Cyber attack processing method and system, device, storage medium, and program product

Abstract

Embodiments of the present disclosure provide a cyber attack processing method and system, a device, a storage medium, and a program product. In the process of performing security protection on a target host, when a suspicious behavior on the target host is detected, behavior data corresponding to the suspicious behavior may be acquired, and an interception rule corresponding to the suspicious behavior is acquired on the basis of the behavior data, wherein the interception rule is determined by using an attack analysis model. The attack analysis model is obtained by training behavior data samples of processes corresponding to historical cyber attack behaviors, and therefore, the attack analysis model can better grasp knowledge in the field of cyber attacks. When analyzing behavior data of a process of the suspicious behavior, the attack analysis model can more accurately identify and determine the behavior of the process, thereby generating a more adversarial interception rule. Therefore, it is convenient to quickly and accurately process potential security threats corresponding to suspicious behaviors, the risk of missing potential attacks is reduced, and the defensive capability is improved.

Description

Cyber attack processing method, system, device, storage medium and program product

[0001] The present disclosure claims priority to Chinese Patent Application No. 202411103488.0, filed on August 12, 2024 with the Chinese Patent Office, entitled "Cyber attack processing method, system, device, storage medium and program product", the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0002] The present disclosure relates to the technical field of computer, and particularly relates to a cyber attack processing method, system, device, storage medium and program product. BACKGROUND

[0003] Cyber attack refers to any type of malicious behavior against computer information systems, infrastructure, computer networks or personal computer devices. The purpose of such attacks is usually to destroy, expose, modify, disable software or services, or to steal or access computer data without authorization. With the popularity of artificial intelligence generated content (AIGC) technology, especially the release of generative code products, the frequency and complexity of cyber attacks are rising, posing new challenges to cyber attack defense.

[0004] In a traditional host-based intrusion prevention system (HIPS), defense rules are usually generated through manual analysis, and cyber attacks that trigger the defense rules are defended. However, this way of defense has weak defense capability. Therefore, a solution is needed. SUMMARY

[0005] The present disclosure provides a cyber attack processing method, system, device, storage medium and program product to improve the resistance to cyber attacks.

[0006] The present disclosure provides a cyber attack processing method, comprising: when detecting suspicious behavior on a target host, obtaining behavior data of a process corresponding to the suspicious behavior; obtaining an interception rule corresponding to the suspicious behavior according to the behavior data; wherein the interception rule is determined based on a preset attack analysis model, and the attack analysis model is a deep learning model trained according to a behavior data sample of a process corresponding to a historical cyber attack behavior; and intercepting the suspicious behavior according to the interception rule.

[0007] Optionally, the intercept rule corresponding to the suspicious behavior is obtained according to the behavior data, including: sending the behavior data to a server, so that the server inputs the behavior data into the attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; and receiving the intercept rule corresponding to the suspicious behavior returned by the server, the intercept rule being generated by the server according to the attack analysis model after determining that the suspicious behavior is a network attack behavior according to the behavior type prediction label.

[0008] Optionally, the intercept rule corresponding to the suspicious behavior is obtained according to the behavior data, including: sending the behavior data to a server, so that the server inputs the behavior data into the attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; and receiving the intercept rule corresponding to the suspicious behavior returned by the server, the intercept rule being generated by the server according to the attack analysis model after determining that the suspicious behavior is a network attack behavior according to the behavior type prediction label.

[0009] Optionally, the behavior data is sent to the server, including: sending the behavior data to the server through a long connection between the server and the server.

[0010] Optionally, the behavior data of the process corresponding to the suspicious behavior is obtained, including: obtaining a danger level of an operation corresponding to the suspicious behavior; and if the danger level of the operation corresponding to the suspicious behavior is greater than a preset level threshold, obtaining the behavior data of the process corresponding to the suspicious behavior.

[0011] The embodiments of the present disclosure further provide a network attack processing method, including: receiving behavior data of a process corresponding to a suspicious behavior sent by a client, the behavior data being obtained by the client when detecting the suspicious behavior on a target host; inputting the behavior data into a preset attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; the attack analysis model being a deep learning model trained according to behavior data samples of processes corresponding to historical network attack behaviors; if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, determining an intercept rule corresponding to the suspicious behavior; and sending the intercept rule to the client, the intercept rule being used for intercepting the suspicious behavior.

[0012] Optionally, determining the interception rule corresponding to the suspicious behavior comprises: generating, by using the attack analysis model, the interception rule corresponding to the suspicious behavior according to the behavior data; or determining, from at least one interception rule generated by the attack analysis model, the interception rule corresponding to the behavior type prediction label as the interception rule corresponding to the suspicious behavior.

[0013] Optionally, the method further comprises: obtaining behavior data samples of processes corresponding to historical network attack behaviors, the behavior data samples comprising: at least one group of behavior data and respective behavior type true labels of the at least one group of behavior data; inputting the at least one group of behavior data into a preset base model to obtain respective behavior type prediction labels of the at least one group of behavior data; the base model comprising: a content generation type deep learning model; and fine-tuning the base model according to errors between the respective behavior type true labels and the behavior type prediction labels of the at least one group of behavior data until the base model converges, and taking the converged base model as the attack analysis model.

[0014] Optionally, the method further comprises: obtaining a behavior type true label corresponding to the suspicious behavior; and fine-tuning the attack analysis model under triggering of a model update event, so as to reduce errors between the behavior type true label corresponding to the suspicious behavior and the behavior type prediction label corresponding to the suspicious behavior.

