Behavior recognition method, device, equipment, storage medium and computer program product

Abstract

This application discloses a behavior recognition method, apparatus, device, storage medium, and computer program product, relating to the field of computer technology. The method includes: acquiring business behavior records of cloud services within a historical time period; labeling cloud interface call records with stage tags; constructing an interface call behavior chain based on the stage tags; and performing behavior recognition on a target account based on the interface call behavior chain to obtain the behavior recognition result of the target account. For cloud interface call records, stage tags are labeled according to the risk event stage to determine the corresponding risk stage of the interface call. The behavior chain formed by the stage tags represents the characteristics of the interfaces continuously called by the target account, thereby analyzing the risk situation of the target account based on the behavior chain and improving the accuracy of behavior recognition. This application can be applied to various scenarios such as cloud technology, map-based vehicle networking, and intelligent transportation, including trip sharing and parking space allocation.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a behavior recognition method, apparatus, device, storage medium, and computer program product. Background Technology

[0002] With the rapid development of cloud technology, more and more enterprises are choosing to deploy their businesses to the cloud. Operating cloud resources inevitably requires the use of cloud application programming interfaces (APIs). A cloud API is an interface that provides services from cloud providers, and users can use cloud services by calling cloud APIs.

[0003] Security protection of cloud APIs is an important part of cloud business applications. Among the related technologies, the scope of cloud API security detection mainly includes: detecting API calls from abnormal locations or anonymous proxies, disabling specified logging functions / instances, or abnormal startup of infrastructure, etc.

[0004] However, the security protection methods of the aforementioned cloud APIs only perform security detection in a limited single dimension, resulting in low detection accuracy and a low security level in the environment in which cloud services operate. Summary of the Invention

[0005] This application provides a behavior recognition method, apparatus, device, storage medium, and computer program product, which can improve the accuracy and utilization of evaluation results. The technical solution is as follows:

[0006] On the one hand, a behavior recognition method is provided, the method comprising:

[0007] Obtain the business behavior records of cloud services within a historical time period, including cloud interface call records of the cloud services;

[0008] The cloud interface call record is labeled with a stage tag, which is used to indicate the call stage type corresponding to the cloud interface call record;

[0009] Based on the stage tags, an interface call behavior chain corresponding to the target account is constructed. The interface call behavior chain includes a sequence of stage tags corresponding to the cloud interfaces called by the target account within the historical time period.

[0010] Based on the interface call behavior chain, the target account is identified to obtain the behavior identification result of the target account. The behavior identification result is used to indicate the risk level of the target account for the cloud service.

[0011] On the other hand, a behavior recognition device is provided, the device comprising:

[0012] The acquisition module is used to acquire the business behavior records of cloud services within a historical time period, including the cloud interface call records of the cloud services.

[0013] The annotation module is used to annotate the cloud interface call record with a stage label, wherein the stage label is used to indicate the call stage type corresponding to the cloud interface call record;

[0014] The construction module is used to construct an interface call behavior chain corresponding to the target account based on the stage tags. The interface call behavior chain includes a sequence of stage tags corresponding to the cloud interfaces called by the target account within the historical time period.

[0015] The identification module is used to identify the behavior of the target account based on the behavior chain called by the interface, and obtain the behavior identification result of the target account. The behavior identification result is used to indicate the risk level of the target account for the cloud service.

[0016] On the other hand, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one instruction, at least one program, code set or instruction set, the at least one instruction, the at least one program, the code set or instruction set being loaded and executed by the processor to implement the behavior recognition method as described in any of the embodiments of this application above.

[0017] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction, at least one program, code set, or instruction set is stored therein, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the behavior recognition method as described in any of the embodiments of this application above.

[0018] On the other hand, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the behavior recognition methods described in the above embodiments.

[0019] The beneficial effects of the technical solutions provided in this application include at least the following:

[0020] For cloud interface call records in business behavior records, stage tags are marked on the cloud interface call records according to the stage of the risk event, thereby determining the risk stage corresponding to the interface call. The behavior chain formed by the stage tags represents the characteristics of the interfaces continuously called by the target account. Based on the behavior chain, the risk status of the target account is analyzed, which improves the accuracy of behavior recognition. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the overall process of a behavior recognition method provided in an exemplary embodiment of this application;

[0023] Figure 2 This is a schematic diagram of an implementation environment provided by an exemplary embodiment of this application;

[0024] Figure 3 This is a flowchart of a behavior recognition method provided in an exemplary embodiment of this application;

[0025] Figure 4 This is a flowchart of a behavior recognition method provided in another exemplary embodiment of this application;

[0026] Figure 5 This is a flowchart of a behavior recognition method provided in another exemplary embodiment of this application;

[0027] Figure 6 This is a structural block diagram of a behavior recognition device provided in an exemplary embodiment of this application;

[0028] Figure 7 This is a structural block diagram of a behavior recognition device provided in another exemplary embodiment of this application;

[0029] Figure 8 This is a structural block diagram of a server provided in an exemplary embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0031] ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base of adversarial tactics and techniques. The ATT&CK knowledge base is community-driven and is open, free, and globally accessible.

[0032] In related technologies, the security detection scope of cloud APIs mainly includes: detecting API calls from abnormal locations or anonymous proxies, disabling specified logging functions / instances, or abnormal startup of infrastructure, etc. However, 1. Traditional anti-intrusion security is based on the host layer, building various detection strategies based on the host, while cloud-native security is based on the account layer. Host-layer strategies cannot cover account-layer scenarios and lack detection capabilities; 2. The essence of cloud API attacks is also the call to cloud API interfaces, which is consistent with normal business logic, making it difficult to distinguish whether the API call behavior is malicious or a normal business operation; 3. After business moves to the cloud, lightweight containers replace bulky servers, and the traditional Endpoint Detection and Response (EDR) system deployed on servers for monitoring will become unsuitable due to its excessive resource consumption.

[0033] To address the above problems, embodiments of this application provide a behavior recognition method. Figure 1 This is a schematic diagram of the overall process of a behavior recognition method provided in an exemplary embodiment of this application, as shown below. Figure 1 As shown, the process first obtains 100 records of all cloud service activities within a specified historical time period.

[0034] The ATT&CK framework is used to filter cloud API call records in business behavior records. Cloud API call records with low risk coefficients are filtered out, while cloud API call records with potential risks are screened out and tagged with Tactics, Techniques, and Procedures (TTP).

