomaly detection device 120 maintains the original baseline information.

[0225] The intelligent agent anomaly detection device 120 can continue to perform subsequent anomaly detection using the original baseline information, or it can wait for new execution results or confirmation results provided by the management device. This approach avoids unverified and untrusted behaviors directly entering the baseline information.

[0226] S705: The intelligent agent anomaly detection device 120 updates the baseline information based on newly added trusted behaviors and their temporal characteristics.

[0227] In the first possible implementation, the agent anomaly detection device 120 can directly add the newly added trusted behaviors and their temporal characteristics to the baseline information to form an incremental update.

[0228] In a second possible implementation, the agent anomaly detection device 120 can re-statistically analyze at least one of the following: baseline intent distribution, baseline intent entropy, or historical trusted domain name records, after the number of newly added trusted behaviors reaches a preset number or a preset update cycle. Furthermore, the agent anomaly detection device 120 can also re-perform partial or complete clustering processing based on the updated historical DNS behavior chains to form updated baseline information.

[0229] In conclusion, Figure 7 The baseline update conditions, trusted confirmation methods, update content, and update timing shown can be configured according to the business operation mode. Baseline updates are not... Figure 2 The necessary steps for anomaly detection are completed in the process. The intelligent agent anomaly detection device 120 can also continue to execute steps S201 to S203 while keeping the baseline information unchanged.

[0230] Steps S201 and S202 do not have a fixed order. For example, the agent anomaly detection device 120 can first construct the DNS behavior chain and then read the already formed baseline information; the agent anomaly detection device 120 can also first read the baseline information and then construct the DNS behavior chain; if processing resources allow, steps S201 and S202 can also be executed in parallel.

[0231] Understandable. Figures 3 to 7 The specific processing methods shown are for reference only. Figure 2 The implementation examples of the corresponding process steps in the example do not represent the actual implementation of the process. Figure 2 The corresponding steps in must be adopted Figures 3 to 7 This includes all processing steps, processing order, and specific parameters. In practical applications, as long as it can be achieved... Figure 2 The functions corresponding to the steps in the process can also be handled in other ways. Figures 3 to 7 When DNS behavior chains, baseline information, anomaly detection results, degree of trust deviation, deviation level, security governance policies, or execution results reappear in the context, it indicates a connection to... Figure 2 The corresponding data objects shown for the first time in the figure are the same. Similarly, when subsequent figures refer to behavior windows, intent categories, historical DNS behavior chains, target DNS behavior chains, sequence deviation, intent distribution deviation, abnormal domain frequency, newly added trusted behaviors, or time-series characteristics, the figure labels used when the corresponding data object first appeared will be retained. The above figure labels are used to improve the correspondence between different figures and readability, and do not limit the corresponding information to existing in the form of independent files, independent data structures, or independent storage objects.

[0232] In other implementations, Figures 2 to 7Some processing steps can be combined or broken down into more steps while maintaining processing dependencies. Different processing functions in the agent anomaly detection device 120 can be executed by the same computing device or by multiple communicating computing devices working together. As long as the corresponding DNS behavior chain construction, baseline acquisition, anomaly detection, security governance, or baseline update functions can be achieved, the embodiments of this application do not limit the specific software and hardware deployment form.

[0233] Furthermore, the intelligent agent anomaly detection system 100 can also employ different deployment methods to achieve corresponding detection and security management functions. The following section will combine... Figure 8 This paper provides an exemplary illustration of a deployment method for model training, local detection, trusted execution, and security governance.

[0234] See Figure 8 , Figure 8 This is a schematic diagram of a model deployment, trusted execution, and layered governance structure provided for an embodiment of this application. Figure 8 The structure shown can be applied to Figure 1 The agent anomaly detection system 100 shown can also be applied to other applicable agent anomaly detection systems. Figure 8 Mainly used for centralized explanation Figure 1 The content not elaborated in this document, such as offline training, local deployment, trusted execution environment, and governance execution layer, is not intended to imply that each functional entity must comply with... Figure 8 The order of operations is executed sequentially.

