Security detection method, apparatus and device, and computer-readable storage medium

Abstract

The present application belongs to the field of network security. Disclosed are a security detection method, apparatus and device, and a computer-readable storage medium. The method comprises: a proxy device collecting a first event; the proxy device performing first security detection on the first event, so as to obtain a first detection result; the proxy device processing the first event to obtain a second event, wherein the amount of data in the second event is less than the amount of data in the first event; and the proxy device sending the first detection result and the second event to a cloud, wherein the first detection result and the second event are used for a cloud device to perform second security detection on the second event, so as to obtain a second detection result. In the present application, collaborative detection is performed on collected events on the basis of a proxy device and a cloud device, such that the amount of data to be transmitted between the proxy device and the cloud device is reduced, thereby reducing a bandwidth cost and improving the detection efficiency.

Description

Security detection method, device, equipment and computer-readable storage medium

[0001] This application claims priority to Chinese patent application No. 202310969621.X filed on August 2, 2023, entitled “Method, device, apparatus and computer-readable storage medium for security detection,” the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application relates to the field of network security, and in particular to a security detection method, apparatus, device, and computer-readable storage medium. Background Art

[0003] Network security is an important issue that cannot be ignored in today's digital age. With the rapid development of the Internet, more and more security detection issues have emerged in the network. Therefore, it is particularly important to use reasonable network security solutions for security detection.

[0004] A related art security detection method provides a method in which a collection agent deployed on a user terminal collects data and a cloud device analyzes the collected data. This detection method implements security detection by uploading the full amount of data collected by the collection agent to the cloud device for data analysis.

[0005] However, since the full amount of data collected by the collection agent needs to be uploaded to the cloud device, the data transmission volume during the transmission process is large, the bandwidth cost is high, and the detection efficiency is low.

[0006] Summary of the Invention

[0007] This application provides a security detection method, apparatus, device, and computer-readable storage medium to solve the problems provided by related technologies. The technical solutions are as follows:

[0008] In a first aspect, a security detection method is provided, which is applied to an agent device, and includes: collecting a first event; performing a first security detection on the first event to obtain a first detection result; processing the first event to obtain a second event, wherein the data volume of the second event is smaller than the data volume of the first event; sending the first detection result and the second event to a cloud device, wherein the first detection result and the second event are used by the cloud device to perform a second security detection on the second event to obtain a second detection result.

[0009] This application is based on the collaborative detection of collected events by proxy devices and cloud devices, thereby reducing the amount of data transmitted between the two, reducing bandwidth costs and improving detection efficiency.

[0010] In one possible implementation, collecting the first event includes collecting the first event according to a collection policy issued by the cloud device or a collection configuration of the proxy device. Collecting the first event by issuing a collection policy from the cloud device or by locally configuring a collection configuration on the proxy device is more flexible.

[0011] In one possible implementation, performing a first security check on the first event to obtain a first test result includes: converting the first event into a traceability graph, the traceability graph comprising a plurality of nodes and edges, the nodes representing different types of system entities included in the first event, the edges representing operational relationships between system entities corresponding to connected nodes, the nodes and edges each having corresponding attribute information; and performing a first security check on the first event based on the traceability graph to obtain a first test result. Implementing security checks based on a traceability graph improves detection efficiency and accuracy.

[0012] In one possible implementation, converting the first event into a traceability graph includes: obtaining a traceability graph model, the traceability graph model including node and edge types and field definitions, and also including descriptive information for converting the event into a graph structure; determining the nodes and edges corresponding to the first event using the traceability graph model, and converting the first event into a traceability graph based on the nodes and edges corresponding to the first event. Converting the first event into a traceability graph using the traceability graph model makes the obtained traceability graph more accurate, thereby improving the efficiency of security testing based on the traceability graph.

[0013] In a possible implementation, the first security detection of the first event based on the traceability graph includes: matching the traceability graph with each security rule, assigning a corresponding alarm label and alarm value to the subgraph that hits any security rule, and the alarm label is used to indicate the alarm type; when the cumulative alarm value of the traceability graph exceeds the alarm threshold, matching the alarm label assigned to the traceability graph with the security rule combination, and when the alarm label assigned to the traceability graph hits the security rule combination, determining the subgraph assigned the alarm label as the target subgraph with a security problem, and taking the event corresponding to the target subgraph as the target event with a security problem to obtain a first detection result, which includes the target subgraph and the target event. Matching by a single security rule and a combination of security rules makes the detection result of the security detection more accurate.

[0014] In one possible implementation, the processing of the first event to obtain the second event includes: filtering the first event that hits the security whitelist, and using the unfiltered first event as the second event; or, aggregating repeated events in the first event, and obtaining the second event based on the aggregation result; or, filtering the first event that hits the security whitelist, and aggregating repeated events in the unfiltered first event, and obtaining the second event based on the aggregation result; or, aggregating repeated events in the first event, filtering the first event that hits the security whitelist in the aggregation result, and using the unfiltered first event as the second event. By at least one of filtering and aggregation, the amount of data of the second event is reduced compared to the first event, thereby reducing the amount of data transmission, reducing the transmission bandwidth, and improving the detection efficiency.

[0015] In one possible implementation, after performing a first security check on the first event and obtaining a first test result, the method further includes: if the first test result indicates that the first event has a security issue, handling the first event according to a handling strategy; and logging the handling process and results. Local processing and logging of the handling process and results facilitate subsequent analysis.

[0016] In a second aspect, a security detection method is provided, which is applied to a cloud device. The method includes: receiving a first detection result and a second event sent by each proxy device, where the second event is obtained after the proxy device collects the first event and processes the first event, and the data volume of the second event is smaller than the data volume of the first event; performing a second security detection on the second event based on the first detection result and the second event to obtain a second detection result.

[0017] This application is based on the collaborative detection of collected events by proxy devices and cloud devices, thereby reducing the amount of data transmitted between the two, reducing bandwidth costs and improving detection efficiency.

[0018] In a possible implementation, before receiving the first detection result and the second event sent by each proxy device, the method further includes: issuing a collection strategy to each proxy device, where the collection strategy is used by the proxy device to collect the first event.

[0019] In a possible implementation, before receiving the first detection result and the second event from each proxy device, the method further includes: issuing a security whitelist to each proxy device, where the security whitelist is used by the proxy device to filter the first event to obtain the second event.

[0020] Since the first event collected by the proxy device can be implemented according to the collection strategy issued by the cloud device, the cloud device can also issue filtering configurations to the proxy device. Therefore, in addition to passively receiving data reported by the proxy device, the cloud can also dynamically adjust the collection, detection and filtering configurations of the proxy device.

[0021] In one possible implementation, a second security check is performed on the second event based on the first detection result and the second event to obtain a second detection result, including: performing correlation analysis on the second events sent by each proxy device in combination with a security information library, cross-device events, historical statistical data and the first detection result, and obtaining a second detection result based on the correlation analysis result.