[0015] The embodiments of the present disclosure further provide a network attack processing system, comprising: a client and a server; wherein the client is configured to: obtain behavior data of a process corresponding to a suspicious behavior when detecting the suspicious behavior on a target host; send the behavior data to the server and receive an interception rule corresponding to the suspicious behavior returned by the server; and intercept the suspicious behavior according to the interception rule; and the server is configured to: receive the behavior data of the process corresponding to the suspicious behavior sent by the client; input the behavior data into a preset attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; determine an interception rule corresponding to the suspicious behavior if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior; and return the interception rule to the client; and the attack analysis model is a deep learning model trained according to behavior data samples of processes corresponding to historical network attack behaviors.

[0016] The embodiments of the present disclosure further provide an electronic device, comprising: a memory and a processor; the memory is configured to store one or more computer instructions; and the processor is configured to execute the one or more computer instructions to perform steps in the method provided by the embodiments of the present disclosure.

[0017] The embodiment of the present disclosure further provides a computer readable storage medium storing a computer program, and the computer program can implement the steps in the method provided by the embodiment of the present disclosure when executed by a processor.

[0018] The embodiment of the present disclosure further provides a computer program product, comprising: a computer program / instruction, which can implement the steps in the method provided by the embodiment of the present disclosure when executed by a processor.

[0019] The method for processing network attacks provided by the embodiment of the present disclosure comprises the following steps: when detecting suspicious behavior on a target host, acquiring behavior data corresponding to the suspicious behavior, and acquiring an interception rule corresponding to the suspicious behavior according to the behavior data, wherein the interception rule is determined by using an attack analysis model. Based on the interception rule, the suspicious behavior can be intercepted. In this implementation, the attack analysis model is obtained by training on behavior data samples of processes corresponding to historical network attack behaviors, so that the attack analysis model can better master the knowledge in the field of network attacks and better understand and process tasks in the field of network attacks. Based on this, when analyzing the behavior data of the process of the suspicious behavior, the attack analysis model can more accurately identify and judge the behavior of the process, thereby generating an interception rule with stronger adversarialness. Based on the interception rule with stronger adversarialness, the client can more accurately identify network attack behaviors, thereby quickly discovering potential security threats corresponding to the suspicious behavior, reducing the risk of missing potential attacks, reducing false positives and false negatives, and improving defense capabilities. BRIEF DESCRIPTION OF DRAWINGS

[0020] The accompanying drawings described herein are used to provide further understanding of the present disclosure, and form a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions serve to explain the present disclosure, and do not constitute improper limitations on the present disclosure. In the drawings:

[0021] FIG. 1 is a structural schematic diagram of a network attack processing system provided by an example embodiment of the present disclosure;

[0022] FIG. 2 is an interaction schematic diagram of various roles in the network attack processing system provided by an example embodiment of the present disclosure;

[0023] FIG. 3 is a flowchart of the network attack processing method provided by an example embodiment of the present disclosure when executed on the client side;

[0024] FIG. 4 is a flowchart of the network attack processing method provided by an example embodiment of the present disclosure when executed on the server side;

[0025] FIG. 5 is a structural schematic diagram of an electronic device provided by an example embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] In order to make the purposes, technical solutions and advantages of the present disclosure clearer, the technical solutions of the present disclosure will be clearly and completely described below with embodiments of the present disclosure and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present disclosure.

[0027] The terms used in the embodiments of the present disclosure are only for the purpose of describing particular embodiments and are not intended to limit the present disclosure. The singular forms "a", "an" and "the" used in the embodiments of the present disclosure and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. "Plural" generally includes at least two, but does not exclude the case of including at least one.

[0028] It should be understood that the term "and / or" used herein only describes an association relationship of associated objects, which means that there can be three relationships, for example, A and / or B can represent three cases of A alone, A and B together, and B alone. In addition, the character " / " herein generally represents an "or" relationship between the front and rear associated objects.

[0029] It should also be noted that the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such product or system. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the product or system including the element.

[0030] When AIGC technology is applied for malicious purposes, it lowers the threshold for writing attack code, and non-professional attackers can use AIGC tools to generate complex malicious code without deep programming knowledge or understanding of specific system architecture, increasing the number of potential attackers. In addition, AIGC technology makes network attacks tend to be automated, intelligent and weaponized, increasing the number, complexity and detection difficulty of attacks. The automation and intelligence of network attacks means that AIGC tools can automatically create and modify attack strategies to adapt to different targets and defense mechanisms. This intelligence makes network attacks more dynamic, and traditional security solutions may be difficult to keep up with their speed of change. Weaponization of attacks means that attackers can use AIGC tools to quickly generate a large number of customized attack tools, including but not limited to viruses, trojans, backdoors, etc. These tools can be optimized for specific vulnerabilities, increasing the success rate of attacks. Increasing the number and complexity of attacks means that AIGC tools allow attackers to launch multi-threaded attacks simultaneously, increasing the scale of attacks, while the generated code can contain complex logic and obfuscation techniques, increasing the difficulty of analysis and countermeasures. Increasing the detection difficulty means that AIGC tools generate code that can mimic the behavior of legitimate programs or use advanced evasion techniques to bypass common detection methods.

[0031] In this case, the traditional method of generating defense rules based on manual analysis and defending against network attacks based on defense rules cannot cope with the above challenges brought by network attacks based on AIGC tools.

[0032] To solve the above technical problems, in some embodiments of the present disclosure, a solution is provided, and the technical solutions provided by the embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0033] FIG. 1 is a structural schematic diagram of a network attack processing system according to an example embodiment of the present disclosure. As shown in FIG. 1, the network attack processing system 100 can include a client 10, a server 20 and a target host 30.