[0235] Figure 8 The deployment structure shown may include an offline model training platform 860. The offline model training platform 860 can train a mapping model based on historical DNS query records and establish a mapping relationship between domain name vectors and intent categories. As an implementation example, the offline model training platform 860 can also combine risky domain name information, historical trusted domain name records, or manual annotation results to train or adjust the mapping model. The trained mapping model and corresponding mapping relationships can be deployed to the customer's local environment for use by the intelligent agent anomaly detection device 120 during anomaly detection. The offline model training platform 860 can be set up outside the customer's local environment or within the customer's local environment.

[0236] Figure 8The client's local environment may include a DNS query acquisition device 110, an agent anomaly detection device 120, and a security governance control device 130. Baseline information can be stored in a memory within the client's local environment. The DNS query acquisition device 110 can obtain the DNS query records corresponding to the agent to be detected and provide these records to the agent anomaly detection device 120. The agent anomaly detection device 120 can construct a DNS behavior chain based on the DNS query records and read the baseline information for anomaly detection; if the baseline update conditions are met, the agent anomaly detection device 120 can also update the baseline information. The security governance control device 130 can determine or execute corresponding security governance strategies based on the anomaly detection results, degree of trust deviation, deviation level, or governance instructions provided by the agent anomaly detection device 120.

[0237] Furthermore, in one possible implementation, the processor implementing the agent anomaly detection device 120 can be configured with a trusted execution environment (TEE) 854. The trusted execution environment can be a protected execution region formed within the processor, isolated from the ordinary execution environment, primarily used to provide isolation protection for program instructions and processed data. The trusted execution environment itself does not act as the main entity performing the detection operations; the specific detection, calculation, or policy generation operations can be implemented by the processor running the corresponding program logic deployed within the trusted execution environment.

[0238] For example, at least one of the anomaly detection logic, trust deviation calculation logic, or policy generation logic in the intelligent agent anomaly detection device 120 can be deployed in a trusted execution environment. When the processor runs the corresponding program logic in the trusted execution environment, it can read the current DNS behavior chain, baseline information, or trust deviation, and perform corresponding detection or policy generation processing. By setting the above-mentioned program logic or processing data in the trusted execution environment, the possibility of other programs in the ordinary execution environment modifying or reading the detection logic or corresponding data can be reduced.

[0239] As another implementation example, the processor can first determine the degree of trust deviation outside the trusted execution environment, and then provide the degree of trust deviation to the policy generation logic deployed in the trusted execution environment. When the processor runs the policy generation logic in the trusted execution environment, it can determine governance instructions based on the degree of trust deviation and can sign the governance instructions. The security governance control device 130 can receive the governance instructions and, after completing the corresponding verification, execute the security governance policy or control the corresponding governance execution entity to execute the security governance policy. Here, the generation and signing of governance instructions are both implemented by the processor executing the corresponding program logic, while the trusted execution environment is used to provide a protected execution space for the corresponding program logic to run.

[0240] like Figure 8 As shown, the security governance control device 130 can also communicate with the DNS execution layer 851, the runtime execution layer 852, and the network policy execution layer 853, respectively. The security governance control device 130 can send security governance policies or governance instructions to the corresponding execution layer according to the type of governance action. The DNS execution layer 851 can perform DNS resolution control, the runtime execution layer 852 can perform agent operation state control, and the network policy execution layer 853 can perform network access policy control. For example, access restrictions can be executed by the network policy execution layer 853, while function restrictions or task suspension can be executed by the runtime execution layer 852. Each governance execution layer can be set in different devices or implemented by different functional modules within the same device.

[0241] It should be noted that the offline model training platform 860, the trusted execution environment, and each governance execution layer can all be implemented as optional components. Figure 8 The connection relationships in the code are mainly used to represent the data interaction, model deployment, or function call relationships between various functional entities, and do not limit the unique data flow or fixed execution order between the functional entities.

[0242] See Figure 9 , Figure 9 This is a schematic diagram of the structure of an intelligent agent anomaly detection device 120 provided in an embodiment of this application. Figure 9 Mainly from the perspective of functional modules Figure 1 The intelligent agent anomaly detection device 120 shown will be further described.

[0243] like Figure 9 As shown, the intelligent agent anomaly detection device 120 may include a construction module 910, an acquisition module 920, and a generation module 930. The construction module 910, the acquisition module 920, and the generation module 930 may be implemented through software functions, hardware circuits, or a combination of software and hardware.