[0022] In a possible implementation, performing a second security check on the second event to obtain a second check result includes: processing the second event according to a handling strategy when the second check result indicates that there is a security issue with the second event.

[0023] In a third aspect, a security detection device is provided, which includes: a transceiver module for performing the reception and / or transmission related operations performed by the security detection device in any one of the methods in the first aspect; and a processing module for performing other operations in addition to the reception and / or transmission related operations performed by the security detection device in any one of the methods in the first aspect.

[0024] In a fourth aspect, a security detection device is provided, which includes: a transceiver module for performing the reception and / or transmission related operations performed by the security detection device in any one of the methods described in the second aspect; and a processing module for performing other operations in addition to the reception and / or transmission related operations performed by the security detection device in any one of the methods described in the second aspect.

[0025] In a fifth aspect, a communication device is provided, comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other via an internal connection path; the memory is configured to store instructions; and the processor is configured to execute the instructions stored in the memory to control the transceiver to receive signals and to control the transceiver to transmit signals. When the processor executes the instructions stored in the memory, the processor performs the method according to the first aspect or any possible implementation of the first aspect.

[0026] In a sixth aspect, another communication device is provided, comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other via an internal connection path. The memory is configured to store instructions, and the processor is configured to execute the instructions stored in the memory to control the transceiver to receive signals and to control the transceiver to transmit signals. When the processor executes the instructions stored in the memory, the processor performs the method according to the second aspect or any possible implementation of the second aspect.

[0027] Optionally, there are one or more processors and one or more memories.

[0028] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0029] In the specific implementation process, the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated on the same chip as the processor or be set on different chips. This application does not limit the type of memory and the setting method of the memory and the processor.

[0030] In a seventh aspect, a security detection system is provided, which includes a proxy device and a cloud device, wherein the proxy device is used to execute any of the methods described in the first aspect, and the cloud device is used to execute any of the methods described in the second aspect.

[0031] In an eighth aspect, a computer program (product) is provided, which includes: computer program code, which, when executed by a computer, enables the computer to execute the methods in the above aspects.

[0032] In a ninth aspect, a computer-readable storage medium is provided, which stores a program or instruction. When the program or instruction runs on a computer, the methods in the above aspects are executed.

[0033] In a tenth aspect, a chip is provided, comprising a processor for calling and executing instructions stored in a memory from the memory, so that a communication device equipped with the chip executes the methods in the above aspects.

[0034] In the eleventh aspect, another chip is provided, comprising: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the methods in the above aspects.

[0035] In the twelfth aspect, a security detection device is provided, which includes a memory and a processor; at least one instruction is stored in the memory, and the at least one instruction is loaded and executed by the processor to enable the security detection device to perform the methods in the above aspects.

[0036] It should be understood that the beneficial effects achieved by the technical solutions of the third to twelfth aspects and the corresponding possible implementation methods can be referred to the technical effects of the first or second aspects and their corresponding possible implementation methods, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] FIG1 is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0038] FIG2 is a schematic diagram of another implementation environment provided by an embodiment of the present application;

[0039] FIG3 is an interactive flow chart of a security detection method provided in an embodiment of the present application;

[0040] FIG4 is a schematic diagram of the structure of a traceability diagram provided in an embodiment of the present application;

[0041] FIG5 is a schematic diagram of a reporting process of a repeated event provided in an embodiment of the present application;

[0042] FIG6 is a schematic diagram of another safety detection process provided by an embodiment of the present application;

[0043] FIG7 is a schematic diagram of another safety detection process provided by an embodiment of the present application;

[0044] FIG8 is a schematic diagram of a security detection process on a proxy device side provided in an embodiment of the present application;

[0045] FIG9 is a schematic diagram of the structure of a security detection device provided in an embodiment of the present application;

[0046] FIG10 is a schematic diagram of the structure of another security detection device provided in an embodiment of the present application;

[0047] FIG11 is a schematic diagram of the structure of a computer device provided in an embodiment of the present application;

[0048] FIG12 is a schematic diagram of the structure of another computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] The terms used in the implementation section of this application are only used to explain the specific embodiments of this application and are not intended to limit this application.

[0050] With the rapid development of the internet, more and more security detection issues have emerged in networks. Furthermore, with the escalation of network attack and defense, more and more advanced threats and unknown samples are able to evade traditional security solutions. To address this situation, endpoint detection and response (EDR) has emerged and has become a key focus for security vendors and enterprises. EDR solutions comprehensively monitor program execution records on user terminals and analyze them through big data, providing a comprehensive approach to security detection, including insight into hacker attacks.

[0051] In related technologies, EDR solutions typically combine a collection agent deployed on user terminals with advanced cloud-based analysis capabilities and security operations personnel to implement security detection. The agent is solely responsible for data collection, while the majority of data analysis functions are deployed in the cloud. This approach inevitably incurs heavy bandwidth and storage costs. Furthermore, as the number of cloud-connected terminals increases, computing pressure increases, compromising real-time detection. Furthermore, the sheer volume of certain types of data makes it impossible to send all of it to the cloud, such as file and registry reads and memory operations. Relying solely on cloud-based analysis can miss key attack details.

[0052] In order to solve the cost and delay problems caused by uploading massive amounts of original events to the cloud, while retaining the security detection capabilities of complex threats in the cloud, an embodiment of the present application proposes a cloud-edge collaborative security detection method. For example, the method can be applied to the implementation environment shown in Figure 1. As shown in Figure 1, the implementation environment includes a cloud device 101 and an agent device 102. Each agent device 102 communicates with the cloud device 101 in a wired or wireless manner. The number of agent devices 102 can be multiple. Figure 1 only shows three agent devices 102 as an example for illustration. Among them, the embodiment of the present application does not limit the product form of the cloud device 101 and the agent device 102. For example, the cloud device 101 can be a cloud server, a cloud server cluster, a separate cloud device or other device that can implement security detection in the cloud. The agent device 102 is responsible for collecting the original operations of non-cloud devices such as terminals, and can be deployed on various types of user terminal devices. For example, the terminal can be a desktop, a notebook, a handheld terminal and a server.