[0034] The client 10 can run on the target host 30 to protect the target host 30. The target host 30 can be any device that can connect to a network, including but not limited to physical environment entity devices or cloud environment virtual devices. For example, in some scenarios, the target host 30 can be any entity device that can connect to a network, such as a mobile phone, a computer, a smart wearable device, a smart home device, a physical server, etc. In other scenarios, the target host 30 can be a virtual machine, a virtual server, a cloud desktop, etc. virtual devices running in a cloud environment.

[0035] The server 20 can be a physical server or a virtual server in a cloud environment, and the embodiment is not limited thereto. The server 20 can communicate with a plurality of clients, and can provide the clients 10 with analysis services of network attack behaviors based on a pre-trained attack analysis model. Details will be described below.

[0036] In the network attack processing system 100, the client 10 is mainly used to detect suspicious behaviors on the target host 30. When a suspicious behavior on the target host 30 is detected, the client 10 acquires behavior data of a process corresponding to the suspicious behavior, and sends the behavior data of the process to the server 20.

[0037] The suspicious behavior refers to a behavior that threatens the security of the target host 30 or initiates abnormal activities on the target host 30, and the suspicious behavior can generally include a series of operations. When detecting the suspicious behavior on the target host 30, the client 10 can track operating system level call operations such as file read / write operations, process management, memory management, registry access, network connection, etc. on the target host 30, and determine whether the behavior occurring on the target host 30 is a suspicious behavior according to the tracking results of each call operation and identification rules. For example, when the frequency of file read / write operations on the target host 30 to the disk is greater than a set frequency threshold, the behavior of the file operation can be considered as a suspicious behavior. For example, when the network connection operation on the target host 30 is an unknown source connection attempt or the data volume of network connection transmission is greater than a set threshold, the behavior of the network connection operation can be considered as a suspicious behavior. For example, when the process management operation on the target host 30 creates a process and the process is not associated with any known program on the target host 30, the behavior of the process management operation can be considered as a suspicious behavior. For example, when the registry access operation on the target host 30 requests to change the registry, the behavior of the process management operation can be considered as a suspicious behavior, and the above examples are not exhaustive.

[0038] When acquiring the behavior data of the process corresponding to the suspicious behavior, the client 10 can collect at least one of process metadata, log data, and event data corresponding to the process. The process metadata can include at least one of process ID (Identification, identity), parent process ID, process name, start time, and path. The log data is used to record events and activities related to the process, including but not limited to at least one of start and end time of the process, error or warning information generated by the process, operations and system calls executed by the process, usage of system resources (such as processor resources, storage resources), network activities, and security-related events. The event data of the process can include at least one of a timestamp of an event triggered by the process, an event type, a file name or a registry key involved, and a network endpoint involved.

[0039] The server 20 is mainly configured to receive the behavior data of the suspicious behavior corresponding process sent by the client 10, input the behavior data of the process into a preset attack analysis model, and obtain a behavior type prediction label corresponding to the suspicious behavior.

[0040] The behavior type prediction label is used to describe whether the suspicious behavior is a network attack behavior. In some embodiments, the behavior type prediction label can include: non-network attack or network attack. In other embodiments, if the suspicious behavior is identified as a network attack, the attack analysis model can also predict the specific type of network attack, that is, the behavior type prediction label output by the attack analysis model can include: non-network attack or a specific type of network attack, for example, a specific type of network attack can include: unauthorized file operation, unauthorized registry modification, malware execution, buffer overflow, privilege escalation, resource exhaustion attack, process injection attack or denial of service (DoS) attack, etc., and the present embodiment includes but is not limited to this.

[0041] In the present embodiment, the attack analysis model is a deep learning model trained according to sample data corresponding to historical network attack behaviors. The historical network attack behavior is a real network attack behavior, and thus the behavior data of the historical network attack behavior can reflect the real behavior rule of the process initiating the network attack. The deep learning model performs tasks by constructing a deep neural network, and has strong feature representation ability, generalization ability and self-adaptive ability. In the training process, the deep learning model learns rich network attack behavior related feature expressions and behavior data understanding ability according to the input behavior data samples of the historical network attack behaviors, so as to deeply analyze the behavior data of the input suspicious behavior and accurately judge whether the suspicious behavior is a network attack behavior.

[0042] In some optional embodiments, the server 20 can directly return the behavior type prediction label to the client 10, so that the client 10 processes the process corresponding to the suspicious behavior according to the behavior type prediction label.

[0043] Correspondingly, the client 10 can receive the behavior type prediction label corresponding to the suspicious behavior returned by the server 20. If the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, the client 10 can intercept the suspicious behavior.

[0044] Optionally, when intercepting the suspicious behavior, the client 10 can acquire an interception rule corresponding to the suspicious behavior, and intercept the suspicious behavior based on the interception rule corresponding to the suspicious behavior. The interception rule can be used to describe conditions met by different types of network attack behaviors and corresponding interception manners, and can be generated by the client 10, acquired by the client 10 from a configuration file of a user, or acquired by the client 10 from the server 20, which is not limited in the embodiment.

[0045] Optionally, the interception rule can be used to intercept a specific operation when an operation corresponding to the suspicious behavior meets a set condition, or the interception rule can be used to directly intercept a process corresponding to the suspicious behavior when the suspicious behavior meets a set condition.