[0035] Optionally, the cloud API call records can be associated with a preset business feature library 110 to reduce the scale of the API call records to be analyzed. For example, cloud API call records corresponding to a specified intranet business IP do not need to be analyzed, cloud API call records corresponding to a specified business manager do not need to be analyzed, and cloud API call records corresponding to a specified platform sub-user do not need to be analyzed.

[0036] The cloud API call records that need to be analyzed are stored in database 120, and the cloud API call records (including TTP tags) of the same user within a specified historical time period are aggregated by user account to obtain user interface behavior call table 130, which includes the interface call behavior chain corresponding to the user account.

[0037] By performing quantitative analysis on user interface behavior call table 130, we can comprehensively determine whether a user account has any possible behavior and whether the user account is a risky account.

[0038] If the user account is determined to be a risky account, an alert will be issued regarding the cloud API attack.

[0039] Figure 2 This is a schematic diagram of an implementation environment provided by an exemplary embodiment of this application, such as... Figure 2 As shown, the implementation environment includes a terminal 210 and a cloud service 220, which are connected via a communication network 230.

[0040] Terminal 210 runs a platform that supports cloud services. In this embodiment, the user interface behavior call table generated in cloud service 220 is retrieved by terminal 210, and the user behavior risk is analyzed based on the user interface behavior call table.

[0041] Optionally, the cloud service 220 stores business behavior records corresponding to cloud services. The cloud service 220 obtains the business behavior records, filters and labels the API interface call records in the business behavior records with TTP tags, thereby generating a user interface behavior call table. The user interface behavior call table or the data in the user interface behavior call table corresponding to the target account is transmitted to the terminal 210, which analyzes the target account to obtain the behavior identification result of the target account and indicates the risk level of the target account for cloud services.

[0042] It is worth noting that in the above embodiments, the risk identification of the target account by the terminal 210 offline is used as an example for illustration. In some embodiments, the cloud service 220 can also identify the risk of the target account online. This embodiment does not limit this.

[0043] The aforementioned terminal can be a variety of terminal devices such as mobile phones, tablets, desktop computers, portable laptops, smart voice interaction devices, smart home appliances, and vehicle terminals; the cloud service 220 can also send business behavior records to the terminal 210 in real time, and the terminal 210 can annotate the business behavior records with TTP tags and generate user interface behavior call tables. This application embodiment does not limit this.

[0044] It is worth noting that the aforementioned cloud services refer to cloud servers used to provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0045] Cloud technology refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. Based on the cloud computing business model, cloud technology encompasses network technology, information technology, integration technology, management platform technology, and application technology. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to backend systems for logical processing. Data at different levels will be processed separately, and various industry data will require robust system support, which can only be achieved through cloud computing.

[0046] In some embodiments, the server described above can also be implemented as a node in a blockchain system. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include a blockchain underlying platform, a platform product service layer, and an application service layer.

[0047] The behavior recognition method provided in this application will be described in light of the above application scenarios and implementation environments. Figure 3 This is a flowchart of an exemplary embodiment of the behavior recognition method provided in this application. The method is illustrated using an example of its application in a computer device. Figure 3 As shown, the method includes:

[0048] Step 301: Obtain the business behavior records of the cloud service within the historical time period. The business behavior records include the cloud service's cloud interface call records.

[0049] In some embodiments, cloud services are services that run on cloud servers, such as cloud financial products, cloud auditing products, cloud gaming products, etc.

[0050] In some embodiments, the behavior recognition process is performed periodically; or, the behavior recognition process is performed based on behavior recognition instructions; or, the behavior recognition process is performed in real time. The triggering method for behavior recognition is described below:

[0051] First, conduct behavior recognition periodically. That is, perform behavior recognition on the business behavior records within the most recent period at preset intervals.

[0052] For example, if behavior recognition is performed once a day, then at a designated time each day, the business behavior records generated in the previous 24 hours will be retrieved.

[0053] Second, behavior recognition is performed based on behavior recognition instructions. That is, when a behavior recognition instruction is received, business behavior records within a historical time period are retrieved.

[0054] Optionally, the historical time period is indicated in the behavior recognition instruction. That is, when the user triggers the behavior recognition instruction, the historical time period for which business behavior records need to be obtained is configured, so that after the behavior recognition instruction is triggered, business behavior records can be obtained based on the historical time period indicated by the behavior recognition instruction.

[0055] Alternatively, the historical time period can be the default time period corresponding to the behavior recognition instruction, such as: the historical time period is the time period with a preset duration before the behavior recognition instruction is received.

[0056] Third, real-time behavior recognition is performed. That is, whenever the computer device receives a business behavior record, it stores the record and integrates the stored records for behavior recognition. Optionally, when a business behavior record corresponding to a target account is received, the stored business behavior records for that target account within the historical time period are retrieved.

[0057] Since users need to call cloud interfaces to use cloud services, the business behavior record includes cloud interface call records for cloud services. Optionally, the cloud interface call record includes the cloud interface name, interface call method, caller source Internet Protocol (IP), cloud interface parameters, etc.

[0058] Optionally, the business behavior record may also include the event time (i.e., the time when the business event corresponding to the business behavior record occurred); business information, such as: device owner, region, corresponding IP, etc.; cloud account information, such as: account identifier, account owner, etc.

[0059] Step 302: Label the cloud interface call records with stage tags.

[0060] The stage label is used to indicate the call stage type corresponding to the cloud interface call record.

[0061] Optionally, cloud interface call records that meet the risk prediction requirements are selected from business behavior records based on the risk event stage. The cloud interface call records that meet the risk prediction requirements are labeled with stage tags. The risk event stage is the tactical stage of the risk event that has been pre-divided. The stage tag is used to indicate the tactical stage type to which the cloud interface call record belongs.

[0062] In some embodiments, the business behavior records obtained above are full data sets, including some records with a low probability of risk. Therefore, the full data set of business behavior records is first filtered according to risk prediction requirements to obtain cloud interface call records that meet the risk prediction requirements. These cloud interface call records that meet the risk prediction requirements are considered to have high risk. In some embodiments, cloud interface call records that meet the risk prediction requirements are filtered from the business behavior records based on the risk event stage. For example, suspicious high-risk cloud API interface call records are filtered based on the ATT&CK framework feature model, and stage tags (such as TTP tags) are added.