[0053] Exemplarily, the implementation environment can also be deployed using the distributed architecture shown in FIG2 . In FIG2 , the implementation environment includes a management and analysis platform and multiple agent devices (Agents). The management and analysis platform can be deployed on the cloud device 101 shown in FIG1 . For example, the management and analysis platform can be deployed on a public cloud, an enterprise private cloud, or a physical server. The agent device in FIG2 can be the agent device shown in FIG1 . For any agent device in FIG2 , the agent device includes a collection module, a graph streaming processing (GSP) engine, and a reporting module. The agent is a collection agent. The collection module is responsible for collecting raw terminal operations, collecting data, and feeding it into the GSP engine for local analysis. Based on the analysis results, a response action is executed, such as local handling of events involving security issues. Optionally, the GSP engine can also perform at least one of filtering and aggregation of events based on the configuration issued by the cloud device, and transmit the processed events to the management and analysis platform of the cloud device via the reporting module. The management and analysis platform includes an interface display module, an operation platform, a configuration delivery module, an analysis module, and a storage module. The operation platform collects and stores raw events from each terminal. The analysis module then conducts a more in-depth analysis of events from different terminals to detect security issues that might not be detected within a single terminal or a short time window. For example, correlation analysis can be performed by combining the threat information database, cross-terminal events, and historical statistical data to detect security issues such as advanced threats that might have been missed within a single terminal. Furthermore, the cloud device provides an interface display module, allowing enterprise administrators or security operations personnel to view threat events with security concerns or conduct proactive detection through the operation platform. The configuration and delivery module can also be used to distribute collection policies and other configurations. Furthermore, the storage module can store processing logs for subsequent analysis.

[0054] 3 , the security detection method provided in the embodiment of the present application may include but is not limited to the following steps S301 - S306 .

[0055] In S301 , the agent device collects a first event.

[0056] The embodiment of the present application does not limit the triggering conditions for the agent device to collect the first event. It can be real-time collection, or it can be triggered after receiving a collection instruction, or it can be periodic triggering of the collection of the first event. For example, the cloud device sends a collection strategy to each agent device, and the collection strategy is used by the agent device to collect the first event. Therefore, the agent device collects the first event, including: collecting the first event according to the collection strategy issued by the cloud device or the collection configuration of the agent device. Among them, the first event is an operation event on the terminal connected to the agent device management. The embodiment of the present application does not limit the type and number of the first event. For example, the first event can include process startup events, file read / write / rename / delete / create / modify security attributes, network transmission and reception, registry creation / modification / deletion, memory read / write / modify attributes, inter-process communication (IPC), local procedure call (LPC), process injection, thread start and stop, thread call stack, user mouse event, universal serial bus (USB) hardware event, etc.

[0057] In S302 , the agent device performs a first security check on the first event and obtains a first check result.

[0058] In the embodiment of the present application, the data corresponding to the first event collected from the terminal usually shows obvious graph features, or is called a subject-verb-object structure, such as the "PROC_FORK (derive instruction process)" event that describes process A generating child process B, and the "FILE_WRITE (write file)" event that describes process A writing data to file B. Therefore, the original EDR event, that is, the first event, can be mapped to a dependency edge of "(head)-[edge]->(tail)", and the detection and association of complex threats can be completed with the help of a graph model. For example, the above-mentioned process fork (derive) event will be converted into a dependency edge of (A process: pid=9)-[PROC_FORK:cmdLine=XXX]-->(B process: pid=99). This graph data structure established based on the original EDR event is called a provenance graph (PG).

[0059] In one possible implementation, the agent device performs a first security check on the first event and obtains a first detection result, including: converting the first event into a traceability graph, the traceability graph includes multiple nodes and edges, the nodes represent different types of system entities included in the first event, and the edges represent the operational relationship between the system entities corresponding to the connected nodes, and the nodes and edges each have corresponding attribute information; performing a first security check on the first event based on the traceability graph to obtain a first detection result.

[0060] Taking a fragment of the traceability graph shown in Figure 4 as an example, system entities in an event can be represented by different types of nodes. System entities include but are not limited to processes, networks, files, registries, and the Domain Name System (DNS). In Figure 4, these entities can be represented by nodes of different shapes. The operational relationships between system entities are represented by different types of dependency edges, with the direction of the dependency edge representing the actual direction of dependency diffusion. Each type of node has a universally unique identifier (UUID). For example, processes have their own process UUIDs, while files are uniquely identified by their full paths. Similarly, the registry is uniquely identified by its full path. In addition, both nodes and edges can carry additional attribute information for security analysis. For example, process nodes can carry attributes such as the process identifier (PID), command line (cmdLine), and message-digest algorithm version 5 (MD5), while file nodes can carry attributes such as creation time, last modification time, and MD5.

[0061] Among them, converting the first event into a traceability graph includes but is not limited to: obtaining a traceability graph model, the traceability graph model includes the types of nodes and edges and the definition of fields, and also includes descriptive information for converting the event into a graph structure; determining the nodes and edges corresponding to the first event through the traceability graph model, and converting the first event into a traceability graph according to the nodes and edges corresponding to the first event.

[0062] Among them, the tracing graph model (Scheme) can be sent from the cloud device to the proxy device, or it can be built-in to the proxy device, by converting the original event into a dependent edge structure of (head)-[edge]->(tail). The Scheme here refers to the definition of a tracing graph model, which includes the types of nodes and edges and the definition of each field, as well as a description of how to convert the graph structure according to the original event. A hidden prerequisite for the successful conversion of the graph structure is that the original event sent by the acquisition end contains all the necessary fields. There are many methods in the industry for event collection through kernel state or user state code, which will not be repeated in the embodiments of this application. The Scheme can be dynamically adjusted according to demand to adapt to the new downstream analysis module. Taking the original event of the process creation, file modification, and registry modification operations in Table 1 below, that is, the first event, as an example, a possible tracing graph model is described.

[0063] Table 1

[0064] For example, this process can be illustrated in Figure 6. The proxy device sends the first event it collects to the GSP in real time. The GSP uses a provenance graph model (either built-in or distributed by a cloud device) to determine the nodes and edges corresponding to the first event. This translates the first event into dependent edges. Once the graph structure is obtained, the dependent edges (i.e., the determined nodes and edges) are inserted into the provenance graph in real time, completing real-time updates and security checks on the provenance graph. In one possible implementation, the GSP can internally cache graph data and update and eliminate expired data using a circular queue to ensure that engine memory usage remains within limits. For example, the default configuration is for the GSP to cache a reference number of, say, 10,000 recent events. This reference number can be modified based on memory usage and desired detection performance. Using this mechanism, new events automatically update the oldest event. After updating the graph structure (i.e., obtaining the provenance graph), the real-time detection process can begin, outputting detected security-related events and triggering subsequent actions. Processing then continues with the next first event.

[0065] The detection process can also be illustrated in Figure 7. The GSP engine receives the first event sent by the collection end in real time. The GSP engine supports the attachment of different custom detection operators (user-defined functions, UDFs). These operators are designed based on the concept of real-time graph computing to meet performance constraints and detection latency requirements. For example, abnormal subgraph detection based on RiskScore accumulation and attack path detection based on streaming indicator of attack (IOA) matching are all possible. If any operator detects a threat, that is, an event with a security issue, an alarm result will be output.