[0046] When the operation corresponding to the suspicious behavior is intercepted, the operation included in the suspicious behavior or the operation associated with the suspicious behavior can be identified, and it is determined whether the operation meets a set condition in the interception rule. If the operation meets the set condition, the operation can be intercepted based on an interception manner set in the interception rule. The set condition met by the operation can include that the operation is used to execute a specific command, the operation is used to access a specific file, or the operation is used to access a specific network resource. The interception manner of the operation can include using a firewall system to block the operation for accessing the specific network resource, or using an access control list or a security policy to limit the access operation to the specific file, which is not listed one by one.

[0047] The process interception refers to stopping or limiting the start or running of the process corresponding to the suspicious behavior. Optionally, the interception rule for intercepting the process can include but is not limited to: if the suspicious behavior meets a first condition, directly terminating the process corresponding to the suspicious behavior; if the suspicious behavior meets a second condition, limiting the use of processor and memory resources of the process; if the suspicious behavior meets a third condition, adding the process corresponding to the suspicious behavior to a blocked list; if the suspicious behavior meets a fourth condition, adding the ID of the process corresponding to the suspicious behavior to an access control list of specific files and resources to limit the access permission of the process to the specific files and resources; if the suspicious behavior meets a fifth condition, intercepting system calls of the process using a kernel module; and if the suspicious behavior meets a sixth condition, controlling the outbound and inbound network communication of the process by configuring a firewall rule.

[0048] In some embodiments A1, when determining the interception rule hit by the suspicious behavior, the client 10 can identify a target condition from the above-mentioned multiple conditions that is satisfied by the behavior data corresponding to the suspicious behavior, and take the interception rule corresponding to the target condition as the interception rule hit by the suspicious behavior. For example, if the system resource usage of the process corresponding to the suspicious behavior in the behavior data corresponding to the suspicious behavior is greater than 80%, it can be determined that the suspicious behavior satisfies the second condition, and the client 10 can limit the use of processor and memory resources of the process. For example, if the file involved in the behavior data corresponding to the suspicious behavior is a sensitive file, it can be determined that the suspicious behavior satisfies the fourth condition, and the ID of the process corresponding to the suspicious behavior can be added to the access control list of the file corresponding to the file name.

[0049] In other embodiments A2, the client 10 can identify a target condition from the above-mentioned multiple conditions that matches the behavior type prediction label corresponding to the suspicious behavior, and take the interception rule corresponding to the target condition as the interception rule hit by the suspicious behavior. For example, if the behavior type prediction label corresponding to the suspicious behavior is a resource exhaustion attack, it can be determined that the suspicious behavior satisfies the second condition described above, and the client 10 can limit the use of processor and memory resources of the process to reduce the risk of resource exhaustion of the target host 30.

[0050] In some optional embodiments, the server 20 can be configured to issue an interception rule to the client 10, where the interception rule is generated by the server 20 using the attack analysis model. Optionally, after obtaining the behavior type prediction label corresponding to the suspicious behavior, if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, the server 20 can determine the interception rule corresponding to the suspicious behavior and issue the interception rule to the client 10.

[0051] In some embodiments, after determining that the suspicious behavior is a network attack behavior, the server 20 can generate an interception rule corresponding to the suspicious behavior using the attack analysis model and issue the interception rule to the client 10. For example, the server 20 can construct a prompt word in a set format, where the prompt word is used to make the attack analysis model generate an interception rule for defending against the suspicious behavior according to the input behavior data of the process corresponding to the suspicious behavior. For example, the interception rule generated by the attack analysis model can be: block any operation that attempts to execute a specific type of command from a specific path with a specific string.

[0052] In other embodiments, after determining that the suspicious behavior is a network attack behavior, the server 20 can match the interception rule corresponding to the behavior type label from the interception rules generated by the attack analysis model, and issue the matched interception rule to the client 10, which is not limited in this embodiment.

[0053] Correspondingly, the client 10 can receive the interception rule corresponding to the suspicious behavior returned by the server 20, and intercept the suspicious behavior according to the interception rule.

[0054] Optionally, the client 10 saves the correspondence between the interception rule and the behavior type label after obtaining the interception rule returned by the server 20 each time. Based on this, in some optional embodiments, after receiving the behavior type prediction label corresponding to a suspicious behavior returned by the server 20, the client 10 can determine the interception rule corresponding to the behavior type prediction label from the at least one interception rule generated by the attack analysis model that has been saved, as the interception rule corresponding to the suspicious behavior. In this implementation, the client 10 can reduce the dependence on the server 20 and the attack analysis model, and improve the defense speed.

[0055] In this implementation, when training the attack analysis model on the behavior data samples of the processes corresponding to the historical network attack behaviors, the attack type corresponding to the historical network attack behaviors and the real interception rule corresponding to the historical network attack behaviors can be used as the supervision signal, and the attack analysis model can be trained based on the behavior data samples and the supervision signal to have the ability to output the behavior type prediction label according to the input behavior data and the ability to generate the interception rule.

[0056] Optionally, the attack analysis model can generate different interception rules for different types of network attack behaviors, so as to effectively intercept different types of network attack behaviors. For example, if the type of the network attack behavior is unauthorized file operation, the interception rule generated by the attack analysis model can be to add the ID of the process corresponding to the suspicious behavior to the access control list of the specific file and resource, so as to limit the access permission of the process to the specific file and resource. For example, if the type of the network attack behavior is unauthorized registry modification or process injection attack, the interception rule generated by the attack analysis model can be to directly terminate the process corresponding to the suspicious behavior. For example, if the type of the network attack behavior is privilege escalation, the interception rule generated by the attack analysis model can be to add the process corresponding to the suspicious behavior to the blocked list. For example, if the type of the network attack behavior is resource exhaustion attack, the interception rule generated by the attack analysis model can be to limit the use of processor and memory resources of the process corresponding to the suspicious behavior, and the like.

