Method and apparatus for detecting attack behavior, device, and storage medium

Abstract

Embodiments of the present disclosure provide a method and apparatus for detecting an attack behavior, a device, and a storage medium. The method comprises: acquiring attack behavior data and non-attack behavior data, wherein the attack behavior data is collected from at least one honeypot host, and the non-attack behavior data is collected from at least one user host; on the basis of keywords in the non-attack behavior data and keywords in the attack behavior data, selecting keywords from the attack behavior data to generate at least one attack behavior detection rule, wherein each attack behavior detection rule comprises at least one keyword used for representing an attack behavior; and on the basis of the at least one attack behavior detection rule, performing attack behavior detection on a target user host. In this way, automatic and efficient detection of unknown attack behaviors can be realized, improving the detection capability and the detection accuracy for attack behaviors.

Description

Method, device, equipment and storage medium for attack behavior detection

[0001] This application claims priority to the Chinese invention patent application entitled “Method, apparatus, device and storage medium for attack behavior detection” and application number 202310900309.5 filed on July 20, 2023. The entire contents of that application are incorporated by reference into this application. Technical Field

[0002] Example embodiments of the present disclosure generally relate to the field of network security, and more particularly, to methods, apparatuses, devices, and computer-readable storage media for attack behavior detection. Background Art

[0003] Honeypots, such as Secure Shell (SSH) high-interaction honeypots, are network security tools used to trap intruders (e.g., hackers) for attacks. Honeypots can simulate a real server or computer using the SSH protocol for remote login, attracting intruders to attempt to log in and perform operations, thereby collecting and recording data such as the intruder's behavioral activities (e.g., including the operation commands executed by the intruder). When using behavioral data collected by honeypots, manual analysis of the intruder's attack methods is usually required, and different security policies rely on expert knowledge, resulting in low efficiency in defending against intrusions. Therefore, a solution is desired that can detect intrusions in a timely and accurate manner.

[0004] Summary of the Invention

[0005] In a first aspect of the present disclosure, a method for attack behavior detection is provided, comprising: acquiring attack behavior data and non-attack behavior data, the attack behavior data being collected from at least one honeypot host, and the non-attack behavior data being collected from at least one user host; filtering keywords from the attack behavior data based on keywords in the non-attack behavior data and keywords in the attack behavior data to generate at least one attack behavior detection rule, wherein each attack behavior detection rule includes at least one keyword for characterizing the attack behavior; and performing attack behavior detection on the target user host based on the at least one attack behavior detection rule.

[0006] In a second aspect of the present disclosure, a device for attack behavior detection is provided, comprising: a data acquisition module configured to acquire attack behavior data and non-attack behavior data, the attack behavior data being collected from at least one honeypot host, and the non-attack behavior data being collected from at least one user host; a rule generation module configured to filter keywords from the attack behavior data based on keywords in the non-attack behavior data and keywords in the attack behavior data to generate at least one attack behavior detection rule, wherein each attack behavior detection rule includes at least one keyword for characterizing the attack behavior; and a behavior detection module configured to perform attack behavior detection on the target user host based on the at least one attack behavior detection rule.

[0007] In a third aspect of the present disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit. When executed by the at least one processing unit, the instructions cause the device to perform the method of the first aspect.

[0008] In a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and the computer program can be executed by a processor to implement the method of the first aspect.

[0009] It should be understood that the content described in this summary section is not intended to limit the key features or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0011] FIG1 shows a schematic diagram of an example network environment in which embodiments of the present disclosure can be implemented;

[0012] FIG2 shows a schematic structural diagram of an attack behavior detection system according to some embodiments of the present disclosure;

[0013] FIG3 shows a schematic diagram of an initialization subsystem processing non-attack behavior data according to some embodiments of the present disclosure;

[0014] FIG4 shows a schematic diagram of an instruction aggregation module generating a user instruction sequence set according to some embodiments of the present disclosure;

[0015] FIG5 is a schematic diagram showing a keyword extraction module processing a user instruction sequence set according to some embodiments of the present disclosure;

[0016] FIG6 shows a schematic diagram of an attack behavior determination subsystem according to some embodiments of the present disclosure;

[0017] FIG7 is a schematic diagram showing a keyword extraction module processing a honeypot instruction sequence set according to some embodiments of the present disclosure;

[0018] FIG8 shows a schematic diagram of compressing and merging a keyword set by a keyword clustering compression module according to some embodiments of the present disclosure;

[0019] FIG9 shows a schematic diagram of a process for generating detection rules according to some embodiments of the present disclosure;

[0020] FIG10 shows a schematic diagram of a process for publishing and adjusting detection rules according to some embodiments of the present disclosure;

[0021] FIG11 shows a flow chart of a method for attack behavior detection according to some embodiments of the present disclosure;

[0022] FIG12 shows a schematic structural block diagram of an apparatus for attack behavior detection according to some embodiments of the present disclosure;

[0023] FIG13 illustrates a block diagram of an electronic device in which one or more embodiments of the present disclosure may be implemented. DETAILED DESCRIPTION

[0024] It is understandable that before using the technical solutions disclosed in the various embodiments of this disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved in this disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0025] For example, in response to a user's active request, a prompt message is sent to the user to clearly inform the user that the operation requested will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the electronic device, application, server, storage medium, or other software or hardware that performs the operations of the disclosed technical solution based on the prompt message.

[0026] As an optional but non-limiting implementation, in response to receiving a user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. Furthermore, the pop-up window may also contain a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0027] It is understandable that the above notification and user authorization process are merely illustrative and do not limit the implementation of the present disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0028] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) must comply with the requirements of relevant laws, regulations and relevant provisions.

[0029] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0030] It should be noted that the titles of any section / subsection provided herein are not limiting. Various embodiments are described throughout this document, and any type of embodiment may be included under any section / subsection. Furthermore, the embodiments described in any section / subsection may be combined in any manner with any other embodiments described in the same section / subsection and / or in different sections / subsections.

[0031] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may be included below. The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may be included below.

[0032] In the field of network security, attack behavior data collected by honeypots (or honeypot hosts) can be used in at least the following ways:

[0033] Contribute intelligence: Collect indicators of compromise (IOCs), such as file hashes, C2 domain names, IP addresses, and file names, for use as threat intelligence.

[0034] Collect malicious samples: Collect malicious samples dropped by intruders, such as Trojans, mining machines, and backdoors.

[0035] Describe intrusion trends: Use honeypot data to perceive possible attack behaviors and trends in cyberspace.

[0036] Collect attack methods: The collected attack methods of intruders help the security team better understand the intruders' strategies and methods, and then take corresponding security measures and strengthen network security defense.

[0037] These honeypot behavior data utilization schemes all require manual intervention to analyze the intruder's attack methods and then rely on expert knowledge to design different security strategies. However, for honeypots, especially SSH high-interaction honeypots, the operational behaviors collected by SSH high-interaction honeypots are mainly shell commands executed by intruders. These are often complex and do not have a unified format, making it difficult to standardize and automate the collected operational behaviors.

[0038] A host-based intrusion detection system (HIDS) collects a variety of data, including system operations and user behavior, and performs intrusion detection based on pre-configured detection rules. Detection rules can generally employ a blacklist approach, alerting on data that matches exactly, or a pattern matching approach, alerting on behavior that matches a certain characteristic pattern. Complex detection logic can also be designed to achieve a high detection rate and a low false alarm rate. HIDS detection rules for malicious commands are primarily manually developed by security professionals based on different intrusion methods or behaviors, enabling them to match and detect the corresponding Shell instructions or Shell instruction sequences for each intrusion behavior.