[0244] Module 910 can be used to construct a DNS behavior chain based on the DNS query records of the agent to be detected. The DNS behavior chain can include multiple intent categories and the temporal relationships between these intent categories. For the specific implementation of behavior window formation, intent category determination, and intent category sorting by module 910, please refer to [link to documentation / reference]. Figure 3 The illustrated embodiment.

[0245] The acquisition module 920 can be used to acquire baseline information. Baseline information can be used to indicate multiple trusted behaviors formed by the agent under test based on DNS query behavior within a historical time period, as well as the temporal characteristics of the execution of these trusted behaviors. For the specific implementation of the acquisition module 920 in constructing historical DNS behavior chains, clustering processing, and forming baseline information, please refer to [link to documentation / reference]. Figure 4 The illustrated embodiment.

[0246] The generation module 930 can be used to generate anomaly detection results based on the comparison results of the DNS behavior chain and baseline information. The comparison results may include behavioral comparison results and time-series comparison results between the current DNS behavior chain and the baseline information. For the specific implementation of the generation module 930 in determining deviation representations, determining the degree of credible deviation, and generating anomaly detection results, please refer to [link to documentation]. Figure 5 The illustrated embodiment.

[0247] In one possible implementation, the intelligent agent anomaly detection device 120 may further include a governance module 940. The governance module 940 can be used to determine a security governance strategy based on the deviation level of the trust deviation, and to execute or control the corresponding implementing entity to execute the security governance strategy. For a detailed implementation of the governance module 940, please refer to [link to relevant documentation]. Figure 6 The illustrated embodiment. In another possible implementation, the agent anomaly detection device 120 may further include an update module 950. The update module 950 can be used to obtain the execution result and update the baseline information when the baseline update conditions are met. For a detailed implementation of the update module 950, please refer to... Figure 7 The illustrated embodiment.

[0248] It should be noted that, Figure 9 The module division shown is merely an illustrative example and does not constitute a limitation on the embodiments of this application. In other possible implementations, two or more modules can be integrated into one module, and a module can also be divided into multiple sub-modules according to the different functions it performs. The governance module 940 and the update module 950 are optional modules. In scenarios where only anomaly detection is implemented without performing subsequent governance or baseline updates, these modules may not be provided.

[0249] See Figure 10 , Figure 10 This is a schematic diagram of the structure of a computing device 1000 provided in an embodiment of this application. The computing device 1000 can be used to implement... Figure 1 and Figure 9 The intelligent agent anomaly detection device 120 can also be used to implement other computing functions in the intelligent agent anomaly detection system 100. The computing device 1000 can also be applied to the offline model training platform 860 or other computing functions related to the embodiments of this application, and there are no limitations on this.

[0250] like Figure 10 As shown, the computing device 1000 may include a processor 1010, a memory 1020, a communication interface 1030, and a bus 1040. The processor 1010, the memory 1020, and the communication interface 1030 can communicate via the bus 1040. Figure 10 The use of a single bus 1040 to illustrate the connection between components does not imply that the computing device 1000 includes only one bus or only one type of bus.

[0251] In one possible implementation, the bus 1040 may be a peripheral component interconnect (PCI) bus, an extended industry standard architecture (EISA) bus, or at least one of an address bus, a data bus, and a control bus. This application does not limit this implementation.

[0252] The processor 1010 can be a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), other programmable logic devices, or discrete device components. The processor 1010 may include one processing core or multiple processing cores.

[0253] The memory 1020 may include at least one of volatile memory and non-volatile memory. Non-volatile memory may include read-only memory (ROM), programmable read-only memory, flash memory, or solid-state memory. Volatile memory may include random access memory (RAM). The memory 1020 may be used to store program instructions, and may also be used to store at least one of the following: DNS query records, DNS behavior chains, baseline information, mapping model parameters, intent category mapping relationships, risky domain name records, and execution results.

[0254] The communication interface 1030 can interact with the DNS query acquisition device 110, the security management control device 130, the offline model training platform 860, or other computing devices. The communication interface 1030 can include a wired communication interface or a wireless communication interface. Baseline information can be stored in the memory 1020 or in a data storage device accessible to the computing device 1000 via the communication interface 1030. When the processor 1010 executes the program instructions stored in the memory 1020, it can cause the computing device 1000 to execute... Figures 2 to 7 The corresponding processing in the intelligent agent anomaly detection method shown.