[0063] Optionally, first determine the purpose of the interface call corresponding to the cloud interface call record. The purpose of the interface call is used to indicate the purpose of calling the cloud interface in the cloud interface call record. Match the purpose of the interface call with the stage of the risk event to obtain the stage label corresponding to the cloud interface call record.

[0064] The risk event phase is a pre-defined phase within the ATT&CK framework.

[0065] To illustrate, let's take cloud auditing as an example to explain how to filter and tag suspicious high-risk cloud API call records based on the ATT&CK framework feature model. First, for all data reported by the cloud auditing business, the corresponding cloud APIs of each cloud auditing product are tagged according to the multiple tactical phases defined by ATT&CK, establishing a tagging system based on the cloud API within the ATT&CK framework. Since the same cloud API can correspond to different ATT&CK framework tactical phases, cloud APIs that share common tags across multiple tactical phases are additionally tagged as high-risk cloud APIs. Then, the tagging system removes cloud API calls that do not belong to any ATT&CK framework tactical phase and simultaneously adds a tag field to record the tactical phase type to which the cloud API belongs.

[0066] In other words, firstly, high-risk cloud API interfaces are identified based on the ATT&CK framework. The ATT&CK framework is a framework generated based on the attack stages corresponding to the attack behavior. The framework includes the process that needs to be executed at each stage of the attack (corresponding to the purpose of calling the interface in this embodiment). That is, after determining the risky interface call purpose in the ATT&CK framework, stage tags can be marked on the cloud interface call records where the interface call purpose matches the risk event stage in the ATT&CK framework.

[0067] As an illustration, the ATT&CK framework includes an initial access phase, which provides the entry point for accessing cloud service resources. For example, when obtaining the access address of the Virtual Network Console (VNC), if the cloud API corresponding to the cloud interface call record is DescribeInstanceVncUrl, it is determined that the cloud API matches the risk event phase in ATT&CK, and the phase is labeled "Initial Access Phase".

[0068] Optionally, the risk event phase in the ATT&CK framework includes at least one of the following phases:

[0069] First, the initial access phase, the purpose of the interface calls in the initial access phase includes accessing cloud resources in cloud services;

[0070] In other words, it provides an entry point for accessing cloud resources, such as obtaining the VNC access address.

[0071] Second, the execution phase. The purpose of the interface calls in the execution phase includes penetrating data into cloud services and indicating the instructions that need to be executed in cloud services.

[0072] Users can gain access to data through commands and control, and instruct malware on the next steps it needs to take. For example, they can create custom script interfaces; a corresponding cloud API example is CreateUserCmd.

[0073] Third, the persistence phase. The purpose of the interface calls in the persistence phase includes maintaining the persistence of the connection state with the cloud service.

[0074] In other words, even after maintenance personnel take measures such as restarting or changing credentials, operations during the persistence phase can still allow the computer to be reinfected with viruses or maintain existing connections of attack accounts. For example, creating a backdoor image interface; the corresponding cloud API example is CreateImage.

[0075] Fourth, the privilege escalation phase, the purpose of which is to adjust the permissions of accounts in cloud services;

[0076] This means obtaining administrator-level management permissions for the main account, such as adding an administrator permission policy interface, with the corresponding cloud API example being UpdatePolicy.

[0077] Fifth, the credential access phase. The purpose of the interface calls corresponding to the credential access phase includes obtaining the key credentials of the cloud server or container cluster corresponding to the cloud service.

[0078] In other words, this stage is used to obtain the key credentials of the cloud server or container cluster, which are then used in the penetration testing phase. For example, obtaining the cluster's kubeconfig file; the corresponding cloud API example is: DescribeClusterKubeconfig.

[0079] Sixth, the information collection phase. The purpose of the interface calls in the information collection phase includes acquiring target data for cloud services. The target data is data related to the target attack methods.

[0080] In other words, these are the techniques attackers employ to discover and collect the data needed to achieve their goals. For example, obtaining asset information about cloud servers or container clusters; relevant cloud API examples include DescribeInstances and DescribeClusterInstances.

[0081] Seventh, the lateral movement phase. The purpose of the interface calls in the lateral movement phase includes lateral search in cloud services based on the basic landing point to improve access permissions.

[0082] In other words, attackers typically first find a foothold in cloud services, then use that foothold as a starting point to move through various systems, seeking better access permissions, and ultimately controlling the overall network. For example, they might use a peering connection to establish access to the internal network; a relevant cloud API example is CreateVpcPeeringConnection.

[0083] Eighth, the data leakage stage. The purpose of the interface calls in the data leakage stage includes obtaining sensitive data of cloud services.

[0084] In other words, once an attacker gains access, they will search for relevant data, such as trade secrets or sensitive information. For example, they might read COS (Object Storage) data, with a corresponding cloud API example: GetObjectACL.

[0085] Step 303: Construct an interface call behavior chain corresponding to the target account based on the stage label.

[0086] The API call behavior chain includes the sequence of stage tags corresponding to the target account's calls to cloud APIs within a historical time period.

[0087] Optionally, obtain the cloud interface call records marked with stage tags corresponding to the cloud interfaces called by the target account within a historical time period, and obtain the interface call behavior chain based on the marked stage tags of the cloud interface call records. The interface call behavior chain is the behavior chain obtained by arranging the marked stage tags in order.

[0088] As an illustration, the interface call chain corresponding to user A includes "Collect Information - DescribeInstances, Persistence - ResetInstancesPassword, Initial Access - DescribeInstanceVncUrl". Here, Collect Information, Persistence, and Initial Access are stage labels. DescribeInstances is the name of the cloud API interface called in the Collect Information stage, ResetInstancesPassword is the name of the cloud API interface called in the Persistence stage, and DescribeInstanceVncUrl is the name of the cloud API interface called in the Initial Access stage.

[0089] Step 304: Based on the interface call behavior chain, perform behavior recognition on the target account to obtain the behavior recognition result of the target account.

[0090] Behavioral recognition results are used to indicate the level of risk a target account poses to cloud services.

[0091] Optionally, risk analysis is performed on the target account based on the interface call behavior chain to obtain the risk value corresponding to the target account, and the behavior recognition result corresponding to the target account is determined based on the risk value.

[0092] As an illustration, when the risk value reaches the risk threshold, the target account is identified as a risk account.