[0039] Because shell commands differ from IOCs in their complexity and diversity, and their parameters and formats offer significant flexibility, intruders can carefully craft them to bypass current detection schemes, such as Network Intrusion Detection Systems (NIDS) and Industrial Intrusion Detection Systems (IIDS). Furthermore, pattern-matching detection schemes that haven't been rigorously designed and tested are prone to generating numerous false positives.

[0040] Therefore, it is expected to provide an improved solution to realize attack behavior detection.

[0041] In the embodiments of this disclosure, an improved solution for attack behavior detection is proposed. This solution automatically generates and identifies attack behavior patterns from attack behavior data from honeypots, using non-attack behavior data collected from user hosts (which can represent non-attack behavior) and generates corresponding detection rules for subsequent attack behavior detection. This can improve the efficiency of attack behavior identification, the detection capability, and the accuracy of attack behavior detection.

[0042] In some embodiments, the deployed honeypot host will continuously collect attack behavior data. Through the above process, more unknown or new attack behaviors can be updated and identified in a timely and automatic manner, greatly improving network security.

[0043] FIG1 shows a schematic diagram of an example network environment 100 in which embodiments of the present disclosure can be implemented. In this example network environment 100, a honeypot network 102 is deployed to trap intruder attacks. For example, due to the attraction of the honeypot network 102, a hacker 112 may use a hacker host 110 to access the honeypot network 102. In this way, attack behavior data can be collected on the honeypot network 102. In addition, a HIDS 104 is also deployed in the network environment 100 to collect non-attack behavior data generated during normal user operations. In embodiments of the present disclosure, attack behavior data and non-attack behavior data will be used to generate attack behavior detection rules suitable for performing attack behavior detection. The generated attack behavior detection rules can be used by user hosts on HIDS 104 or HIDS 106 to detect attack behavior.

[0044] In the example network environment 100, the honeypot network 102 may include one or more honeypot hosts 120-1, 120-2, ..., 120-N (collectively referred to as honeypot hosts 120 for ease of discussion), the HIDS 104 may include one or more user hosts 130-1, 130-2, ..., 130-M (collectively referred to as user hosts 130 for ease of discussion), and the HIDS 106 may include one or more target user hosts 140-1, 140-2, ..., 140-K (collectively referred to as target user hosts 140 for ease of discussion). In FIG1 , N, M, and K may be any value. In some embodiments, the HIDS 106 and the HIDS 104 may be in the same system or may be separate systems.

[0045] The host 110, honeypot host 120, user host 130, and target user host 140 can be servers or any type of device with computing capabilities, including terminal devices. The terminal device can be any type of mobile terminal, fixed terminal, or portable terminal, including a mobile phone, desktop computer, laptop computer, notebook computer, netbook computer, tablet computer, media computer, multimedia tablet, personal communication system (PCS) device, personal navigation device, personal digital assistant (PDA), audio / video player, digital camera / camcorder, positioning device, television receiver, radio broadcast receiver, e-book device, gaming device, or any combination thereof, including accessories and peripherals of these devices, or any combination thereof.

[0046] It should be understood that the structure and functionality of environment 100 are described for exemplary purposes only and do not imply any limitation on the scope of the present disclosure.

[0047] Some example embodiments of the present disclosure are described below with reference to the accompanying drawings. Figure 2 shows a schematic diagram of an attack behavior detection system 200 according to some embodiments of the present disclosure. For ease of discussion, the attack behavior detection system 200 will be described with reference to the environment 100 of Figure 1 .

[0048] As shown in Figure 2, the process of generating rules for attack behavior detection can be divided into two stages. In the first stage, non-attack behavior data 205 is obtained from HIDS 104, where non-attack behavior data 205 can be collected from at least one user host in HIDS 104. Non-attack behavior data 205 from HIDS 104 is input into initialization subsystem 220 for use as baseline behavior data. In the second stage, attack behavior data 210-1, 210-2, ..., 210-J (collectively referred to as attack behavior data 210) is obtained, where attack behavior data can be collected from at least one honeypot host. Attack behavior data 210 from honeypot network 102 is provided to attack behavior determination subsystem 230 for generating attack behavior detection rules. Different attack behavior data 210-1, 210-2, ..., 210-J can include data collected from honeypot network 102 at different time periods.

[0049] Based on the non-offensive behavior data 205, the offensive behavior determination subsystem 230 can determine at least one offensive behavior detection rule from the offensive behavior data 210, where each offensive behavior detection rule can correspond to a type of offensive behavior. In some embodiments, based on the input offensive behavior data 210 and the output of the initialization subsystem 220, the offensive behavior determination subsystem 230 can output an offensive behavior detection rule. Specifically, the offensive behavior determination subsystem 230 filters keywords from the offensive behavior data 210 based on keywords in the non-offensive behavior data 205 and keywords in the offensive behavior data 210 to generate at least one offensive behavior detection rule, where each offensive behavior detection rule includes at least one keyword that characterizes offensive behavior. Here, the non-offensive behavior data 205 is considered to characterize normal, non-offensive behavior and can therefore be used as benchmark data. When identifying offensive behavior detection rules, using the non-offensive behavior data 205 as a benchmark, keywords that can be distinguished from non-offensive behavior data and that characterize offensive behavior can be identified from the offensive behavior data 210.

[0050] The determined attack behavior detection rule is provided to the behavior detection subsystem 240 for performing attack behavior detection on the target user host 140. The behavior detection subsystem 240 performs attack behavior detection on the target user host 140 based on at least one attack behavior detection rule.

[0051] Attack behavior data 210 may include instruction sequences (e.g., shell instruction sequences) collected by one or more honeypot hosts 120 in the honeypot network 102, and may also be referred to as honeypot behavior data. Because it is collected on the honeypot hosts, attack behavior data 210 represents data that may contain abnormal behavior, such as data generated by malicious behavior by a malicious user (e.g., hacker 112). Table 1 below shows an example of attack behavior data 210.

[0052] Table 1. Example attack behavior data

[0053] The non-attack behavior data 205 may represent an instruction sequence (e.g., a Shell instruction sequence) collected by one or more user hosts 130 in the HIDS 104, and may also be referred to as normal behavior data, which represents data generated by normal user behavior, such as data generated by normal behavior (non-malicious behavior) of a normal user (non-malicious user).

[0054] In the first phase, non-attack behavior data 205 from HIDS 104 is input to initialization subsystem 220, which performs data pre-processing and statistics for use by attack behavior determination subsystem 230. The first phase of initialization subsystem 220 is described below with reference to FIG3 to FIG5.

[0055] 3 shows the structure of the initialization subsystem 220 and the processing of the exemplary non-offensive behavior data 205 according to some embodiments of the present disclosure. As shown in FIG3 , the initialization subsystem 220 includes an instruction aggregation module 320 and a keyword extraction module 330 .

[0056] The non-attack behavior data 205 includes user command sequences collected from at least one user host 130 of the HIDS 104. In some embodiments, multiple user command sequence sets can be collected separately in multiple sessions on at least one user host, for example, each session corresponds to a user command sequence set. In some embodiments, the user command sequence may include Shell instructions or other instructions. As shown in Figure 3, the example non-attack behavior data 315 includes host ID: 1, session ID: 100, Shell instruction: "ls"; host ID: 1, session ID: 100, Shell instruction: "pwd"; host ID: 2, session ID: 200, Shell instruction: "history". Behavior data with consistent host IDs (also called host identifiers) can indicate that the behavior data is generated by the same user host, and behavior data with consistent session IDs (also called session identifiers) can indicate that the behavior data is generated by the same session.