[0066] In one possible implementation, a first security check is performed on the first event based on the traceability graph, including: matching the traceability graph with each security rule, assigning a corresponding alarm label and alarm value (also called a risk score (riskScore)) to the subgraph that hits any security rule, and the alarm label is used to indicate the alarm type; when the cumulative alarm value of the traceability graph exceeds the alarm threshold, the alarm label assigned to the traceability graph is matched with the security rule combination, and when the alarm label assigned to the traceability graph hits the security rule combination, the subgraph assigned the alarm label is determined to be a target subgraph with a security problem, and the event corresponding to the target subgraph is used as a target event with a security problem, to obtain a first detection result, which includes the target subgraph and the target event. Among them, when the behavioral alarm labels are aggregated in real time along the traceability graph, as shown in Figure 7, the virus alarm results can also be aggregated, and then the riskScore is accumulated. When the cumulative alarm value of the traceability graph exceeds the alarm threshold, the alarm label assigned to the traceability graph is sent to the multi-modal rule engine, which matches it with the security rule combination. When the multi-modal combination described by the rule in the security rule combination is matched, the threat event (also known as the target event) and the threat subgraph (also known as the target event) are output. The threat subgraph is then sent to the disposal module for complete disposal and reporting.

[0067] The embodiments of this application do not limit the content and number of security rules. Security rules can also be called single-pattern matching rules. An example of a single-pattern matching rule, also known as a security rule, is as follows:

[0068] For example, the embodiments of the present application do not limit the content of the security rule combination. For example, an example of a multi-pattern matching rule, that is, a security rule combination, is as follows:

[0069] Attack path detection based on streaming IOA matching and abnormal subgraph detection based on riskScore accumulation are one implementation method of the above detection process. Both of them transmit and converge alarm labels along the traceability graph. The propagation direction can be one-way transmission or convergence along the subgraph. The embodiments of this application will not be described one by one here.

[0070] Regardless of the detection method adopted, after performing a first security detection on the first event and obtaining the first detection result, it also includes: when the first detection result indicates that the first event has a security problem, processing the first event according to the disposal strategy; logging the disposal process and disposal results. For example, when the agent device detects a first event with a security problem, it notifies the user through a pop-up window or other mechanism, and logs the disposal process and disposal results. In addition, the embodiment of the present application does not limit the way of processing the first event according to the disposal strategy. For example, if the calculation result shows that a threatening event has occurred, that is, an event with a security problem, a subsequent response is triggered, which includes but is not limited to local disposal and uploading to the cloud device. For example, the agent device can deeply dispose along the traceability graph, kill processes, isolate virus samples, restore registry modifications, clean up scheduled tasks / services, etc.

[0071] In summary, as shown in Figure 8, the proxy device collects the original first event and sends it to the GSP. The GSP engine implements cache self-elimination based on a circular queue to ensure stable memory usage. Simultaneously, the detection logic is designed based on real-time graph computing to ensure efficient performance and real-time detection. Finally, local processing is performed based on the GSP engine's detection results (such as the resulting threat subgraph, also known as the target subgraph). After the detection is completed, a detection completion signal can be output to exit the detection process.

[0072] In S303 , the proxy device processes the first event to obtain a second event, where the data volume of the second event is smaller than the data volume of the first event.

[0073] In the cloud-edge collaboration method adopted in the embodiment of the present application, in addition to performing security detection locally, the proxy device can also process the first event to obtain a second event with a data volume smaller than that of the first event. The second event can be subsequently reported to the cloud device, thereby realizing cloud-edge collaboration. Among them, the embodiment of the present application does not limit the way in which the proxy device processes the first event, and it is sufficient to reduce the data volume of the first event and ensure that the data reflected by the second event is not missing. For example, the proxy device can use at least one of filtering and aggregation to process the first event. The filtering configuration includes but is not limited to overall filtering based on the above-mentioned event type, and also includes filtering based on specific objects such as trusted application lists (also called white lists), trusted IP / DNS, program hashes, etc.

[0074] Exemplarily, the first event is processed to obtain the second event, including but not limited to the following processing methods.

[0075] Processing method 1: filter the first event that hits the security whitelist, and use the first event that is not filtered as the second event.

[0076] The security whitelist used in this processing method 1 can be sent from the cloud device to each proxy device, so that the proxy device can filter the first event and obtain the second event. For specific tenants or machines, security operations personnel can configure the filtering whitelist as needed to filter a large number of events in the security whitelist, thereby reducing bandwidth and storage pressure. The proxy device only reports events that require attention, that is, events that are not in the security whitelist. It should be noted that the reporting filter occurs after the graph engine has fully analyzed the event. Only events that hit the security whitelist and the graph engine does not detect suspicious signals will be filtered. As shown in Table 2 below, there are examples of application events in the security whitelist that can be filtered.

[0077] Table 2

[0078] Processing method 2: aggregate the repeated events in the first event and obtain the second event based on the aggregation result.

[0079] Because the original first event collected will contain a large amount of duplicate data, such as a process continuously writing data to a log file, or a remote conference program continuously accessing the same network address. For threat detection and attack investigation, event aggregation and deduplication can be completed without losing attack dependencies. Therefore, after the original first event is analyzed by the GSP graph engine, the event will be aggregated based on the consistency of <head-edge-tail>, and the number of aggregations and intervals will be reported at regular intervals. Taking the aggregation reporting process based on the GSP engine shown in Figure 5 as an example, Table 3 shows examples of duplicate events that can be aggregated in actual machines.

[0080] Table 3

[0081] Processing method three: filter the first event that hits the security whitelist, aggregate the repeated events in the first event that are not filtered, and obtain the second event based on the aggregation result.

[0082] In the third processing method, the process of filtering the first event can refer to the first processing method, and the process of aggregating repeated events in the unfiltered first event can refer to the second processing method, which will not be repeated here.

[0083] Processing method 4 is to aggregate repeated events in the first event, filter the first event that hits the security whitelist in the aggregation result, and use the unfiltered first event as the second event.

[0084] The difference between the fourth processing method and the third processing method is that the order of aggregation and filtering is different. The process of aggregation and filtering can refer to the above-mentioned first processing method and the second processing method, which will not be repeated here.

[0085] In S304 , the proxy device sends the first detection result and the second event to the cloud device. The first detection result and the second event are used by the cloud device to perform a second security detection on the second event to obtain a second detection result.

[0086] Based on the above-mentioned process of S301-S303, the proxy device obtains the first detection result and the second event, and sends the first detection result and the second event to the cloud device, which performs further detection to achieve cloud-edge collaborative security detection. The embodiment of the present application does not limit the timing and method of the proxy device sending the first detection result and the second event to the cloud device. For example, after the proxy device detects and obtains the first detection result, it can send the first detection result to the cloud device, or after detecting and obtaining the first detection result and processing the second event, it can send the first detection result and the second event together to the cloud device. Alternatively, after the proxy device receives the receive or obtain instruction sent by the cloud device, it sends the first detection result and the second event to the cloud device.

[0087] In S305 , the cloud device receives the first detection result and the second event sent by each proxy device. The second event is obtained after the proxy device collects and processes the first event. The data volume of the second event is smaller than that of the first event.