[0255] In one possible implementation, the computing device 1000 can serve as a local secure computing device within a customer environment and can implement the construction module 910, acquisition module 920, and generation module 930 in the intelligent agent anomaly detection device 120.

[0256] In another possible implementation, the multiple functional modules in the agent anomaly detection device 120 can also be distributed and executed on multiple local computing devices. It is understood that... Figure 10 The computing device 1000 shown is only an example of a hardware structure. The embodiments of this application do not limit the specific device model, interface type or bus form of the computing device 1000.

[0257] This application also provides a computer-readable storage medium. The computer-readable storage medium stores program instructions, which, when executed by a processor, can implement the aforementioned intelligent agent anomaly detection method. The computer-readable storage medium may include a read-only memory, random access memory, magnetic disk, optical disk, flash memory, or other media capable of storing program instructions.

[0258] This application also provides a computer program product. The computer program product may include program instructions, which, when executed by a processor, can implement the aforementioned intelligent agent anomaly detection method.

[0259] In the embodiments of this application, "at least one" refers to one or more, and "multiple" refers to two or more. "And / or" is used to describe the association relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: only A exists, both A and B exist, or only B exists.

[0260] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can make equivalent modifications or substitutions to the above embodiments within the scope of the technology disclosed in this application, and such modifications or substitutions should all be covered within the scope of protection of this application.

Claims

1. A method for detecting anomalies in an intelligent agent, characterized in that, The method includes: A DNS behavior chain is constructed based on the DNS query records of the agent to be detected. The DNS behavior chain includes multiple intent categories and the temporal association between the multiple intent categories. The intent category is used to characterize the intent of the agent to perform the behavior corresponding to the queried domain name in the DNS query record. The temporal association is the order in which the multiple intent categories are performed by the agent in the process of performing the corresponding behavior. Obtain baseline information, which is used to indicate multiple trusted behaviors formed by the agent based on DNS query behavior within a historical time period, and the temporal characteristics of the execution of the multiple trusted behaviors; Based on the comparison results of the DNS behavior chain and the baseline information, an anomaly detection result of the agent is generated. The comparison result includes the behavior comparison result between the behaviors corresponding to the multiple intent categories in the DNS behavior chain and the multiple trusted behaviors, as well as the temporal comparison result between the temporal correlation and the temporal feature. The anomaly detection result is used to indicate whether the current behavior of the agent characterized by the DNS behavior chain deviates from the normal behavior indicated by the baseline information.

2. The method according to claim 1, characterized in that, The generation of anomaly detection results for the agent based on the comparison results of the DNS behavior chain and the baseline information includes: Based on the DNS behavior chain and the baseline information, at least one of the following is determined: sequence deviation degree, intent distribution deviation degree, and abnormal domain name frequency of the DNS behavior chain. The sequence deviation degree is used to characterize the degree of deviation of the order of the multiple intent categories relative to the temporal characteristics. The intent distribution deviation degree is used to characterize the degree of deviation of the distribution of intent categories in the DNS behavior chain relative to the distribution of intent categories corresponding to the multiple trusted behaviors. The abnormal domain name frequency is used to characterize the frequency of occurrence of abnormal domain names in the DNS query records. The degree of trustworthy deviation is determined based on at least one of the sequence deviation degree, the intention distribution deviation degree, and the abnormal domain name frequency. The degree of trustworthy deviation is used to characterize the degree of deviation of the current behavior corresponding to the DNS behavior chain relative to the plurality of trustworthy behaviors, and the degree of deviation of the temporal association corresponding to the current behavior relative to the temporal features corresponding to the plurality of trustworthy behaviors. The anomaly detection result is determined based on the degree of confidence deviation.

3. The method according to claim 2, characterized in that, The degree of sequence deviation is the sequence distance determined between the DNS behavior chain and at least one baseline DNS behavior chain. The sequence distance is determined by the order in which the agent performs the corresponding operation of the intent category, the sequence position of each intent category in the corresponding DNS behavior chain, and the differences in the overall arrangement structure. The at least one baseline DNS behavior chain is constructed based on the plurality of trusted behaviors and the temporal features corresponding to the plurality of trusted behaviors.