[0057] The instruction aggregation module 320 is configured to perform an aggregation operation on the non-offensive behavior data 205. For example, the user instruction sequences in the non-offensive behavior data 205 can be aggregated according to the host identifier (ID) and session ID to obtain user instruction sequence sets 325 (in this example, shell instruction sequence sets) grouped by host ID and session ID. The user instruction sequences in each user instruction sequence set have the same host ID and session ID, indicating that the user instructions in a user instruction sequence set all come from the same host and the same group of sessions. The example user instruction sequence set shown in FIG3 includes user instruction sequence set 1: {"ls", "pwd", ...}. The shell instructions "ls" and "pwd" in the set all come from the same host and the same group of sessions (in this example, the host ID is 1 and the session ID is 100). The remaining user instruction sequence sets are similar.

[0058] Figure 4 illustrates an example of the process by which instruction aggregation module 320 aggregates example non-offensive behavior data 205. In the example of Figure 4 , the example non-offensive behavior data 205 in the data stream includes instruction sequences 410, 425, 420, and 425 from various sessions on various user hosts, respectively including: host ID: 1, session ID: 100, shell instruction: "ls"; host ID: 2, session ID: 112, shell instruction: "rm.test.sh"; host ID: 3, session ID: 1321, shell instruction: "history"; and host ID: 1, session ID: 100, shell instruction: "pwd." Inputting example non-offensive behavior data 205 into instruction aggregation module 320 yields multiple sets of user instruction sequences, each of which contains instructions from the same user host and the same session. For example, in the example of Figure 4, user instruction sequence set 1430 includes the instructions "ls" and "pwd" from the host ID 1 and the session ID 100; the user instruction sequence set 2435 includes the instruction "rm.test.sh" from the host ID 2 and the session ID 112; the user instruction sequence set 3440 includes the instruction "history-c" from the host ID 3 and the session ID 1321, and so on.

[0059] In some embodiments, each user instruction sequence set can be considered a behavior description document, and multiple behavior description documents corresponding to all non-offensive behavior data 205 can be obtained. In some embodiments, the behavior description documents corresponding to the non-offensive behavior data 205 (i.e., user instruction sequence sets 430, 435, 440, etc.) are input into the keyword extraction module 330. Figure 5 shows an example structure of the keyword extraction module 330 and the processing of an example user instruction sequence set according to some embodiments of the present disclosure. As shown in Figure 5, the keyword extraction module 330 may include a word segmentation module 510 and a word frequency statistics module 530.

[0060] The word segmentation module 510 can be configured to perform word segmentation (e.g., English word segmentation) on multiple users in the non-offensive behavior data 205. Word segmentation refers to the division of a text sequence into individual words or phrases. As shown in Figure 5, the instructions "ls" and "pwd" included in the user instruction sequence set 1430 are segmented by the word segmentation module 510 to obtain the character strings 515 "ls" and "pwd"; the instruction "rm.test.sh" included in the user instruction sequence set 2435 is segmented by the word segmentation module 510 to obtain the character strings 520 "rm", "test", and "sh"; and the instruction "history-c" included in the user instruction sequence set 3440 is segmented by the word segmentation module 510 to obtain the character strings 525 "history" and "-c". After the word segmentation process, the resulting character strings can also be cleaned, for example, by removing all IP addresses and pure numbers (i.e., consisting entirely of numbers) to prevent irrelevant content from interfering with subsequent keyword extraction. Since in some cases, keywords such as file names may be a combination of English and numbers, the combination of English and numbers can be retained during the cleaning process to avoid incorrect cleaning. After word segmentation or cleaning, a benchmark keyword set including multiple benchmark keywords (e.g., character strings) can be obtained.

[0061] The word frequency statistics module 530 is configured to perform statistics on the benchmark keywords. Specifically, the word frequency statistics module 530 can count the total number of behavior description documents (i.e., user instruction sequence sets) and the number of behavior description documents containing each benchmark keyword. In the example shown in Figure 5, the total number of behavior description documents 535 is, for example, 18,888, the number of behavior description documents containing "ls" 540 is 3,200, the number of behavior description documents containing "pwd" 545 is 1,800, and the number of behavior description documents containing "rm" 550 is 2,800.

[0062] Note that the specific instruction sequences and statistical information thereof shown in FIG. 3 to FIG. 5 are merely examples given for illustrative purposes and do not imply any limitation on the scope of the embodiments of the present disclosure.

[0063] The above steps complete the initialization of the keyword extraction module in the first phase. The keyword extraction module then constructs a baseline keyword set, counts the number of user command sequences in the non-offensive behavior data 205, and counts the number of user command sequences containing each baseline keyword. The statistical information obtained from the non-offensive behavior data 205 can be used to subsequently screen for representative keywords in the offensive behavior data 210.

[0064] In the second phase, the attack behavior data 210 collected from the honeypot network 102 can be converted into rules for attack behavior detection. Next, the process of executing the second phase will be described with reference to FIG6 to FIG8.

[0065] Figure 6 illustrates an example structure of the attack behavior determination subsystem 230 and a schematic diagram of processing example attack behavior data 210, according to some embodiments of the present disclosure. The attack behavior determination subsystem 230 can convert the attack behavior data 210 into attack behavior detection rules 655 for attack behavior detection. As shown in Figure 6, the attack behavior determination subsystem 230 includes an instruction aggregation module 620, a keyword extraction module 630, a keyword clustering and compression module 640, a detection rule generation module 650, and a detection rule publishing and adjustment module 660.

[0066] To facilitate subsequent discussion, it is assumed that the attack behavior data 210 includes host ID: 1, session ID: 365, shell instruction: "chattr-iae / root / .ssh"; host ID: 2, session ID: 365, shell instruction: ". / meow meow.Selfrep.arm5", and so on.

[0067] The instruction aggregation module 620 is configured to aggregate the attack behavior data 210 according to the host ID and session ID to obtain a honeypot instruction sequence set grouped by host ID and session ID (e.g., honeypot instruction sequence set 625). The instruction aggregation module 620 here has the same function as the instruction aggregation module 320 used in the first stage. In the example of Figure 6, the aggregation operation results in honeypot instruction sequence set 1: {". / meowmeow.Selfrep.arm5", Shell instruction 2, Shell instruction 3, ........}.

[0068] In some embodiments, multiple honeypot instruction sequence sets are determined from the attack behavior data 210. The multiple honeypot instruction sequence sets can be collected from multiple sessions on at least one honeypot host. For example, each honeypot instruction sequence set can include instruction sequences from sessions on the honeypot host. Multiple candidate keyword sets are extracted from the multiple honeypot instruction sequence sets in the attack behavior data 210. In some embodiments, all character strings in each honeypot instruction sequence set (e.g., the shell instructions included in the set) can be treated as a behavior description document, and behavior description documents corresponding to all attack behavior data 210 can be obtained. The behavior description documents corresponding to the attack behavior data 210 can be input into the keyword extraction module 630 to obtain candidate keyword sets 635. The keyword clustering and compression module 640 can determine the frequency of occurrence of each keyword in the multiple candidate keyword sets in the non-attack behavior data and the non-attack behavior data by referring to the keywords in the non-attack behavior data 205. Based on the frequency of occurrence of each keyword, at least one target keyword set 645 is determined from the multiple candidate keyword sets. Each target keyword set 645 includes at least one keyword that can be used to characterize attack behavior.

[0069] FIG7 provides a specific example of a keyword extraction module 630 according to some embodiments, including a schematic diagram illustrating how the keyword extraction module 630 processes a honeypot instruction sequence set. As shown in FIG7 , the keyword extraction module 630 may include a word segmentation module 720, a statistics update module 735, an importance calculation module 760, and a keyword determination module 775. The word segmentation module 720 is used to perform word segmentation (e.g., English word segmentation) on the behavior description document corresponding to the attack behavior data 210, using a similar word segmentation method as in the first stage. As shown in FIG7 , the instruction ". / meow meow.Selfrep.arm5" included in the honeypot instruction sequence set 1710 is segmented by the word segmentation module 720 to obtain a candidate keyword set 725 of "meow," "Selfrep," and "arm5." The instruction "chattr-iae / root / .ssh" included in the honeypot instruction sequence set 2715 is segmented by the word segmentation module 720 to obtain a candidate keyword set 730 of "chattr," "-iae," and "root."