[0093] Alternatively, if the risk value is less than the first risk threshold, the target account is identified as a safe account; if the risk value reaches the first risk threshold but not the second risk threshold, the target account is identified as a suspicious account; if the risk value reaches the second risk threshold, the target account is identified as a risky account.

[0094] In summary, the behavior recognition method provided in this application identifies cloud interface call records in business behavior records by labeling the cloud interface call records with stage tags according to the risk event stage, thereby determining the risk stage corresponding to the interface call. The behavior chain formed by the stage tags represents the characteristics of the interfaces continuously called by the target account, thereby analyzing the risk status of the target account based on the behavior chain and improving the accuracy of behavior recognition.

[0095] In an optional embodiment, the interface call behavior chain is implemented through clustering in the database. Figure 4This is a flowchart of a behavior recognition method provided in another exemplary embodiment of this application, which is illustrated by taking the application of the method to a computer device as an example. Figure 4 As shown, the method includes:

[0096] Step 401: Obtain the business behavior records of the cloud service within the historical time period. The business behavior records include the cloud service's cloud interface call records.

[0097] In some embodiments, cloud services are services that run on cloud servers, such as cloud financial products, cloud auditing products, cloud gaming products, etc.

[0098] In some embodiments, the behavior recognition process is performed periodically; or, the behavior recognition process is performed based on behavior recognition instructions; or, the behavior recognition process is performed in real time.

[0099] Step 402: Label the cloud interface call records with stage tags.

[0100] The stage label is used to indicate the call stage type corresponding to the cloud interface call record.

[0101] Optionally, cloud interface call records that meet the risk prediction requirements are selected from business behavior records based on the risk event stage. The cloud interface call records that meet the risk prediction requirements are labeled with stage tags. The risk event stage is the tactical stage of the risk event that has been pre-divided. The stage tag is used to indicate the tactical stage type to which the cloud interface call record belongs.

[0102] Step 403: Import the correspondence between business behavior records and stage tags into the first database as data items.

[0103] The business activity records also include the accounts that executed the business activities.

[0104] Optionally, before importing business behavior records and stage tags into the first database, the data size of the business behavior records is first pruned. In some embodiments, a preset business feature library is associated, and the data volume of business behavior records and corresponding stage tags is suppressed based on the business feature library. For example, the business feature library includes a whitelist, and the portion of the business behavior record that matches the whitelist is deleted according to the whitelist. Optionally, the whitelist includes an IP whitelist, an account whitelist, a platform whitelist, etc. For example, the IP whitelist includes internal network business IPs; when the business IP corresponding to a business behavior record matches an internal network business IP in the IP whitelist, the business behavior record is determined to be a safe operation; the account whitelist includes the business manager's account; when the account corresponding to a business behavior record matches the manager's account in the account whitelist, the business behavior record is determined to be a safe operation; the platform whitelist includes platform sub-user accounts; when the account corresponding to a business behavior record matches a platform sub-user account in the platform whitelist, the business behavior record is determined to be a safe operation.

[0105] Business behavior records that do not match the business feature library, along with their corresponding stage tags, are imported into the first database. In other words, cloud APIs selected through the ATT&CK framework feature model will be tagged with corresponding TTP type tags and filtered using the known business feature library.

[0106] It is worth noting that the above-mentioned business feature library is only an illustrative example. In some embodiments, the above-mentioned business feature library may also include other whitelists or behavioral features. Optionally, during the strategy operation of the behavior recognition method, the business feature library can be continuously updated, such as: based on the false alarm results in the behavior recognition results, summarizing the feature whitelist of false alarm results and adding it to the business feature library.

[0107] Optionally, when importing business behavior records and stage tags into the first database, the business behavior record and stage tag corresponding to each business event are imported into the first database as a single data item. The table format of the first database is illustrated in Table 1 below:

[0108] Table 1

[0109] Account ID Cloud API Interface Name TTP label Event Time ... User A DescribeInstances Information gathering 2021-4-1 10:00 ... User B GetObjectACL Data leakage 2021-4-1 10:30 ... User A ResetInstancesPassword persistence 2021-4-1 11:00 ... User B GetObjectACL Data leakage 2021-4-1 11:30 ... User A DescribeInstanceVncUrl Initial visit 2021-4-1 12:00 ...

[0110] For example, the first row of data indicates that user A called the DescribeInstances interface at 10:00 on April 1, 2021, and the corresponding stage label (TTP label) for this interface is the information collection stage.

[0111] Step 404: Using the account as the cluster center, cluster the data items in the first database, import them into the second database, and obtain the interface call behavior chain corresponding to the target account.

[0112] Optionally, data items corresponding to the same account in the first database are merged into the same row in the second database. The cloud interface call records in the business behavior records and the stage tags corresponding to the cloud interface call records are merged into the behavior chain cell. The content of the behavior chain cell corresponding to the target account in the second database is obtained as the interface call behavior chain corresponding to the target account.

[0113] Optionally, the interface name of the cloud interface called in the business behavior record and the corresponding stage label are merged into the behavior chain cell.

[0114] As an illustration, based on the data items shown in Table 1, the clustering results in a second database in tabular form, as shown in Table 2 below:

[0115] Table 2

[0116]

[0117] For example, taking user A, the first line of data indicates that between 10:00 and 12:00 on April 1, 2021, the corresponding API call chain for user A includes "Collect Information - DescribeInstances, Persistence - ResetInstancesPassword, Initial Access - DescribeInstanceVncUrl". Here, "Collect Information", "Persistence", and "Initial Access" are stage labels. "DescribeInstances" is the name of the cloud API interface called in the "Collect Information" stage, "ResetInstancesPassword" is the name of the cloud API interface called in the "Persistence" stage, and "DescribeInstanceVncUrl" is the name of the cloud API interface called in the "Initial Access" stage.

[0118] Optionally, the tables in the second database are obtained by adding behavior chain cells and event time period cells to the tables in the first database.

[0119] Step 405: Based on the interface call behavior chain, perform behavior recognition on the target account to obtain the behavior recognition result of the target account.

[0120] Behavioral recognition results are used to indicate the level of risk a target account poses to cloud services.

[0121] Optionally, risk analysis is performed on the target account based on the interface call behavior chain to obtain the risk value corresponding to the target account, and the behavior recognition result corresponding to the target account is determined based on the risk value.