[0088] As described in S304 above, the proxy device can send the first detection result and the second event separately to the cloud device, and the cloud device will receive the first detection result and the second event separately. If the proxy device sends the first detection result and the second event together to the cloud device, the cloud device will receive the first detection result and the second event together.

[0089] In S306 , the cloud device performs a second security check on the second event based on the first detection result and the second event to obtain a second detection result.

[0090] In one possible implementation, after receiving the second event, the cloud device may also obtain a traceability diagram and perform a security check based on the traceability diagram. The embodiment of the present application does not limit the manner in which the cloud device performs a security check on the second event. Exemplarily, the cloud device performs a second security check on the second event based on the first test result and the second event to obtain a second test result, including: performing a correlation analysis on the second event sent by each proxy device in combination with a security information library, cross-device events, historical statistical data, and the first test result, and obtaining the second test result based on the correlation analysis result.

[0091] For example, after receiving the second event and the first detection result, the management and analysis platform stores them in a big data platform, which can be a data lake or a graph database. The management and analysis platform then combines historical statistical information, cross-terminal data, and cross-data source information (static detection combined with the security information library) to perform correlation analysis to detect missed advanced threats. This detection can be triggered in real time or on a scheduled basis. For example, security operations personnel can also proactively trigger attack investigations and security detection.

[0092] The cloud device performs a second security check on the second event and obtains a second detection result, including: if the second detection result indicates that the second event has a security issue, handling the second event according to the handling strategy. This embodiment of the application does not limit the manner in which the cloud device handles the second event. For example, the detected threat event, i.e., the event with a security issue, may be presented on a page, and handled by security operations personnel.

[0093] The method provided in the embodiment of the present application realizes security detection through cloud-edge collaboration, solves the storage and performance problems of real-time graph computing, and has higher accuracy and real-time detection for complex threats. Since the data volume of the second event is smaller than that of the first event, the original first event is sent to the cloud, and only the key second event is reported to the cloud, which improves detection efficiency and saves bandwidth. The cloud device can ensure the recall rate and traceability integrity of complex threats. In addition, since the first event collected by the proxy device can be implemented according to the collection strategy issued by the cloud device, the cloud device can also issue filtering configurations to the proxy device. Therefore, in addition to passively receiving the data reported by the proxy device, the cloud can also dynamically adjust the collection, detection and filtering configurations of the proxy device.

[0094] The above describes the security detection method provided by the embodiment of the present application. Corresponding to the above method, the embodiment of the present application also provides a security detection device. Figure 9 is a structural diagram of a security detection device provided by the embodiment of the present application, and the device is applied to the proxy device in Figure 3 above. Based on the following multiple modules shown in Figure 9, the security detection device shown in Figure 9 can perform all or part of the operations performed by the proxy device. It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown therein, and the embodiment of the present application does not limit this. As shown in Figure 9, the device includes:

[0095] A collection module 901 is configured to collect a first event;

[0096] A detection module 902 is configured to perform a first security detection on the first event and obtain a first detection result;

[0097] A processing module 903 is configured to process the first event to obtain a second event, where the amount of data of the second event is smaller than that of the first event;

[0098] The sending module 904 is used to send the first detection result and the second event to the cloud device. The first detection result and the second event are used by the cloud device to perform a second security detection on the second event to obtain a second detection result.

[0099] In a possible implementation, the collection module 901 is configured to collect the first event according to the collection policy issued by the cloud device or the collection configuration of the proxy device.

[0100] In one possible implementation, the detection module 902 is used to convert the first event into a traceability graph, which includes multiple nodes and edges. The nodes represent different types of system entities included in the first event, and the edges represent the operational relationships between the system entities corresponding to the connected nodes. The nodes and edges each have corresponding attribute information; a first security detection is performed on the first event based on the traceability graph to obtain a first detection result.

[0101] In one possible implementation, the detection module 902 is used to obtain a traceability graph model, which includes the types of nodes and edges and the definition of fields, and also includes descriptive information for converting events into a graph structure; the nodes and edges corresponding to the first event are determined through the traceability graph model, and the first event is converted into a traceability graph based on the nodes and edges corresponding to the first event.

[0102] In one possible implementation, the detection module 902 is used to match the traceability graph with each security rule, and assign a corresponding alarm label and alarm value to the subgraph that hits any security rule, and the alarm label is used to indicate the alarm type; when the cumulative alarm value of the traceability graph exceeds the alarm threshold, the alarm label assigned to the traceability graph is matched with the security rule combination, and when the alarm label assigned to the traceability graph hits the security rule combination, the subgraph assigned the alarm label is determined as the target subgraph with a security problem, and the event corresponding to the target subgraph is used as the target event with a security problem to obtain a first detection result, which includes the target subgraph and the target event.

[0103] In one possible implementation, the processing module 903 is used to filter the first event that hits the security whitelist and use the unfiltered first event as the second event; or, aggregate the repeated events in the first event and obtain the second event based on the aggregation result; or, filter the first event that hits the security whitelist, aggregate the repeated events in the unfiltered first event, and obtain the second event based on the aggregation result; or, aggregate the repeated events in the first event, filter the first event that hits the security whitelist in the aggregation result, and use the unfiltered first event as the second event.

[0104] In a possible implementation, the processing module 903 is further configured to process the first event according to a handling strategy when the first detection result indicates that the first event has a security issue; and log the handling process and handling results.

[0105] Corresponding to the above method, an embodiment of the present application also provides a security detection device. Figure 10 is a structural diagram of a security detection device provided by an embodiment of the present application, and the device is applied to the cloud device in Figure 3 above. Based on the following multiple modules shown in Figure 10, the security detection device shown in Figure 10 can perform all or part of the operations performed by the cloud device. It should be understood that the device may include more additional modules than the modules shown or omit some of the modules shown therein, and the embodiment of the present application does not limit this. As shown in Figure 10, the device includes:

[0106] A receiving module 1001 is configured to receive a first detection result and a second event sent by each proxy device, where the second event is obtained after the proxy device collects and processes the first event, and the amount of data in the second event is smaller than that in the first event.

[0107] The detection module 1002 is configured to perform a second security detection on the second event based on the first detection result and the second event to obtain a second detection result.

[0108] In a possible implementation, the apparatus further includes a first sending module, configured to send a collection strategy to each proxy device, where the collection strategy is used by the proxy device to collect the first event.

[0109] In a possible implementation, the apparatus further includes a second sending module, configured to send a security whitelist to each proxy device, where the security whitelist is used by the proxy device to filter the first event to obtain the second event.

[0110] In one possible implementation, the detection module 1002 is configured to perform correlation analysis on the second events sent by each proxy device in combination with the security information library, cross-device events, historical statistical data, and the first detection result, and obtain a second detection result based on the correlation analysis result.