[0070] In some embodiments, the statistical update module 735 is configured to update the statistics of the total number of behavior description documents, update the statistics of the number of behavior description documents containing each word, and count the word frequency of each word in all behavior description documents. For the statistical update of the total number of behavior description documents, the total number of behavior description documents counted based on the non-offensive behavior data 205 during the initialization process of the first phase can be added to the total number of description documents currently counted based on the offensive behavior data 210 in the second phase, as the updated total number of behavior description documents. For the statistical update of the number of behavior description documents containing each word, the number of behavior description documents containing each word counted based on the non-offensive behavior data 205 during the initialization of the first phase can be added to the number of behavior description documents containing each word currently counted based on the offensive behavior data 210 in the second phase, as the updated number of behavior description documents containing each word. For the word frequency of each word in all behavior description documents, the number of times the word appears in the current behavior description document in the second phase is counted and divided by the total number of words in the current behavior description document.

[0071] In the example shown in FIG7 , the total number of updated behavior description documents 740 is, for example, 18,888 + 25 (where 18,888 represents the total number of behavior description documents counted based on the non-offensive behavior data 205 during the initialization process of the first phase, and 25 represents the total number of description documents currently counted based on the offensive behavior data 210 during the second phase). The updated number of behavior description documents containing “ls” 745 is 3,200 + ? (where 3,200 represents the number of behavior description documents containing each word counted based on the non-offensive behavior data 205 during the initialization process of the first phase, and “?” represents the number of behavior description documents containing each word currently counted based on the offensive behavior data 210 during the second phase).

[0072] In some embodiments, the importance calculation module 760 is configured to calculate the importance score of each keyword. The importance calculation module 760 can determine the importance score of each keyword in the multiple candidate keyword sets based on the frequency of occurrence of each keyword in the keywords in the offensive behavior data 210 and the keywords in the non-offensive behavior data 205, wherein the importance score of the candidate keyword indicates the degree to which the candidate keyword can represent the offensive behavior. Generally, the higher the frequency of a keyword in a candidate keyword set and the lower the frequency of its occurrence in each keyword set in the offensive behavior data 210 and the non-offensive behavior data 205, the more representative the keyword is of a particular offensive behavior.

[0073] In some embodiments, the importance score of a keyword can be calculated by term frequency-inverse document frequency (TF-IDF). The TF value can be determined by the term frequency of each keyword in the corresponding candidate keyword set in multiple candidate keyword sets, for example, by counting the number of times the current keyword appears in the current behavior description document. The IDF value can be determined by the inverse document frequency of each keyword in the multiple candidate keyword sets in multiple benchmark keyword sets and multiple candidate keyword sets, for example, by calculating the total number of behavior description documents divided by the number of behavior description documents containing the word. Then, the importance score of each keyword is determined based on the IDF and TF of each keyword in the multiple candidate keyword sets. The importance score of a keyword is the product of the TF value and the IDF value of the keyword. The higher the importance score of a keyword, the more representative the keyword is, indicating that the keyword appears more frequently in the current behavior and less frequently in all behaviors. In the example shown in Figure 7, the importance score of the keyword meow in the candidate keyword set 765 corresponding to the host identifier 1 session identifier 365 is 12.5, the importance score of Selfrep is 11.1, and the importance score of arm5 is 2.0. The solution disclosed herein utilizes the word frequency difference between the non-offensive behavior data 205 and the offensive behavior data 210 to filter out representative keywords in the offensive behavior data 210 .

[0074] Table 2 below shows the importance scores corresponding to the keywords of the example.

[0075] Table 2. Example keywords and their importance scores

[0076] In some embodiments, the keyword determination module 775 is configured to determine at least one target keyword set from multiple candidate keyword sets according to the importance score of each keyword in the multiple candidate keyword sets, wherein each target keyword set can be used to characterize attack behavior.

[0077] In some embodiments, a predetermined number (e.g., 10) of keywords with the highest importance scores are extracted from the candidate keyword set. Each keyword extracted in this way is representative to a certain extent, and a summary of the entire honeypot instruction sequence set can be formed by the predetermined number of keywords extracted in this way. Different honeypot instruction sequence sets can be distinguished by including the summary of keywords. Since the keyword extraction module 630 is initialized by the non-attack behavior data 205, it can be ensured that the extracted honeypot behavior keywords belong to malicious behavior by giving lower importance scores to words belonging to normal behavior in the collected attack behavior data 210. In the example shown in Figure 7, the candidate keyword set 780 corresponding to the host ID 1 and the session ID 365 includes the determined keywords meow and Selfrep. The candidate keyword set 785 corresponding to the host ID 2 and the session ID 365 includes the determined keywords ls and pwd.

[0078] In order to compress and merge the candidate keyword set 635, the candidate keyword set can be input into the keyword clustering compression module 640. A plurality of candidate keyword sets (e.g., all candidate keyword sets) can be clustered by a clustering algorithm to obtain at least one keyword set cluster after clustering, wherein each keyword set cluster can include at least two candidate keyword sets. In some embodiments, a SinglePass clustering algorithm can be used, and the feature can adopt a bag-of-words model suitable for text clustering, so that after adding new data, the clustering result can be directly updated on the basis of the current clustering result. Other clustering algorithms can also be selected, such as K-Means, AGNES, etc., but are not limited to this.

[0079] Each keyword set cluster includes multiple groups of candidate keyword sets. Some candidate keyword sets included in a keyword set cluster may have certain similarities, for example, they may be from the same intrusion behavior (attack behavior). For each keyword set cluster, based on the importance scores of each keyword included in the keyword set cluster, an active keyword set is selected from at least two candidate keyword sets included in the keyword set cluster. In some embodiments, for each candidate keyword set in the at least two candidate keyword sets, the number of keywords in the candidate keyword set whose importance scores exceed a first predetermined threshold is determined. Based on the determined number of keywords exceeding the first predetermined threshold, an active keyword set is selected from the at least two candidate keyword sets. For example, the candidate keyword set with the largest number of keywords with importance scores greater than the threshold can be used as the active keyword set in the keyword set cluster to which it belongs. The first predetermined threshold here can be related to the ratio of non-attack behavior data 205 to attack behavior data 210. Keywords with importance scores exceeding the first predetermined threshold indicate that they are likely to be keywords unique to the attack behavior data 210. The specific value of the first predetermined threshold is not limited.

[0080] After selecting an active keyword set for each keyword set cluster, an active keyword set can be determined in each keyword set cluster to represent the representative behavior of the keyword set cluster. In some embodiments, a target keyword set can be determined based on the selected active keyword set. In some embodiments, at least one keyword can be deleted from the active keyword set based on a comparison of the importance scores of each keyword in the active keyword set with a second predetermined threshold to obtain a target keyword set. For example, the active keyword set can be cleaned to retain only keywords with an importance score greater than the second predetermined threshold and remove other keywords. In some embodiments, the trigger words of the target keyword set are determined based on at least one of the importance scores of each keyword in the active keyword set and the character length of each keyword. For example, for each active keyword set, a keyword (e.g., the first keyword that meets this condition, or any keyword that meets this condition) whose importance score is greater than the average importance score of the keywords in the active keyword set and whose character length is greater than a predetermined length (e.g., 4) is selected and marked as a trigger word.