[0122] In summary, the behavior recognition method provided in this application identifies cloud interface call records in business behavior records by labeling the cloud interface call records with stage tags according to the risk event stage, thereby determining the risk stage corresponding to the interface call. The behavior chain formed by the stage tags represents the characteristics of the interfaces continuously called by the target account, thereby analyzing the risk status of the target account based on the behavior chain and improving the accuracy of behavior recognition.

[0123] The method provided in this embodiment first imports business behavior records into a first database for organization. Then, based on the first database, the interface call behaviors corresponding to each account are clustered and integrated using the account as the cluster center, and imported into a second database. The second database intuitively reflects the interface call behavior chain corresponding to each account, thereby obtaining the account risk identification result based on the interface call behavior chain, which improves the accuracy and efficiency of risk identification.

[0124] In an optional embodiment, when identifying the behavior of a target account based on the interface call behavior chain, a risk value is determined based on the matching between the interface call behavior chain and the preset attack chain model, as well as the identification results of other dimensions, thereby determining the behavior identification results shared to the target account.

[0125] Figure 5 This is a flowchart of a behavior recognition method provided in another exemplary embodiment of this application, taking the application of this method in a computer device as an example, such as... Figure 5 As shown, the method includes:

[0126] Step 501: Obtain the business behavior records of the cloud service within the historical time period. The business behavior records include the cloud service's cloud interface call records.

[0127] In some embodiments, the behavior recognition process is performed periodically; or, the behavior recognition process is performed based on behavior recognition instructions; or, the behavior recognition process is performed in real time.

[0128] Step 502: Label the cloud interface call records with stage tags.

[0129] The stage label is used to indicate the call stage type corresponding to the cloud interface call record.

[0130] Optionally, cloud interface call records that meet the risk prediction requirements are selected from business behavior records based on the risk event stage. The cloud interface call records that meet the risk prediction requirements are labeled with stage tags. The risk event stage is the tactical stage of the risk event that has been pre-divided. The stage tag is used to indicate the tactical stage type to which the cloud interface call record belongs.

[0131] Step 503: Construct an interface call behavior chain corresponding to the target account based on the stage label.

[0132] The API call behavior chain includes the sequence of stage tags corresponding to the target account's calls to cloud APIs within a historical time period.

[0133] Optionally, obtain the cloud interface call records marked with stage tags corresponding to the cloud interfaces called by the target account within a historical time period, and obtain the interface call behavior chain based on the marked stage tags of the cloud interface call records. The interface call behavior chain is the behavior chain obtained by arranging the marked stage tags.

[0134] In some embodiments, the risk value corresponding to the target account is first reset to zero, and then a new risk value is assigned based on subsequent quantitative analysis. The quantitative analysis includes at least one of the following: (1) attack chain analysis; (2) high-risk TTP type analysis; (3) data traversal analysis; and (4) platform call analysis. The quantitative analysis methods described above are explained in detail below:

[0135] (1) Attack Link Analysis

[0136] Step 504: Obtain the pre-built attack chain model.

[0137] The attack chain model includes a stage label structure corresponding to the attack chain.

[0138] Optionally, at least one attack chain model is pre-constructed based on cloud-native security risk analysis. In the stage label structure of the attack chain model, each stage label corresponds to a weight value. In some embodiments, the cloud API interfaces corresponding to the attack chain model are assigned weight values ​​from low to high in sequence, meaning the weight values ​​of the cloud API interfaces are positively correlated with their order.

[0139] As an illustration, one of the pre-constructed attack chain models is: L1 (query the old instance's external IP address) → L2 (reset password) → L3 (Secure Shell login), where the weight value of L1 is 0.2, the weight value of L2 is 0.3, and the weight value of L3 is 0.5.

[0140] Step 505: Match the interface call behavior chain with the attack chain model.

[0141] In other words, the API call behavior chain corresponding to the target account is matched with each attack chain model. Optionally, the stage labels in the API call behavior chain are matched with the stage labels in the stage label structure to obtain the target weight corresponding to the attack chain model. When the target weight reaches the weight threshold, it is determined that the API call behavior chain matches the attack chain. For example, taking the above attack chain model L1→L2→L3 as an illustration, in Table 2, the cloud API interfaces DescribeInstances and ResetInstancesPassword in the API call behavior chain corresponding to user A satisfy L1 and L2 respectively. Therefore, the corresponding weight value is 0.2 + 0.3 = 0.5, and the weight threshold is 0.4. That is, the weight value corresponding to the API call behavior chain and the attack chain model exceeds the weight threshold, and the API call behavior chain matches the attack chain model.

[0142] Step 506: In response to the API call behavior chain matching at least one attack chain model, adjust the risk value corresponding to the target account.

[0143] In some embodiments, in response to an interface call behavior chain matching at least one attack chain model, the risk value corresponding to the target account is increased by the corresponding value.

[0144] Optionally, regardless of whether the API call behavior chain matches a single or multiple attack chain models, the target account gains the same risk value; or, the number of attack chain models that match the API call behavior chain is positively correlated with the increase in risk value.

[0145] As an illustration, if the API call behavior chain matches at least one attack chain model, the risk value of the target account increases by 1.

[0146] (2) Analysis of High-Risk TTP Types

[0147] Step 507: Obtain the pre-defined set of high-risk tags.

[0148] The high-risk label set includes stage labels that meet the risk criteria.

[0149] In some embodiments, the priority of TTP tag types is preset, such as: TTP tags corresponding to privilege escalation phase, execution phase, etc. are high-risk tags.

[0150] Step 508: In response to the fact that the interface call behavior chain includes a stage tag that matches the high-risk tag set, adjust the risk value corresponding to the target account.

[0151] Optionally, when the API call behavior chain includes stage tags that are the same as the high-risk tag set, the risk value of the target account is increased accordingly; or, when the number of high-risk tags included in the API call behavior chain reaches a certain threshold, the risk value of the target account is increased accordingly.

[0152] In some embodiments, when the API call behavior chain includes stage tags that are the same as those in the high-risk tag set, the same risk value is added to the target account regardless of the number of high-level tags; or, the risk value of the target account is increased proportionally according to the number of stage tags in the API call behavior chain that match those in the high-risk tag set; or, according to the correspondence between the number of risk values, the corresponding risk value is increased according to the number of stage tags in the API call behavior chain that match those in the high-risk tag set.

[0153] (3) Data traversal analysis

[0154] Step 509: In response to the fact that the interface call behavior chain includes a specified stage label and the number of times the specified stage label appears reaches the threshold, obtain the interface parameters corresponding to the interface call behavior chain.