[0111] In a possible implementation, the detection module 1002 is configured to process the second event according to a handling strategy when the second detection result indicates that the second event has a security issue.

[0112] It should be understood that the devices provided in FIG. 9 or FIG. 10 above are merely examples of the division of the functional modules described above when implementing their functions. In actual applications, the functions described above can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the devices and method embodiments provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0113] Referring to Figure 11 , Figure 11 shows a schematic diagram of the structure of a computer device 2000 provided in accordance with an exemplary embodiment of the present application. The computer device 2000 shown in Figure 11 is used to perform the operations involved in the security detection method shown in Figure 3 . The computer device 2000 is, for example, a switch or router, and can be implemented using a general bus architecture.

[0114] As shown in FIG. 11 , a computer device 2000 includes at least one processor 2001 , a memory 2003 , and at least one communication interface 2004 .

[0115] The processor 2001 is, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, the processor 2001 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of the present invention. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0116] Optionally, computer device 2000 also includes a bus. The bus is used to transmit information between the various components of computer device 2000. The bus may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, for example. Buses can be classified as address buses, data buses, control buses, etc. For ease of illustration, FIG11 shows only one line, but this does not mean that there is only one bus or only one type of bus.

[0117] The memory 2003 is, for example, a read-only memory (ROM) or other type of static storage device that can store static information and instructions, or a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2003 is, for example, independent and connected to the processor 2001 via a bus. The memory 2003 can also be integrated with the processor 2001.

[0118] The communication interface 2004 uses any transceiver-like device for communicating with other devices or communication networks. The communication network can be Ethernet, a radio access network (RAN), or a wireless local area network (WLAN). The communication interface 2004 can include a wired communication interface or a wireless communication interface. Specifically, the communication interface 2004 can be an Ethernet interface, a Fast Ethernet (FE) interface, a Gigabit Ethernet (GE) interface, an Asynchronous Transfer Mode (ATM) interface, a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In the embodiment of the present application, the communication interface 2004 can be used for the computer device 2000 to communicate with other devices.

[0119] In a specific implementation, as an embodiment, the processor 2001 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG11 . Each of these processors may be a single-core CPU processor or a multi-core CPU processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0120] In a specific implementation, as an embodiment, the computer device 2000 may include multiple processors, such as processor 2001 and processor 2005 shown in Figure 11. Each of these processors may be a single-core CPU or a multi-core CPU. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0121] In a specific implementation, as an embodiment, the computer device 2000 may further include an output device and an input device. The output device communicates with the processor 2001 and can display information in a variety of ways. For example, the output device can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device communicates with the processor 2001 and can receive user input in a variety of ways. For example, the input device can be a mouse, a keyboard, a touch screen device, or a sensor device.

[0122] In some embodiments, the memory 2003 is used to store program code 2010 for executing the solution of the present application, and the processor 2001 can execute the program code 2010 stored in the memory 2003. In other words, the computer device 2000 can implement the security detection method provided by the method embodiment through the processor 2001 and the program code 2010 in the memory 2003. The program code 2010 may include one or more software modules. Optionally, the processor 2001 itself can also store program code or instructions for executing the solution of the present application.

[0123] In a specific embodiment, the computer device 2000 of the embodiment of the present application may correspond to the proxy device or cloud device in the above-mentioned method embodiments. The processor 2001 in the computer device 2000 reads the instructions in the memory 2003, so that the computer device 2000 shown in Figure 11 can execute all or part of the operations performed by the proxy device or cloud device.

[0124] The computer device 2000 may also correspond to the security detection apparatus shown in FIG. 9 or FIG. 10 , and each functional module in the security detection apparatus is implemented using software of the computer device 2000. In other words, the functional modules included in the security detection apparatus are generated by the processor 2001 of the computer device 2000 after reading the program code 2010 stored in the memory 2003.

[0125] Among them, each step of the security detection method shown in Figure 3 is completed by the hardware integrated logic circuit or software instructions in the processor of the computer device 2000. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the art such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0126] Referring to FIG. 12 , FIG. 12 shows a schematic diagram of the structure of a computer device 2100 provided in another exemplary embodiment of the present application. The computer device 2100 shown in FIG. 12 is configured to perform all or part of the operations involved in the security detection method shown in FIG. 3 . The computer device 2100 is, for example, a switch or router, and can be implemented using a general bus architecture.

[0127] As shown in FIG. 12 , the computer device 2100 includes a main control board 2110 and an interface board 2130 .

[0128] The main control board (2110), also known as the main processing unit (MPU) or route processor card, is used to control and manage various components in computer device 2100, including routing calculations, device management, device maintenance, and protocol processing. It includes a central processing unit (CPU) 2111 and memory 2112.

[0129] Interface board 2130 is also known as a line processing unit (LPU), line card, or service board. It provides various service interfaces and implements data packet forwarding. Service interfaces include, but are not limited to, Ethernet interfaces and POS (Packet over SONET / SDH) interfaces. Ethernet interfaces, for example, are Flexible Ethernet Clients (FlexE Clients) interfaces. Interface board 2130 includes a central processing unit (CPU) 2131, a network processor (NPU) 2132, a forwarding table memory 2134, and a physical interface card (PIC) 2133.

[0130] The central processing unit 2131 on the interface board 2130 is used to control and manage the interface board 2130 and communicate with the central processing unit 2111 on the main control board 2110 .

[0131] The network processor 2132 is used to implement message forwarding processing. The network processor 2132 can be in the form of a forwarding chip. The forwarding chip can be a network processor (NP). In some embodiments, the forwarding chip can be implemented using an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA). Specifically, the network processor 2132 is used to forward received messages based on the forwarding table stored in the forwarding entry memory 2134. If the destination address of the message is the address of the computer device 2100, the message is sent to the CPU (such as the central processing unit 2131) for processing. If the destination address of the message is not the address of the computer device 2100, the next hop and outgoing interface corresponding to the destination address are searched in the forwarding table based on the destination address, and the message is forwarded to the outgoing interface corresponding to the destination address. The processing of uplink messages may include processing the message inbound interface and forwarding table lookup; the processing of downlink messages may include forwarding table lookup, etc. In some embodiments, the central processing unit may also perform the functions of the forwarding chip, such as implementing software forwarding based on a general-purpose CPU, thereby eliminating the need for a forwarding chip in the interface board.

[0132] Physical interface card 2133 implements physical layer interconnection. Raw traffic enters interface board 2130 through this card, and processed packets are sent out from this physical interface card 2133. Physical interface card 2133, also known as a daughter card, can be installed on interface board 2130. It converts optical and electrical signals into packets, performs a validity check on these packets, and then forwards them to network processor 2132 for processing. In some embodiments, central processing unit 2131 can also perform the functions of network processor 2132, such as implementing software forwarding based on a general-purpose CPU, thus eliminating the need for network processor 2132 in physical interface card 2133.