[0081] In some embodiments, when there are multiple keyword set clusters, if the trigger words of a certain active keyword set in the multiple active keyword sets selected for the multiple keyword set clusters are the same, then these active keyword sets can be merged. For example, if the trigger words of the first active keyword set and the second active keyword set are the same, the first active keyword set and the second active keyword set are merged to obtain a target keyword set. This not only further reduces the number of target keyword sets, but also enables different target keyword sets to include different trigger words. By traversing all active keyword sets, active keyword sets with the same trigger words can be merged, and the merged active keyword sets can be processed to remove duplicate words. For example, a union of multiple active keyword sets with the same trigger words can be taken. In the example embodiments of the present disclosure, the trigger words have at least the following functions: the trigger words can be used as pre-matched objects in the generated rules to implement trigger detection (if the trigger words are not matched, no subsequent detection is required), and multiple active keyword sets can also be merged through the trigger words to further reduce the number of active keyword sets, reduce the amount of calculation, save resources and improve efficiency.

[0082] FIG8 shows the specific structure of the keyword clustering compression module 640 in the attack behavior determination subsystem 230. The target keyword set 645 can be obtained through the keyword clustering compression module 640. FIG8 shows a schematic diagram of compressing and merging the candidate keyword set through the keyword clustering compression module 640 according to some embodiments of the present disclosure. The keyword clustering compression module 640 may include a clustering module 820 and a screening module 840. As shown in FIG8 , the candidate keyword set is first clustered and compressed by the clustering module 820 to obtain keyword set clusters (as shown in FIG8 , keyword set cluster 1 825, keyword set cluster 2 830, and keyword set cluster 3 835), wherein each keyword set cluster includes multiple groups of candidate keyword sets with similarities. The screening module 840 is configured to screen the active keyword sets and trigger words in the keyword set clusters.

[0083] As shown in Figure 8, the active keyword set 845 with host ID 1 and session ID 365 includes {meow; Selfrep}, and the trigger word is meow; the active keyword set 850 with host ID 1 and session ID 277 includes {meow; watchd0g}, and the trigger word is meow; the active keyword set 855 with host ID 2 and session ID 365 includes {xmrig; minor}, and the trigger word is xmrig. Since the trigger words corresponding to active keyword set 845 and active keyword set 850 are the same, both are meow, the two can be merged to remove duplicates. The target keyword set 860 obtained after the merger includes {meow; Selfrep; watchd0g}. It can be seen that the merged target keyword set includes all the words in the two active keyword sets, and there are no duplicate words. Here, the session ID corresponding to the target keyword set 860 is the same as the session ID corresponding to the active keyword set 845, which is only used as an example. Since the merging process is based on trigger words and is not related to the host ID and session ID, the host ID and session ID corresponding to the target keyword set 860 can be the host ID and session ID corresponding to the active keyword set 845 and / or the active keyword set 850.

[0084] The target keyword set obtained by the attack behavior determination subsystem 230 can be provided to the behavior detection subsystem 240. Each target keyword set can be regarded as an attack behavior detection rule. The behavior detection subsystem 240 is configured to perform attack behavior detection on the target user host (e.g., the target user host 140 in Figure 1) based on at least one target keyword set.

[0085] In some embodiments, the detection subsystem 240 may determine an attack behavior detection result on the target user host based at least on the degree of match between at least one user instruction collected from the target user host and at least one target keyword set, wherein the attack behavior detection result may indicate whether an attack behavior has occurred. For example, the user instruction is matched with the target keyword set. If the user instruction has a high degree of match with a target keyword set in the target keyword set (for example, the user instruction has a high degree of match with multiple keywords in a target keyword set), then it can be considered that the user instruction indicates the occurrence of an attack behavior. The degree of match can be calculated by similarity, which can be calculated by converting a string into a vector and calculating the vector distance.

[0086] In some embodiments, when each target keyword set in at least one target keyword set includes a trigger word and at least one keyword, the degree of match between the first user instruction collected from the target user host and the trigger word in the at least one target keyword set is determined based at least on the degree of match between at least one user instruction collected from the target user host and the at least one target keyword set. Specifically, for each target keyword set, a rule for matching the trigger word is generated, for example, when it is detected that the user instruction (e.g., Shell instruction) contains the trigger word, it indicates a hit. Attack behavior detection rules can also be generated for the keywords in the target keyword set, for example, when it is detected that the executed user instruction contains the keyword in the target keyword set, it indicates a hit.

[0087] In some embodiments, the attack behavior determination subsystem 230 can generate at least one attack behavior detection rule based on at least one target keyword set and publish the attack behavior detection rule to the behavior detection subsystem 240. Specifically, in the attack behavior determination subsystem 230, the target keyword set obtained after processing by the keyword clustering and compression module 640 is input to the detection rule generation module 650 for generating attack behavior detection rules adapted for the HIDS. The detection rule generation module 650 generates at least one attack behavior detection rule based on the at least one target keyword set.

[0088] By automatically converting the attack behavior data 210 into HIDS detection rules, automatic perception and detection of unknown threats can be achieved, thereby improving the attack behavior detection capability of the HIDS.

[0089] FIG9 is a flow chart illustrating a process for generating attack behavior detection rules 655 according to some embodiments of the present disclosure. As shown in FIG9 , it is assumed that the keyword clustering and compression module 640 obtains a target keyword set 860 and a target keyword set 865. From the target keyword set 860, an attack behavior detection rule 910 with the trigger word "meow" can be determined, and from the target keyword set 865, an attack behavior detection rule 915 with the trigger word "xmrig" can be determined. Rules that match keywords in the target keyword set can also be obtained, such as an attack behavior detection rule 920 that matches the keywords [meow; Selfrep; Watchd0g; ...], and an attack behavior detection rule 925 that matches the keywords [xmrig; miner; ...].

[0090] If it is determined that the first user instruction matches the first trigger word in the first target keyword set, multiple user instructions are obtained from the target user host based on the first user instruction. In some embodiments, multiple user instructions are obtained from the target user host based on the host ID and session ID of the first user instruction. The attack behavior detection result is determined based on the degree of match between the multiple user instructions and at least one keyword in the first target keyword set. For example, if it is detected that the user instruction contains a trigger word, data with a host ID and session ID consistent with the current user instruction within a predetermined time period (e.g., 30 minutes) is filtered out, and the number of types of keywords in the attack behavior detection rules that hit the data is counted, such as how many keywords are hit. If the number of types is greater than a preset threshold, an alarm is issued. For example, the user instruction is first matched with the trigger word rule. If the trigger word rule is not hit, the user instruction is ignored. If the trigger word rule is hit, the keyword rule is matched. If the keyword rule is hit, an alarm is issued; if the keyword rule is not hit, the user instruction is ignored. Here, filtering out data within a predetermined time period may be to look back at historical data within the predetermined time period, or to detect data within the predetermined time period backward from the current time point, for example, data from the current time to 30 minutes later.

[0091] According to the technical solution disclosed in the present invention, the generation of attack behavior detection rules includes screening out one or more target keyword sets that can characterize attack behavior or malicious behavior from the attack behavior data collected by the honeypot host, and each target keyword set includes keywords extracted from the instruction sequence that initiates the attack behavior. When determining the target keyword set, it also relies on the non-attack behavior data collected from the user host. By comparing the keywords of the instruction sequence of the non-attack behavior data, it is possible to screen out keywords that can accurately characterize the attack behavior. In this way, by combining the attack behavior data from the honeypot and the non-attack behavior data from the user host, the attack behavior data of the honeypot can be automatically converted into rules for behavior detection, that is, target keyword matching.