[0155] Optionally, the cloud API call log includes API parameters.

[0156] Optionally, data traversal analysis refers to the need to determine whether there is a risk of data traversal when an account calls cloud interfaces, since attackers usually traverse the data of cloud services when attacked.

[0157] Step 510: In response to the interface parameters meeting the difference conditions, adjust the risk value corresponding to the target account.

[0158] As an illustration, if the TTP tag indicates that a cloud API call is a record in the information collection or data leakage stage, and a large number of identical API calls with inconsistent parameters occur within a short period, it is considered to meet the data traversal characteristics. In this case, the risk value of the target account will increase accordingly. For example, the risk value of the target account will increase by 1.

[0159] (4) Platform analysis call

[0160] Step 511: In response to the cloud interface call record corresponding to the target account indicating that the calling platform meets the risk platform conditions, adjust the risk value corresponding to the target account.

[0161] The main platforms for calling cloud API interfaces include: API Explorer, command-line tools, and Software Development Kits (SDKs). API Explorer is a web-based platform for calling cloud API interfaces, command-line tools are terminal-based platforms, and SDKs are used by various programming languages. Cloud services primarily use SDKs to call business cloud API interfaces; therefore, API Explorer and command-line tools, being console-based cloud API call methods, carry a higher risk. Based on baseline data from daily cloud API calls using these two platforms, if cloud API behavior chains using API Explorer or command-line tools are recorded and do not conform to the baseline data, the risk value of the target account will be increased accordingly.

[0162] Step 512: In response to the risk value reaching the risk threshold, the target account is identified as a risk account.

[0163] In some embodiments, a threshold method is used to comprehensively determine whether a target account is a risky account. That is, when the risk value of a target account reaches a threshold (i.e., the aforementioned risk threshold), the target account is determined to be a risky account. In some embodiments, if at least one risk condition of the target account exists in the above quantitative analysis method, the target account is determined to be a risky account.

[0164] Step 513: Send an alarm message to the preset alarm account.

[0165] Optionally, the alert information is used to alert users of the risks associated with the target account.

[0166] Optionally, alarm information (also known as work orders) can be sent via mobile or web terminals. The alarm information is sent to the main account administrator, sub-account, or security interface person. Optionally, the work order information includes, but is not limited to: (1) the time of the event; (2) business information, such as the person in charge, the region, and the corresponding business; (3) the reason for the alarm and a specific explanation, such as: the alarm logic in the above quantitative analysis was hit; (4) the cloud API interface call executed; (5) the interface parameters of the cloud API interface; (6) if the attack chain is hit, the hit attack chain is included.

[0167] Optionally, if the work order is confirmed as an intrusion, an emergency response procedure will be initiated. If the work order is a normal false alarm, the administrator or user can choose to add the corresponding command to the business feature database to improve the accuracy of subsequent detection.

[0168] In summary, the behavior recognition method provided in this application identifies cloud interface call records in business behavior records by labeling the cloud interface call records with stage tags according to the risk event stage, thereby determining the risk stage corresponding to the interface call. The behavior chain formed by the stage tags represents the characteristics of the interfaces continuously called by the target account, thereby analyzing the risk status of the target account based on the behavior chain and improving the accuracy of behavior recognition.

[0169] The method provided in this embodiment analyzes the interface call behavior chain and cloud interface call records through various quantitative analysis methods, and analyzes the interface call behavior of the target account from multiple dimensions, thereby improving the accuracy and efficiency of behavioral analysis of the target account.

[0170] Figure 6 This is a structural block diagram of a behavior recognition device provided in an exemplary embodiment of this application, such as... Figure 6 As shown, the device includes:

[0171] The acquisition module 610 is used to acquire the business behavior records of the cloud service within a historical time period, and the business behavior records include the cloud interface call records of the cloud service.

[0172] The annotation module 620 is used to annotate the cloud interface call record with a stage label, wherein the stage label is used to indicate the call stage type corresponding to the cloud interface call record;

[0173] Module 630 is used to construct an interface call behavior chain corresponding to the target account based on the stage tags, wherein the interface call behavior chain includes a sequence of stage tags corresponding to the cloud interfaces called by the target account within the historical time period;

[0174] The identification module 640 is used to identify the behavior of the target account based on the behavior chain called by the interface, and obtain the behavior identification result of the target account. The behavior identification result is used to indicate the risk level of the target account for the cloud service.

[0175] In an optional embodiment, such as Figure 7 As shown, the annotation module 620 includes:

[0176] The filtering unit 621 is used to filter cloud interface call records that meet the risk prediction requirements from the business behavior records based on the risk event stage; and to mark the cloud interface call records that meet the risk prediction requirements with the stage label, wherein the risk event stage is a tactical stage of a pre-divided risk event, and the stage label is used to indicate the tactical stage type to which the cloud interface call record belongs.

[0177] In an optional embodiment, the annotation module 620 further includes:

[0178] The determining unit 622 is used to determine the interface call purpose corresponding to the cloud interface call record, wherein the interface call purpose is used to indicate the purpose of calling the cloud interface in the cloud interface call record;

[0179] The matching unit 623 is used to match the purpose of the interface call with the stage of the risk event to obtain the stage tag corresponding to the cloud interface call record.

[0180] In an optional embodiment, the risk event phase includes at least one of the following phases:

[0181] The initial access phase, the purpose of the interface call corresponding to the initial access phase, includes accessing cloud resources in the cloud service;

[0182] During the execution phase, the purpose of the interface calls corresponding to the execution phase includes injecting data into the cloud service and indicating the instructions that need to be executed in the cloud service;

[0183] The persistence phase, the purpose of the interface call corresponding to the persistence phase includes maintaining the persistence of the connection state with the cloud service;

[0184] During the privilege escalation phase, the purpose of the corresponding interface call includes adjusting the permissions of the account in the cloud service;

[0185] In the credential access phase, the purpose of the interface call corresponding to the credential access phase includes obtaining the key credentials of the cloud server or container cluster corresponding to the cloud service.

[0186] The purpose of the interface call in the information collection phase includes acquiring target data of the cloud service, wherein the target data is data related to the target attack method.

[0187] The purpose of the interface call during the lateral movement phase includes lateral search within the cloud service based on the basic landing point to improve access permissions.