[0133] Optionally, computer device 2100 includes multiple interface boards. For example, computer device 2100 further includes interface board 2140. Interface board 2140 includes a central processing unit 2141, a network processor 2142, a forwarding table entry memory 2144, and a physical interface card 2143. The functions and implementation of each component in interface board 2140 are the same as or similar to those of interface board 2130 and are not described in detail here.

[0134] Optionally, computer device 2100 further includes a switch fabric board 2120. Switch fabric board 2120 may also be referred to as a switch fabric unit (SFU). If computer device 2100 includes multiple interface boards, switch fabric board 2120 is used to exchange data between the interface boards. For example, interface board 2130 and interface board 2140 can communicate via switch fabric board 2120.

[0135] The main control board 2110 is coupled to the interface board. For example, the main control board 2110, the interface board 2130, the interface board 2140, and the switching network board 2120 are connected to the system backplane via a system bus to achieve intercommunication. In one possible implementation, an inter-process communication (IPC) channel is established between the main control board 2110 and the interface boards 2130 and 2140, and communication is performed between the main control board 2110 and the interface boards 2130 and 2140 via the IPC channel.

[0136] Logically, computer device 2100 includes a control plane and a forwarding plane. The control plane includes a main control board 2110 and a central processing unit (CPU) 2111. The forwarding plane includes various components that perform forwarding, such as a forwarding table entry memory 2134, physical interface cards 2133, and a network processor 2132. The control plane performs routing functions, generates forwarding tables, processes signaling and protocol messages, and configures and maintains the computer device's status. The control plane sends the generated forwarding tables to the forwarding plane. On the forwarding plane, the network processor 2132 forwards messages received by the physical interface card 2133 based on the forwarding tables sent by the control plane. The forwarding tables sent by the control plane can be stored in the forwarding table entry memory 2134. In some embodiments, the control plane and forwarding plane can be completely separate and not located on the same computer device.

[0137] It's worth noting that there may be one or more main control boards, including a primary and backup main control board. There may be one or more interface boards. The higher the computer's data processing capabilities, the more interface boards it provides. Interface boards can also have one or more physical interface cards. There may be no switching fabric boards, one or more switching fabric boards, and multiple switching fabric boards can be used to achieve load balancing and redundant backup. In a centralized forwarding architecture, computer equipment may not require switching fabric boards; the interface boards handle the entire system's service data processing. In a distributed forwarding architecture, computer equipment may have at least one switching fabric board, which enables data exchange between multiple interface boards, providing high-capacity data exchange and processing capabilities. Therefore, computer equipment with a distributed architecture offers greater data access and processing capabilities than those with a centralized architecture. Alternatively, a computer device can consist of a single card, without a switching fabric board. The functions of the interface board and the main control board are integrated on this single card. In this case, the central processing unit (CPU) on the interface board and the CPU on the main control board can be combined into a single CPU on this card to perform the combined functions. This type of computer device has lower data exchange and processing capabilities (for example, low-end switches or routers). The specific architecture used depends on the specific networking deployment scenario and is not a limitation.

[0138] In a specific embodiment, the computer device 2100 corresponds to the apparatus for security detection applied to an agent device or a cloud device as shown in FIG. 9 or FIG. 10 .

[0139] The present application also provides a communication device comprising a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other via an internal connection path. The memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to control the transceiver to receive signals and control the transceiver to send signals. When the processor executes the instructions stored in the memory, the processor executes a method required to be executed by a cloud device or a proxy device.

[0140] It should be understood that the processor described above may be a CPU, or other general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor that supports the Advanced Reduced Instruction Set Machine (ARM) architecture.

[0141] Furthermore, in an optional embodiment, the memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. The memory may also include a non-volatile random access memory. For example, the memory may also store device type information.

[0142] The memory may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM), which is used as an external cache memory. By way of example and not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0143] An embodiment of the present application also provides a computer-readable storage medium, in which at least one instruction is stored. The instruction is loaded and executed by a processor to enable a computer to implement any of the security detection methods described above.

[0144] The embodiments of the present application further provide a computer program (product), which, when executed by a computer, can enable a processor or computer to execute the corresponding steps and / or processes in the above method embodiments.

[0145] An embodiment of the present application also provides a chip, including a processor, for calling and executing instructions stored in a memory from a memory, so that a communication device equipped with the chip performs any of the security detection methods described above.

[0146] An embodiment of the present application also provides another chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected through an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute any of the security detection methods described above.

[0147] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive).

[0148] Those skilled in the art will appreciate that the various method steps and modules described in conjunction with the embodiments disclosed herein can be implemented in software, hardware, firmware, or any combination thereof. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0149] Those skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or may be accomplished by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0150] When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer program instructions. As an example, the method of the embodiment of the present application can be described in the context of a machine executable instruction, and the machine executable instruction is such as included in the program module executed in the device on the real or virtual processor of the target. Generally speaking, a program module includes a routine, a program, a library, an object, a class, a component, a data structure, etc., which performs a specific task or realizes a specific abstract data structure. In various embodiments, the function of the program module can be merged or split between the described program modules. The machine executable instruction for the program module can be executed in a local or distributed device. In a distributed device, the program module can be located in both a local and a remote storage medium.

[0151] The computer program code for realizing the method for the embodiment of the application can be written in one or more programming languages.These computer program codes can be provided to the processor of general-purpose computer, special-purpose computer or other programmable data processing device, so that program code, when being executed by computer or other programmable data processing device, causes the function / operation specified in flow chart and / or block diagram to be implemented.Program code can be executed completely on computer, partly on computer, as independent software package, partly on computer and partly on remote computer or completely on remote computer or server.

[0152] In the context of the embodiments of the present application, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like.

[0153] Examples of signals may include electrical, optical, radio, acoustic or other forms of propagated signals, such as carrier waves, infrared signals, etc.

[0154] A machine-readable medium may be any tangible medium that contains or stores a program for or in connection with an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. More detailed examples of machine-readable storage media include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0155] Those skilled in the art will clearly understand that, for the sake of convenience and brevity of description, the specific working processes of the above-described systems, devices, and modules can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0156] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, or can be electrical, mechanical or other forms of connection.

[0157] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0158] In addition, the functional modules in the various embodiments of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into a single module. The above-mentioned integrated modules may be implemented in the form of hardware or software functional modules.

[0159] If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0160] In this application, the terms "first," "second," and the like are used to distinguish between identical or similar items having substantially the same function or effect. It should be understood that "first," "second," and "nth" do not have a logical or temporal dependency, nor do they limit the quantity or order of execution. It should also be understood that although the following description uses the terms "first," "second," and the like to describe various elements, these elements should not be limited by these terms. These terms are simply used to distinguish one element from another.

[0161] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0162] In this application, the term "at least one" means one or more, and the term "plurality" means two or more. For example, "plurality of second messages" means two or more second messages. The terms "system" and "network" are often used interchangeably herein.