[0092] FIG10 provides a specific example of a rule publishing process according to some embodiments of the present disclosure. As shown in FIG10 , after the detection rule publishing and adjustment module 660 determines attack behavior detection rule 1 and attack behavior detection rule 2, it can publish the rules (for example, publish a specific detection rule, or publish a target keyword set). The published attack behavior detection rules can be applied to a HIDS (for example, HIDS 106 or HIDS 104 in FIG1 ). When the HIDS detects an attack behavior according to the rules, it provides an alarm result.

[0093] In some embodiments, the generated attack behavior detection rules can be pushed to the HIDS via the detection rule publishing and adjustment module 660 for incremental updates. In some embodiments, additional attack behavior data is collected from at least one honeypot host, and the attack behavior determination subsystem 230 updates existing attack behavior detection rules, such as the at least one target keyword set determined, based on the additional attack behavior data for use in attack behavior detection. Additional attack behavior data can be collected regularly, periodically, or in real time, and the target keyword set can also be updated regularly, periodically, or in real time, so that attack behavior detection rules can be continuously generated. For example, the attack behavior detection rules can be iteratively updated hourly or daily so that the HIDS can promptly apply the latest attack behavior detection rules. As shown in Figure 2, for different attack behavior data 210-1...210-J, the determined target keyword set can be further updated based on the embodiments described above. Updates to the target keyword set include adding one or more new target keyword sets, adding, deleting, or modifying keywords or trigger words in an existing target keyword set, deleting an existing target keyword set, and so on. The updated behavior detection rules can continue to be published and used for attack behavior detection on target user hosts. In this way, by continuously collecting attack behavior data through the honeypot host to update the attack behavior detection rules, new attack patterns can be tracked and the security of the user host can be continuously guaranteed.

[0094] In the disclosed solution, because normal behavior data is used for initialization, the generated rules have a low false positive rate. Furthermore, the generated attack behavior detection rules have generalization capabilities, capable of detecting variant behaviors of some malicious samples. The generated overall detection rules incorporate the logic of detecting trigger words before keywords, effectively improving the efficiency of user command sequence detection.

[0095] It should be understood that the exemplary instruction sequences and rule codes are provided in the drawings and descriptions for the purpose of explanation only, but this does not impose any limitation on the scope of the present disclosure. The embodiments of the present disclosure can be similarly applied to any other types of instruction sequences and codes.

[0096] Example Process

[0097] 11 shows a flow chart of a method 1100 for attack behavior detection according to some embodiments of the present disclosure. Exemplarily, the method 1100 may be implemented by an electronic device, which may include, for example, the attack behavior detection system 200 of FIG. 2 .

[0098] As shown in FIG11 , in block 1110 , the electronic device obtains attack behavior data and non-attack behavior data, where the attack behavior data is collected from at least one honeypot host, and the non-attack behavior data is collected from at least one user host.

[0099] In block 1120 , the electronic device filters keywords from the offensive behavior data based on the keywords in the non-offensive behavior data and the keywords in the offensive behavior data to generate at least one offensive behavior detection rule, wherein each offensive behavior detection rule includes at least one keyword for characterizing offensive behavior.

[0100] In block 1130 , the electronic device performs attack behavior detection on the target user host based on at least one attack behavior detection rule.

[0101] In some embodiments, filtering keywords from attack behavior data to generate at least one attack behavior detection rule includes: determining multiple honeypot instruction sequence sets from the attack behavior data, each honeypot instruction sequence set including an instruction sequence from a session on a honeypot host; based on the frequency of occurrence of each keyword in multiple candidate keyword sets in the attack behavior data and non-attack behavior data, determining at least one target keyword set from the multiple candidate keyword sets, each target keyword set including at least one keyword for characterizing the attack behavior; and generating at least one attack behavior detection rule from the at least one target keyword set.

[0102] In some embodiments, determining at least one target keyword set from multiple candidate keyword sets includes: determining an importance score for each keyword in the multiple candidate keyword sets based on the frequency of occurrence of each keyword in the multiple candidate keyword sets in the keywords in the attack behavior data and the keywords in the non-attack behavior data, the importance score of the candidate keyword indicating the extent to which the candidate keyword can characterize the attack behavior; and determining at least one target keyword set from the multiple candidate keyword sets based on the importance score of each keyword in the multiple candidate keyword sets.

[0103] In some embodiments, the non-offensive behavior data includes multiple user instruction sequence sets collected from at least one user host, and multiple benchmark keyword sets are respectively extracted from the multiple user instruction sequence sets; and determining the importance score of each keyword in the multiple candidate keyword sets includes: determining the inverse document frequency (IDF) of each keyword in the multiple candidate keyword sets in the multiple benchmark keyword sets and the multiple candidate keyword sets; determining the word frequency (TF) of each keyword in the multiple candidate keyword sets in the corresponding candidate keyword sets; and determining the importance score of each keyword based on the IDF and TF of each keyword in the multiple candidate keyword sets.

[0104] In some embodiments, based on the importance scores of each keyword in multiple candidate keyword sets, determining at least one target keyword set from multiple candidate keyword sets includes: clustering the multiple candidate keyword sets to obtain at least one keyword set cluster, each keyword set cluster including at least two candidate keyword sets; and for each keyword set cluster, based on the importance scores of each keyword included in the keyword set cluster, selecting an active keyword set from the at least two candidate keyword sets included in the keyword set cluster, and determining the target keyword set based on the selected active keyword set.

[0105] In some embodiments, for each keyword set cluster, selecting an active candidate keyword set from at least two candidate keyword sets included in the keyword set cluster includes: for each candidate keyword set in the at least two candidate keyword sets, determining the number of keywords in the candidate keyword set whose importance scores exceed a first predetermined threshold; and selecting an active keyword set from the at least two candidate keyword sets based on the determined number of keywords that exceed the first predetermined threshold.

[0106] In some embodiments, determining the target keyword set based on the selected active keyword set includes: deleting at least one keyword from the active keyword set based on comparison of importance scores of respective keywords in the active keyword set with a second predetermined threshold to obtain the target keyword set.

[0107] In some embodiments, based on the importance scores of each keyword in multiple candidate keyword sets, determining at least one target keyword set from multiple candidate keyword sets includes: determining the trigger words of the target keyword set based on at least one of the importance scores of each keyword in the active keyword set and the character length of each keyword.

[0108] In some embodiments, at least one keyword set cluster includes multiple keyword set clusters, and determining at least one target keyword set further includes: if the trigger words of the first active keyword set and the second active keyword set in the multiple active keyword sets selected for the multiple keyword set clusters are the same, merging the first active keyword set and the second active keyword set to obtain a target keyword set, and the target keyword set at least includes the same trigger words.

[0109] In some embodiments, performing attack behavior detection on a target user host includes: determining whether at least one user instruction collected from the target user host satisfies at least one attack behavior detection rule; and determining an attack behavior detection result on the target user host based on the determination of whether the at least one user instruction satisfies the at least one attack behavior detection rule, the attack behavior detection result indicating whether an attack behavior has occurred. In some embodiments, each of the at least one attack behavior detection rule includes a trigger word and at least one keyword, and determining whether the at least one user instruction collected from the target user host satisfies the at least one attack behavior detection rule includes: determining a degree of match between a first user instruction collected from the target user host and a trigger word in at least one target attack behavior detection rule; if it is determined that the first user instruction matches the first trigger word in the first attack behavior detection rule, obtaining multiple user instructions from the target user host based on the first user instruction; and determining whether the first attack behavior detection rule is satisfied based on a degree of match between the multiple user instructions and at least one keyword in the first attack behavior detection rule.

[0110] In some embodiments, obtaining multiple user instructions from the target user host based on the first user instruction includes: obtaining multiple user instructions from the target user host based on the host identifier and the session identifier of the first user instruction.

[0111] In some embodiments, the electronic device may also: collect additional attack behavior data from at least one honeypot host; update at least one attack behavior detection rule based on the additional attack behavior data; and perform attack behavior detection on the target user host based on the updated at least one attack behavior detection rule.