[0188] During the data leakage phase, the purpose of the corresponding interface calls includes obtaining sensitive data of the cloud service.

[0189] In an optional embodiment, the construction module 630 is further configured to import the correspondence between the business behavior record and the stage tag as a data item into a first database, wherein the business behavior record also includes the execution account of the business behavior; and cluster the data items in the first database with the account as the cluster center, import them into a second database, and obtain the interface call behavior chain corresponding to the target account.

[0190] In an optional embodiment, the construction module 630 is further configured to merge data items corresponding to the same account in the first database into the same row in the second database, wherein the cloud interface call record in the business behavior record and the stage tag corresponding to the cloud interface call record are merged into the behavior chain cell; and to obtain the content in the behavior chain cell corresponding to the target account in the second database as the interface call behavior chain corresponding to the target account.

[0191] In an optional embodiment, the identification module 640 is further configured to perform risk analysis on the target account based on the interface call behavior chain to obtain the risk value corresponding to the target account; and determine the behavior identification result corresponding to the target account based on the risk value.

[0192] In an optional embodiment, the acquisition module 610 is further configured to acquire a pre-built attack chain model, wherein the attack chain model includes a stage label structure corresponding to the attack chain;

[0193] The identification module 640 is further configured to match the interface call behavior chain with the attack chain model; and adjust the risk value corresponding to the target account in response to the interface call behavior chain matching at least one attack chain model.

[0194] In an optional embodiment, in the stage label structure of the attack chain model, each stage label corresponds to a weight value.

[0195] The identification module 640 is further configured to match the stage labels in the interface call behavior chain with the stage labels in the stage label structure to obtain the target weight corresponding to the attack chain model; in response to the target weight reaching the weight threshold, it is determined that the interface call behavior chain matches the attack chain model, and the risk value corresponding to the target account is adjusted.

[0196] In an optional embodiment, the acquisition module 610 is further configured to acquire a pre-set set of high-risk tags, the set of high-risk tags including stage tags that meet the risk conditions;

[0197] The identification module 640 is further configured to adjust the risk value corresponding to the target account in response to a stage tag in the interface call behavior chain that matches the high-risk tag set.

[0198] In an optional embodiment, the cloud interface call record includes interface parameters;

[0199] The identification module 640 is further configured to, in response to the interface call behavior chain including a specified stage label and the occurrence frequency of the specified stage label reaching a frequency threshold, obtain the interface parameters corresponding to the interface call behavior chain; and in response to the interface parameters meeting the difference conditions, adjust the risk value corresponding to the target account.

[0200] In an optional embodiment, the business behavior record may further include the calling platform corresponding to the cloud interface call record;

[0201] The identification module 640 is also used to adjust the risk value corresponding to the target account in response to the cloud interface call record corresponding to the target account indicating that the calling platform meets the risk platform conditions.

[0202] In an optional embodiment, the identification module 640 is further configured to determine the target account as a risk account in response to the risk value reaching a risk threshold;

[0203] The device further includes:

[0204] The sending module 650 is used to send alarm messages to preset alarm accounts, and the alarm messages are used to alert the target account to the risks.

[0205] In summary, the behavior recognition device provided in this application identifies the cloud interface call records in the business behavior records by labeling the cloud interface call records with stage tags according to the risk event stage, thereby determining the risk stage corresponding to the interface call. The behavior chain formed by the stage tags represents the characteristics of the interfaces continuously called by the target account, thereby analyzing the risk status of the target account based on the behavior chain and improving the accuracy of behavior recognition.

[0206] It should be noted that the behavior recognition device provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the behavior recognition device and the behavior recognition method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0207] Figure 8A schematic diagram of the structure of a server provided in an exemplary embodiment of this application is shown.

[0208] Specifically, server 800 includes a central processing unit (CPU) 801, a system memory 804 including random access memory (RAM) 802 and read-only memory (ROM) 803, and a system bus 805 connecting system memory 804 and CPU 801. Server 800 also includes a mass storage device 806 for storing operating system 813, application programs 814, and other program modules 815.

[0209] Mass storage device 806 is connected to central processing unit 801 via a mass storage controller (not shown) connected to system bus 805. Mass storage device 806 and its associated computer-readable media provide non-volatile storage for server 800. That is, mass storage device 806 may include computer-readable media (not shown) such as hard disk or compact disc read-only memory (CD-ROM) drives.

[0210] Without loss of generality, computer-readable media can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include RAM, ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other solid-state storage technologies, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that computer storage media are not limited to the above-mentioned types. The system memory 804 and mass storage device 806 described above can be collectively referred to as memory.

[0211] According to various embodiments of this application, server 800 can also be connected to a remote computer on a network, such as the Internet. That is, server 800 can be connected to network 812 via network interface unit 811 connected to system bus 805, or it can use network interface unit 811 to connect to other types of networks or remote computer systems (not shown).

[0212] The aforementioned memory also includes one or more programs, which are stored in the memory and configured to be executed by the CPU.

[0213] Embodiments of this application also provide a computer device, which includes a processor and a memory. The memory stores at least one instruction, at least one program, code set, or instruction set. The at least one instruction, at least one program, code set, or instruction set is loaded and executed by the processor to implement the behavior recognition method provided in the above-described method embodiments.

[0214] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the behavior recognition method provided in the above-described method embodiments.

[0215] Embodiments of this application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the behavior recognition methods described in the above embodiments.

[0216] Optionally, the computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), solid-state drives (SSDs), or optical discs, etc. The random access memory may include resistive random access memory (ReRAM) and dynamic random access memory (DRAM). The sequence numbers of the embodiments in this application are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0217] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0218] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A behavior recognition method, characterized in that, The method includes: Obtain the business behavior records of cloud services within a historical time period, including cloud interface call records of the cloud services; The cloud interface call record is labeled with a stage tag, which is used to indicate the call stage type corresponding to the cloud interface call record; Based on the stage tags, an interface call behavior chain corresponding to the target account is constructed. The interface call behavior chain includes a sequence of stage tags corresponding to the cloud interfaces called by the target account within the historical time period. Based on the interface call behavior chain, the target account is identified to obtain the behavior identification result of the target account. The behavior identification result is used to indicate the risk level of the target account for the cloud service.