4. The method according to claim 2, characterized in that, The degree of deviation of the intent distribution is determined based on the intent distribution to be detected and the baseline intent distribution. The intent distribution to be detected is used to indicate the distribution of different intent categories in the DNS behavior chain, and the baseline intent distribution is used to indicate the distribution of different intent categories in the DNS behavior chain formed within the historical time period.

5. The method according to any one of claims 1 to 4, characterized in that, The DNS query record includes the query time and domain name. The DNS behavior chain constructed based on the DNS query records of the agent to be detected includes: Based on the query time, the DNS query records are divided into behavior windows to obtain multiple behavior windows, including the target window; Determine the intent category corresponding to the domain name of the query record within the target window; Based on the chronological order of the query times of the DNS query records within the target window, the intent categories are sorted to obtain the DNS behavior chain.

6. The method according to claim 5, characterized in that, The behavior window division of the DNS query records based on the query time in the DNS query records includes: Determine the query interval between adjacent DNS records based on the query time order; Based on the comparison between the query interval and the interval threshold, the DNS query records are divided into behavior windows, and the interval threshold is determined based on the statistical information of historical query intervals.

7. The method according to claim 5, characterized in that, The intent category includes the target intent category, and determining the intent category corresponding to the queried domain name within the target window includes: Based on the mapping model, the domain name vector corresponding to the queried domain name is determined. The mapping model is trained based on historical DNS query records. Based on the domain name vector query mapping relationship, the target intent category corresponding to the queried domain name is obtained, and the mapping relationship is the mapping relationship between the domain name vector and the target intent category.

8. The method according to claim 1, characterized in that, The acquisition of baseline information includes: Obtain the DNS query records generated by the intelligent agent within the historical time period; Multiple historical DNS behavior chains are constructed based on the DNS query records generated within the aforementioned historical time period; The baseline information is formed by identifying multiple trusted behaviors and the timing characteristics of the execution of these trusted behaviors from the behaviors represented by the multiple historical DNS behavior chains.

9. The method according to claim 8, characterized in that, The formation of the baseline information includes: Clustering is performed on the multiple historical DNS behavior chains to obtain clusters; The target DNS behavior chain is determined based on the cluster. The target DNS behavior chain is the historical DNS behavior chain in the cluster whose average sequence distance with other historical DNS behavior chains in the cluster is less than a target threshold. The sequence distance is used to characterize the differences between the two historical DNS behavior chains in terms of the order of intent categories, the sequence position of each intent category in the corresponding historical DNS behavior chain, and the overall arrangement structure. The baseline information is formed based on the target DNS behavior chain.

10. An intelligent agent anomaly detection device, characterized in that, The device includes: The construction module is used to construct a DNS behavior chain based on the DNS query records of the agent to be detected. The DNS behavior chain includes multiple intent categories and the temporal association between the multiple intent categories. The intent category is used to characterize the intent of the agent to perform the behavior corresponding to the queried domain name in the DNS query record. The temporal association is the order in which the multiple intent categories are performed by the agent in the process of performing the corresponding behavior. The acquisition module is used to acquire baseline information, which is used to indicate multiple trusted behaviors formed by the agent based on DNS query behavior within a historical time period, as well as the temporal characteristics of the execution of the multiple trusted behaviors. The generation module is used to generate anomaly detection results for the agent based on the comparison results of the DNS behavior chain and the baseline information. The comparison results include behavior comparison results between the behaviors corresponding to the multiple intent categories in the DNS behavior chain and the multiple trusted behaviors, as well as time-series comparison results between the time-series association and the time-series features. The anomaly detection results are used to indicate whether the current behavior of the agent characterized by the DNS behavior chain deviates from the normal behavior indicated by the baseline information.

11. An intelligent agent anomaly detection system, characterized in that, The intelligent agent anomaly detection system includes a DNS query acquisition device and an intelligent agent anomaly detection device. The DNS query collection device is used to collect the DNS query records of the intelligent agent to be detected; The intelligent agent anomaly detection device is used to perform the method as described in any one of claims 1 to 9.

12. A computing device, characterized in that, It includes a processor and a memory, the memory being used to store program instructions, and the processor being used to execute the program instructions to cause the computing device to perform the method as described in any one of claims 1 to 9.

Images