[0112] Figure 12 shows a schematic block diagram of an apparatus 1200 for attack behavior detection according to some embodiments of the present disclosure. Apparatus 1200 can be implemented in an electronic device, for example, to implement attack behavior detection system 200 in Figure 2 or one or more subsystems thereof. Each module / component in apparatus 1200 can be implemented using hardware, software, firmware, or any combination thereof.

[0113] As shown in Figure 12, device 1200 includes a data acquisition module 1210 configured to acquire attack behavior data and non-attack behavior data, where the attack behavior data is collected from at least one honeypot host, and the non-attack behavior data is collected from at least one user host. Device 1200 also includes a rule generation module 1220 configured to filter keywords from the attack behavior data based on keywords in the non-attack behavior data and keywords in the attack behavior data to generate at least one attack behavior detection rule, wherein each attack behavior detection rule includes at least one keyword used to characterize attack behavior. Device 1200 further includes a behavior detection module 1230 configured to perform attack behavior detection on the target user host based on the at least one attack behavior detection rule.

[0114] In some embodiments, the rule generation module 1220 is configured to determine multiple honeypot instruction sequence sets from the attack behavior data, each honeypot instruction sequence set including an instruction sequence from a session on a honeypot host; extract multiple candidate keyword sets from the multiple honeypot instruction sequence sets of the attack behavior data; determine at least one target keyword set from the multiple candidate keyword sets based on the frequency of occurrence of each keyword in the multiple candidate keyword sets in the keywords in the attack behavior data and the keywords in the non-attack behavior data, each target keyword set including at least one keyword for characterizing the attack behavior; and generate at least one attack behavior detection rule from the at least one target keyword set.

[0115] In some embodiments, the rule generation module 1220 is configured to determine the importance score of each keyword in multiple candidate keyword sets based on the frequency of occurrence of each keyword in the keywords in the attack behavior data and the keywords in the non-attack behavior data, the importance score of the candidate keyword indicating the extent to which the candidate keyword can characterize the attack behavior; and determine at least one target keyword set from the multiple candidate keyword sets based on the importance score of each keyword in the multiple candidate keyword sets.

[0116] In some embodiments, the non-offensive behavior data includes multiple user instruction sequence sets collected from at least one user host, and multiple benchmark keyword sets are extracted from the multiple user instruction sequence sets respectively; and the score determination module 1220 is also configured to determine the inverse document frequency IDF of each keyword in the multiple candidate keyword sets in the multiple benchmark keyword sets and the multiple candidate keyword sets; determine the word frequency TF of each keyword in the multiple candidate keyword sets in the corresponding candidate keyword sets; and determine the importance score of each keyword based on the IDF and TF of each keyword in the multiple candidate keyword sets.

[0117] In some embodiments, the rule generation module 1220 is configured to cluster multiple candidate keyword sets to obtain at least one keyword set cluster, each keyword set cluster including at least two candidate keyword sets; and for each keyword set cluster, based on the importance scores of each keyword included in the keyword set cluster, select an active keyword set from the at least two candidate keyword sets included in the keyword set cluster, and determine the target keyword set based on the selected active keyword set.

[0118] In some embodiments, for each keyword set cluster, the rule generation module 1220 is further configured to determine, for each candidate keyword set in at least two candidate keyword sets, the number of keywords in the candidate keyword set whose importance scores exceed a first predetermined threshold; and select an active keyword set from the at least two candidate keyword sets based on the determined number of keywords that exceed the first predetermined threshold.

[0119] In some embodiments, the rule generation module 1220 is configured to delete at least one keyword from the active keyword set based on a comparison between the importance score of each keyword in the active keyword set and a second predetermined threshold to obtain a target keyword set.

[0120] In some embodiments, the rule generation module 1220 is configured to determine the trigger words of the target keyword set based on at least one of the importance score of each keyword in the active keyword set and the character length of each keyword.

[0121] In some embodiments, at least one keyword set cluster includes multiple keyword set clusters, and the rule generation module 1220 is further configured to merge the first active keyword set and the second active keyword set in the multiple active keyword sets selected for the multiple keyword set clusters to obtain a target keyword set if the trigger words of the first active keyword set and the second active keyword set are the same, and the target keyword set includes at least the same trigger words.

[0122] In some embodiments, the behavior detection module 1230 is configured to determine whether at least one user instruction collected from the target user host satisfies at least one attack behavior detection rule; and based on the determination of whether at least one user instruction satisfies at least one attack behavior detection rule, determine the attack behavior detection result on the target user host, and the attack behavior detection result indicates whether the attack behavior occurs.

[0123] In some embodiments, each attack behavior detection rule in at least one attack behavior detection rule includes a trigger word and at least one keyword, and the behavior detection module 1230 is further configured to determine the degree of matching between a first user instruction collected from the target user host and the trigger word in at least one target attack behavior detection rule; if it is determined that the first user instruction matches the first trigger word in the first attack behavior detection rule, obtain multiple user instructions from the target user host based on the first user instruction; and determine whether the first attack behavior detection rule is satisfied based on the degree of matching between the multiple user instructions and at least one keyword in the first attack behavior detection rule.

[0124] In some embodiments, the behavior detection module 1230 is further configured to obtain multiple user instructions from the target user host based on the host identifier and session identifier of the first user instruction.

[0125] In some embodiments, the rule generation module 1220 is further configured to collect additional attack behavior data from at least one honeypot host and update at least one attack behavior detection rule based on the additional attack behavior data. The behavior detection module 1230 is further configured to perform attack behavior detection on the target user host based on the updated at least one attack behavior detection rule.

[0126] FIG13 shows a block diagram of an electronic device 1300 in which one or more embodiments of the present disclosure may be implemented. It should be understood that the electronic device 1300 shown in FIG13 is merely exemplary and should not be construed as limiting the functionality and scope of the embodiments described herein. The electronic device 1300 shown in FIG13 may be used to implement the electronic device 130 of FIG1 .

[0127] As shown in FIG13 , electronic device 1300 is a general-purpose electronic device. Components of electronic device 1300 may include, but are not limited to, one or more processors or processing units 1205, memory 1320, storage device 1330, one or more communication units 1340, one or more input devices 1350, and one or more output devices 1360. Processing unit 1205 may be a real or virtual processor and is capable of performing various processes according to programs stored in memory 1320. In a multi-processor system, multiple processing units execute computer-executable instructions in parallel to enhance the parallel processing capabilities of electronic device 1300.

[0128] The electronic device 1300 typically includes a plurality of computer storage media. Such media can be any accessible media that is accessible to the electronic device 1300, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 1320 can be a volatile memory (e.g., registers, cache, random access memory (RAM)), a non-volatile memory (e.g., read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 1330 can be a removable or non-removable medium and can include a machine-readable medium, such as a flash drive, a disk, or any other medium that can be used to store information and / or data and can be accessed within the electronic device 1300.

[0129] The electronic device 1300 may further include additional removable / non-removable, volatile / non-volatile storage media. Although not shown in FIG. 13 , a disk drive for reading from or writing to a removable, non-volatile disk (e.g., a “floppy disk”) and an optical drive for reading from or writing to a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to a bus (not shown) by one or more data media interfaces. The memory 1320 may include a computer program product 1325 having one or more program modules configured to perform various methods or actions of various embodiments of the present disclosure.

[0130] The communication unit 1340 enables communication with other electronic devices via a communication medium. Additionally, the functions of the components of the electronic device 1300 can be implemented as a single computing cluster or multiple computing machines that can communicate via a communication connection. Thus, the electronic device 1300 can operate in a networked environment using a logical connection to one or more other servers, a network personal computer (PC), or another network node.