[0057] In this implementation, the attack analysis model is trained on the behavior data samples of the processes corresponding to historical network attack behaviors, and thus the attack analysis model can better master the knowledge in the field of network attack and better understand and process the tasks in the field of network attack. Based on this, when analyzing the behavior data of the suspicious process, the attack analysis model can more accurately identify and judge the behavior of the process, thereby generating more antagonistic interception rules. Based on the more antagonistic interception rules, the client can more accurately identify network attack behaviors, thereby quickly discovering potential security threats corresponding to suspicious behaviors, reducing the risk of missing potential attacks, reducing false positives and false negatives, and improving defense capabilities.

[0058] Wherein, more antagonistic means that on the one hand, the attack analysis model is a deep learning model, which can learn rich network attack behavior related knowledge and behavior data understanding ability, thereby enabling in-depth analysis of suspicious behavior data input, and generating more comprehensive interception rules. On the other hand, the attack analysis model can adjust the interception rules in real time according to the changes in the behavior data of the suspicious process, thereby flexibly dealing with network attacks with different behavior characteristics.

[0059] In particular, when the intrusion program corresponding to the suspicious behavior is generated by AIGC technology, such intrusion programs have high similarity in nature, and the attack analysis model can analyze the behavior characteristics of the intrusion programs generated by AIGC technology based on the learned network attack behavior related feature expression and behavior data understanding ability, and accurately identify the network behaviors initiated by various intrusion programs generated by AIGC technology, thereby efficiently dealing with the scenario where AIGC tools have high incidence of network attacks and high attack complexity.

[0060] In some optional embodiments, the client 10 and the server 20 can maintain a long connection. Then, when the client 10 sends the behavior data to the server 20, the client 10 can send the behavior data of the process to the server 20 through the long connection between the client 10 and the server 20. Correspondingly, the server 20 can return the behavior type prediction label output by the attack analysis model to the client 10 through the long connection.

[0061] Based on this implementation, the communication interaction between the client 10 and the server 20 has small communication delay, and thus for the client 10, the analysis result of the network attack behavior type can be quickly obtained in the case of analyzing the network attack behavior type by using a remote device (i.e. the server 20), thereby facilitating the rapid response to network attack behaviors and reducing the impact of network attack behaviors on the target host 30 under attack.

[0062] In some optional embodiments, after detecting the suspicious behavior, the client 10 can preliminarily screen the suspicious behavior to preliminarily determine whether the suspicious behavior is a more dangerous behavior. Alternatively, before obtaining the behavior data of the process corresponding to the suspicious behavior, the client 10 can obtain the danger level of the operation corresponding to the suspicious behavior. If the danger level of the operation corresponding to the suspicious behavior is greater than a preset level threshold, the client 10 obtains the behavior data of the process corresponding to the suspicious behavior.

[0063] The operation corresponding to the suspicious behavior refers to an operation initiated by the suspicious behavior or an operation associated with the suspicious behavior. Alternatively, the operation corresponding to the suspicious behavior can include at least one of the following operations: downloading a network packet, reading a file, writing a file, and modifying a file. The danger levels of the above different types of operations are different. For example, the danger level of the read file operation is level one, the danger levels of the write file operation and the modify file operation can be level two, and the danger level of the download network packet can be level three. Alternatively, when obtaining the danger level of the operation corresponding to the suspicious behavior, the client 10 can obtain the type of the operation corresponding to the suspicious behavior, and determine the danger level of the operation corresponding to the suspicious behavior according to the type of the operation. For example, when the type of the operation corresponding to the suspicious behavior is writing a file, the client 10 can determine that the danger level of the operation corresponding to the suspicious behavior is level two. The set danger level can be level one, that is, if the danger level of the operation corresponding to the suspicious behavior is greater than level one, the client 10 can consider that the consequences caused by the suspicious behavior are more serious, and thus can obtain the behavior data of the process corresponding to the suspicious behavior, and more accurately identify the behavior type of the suspicious behavior by using the attack analysis model.

[0064] In this implementation, the preliminary screening is performed based on the type of the operation corresponding to the suspicious behavior, and the behavior data collection operation is performed again when the danger level of the operation of the suspicious behavior is high, which is beneficial to reduce the amount of behavior data required to be collected. In particular, in a scenario where network attack behaviors are more common, the preliminary screening operation on the suspicious behavior can reduce the number of processes required to perform the behavior data collection, thereby reducing the resource occupancy rate of the target host where the client 10 is located and the consumption of transmission resources between the client 10 and the server 20.

[0065] In some optional embodiments, the attack analysis model running on the server 20 is obtained by fine-tuning the base model according to sample data corresponding to network attack behaviors, which will be exemplarily described below.

[0066] Optionally, the server 20 can obtain a behavior data sample of a process corresponding to a historical network attack behavior, the behavior data sample comprising: at least one group of behavior data and a respective behavior type true label of each group of behavior data. Each group of behavior data is obtained by collecting behavior data of a process corresponding to a real network attack behavior when the network attack behavior occurs. The behavior type true label of each group of behavior data is used to mark the real behavior type of the group of behavior data as a network attack behavior. The behavior type true label can be generated by manually labeling the type of behavior data. Based on the manual labeling method, the real type of behavior data can be obtained by using the accumulated experience of human beings, thereby effectively guiding the training of the attack analysis model. In some embodiments, when the type of network attack behavior needs to be predicted in a fine-grained manner, the behavior type true label of each group of behavior data can also mark the real network attack behavior type of the group of behavior data.