[0163] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0164] It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. The term "and / or" describes an association relationship between associated objects, indicating that three possible relationships can exist. For example, "A and / or B" can represent: A exists alone, A and B exists simultaneously, or B exists alone. Furthermore, the character " / " in this application generally indicates that the associated objects are in an "or" relationship.

[0165] It will also be understood that the term “comprise” (also known as “includes,” “including,” “comprises,” and / or “comprising”) when used in this specification specifies the presence of stated features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0166] It should also be understood that the terms “if” and “if” may be interpreted to mean “when” or “upon” or “in response to determining” or “in response to detecting.” Similarly, the phrases “if it is determined that ” or “if [stated condition or event] is detected” may be interpreted to mean “upon determining that ” or “in response to determining that ” or “upon detecting [stated condition or event]” or “in response to detecting [stated condition or event],” depending on the context.

[0167] It should be understood that determining B based on A does not mean determining B based solely on A. B can also be determined based on A and / or other information.

[0168] It should also be understood that references throughout this specification to "one embodiment," "an embodiment," or "one possible implementation" mean that specific features, structures, or characteristics associated with that embodiment or implementation are included in at least one embodiment of the present application. Therefore, the appearance of "in one embodiment," "in an embodiment," or "one possible implementation" throughout this specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0169] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for security detection, characterized in that: The method is applied to a proxy device, and the method comprises: Collect the first event; Performing a first security detection on the first event to obtain a first detection result; Processing the first event to obtain a second event, wherein the amount of data of the second event is smaller than the amount of data of the first event; The first detection result and the second event are sent to a cloud device, where the first detection result and the second event are used by the cloud device to perform a second security detection on the second event to obtain a second detection result.

2. The method according to claim 1, characterized in that The collecting of the first event comprises: The first event is collected according to the collection strategy sent by the cloud device or the collection configuration of the proxy device.

3. The method according to claim 1 or 2, characterized in that: The performing a first security detection on the first event to obtain a first detection result includes: Converting the first event into a traceability graph, wherein the traceability graph includes a plurality of nodes and edges, wherein the nodes represent different types of system entities included in the first event, and the edges represent operation relationships between system entities corresponding to the connected nodes, and the nodes and edges each have corresponding attribute information; A first security check is performed on the first event based on the source tracing diagram to obtain a first check result.

4. The method according to claim 3, characterized in that The converting the first event into a traceability graph includes: Obtaining a traceability graph model, wherein the traceability graph model includes definitions of node and edge types and fields, and also includes description information for converting an event into a graph structure; The nodes and edges corresponding to the first event are determined through the traceability graph model, and the first event is converted into a traceability graph according to the nodes and edges corresponding to the first event.

5. The method according to claim 3 or 4, characterized in that: The performing a first security detection on the first event based on the tracing graph includes: Match the traceability graph with each security rule, and assign a corresponding alarm label and alarm value to the subgraph that hits any security rule, wherein the alarm label is used to indicate the alarm type; When the accumulated alarm value of the traceability graph exceeds the alarm threshold, the alarm label assigned to the traceability graph is matched with the security rule combination. When the alarm label assigned to the traceability graph hits the security rule combination, the subgraph assigned with the alarm label is determined as the target subgraph with a security issue, and the event corresponding to the target subgraph is used as the target event with a security issue to obtain a first detection result, which includes the target subgraph and the target event.

6. The method according to any one of claims 1 to 5, characterized in that: The processing of the first event to obtain a second event includes: Filter the first event that hits the security whitelist, and use the first event that is not filtered as the second event; Alternatively, repeated events in the first event are aggregated, and the second event is obtained according to the aggregation result; Alternatively, the first event that hits the security whitelist is filtered, repeated events in the first event that are not filtered are aggregated, and the second event is obtained according to the aggregation result; Alternatively, repeated events in the first events are aggregated, first events that hit the security whitelist in the aggregation results are filtered, and unfiltered first events are used as the second events.

7. The method according to any one of claims 1 to 6, characterized in that: After performing a first security check on the first event and obtaining a first check result, the method further includes: When the first detection result indicates that the first event has a security problem, processing the first event according to a handling strategy; Keep a log of the disposal process and disposal results.

8. A method for security detection, characterized in that: The method is applied to a cloud device, and the method includes: receiving a first detection result and a second event sent by each proxy device, where the second event is obtained after the proxy device collects the first event and processes the first event, and the data volume of the second event is smaller than the data volume of the first event; A second safety check is performed on the second event according to the first detection result and the second event to obtain a second detection result.

9. The method according to claim 8, characterized in that Before receiving the first detection result and the second event sent by each proxy device, the method further includes: A collection strategy is issued to each of the proxy devices, where the collection strategy is used by the proxy device to collect the first event.

10. The method according to claim 8 or 9, characterized in that: Before receiving the first detection result and the second event sent by each proxy device, the method further includes: A security whitelist is issued to each of the proxy devices, where the security whitelist is used by the proxy device to filter the first event to obtain the second event.

11. The method according to any one of claims 8 to 10, characterized in that: The performing a second security detection on the second event according to the first detection result and the second event to obtain a second detection result includes: The second events sent by the respective proxy devices are subjected to correlation analysis in combination with the security information library, cross-device events, historical statistical data, and the first detection result, and the second detection result is obtained according to the correlation analysis result.

12. The method according to any one of claims 8 to 11, characterized in that: The performing a second security detection on the second event to obtain a second detection result includes: When the second detection result indicates that the second event has a security issue, the second event is processed according to a handling strategy.

13. A safety detection device, characterized in that: The device comprises: A transceiver module, used to perform the receiving and / or sending related operations performed by the security detection device in the method according to any one of claims 1 to 7; A processing module, used to perform other operations besides the receiving and / or sending related operations performed by the security detection device in the method described in any one of claims 1 to 7.

14. A safety detection device, characterized in that: The device comprises: A transceiver module, used to perform the receiving and / or sending related operations performed by the security detection device in the method described in any one of claims 8 to 12; A processing module, used to perform other operations besides the receiving and / or sending related operations performed by the security detection device in the method described in any one of claims 8-12.

15. A safety detection device, characterized in that: The device includes a memory and a processor; at least one instruction is stored in the memory, and the at least one instruction is loaded and executed by the processor, so that the security detection device implements the security detection method described in any one of claims 1-12.

16. A safety detection system, characterized in that: The system includes a proxy device and a cloud device, wherein the proxy device is used to execute the method described in any one of claims 1 to 7, and the cloud device is used to execute the method described in any one of claims 8 to 12.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, which is loaded and executed by a processor to implement the security detection method according to any one of claims 1 to 12.

18. A computer program product, characterized in that The computer program product includes a computer program / instructions, and the computer program / instructions are executed by a processor to enable a computer to implement the security detection method according to any one of claims 1 to 12.

Images