[0131] Input device 1350 may be one or more input devices, such as a mouse, keyboard, or trackball. Output device 1360 may be one or more output devices, such as a display, a speaker, or a printer. Electronic device 1300 may also communicate with one or more external devices (not shown) via communication unit 1340, as needed. External devices such as storage devices, display devices, and the like may also be used to communicate with one or more devices that allow a user to interact with electronic device 1300, or with any device that allows electronic device 1300 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0132] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above.

[0133] Various aspects of the present disclosure are described herein with reference to flowcharts and / or block diagrams of methods, apparatuses, devices, and computer program products implemented according to the present disclosure. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0134] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, such that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0135] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0136] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to multiple implementations of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a part for a module, program segment or instruction, and a part for a module, program segment or instruction comprises one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0137] While various implementations of the present disclosure have been described above, the foregoing description is intended to be illustrative, not exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described implementations. The terminology used herein is selected to best explain the principles of the implementations, their practical applications, or improvements to existing technologies, or to enable others skilled in the art to understand the various implementations disclosed herein.

Claims

1. A method for attack behavior detection, comprising: Acquire attack behavior data and non-attack behavior data, wherein the attack behavior data is collected from at least one honeypot host, and the non-attack behavior data is collected from at least one user host; According to the keywords in the non-aggression behavior data and the keywords in the attack behavior data, the keywords are screened from the attack behavior data to generate at least one attack behavior detection rule, wherein each attack behavior detection rule includes at least one keyword for characterizing the attack behavior; as well as Based on the at least one attack behavior detection rule, attack behavior detection is performed on the target user host.

2. The method according to claim 1, wherein filtering keywords from the attack behavior data to generate the at least one attack behavior detection rule comprises: Determine a plurality of honeypot instruction sequence sets from the attack behavior data, each honeypot instruction sequence set comprising an instruction sequence from a session on a honeypot host; Extracting a plurality of candidate keyword sets from the plurality of honeypot instruction sequence sets respectively; Determine at least one target keyword set from the plurality of candidate keyword sets based on the occurrence frequency of the keywords in the non-aggressive behavior data and the keywords in the non-aggressive behavior data of each keyword in the plurality of candidate keyword sets, each target keyword set including at least one keyword for characterizing an aggressive behavior; as well as The at least one attack behavior detection rule is generated respectively from the at least one target keyword set.

3. The method according to claim 2, wherein determining the at least one target keyword set from the plurality of candidate keyword sets comprises: Determine an importance score for each keyword in the plurality of candidate keyword sets based on the frequency of occurrence of each keyword in the attack behavior data and the non-attack behavior data, wherein the importance score of the candidate keyword indicates the degree to which the candidate keyword can characterize the attack behavior; as well as The at least one target keyword set is determined from the plurality of candidate keyword sets based on the importance score of each keyword in the plurality of candidate keyword sets.

4. The method according to claim 3, wherein the non-offensive behavior data comprises a plurality of user instruction sequence sets collected from at least one user host, and a plurality of benchmark keyword sets are respectively extracted from the plurality of user instruction sequence sets; and Determining the importance score of each keyword in the plurality of candidate keyword sets includes: Determine the inverse document frequency (IDF) of each keyword in the plurality of candidate keyword sets in the plurality of benchmark keyword sets and the plurality of candidate keyword sets; Determine the word frequency TF of each keyword in the plurality of candidate keyword sets in the corresponding candidate keyword set; and The importance score of each keyword is determined based on the IDF and TF of each keyword in the plurality of candidate keyword sets.

5. The method according to claim 3, wherein determining the at least one target keyword set from the plurality of candidate keyword sets based on the importance score of each keyword in the plurality of candidate keyword sets comprises: Clustering the multiple candidate keyword sets to obtain at least one keyword set cluster, each keyword set cluster including at least two candidate keyword sets; as well as For each keyword set cluster, Based on the importance score of each keyword included in the keyword set cluster, selecting an active keyword set from at least two candidate keyword sets included in the keyword set cluster, and A target keyword set is determined based on the selected active keyword set.

6. The method according to claim 5, wherein for each keyword set cluster, selecting an active candidate keyword set from at least two candidate keyword sets included in the keyword set cluster comprises: For each candidate keyword set in the at least two candidate keyword sets, determining the number of keywords in the candidate keyword set whose importance scores exceed a first predetermined threshold; as well as An active keyword set is selected from the at least two candidate keyword sets based on the determined number of keywords exceeding the first predetermined threshold.

7. The method of claim 5, wherein determining the target keyword set based on the selected active keyword set comprises: Based on the comparison between the importance score of each keyword in the active keyword set and a second predetermined threshold, at least one keyword is deleted from the active keyword set to obtain the target keyword set.

8. The method according to claim 5, wherein determining the at least one target keyword set from the plurality of candidate keyword sets based on the importance score of each keyword in the plurality of candidate keyword sets comprises: The trigger words of the target keyword set are determined based on at least one of the importance score of each keyword in the active keyword set and the character length of each keyword.

9. The method of claim 8, wherein the at least one keyword set cluster comprises a plurality of keyword set clusters, and wherein determining the at least one target keyword set further comprises: If the trigger words of the first active keyword set and the second active keyword set in the multiple active keyword sets selected for clustering the multiple keyword sets are the same, the first active keyword set and the second active keyword set are merged to obtain a target keyword set, and the target keyword set at least includes the same trigger words.

10. The method according to claim 1, wherein performing attack behavior detection on the target user host comprises: Determining whether at least one user instruction collected from the target user host satisfies at least one attack behavior detection rule; as well as Based on determining whether the at least one user indication satisfies the at least one attack behavior detection rule, an attack behavior detection result on the target user host is determined, the attack behavior detection result indicating whether an attack behavior occurs.

11. The method according to claim 10, wherein each of the at least one attack behavior detection rule comprises a trigger word and at least one keyword, and wherein determining whether at least one user instruction collected from the target user host satisfies the at least one attack behavior detection rule comprises: Determining a degree of match between a first user instruction collected from the target user host and a trigger word in the at least one target attack behavior detection rule; If it is determined that the first user instruction matches the first trigger word in the first attack behavior detection rule, obtaining multiple user instructions from the target user host based on the first user instruction; as well as Whether the first attack behavior detection rule is satisfied is determined based on the matching degree between the multiple user instructions and at least one keyword in the first attack behavior detection rule.

12. The method according to claim 11, wherein acquiring a plurality of user instructions from the target user host based on the first user instruction comprises: Based on the host identifier and the session identifier of the first user instruction, the plurality of user instructions from the target user host are obtained.

13. The method according to claim 1, further comprising: collecting additional attack behavior data from the at least one honeypot host; updating the at least one offensive behavior detection rule based on the additional offensive behavior data; as well as Attack behavior detection is performed on the target user host based on the updated at least one attack behavior detection rule.

14. A device for attack behavior detection, comprising: A data acquisition module is configured to acquire attack behavior data and non-attack behavior data, wherein the attack behavior data is collected from at least one honeypot host, and the non-attack behavior data is collected from at least one user host; a rule generation module, configured to filter keywords from the offensive behavior data to generate at least one offensive behavior detection rule based on keywords in the non-offensive behavior data and keywords in the offensive behavior data, wherein each offensive behavior detection rule includes at least one keyword for characterizing offensive behavior; as well as The behavior detection module is configured to perform attack behavior detection on the target user host based on the at least one attack behavior detection rule.

15. An electronic device, comprising: at least one processing unit; as well as At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 13 when executed by the at least one processing unit.

16. A computer-readable storage medium having a computer program stored thereon, wherein the computer program can be executed by a processor to implement the method according to any one of claims 1 to 13.

Images