[0067] The server 20 can input the at least one group of behavior data into a preset base model to obtain a respective behavior type prediction label of each group of behavior data. According to the error between the respective behavior type true label and the behavior type prediction label of each group of behavior data, the server 20 can fine-tune the base model. When fine-tuning the base model, the error between the behavior type true label and the behavior type prediction label can be reduced as the target, and the part of parameters learned in the base model can be modified; or one or more modules can be added to the base model, and the error between the behavior type true label and the behavior type prediction label can be reduced as the target, and the parameters of the added one or more modules can be modified, which is not limited in the embodiment. The fine-tuning operation of the base model can be iteratively performed for multiple times, and when the base model converges, the server 20 can use the converged base model as the attack analysis model. The convergence of the base model means that the error between the behavior type true label and the behavior type prediction label is less than a set threshold.

[0068] The base model comprises a content generation type deep learning model (hereinafter referred to as a content generation type model). The content generation type model is a neural network architecture capable of creating new content, and can generate different forms of content based on unsupervised learning or semi-supervised learning. The content generation type model can include but is not limited to any one of a generative adversarial network (GANs) model, a variational autoencoder (VAEs), a model based on a transformer (Transformer) architecture, a recurrent neural network (RNNs) model, and a long short-term memory network (LSTMs) model. In an actual host security scenario, the content generation type model can be used by an intruder to generate intrusion programs. When network attacks are mostly initiated by such intrusion programs, the understanding ability of the content generation type model for attack behaviors and attack codes can be used to accurately identify attacks initiated by such intrusion programs.

[0069] Optionally, the preset base model can be a content generation model pre-trained on a large-scale data set, for example, can be a pre-trained large language model. In the pre-training process, the base model learns rich and general feature representations. In the process of fine-tuning the pre-trained large language model using the behavior data of network attack behaviors, the base model can migrate the prior knowledge and generalization ability learned by pre-training to the task of network attack behavior analysis, and then make the fine-tuned large language model more suitable for the network attack behavior analysis task, thereby improving the accuracy of the network attack behavior analysis result.

[0070] In some optional embodiments, the attack analysis model running on the server 20 is dynamically updateable. Continuing with the suspicious behavior described in the foregoing embodiments, optionally, after obtaining the behavior type prediction label of the suspicious behavior based on the attack behavior analysis model, the server 20 can obtain the behavior type real label corresponding to the suspicious behavior. In some optional embodiments, the server 20 can send the behavior data and the behavior type prediction label of the suspicious behavior to the security operation client, and the security operation personnel can determine whether the behavior type prediction label is reasonable according to the behavior data. If not, the security operation personnel can provide the behavior type real label through the security operation client. After obtaining the behavior type real label, the server 20 can fine-tune the attack analysis model under the triggering of a model update event, with the goal of reducing the error between the behavior type real label corresponding to the suspicious behavior and the behavior type prediction label corresponding to the suspicious behavior. The model update event can be an event in which the accumulated sample data amount is greater than a set data amount threshold, or an event in which the error between the behavior type real label and the behavior type prediction label is greater than a set error threshold, or an event in which an update period is reached, or an event in which it is detected that a user triggers an update operation of the intrusion model, and the present embodiment does not limit.

[0071] Optionally, after obtaining the interception rule corresponding to any suspicious behavior based on the attack behavior analysis model, the server 20 can obtain the interception feedback data corresponding to the suspicious behavior. In some optional embodiments, the interception feedback data can be provided by the security operation personnel. In this implementation, the server 20 can send the behavior data and the interception rule of the suspicious behavior to the security operation client, and the security operation personnel can determine whether the interception rule is reasonable according to the behavior data. If not, the security operation personnel can provide the correction result of the interception rule through the security operation client. After obtaining the correction result of the interception rule, the server 20 can fine-tune the attack analysis model under the triggering of a model update event, with the goal of reducing the error between the interception rule corresponding to the suspicious behavior and the correction result of the interception rule.

[0072] In some optional embodiments, the intercepted feedback data can be provided by the client 10. In such an implementation, the client 10 can count the interception results in the process of intercepting suspicious behaviors by using the interception rules, which can include the number of successful interceptions or the interception success rate. The client can provide the interception results to the server 20, which can determine whether the attack analysis model needs to be fine-tuned according to the interception results. For example, when the interception success rate of a certain interception rule is less than a set success rate threshold, or the number of successful interceptions is less than a set number threshold, the server 20 can start the fine-tuning operation of the attack analysis model. In the fine-tuning process, the server 20 can continue to train the attack analysis model based on the behavior data samples and the supervision signals until the model converges to a smaller range. Optionally, in the fine-tuning process, the training data set can be updated according to the actual running data of the attack analysis model. For example, if the interception success rate of a certain interception rule is less than 50%, the server 20 can send the interception rule and the corresponding behavior data to the security operation client and obtain the result of the correction of the interception rule by the security operation personnel according to the behavior data. The server 20 can use the correction result of the interception rule as a new supervision signal corresponding to the behavior data, and continue to train the attack analysis model using the behavior data and the updated supervision signal to improve the performance of the attack analysis model.

[0073] Based on such an implementation, the attack analysis model can be dynamically updated to improve the recognition ability of the attack analysis model to diverse network attack behaviors. When the network attack behaviors change dynamically, the attack analysis model can change timely, and thus the defense capability can be continuously updated in the scenario where the network attack behaviors exist for a long time and occur frequently, thereby effectively improving the long-term intrusion countermeasure effect.

[0074] In addition to the network attack processing system described in the foregoing embodiments, the embodiments of the present disclosure also provide a network attack processing method, which will be described below with reference to the accompanying drawings.