2. The method according to claim 1, characterized in that, The step-by-step tagging of the cloud interface call record includes: Based on the risk event stage, cloud interface call records that meet the risk prediction requirements are selected from the business behavior records. The cloud interface call records that meet the risk prediction requirements are labeled with the stage tag. The risk event stage is a tactical stage of the risk event that has been pre-divided. The stage tag is used to indicate the tactical stage type to which the cloud interface call record belongs.

3. The method according to claim 2, characterized in that, The step-labeling of cloud interface call records that meet the risk prediction requirements includes: Determine the purpose of the interface call corresponding to the cloud interface call record, wherein the purpose of the interface call is used to indicate the purpose of calling the cloud interface in the cloud interface call record; The purpose of the interface call is matched with the stage of the risk event to obtain the stage tag corresponding to the cloud interface call record.

4. The method according to claim 3, characterized in that, The risk event phase includes at least one of the following phases: The initial access phase, the purpose of the interface call corresponding to the initial access phase, includes accessing cloud resources in the cloud service; During the execution phase, the purpose of the interface calls corresponding to the execution phase includes injecting data into the cloud service and indicating the instructions that need to be executed in the cloud service; The persistence phase, the purpose of the interface call corresponding to the persistence phase includes maintaining the persistence of the connection state with the cloud service; During the privilege escalation phase, the purpose of the corresponding interface call includes adjusting the permissions of the account in the cloud service; In the credential access phase, the purpose of the interface call corresponding to the credential access phase includes obtaining the key credentials of the cloud server or container cluster corresponding to the cloud service. The purpose of the interface call in the information collection phase includes acquiring target data of the cloud service, wherein the target data is data related to the target attack method. The purpose of the interface call during the lateral movement phase includes lateral search within the cloud service based on the basic landing point to improve access permissions. During the data leakage phase, the purpose of the corresponding interface calls includes obtaining sensitive data of the cloud service.

5. The method according to any one of claims 1 to 4, characterized in that, The construction of the interface call behavior chain corresponding to the target account based on the stage tag includes: The correspondence between the business behavior records and the stage tags is imported into the first database as a data item. The business behavior records also include the execution account of the business behavior. Using the account as the cluster center, the data items in the first database are clustered and imported into the second database to obtain the interface call behavior chain corresponding to the target account.

6. The method according to claim 5, characterized in that, The step of clustering data items in the first database using the account as the cluster center to obtain the interface call behavior chain corresponding to the target account includes: In the first database, data items corresponding to the same account are merged into the same row in the second database. In the business behavior record, the cloud interface call record and the stage tag corresponding to the cloud interface call record are merged into the behavior chain cell. Retrieve the content of the behavior chain cell corresponding to the target account in the second database, and use it as the interface call behavior chain corresponding to the target account.

7. The method according to any one of claims 1 to 4, characterized in that, The step of performing behavior identification on the target account based on the interface call behavior chain to obtain the behavior identification result of the target account includes: Based on the interface call behavior chain, risk analysis is performed on the target account to obtain the risk value corresponding to the target account; The behavioral identification result corresponding to the target account is determined based on the risk value.

8. The method according to claim 7, characterized in that, The risk analysis of the target account based on the interface call behavior chain to obtain the risk value corresponding to the target account includes: Obtain a pre-constructed attack chain model, which includes a stage label structure corresponding to the attack chain; Match the interface call behavior chain with the attack chain model; In response to the interface call behavior chain matching at least one attack chain model, the risk value corresponding to the target account is adjusted.

9. The method according to claim 8, characterized in that, In the stage label structure of the attack chain model, each stage label corresponds to a weight value. The step of responding to the interface call behavior chain matching at least one attack chain model and adjusting the risk value corresponding to the target account includes: Match the stage labels in the interface call behavior chain with the stage labels in the stage label structure to obtain the target weight corresponding to the attack chain model; In response to the target weight reaching the weight threshold, it is determined that the interface call behavior chain matches the attack chain model, and the risk value corresponding to the target account is adjusted.

10. The method according to claim 7, characterized in that, The risk analysis of the target account based on the interface call behavior chain to obtain the risk value corresponding to the target account includes: Obtain a pre-defined set of high-risk tags, which includes stage tags that meet the risk criteria; In response to the inclusion of a stage tag matching the high-risk tag set in the interface call behavior chain, the risk value corresponding to the target account is adjusted.

11. The method according to claim 7, characterized in that, The cloud interface call record includes interface parameters; The risk analysis of the target account based on the interface call behavior chain to obtain the risk value corresponding to the target account includes: In response to the fact that the interface call behavior chain includes a specified stage label and the number of occurrences of the specified stage label reaches a threshold, the interface parameters corresponding to the interface call behavior chain are obtained. In response to the interface parameters meeting the difference conditions, the risk value corresponding to the target account is adjusted.

12. The method according to claim 7, characterized in that, The business behavior record also includes the calling platform corresponding to the cloud interface call record; The method further includes: If the cloud interface call record corresponding to the target account indicates that the calling platform meets the risk platform conditions, the risk value corresponding to the target account will be adjusted.

13. The method according to claim 7, characterized in that, The step of determining the behavioral identification result corresponding to the target account based on the risk value includes: In response to the risk value reaching the risk threshold, the target account is determined to be a risky account; An alarm message is sent to a preset alarm account. The alarm message is used to alert the target account of any risks.

14. A behavior recognition device, characterized in that, The device includes: The acquisition module is used to acquire the business behavior records of cloud services within a historical time period, including the cloud interface call records of the cloud services. The annotation module is used to annotate the cloud interface call record with a stage label, wherein the stage label is used to indicate the call stage type corresponding to the cloud interface call record; The construction module is used to construct an interface call behavior chain corresponding to the target account based on the stage tags. The interface call behavior chain includes a sequence of stage tags corresponding to the cloud interfaces called by the target account within the historical time period. The identification module is used to identify the behavior of the target account based on the behavior chain called by the interface, and obtain the behavior identification result of the target account. The behavior identification result is used to indicate the risk level of the target account for the cloud service.

15. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, a code set, or an instruction set, the at least one instruction, the at least one program, the code set, or the instruction set being loaded and executed by the processor to implement the behavior recognition method as described in any one of claims 1 to 13.

16. A computer-readable storage medium, characterized in that, The storage medium stores at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or instruction set is loaded and executed by a processor to implement the behavior recognition method as described in any one of claims 1 to 13.

17. A computer program product, characterized in that, It includes a computer program or instructions that, when executed by a processor, implement the behavior recognition method as described in any one of claims 1 to 13.

Images