[0075] FIG. 3 is a flowchart of a network attack processing method provided by an exemplary embodiment of the present disclosure. When the method is executed on the client side, it can include the steps shown in FIG. 3:

[0076] Step 301: When a suspicious behavior on a target host is detected, behavior data of a process corresponding to the suspicious behavior is obtained.

[0077] Step 302: An interception rule corresponding to the suspicious behavior is obtained according to the behavior data; wherein the interception rule is determined based on a preset attack analysis model, and the attack analysis model is a deep learning model trained according to behavior data samples of processes corresponding to historical network attack behaviors.

[0078] Step 303, intercepting the suspicious behavior according to the interception rule.

[0079] In some optional embodiments, the attack analysis model can be run at the client side, and thus the client can locally run the attack analysis model, input the behavior data of the process into the attack analysis model, obtain the behavior type prediction label corresponding to the suspicious behavior, and generate the interception rule by using the attack analysis model after the behavior type prediction label indicates that the suspicious behavior is a network attack behavior when performing step 302.

[0080] In some other optional embodiments, the attack analysis model can be run at the server side, and thus the client can send the behavior data to the server to make the server input the behavior data into the attack analysis model, obtain the behavior type prediction label corresponding to the suspicious behavior, and generate the interception rule by using the attack analysis model after the behavior type prediction label indicates that the suspicious behavior is a network attack behavior. The client can receive the interception rule returned by the server.

[0081] In yet some other optional embodiments, the attack analysis model can be run at the server side, and thus the client can send the behavior data to the server to make the server input the behavior data into the attack analysis model, obtain the behavior type prediction label corresponding to the suspicious behavior; and receive the behavior type prediction label corresponding to the suspicious behavior returned by the server. The client can determine the interception rule corresponding to the behavior type prediction label from at least one interception rule generated by the attack analysis model that has been saved, as the interception rule corresponding to the suspicious behavior.

[0082] Optionally, sending the behavior data to the server comprises sending the behavior data to the server through a long connection between the client and the server.

[0083] Optionally, intercepting the suspicious behavior comprises receiving the interception rule corresponding to the suspicious behavior returned by the server, the interception rule being generated by the server by using the attack analysis model; and intercepting the suspicious behavior according to the interception rule.

[0084] Optionally, obtaining the behavior data of the process corresponding to the suspicious behavior comprises obtaining the danger level of the operation corresponding to the suspicious behavior; and obtaining the behavior data of the process corresponding to the suspicious behavior if the danger level of the operation corresponding to the suspicious behavior is greater than a preset level threshold.

[0085] In this embodiment, when the client detects suspicious behavior on the target host, the client can obtain behavior data corresponding to the suspicious behavior, and obtain an interception rule corresponding to the suspicious behavior according to the behavior data, wherein the interception rule is determined by using an attack analysis model. Based on the interception rule, the suspicious behavior can be intercepted. In this implementation, the attack analysis model is trained on the behavior data samples of the processes corresponding to the historical network attack behaviors, so that the attack analysis model can better master the knowledge in the field of network attacks, and can better understand and process the tasks in the field of network attacks. Based on this, when analyzing the behavior data of the process of the suspicious behavior, the attack analysis model can more accurately identify and judge the behavior of the process, thereby generating an interception rule with stronger countermeasures. Based on the interception rule with stronger countermeasures, the client can more accurately identify network attack behaviors, thereby quickly discovering potential security threats corresponding to the suspicious behavior, reducing the risk of missing potential attacks, reducing false positives and false negatives, and improving defense capabilities.

[0086] FIG. 4 is a flowchart of a network attack processing method according to an example embodiment of the present disclosure, which is executed on the server side and can include the following steps shown in FIG. 4:

[0087] Step 401: Receive behavior data of a process corresponding to suspicious behavior sent by a client, wherein the behavior data is obtained by the client when the client detects the suspicious behavior on a target host.

[0088] Step 402: Input the behavior data into a preset attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; the attack analysis model is a deep learning model trained according to behavior data samples of processes corresponding to historical network attack behaviors.

[0089] Step 403: If the prediction label of the behavior type indicates that the suspicious behavior is a network attack behavior, determine an interception rule corresponding to the suspicious behavior, wherein the interception rule is generated by the attack analysis model.

[0090] Step 405: Issue the interception rule to the client, wherein the interception rule is used to intercept the suspicious behavior.

[0091] Optionally, determining the interception rule corresponding to the suspicious behavior includes: using the attack analysis model to generate the interception rule corresponding to the suspicious behavior according to the behavior data; or determining, from at least one interception rule generated by the attack analysis model that has been saved, an interception rule corresponding to the behavior type prediction label as the interception rule corresponding to the suspicious behavior.

[0092] Optionally, the method further comprises: obtaining behavior data samples of processes corresponding to historical network attack behaviors, the behavior data samples comprising: at least one set of behavior data and respective behavior type true labels of the at least one set of behavior data; inputting the at least one set of behavior data into a preset base model to obtain respective behavior type predicted labels of the at least one set of behavior data; the base model comprising: a content generation type deep learning model; fine-tuning the base model according to errors between the respective behavior type true labels and the behavior type predicted labels of the at least one set of behavior data until the base model converges, and taking the converged base model as the attack analysis model.

[0093] Optionally, the method further comprises: obtaining a behavior type true label corresponding to the suspicious behavior; and fine-tuning the attack analysis model under triggering of a model update event, so as to reduce errors between the behavior type true label corresponding to the suspicious behavior and a behavior type predicted label corresponding to the suspicious behavior.

[0094] In this embodiment, the server can provide an analysis service of network attack behaviors to the client. When obtaining behavior data corresponding to a suspicious behavior sent by the client, the server can use the attack analysis model to identify a behavior type predicted label corresponding to the behavior data, and return the behavior type predicted label to the client. In this implementation, the server can accurately obtain an interception rule corresponding to the suspicious behavior based on the behavior data and the attack analysis model, so as to facilitate rapid and accurate processing of potential security threats corresponding to the suspicious behavior, reduce the risk of missing potential attacks, and improve defense capabilities.

[0095] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can also be executed by different devices as the execution subject. For example, the execution subject of steps 301 to 303 can be device A; for another example, the execution subject of steps 301 and 302 can be device A, and the execution subject of step 303 can be device B; and the like.

[0096] In addition, in some of the processes described in the above embodiments and the accompanying drawings, a plurality of operations appearing in a specific order are included, but it should be clear that these operations can be executed in the order appearing in this document or in parallel. The serial numbers of the operations, such as 301, 302, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes can include more or fewer operations, and the operations can be executed in sequence or in parallel. It should be noted that the descriptions of “first”, “second” and the like in this document are used to distinguish different messages, devices, modules, etc., and do not represent the order of precedence. In addition, “first” and “second” are different types.

[0097] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portal for user to choose authorization or refusal.

[0098] FIG. 5 illustrates a structural schematic diagram of an electronic device provided by an example embodiment of the present disclosure. As shown in FIG. 5, the electronic device can include a memory 501, a processor 502 and a communication component 503.

[0099] The memory 501 is configured to store computer programs and can be configured to store other various data to support operations on the electronic device. Examples of these data include instructions for any application or method operating on the electronic device.

[0100] In some example embodiments, a client of a security system can be run on the electronic device shown in FIG. 5. In such embodiments, the processor 502, coupled with the memory 501, is configured to execute computer programs in the memory 501 for: obtaining behavior data of a process corresponding to a suspicious behavior on a target host when the suspicious behavior is detected; obtaining an interception rule corresponding to the suspicious behavior according to the behavior data; wherein the interception rule is determined based on a preset attack analysis model, and the attack analysis model is a deep learning model trained according to behavior data samples of processes corresponding to historical network attack behaviors; and intercepting the suspicious behavior according to the interception rule.

[0101] Optionally, when the processor 502 obtains the interception rule corresponding to the suspicious behavior according to the behavior data, it is specifically configured to: send the behavior data to a server through the communication component 503, so that the server inputs the behavior data into the attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; and receive the interception rule corresponding to the suspicious behavior returned by the server, wherein the interception rule is generated by the server using the attack analysis model after determining that the suspicious behavior is a network attack behavior according to the behavior type prediction label.

[0102] Optionally, when obtaining the interception rule corresponding to the suspicious behavior according to the behavior data, the communication component 503 is specifically configured to: send the behavior data to a server through the communication component 503, so that the server inputs the behavior data into the attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; receive the behavior type prediction label corresponding to the suspicious behavior returned by the server; and if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, determine an interception rule corresponding to the behavior type prediction label from at least one interception rule generated by the attack analysis model that has been saved, as the interception rule corresponding to the suspicious behavior.

[0103] Optionally, when sending the behavior data to the server through the communication component 503, the processor 502 is specifically configured to: send the behavior data to the server through a long connection between the server and the communication component 503.

[0104] Optionally, when obtaining the behavior data of the process corresponding to the suspicious behavior, the processor 502 is specifically configured to: obtain a danger level of an operation corresponding to the suspicious behavior; and if the danger level of the operation corresponding to the suspicious behavior is greater than a preset level threshold, obtain the behavior data of the process corresponding to the suspicious behavior.

[0105] In some other exemplary embodiments, the electronic device shown in FIG. 5 is a server of a security system. In this embodiment, the processor 502 is coupled to the memory 501 and configured to execute a computer program in the memory 501 to: receive behavior data of a process corresponding to a suspicious behavior sent by a client through a communication component 503, the behavior data being obtained by the client when detecting the suspicious behavior on a target host; input the behavior data into a preset attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior, the attack analysis model being a deep learning model trained according to behavior data samples of processes corresponding to historical network attack behaviors; if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, determine an interception rule corresponding to the suspicious behavior, the interception rule being generated by the attack analysis model; and send the interception rule to the client through the communication component 503, the interception rule being used to intercept the suspicious behavior.

[0106] Optionally, when determining the interception rule corresponding to the suspicious behavior, the processor 502 is specifically configured to: generate the interception rule corresponding to the suspicious behavior according to the behavior data by using the attack analysis model; or determine an interception rule corresponding to the behavior type prediction label from at least one interception rule generated by the attack analysis model that has been saved, as the interception rule corresponding to the suspicious behavior.

[0107] Optionally, the processor 502 is further configured to: obtain a behavior data sample of a process corresponding to a historical network attack behavior, the behavior data sample comprising: at least one set of behavior data and respective behavior type true labels of the at least one set of behavior data; input the at least one set of behavior data into a preset base model to obtain respective behavior type predicted labels of the at least one set of behavior data; the base model comprising: a content generation type deep learning model; fine-tune the base model according to errors between the respective behavior type true labels and the behavior type predicted labels of the at least one set of behavior data, until the base model converges, and use the converged base model as the attack analysis model.

[0108] Optionally, the processor 502 is further configured to: obtain a behavior type true label corresponding to the suspicious behavior; and fine-tune the attack analysis model under triggering of a model update event, with the goal of reducing errors between the behavior type true label corresponding to the suspicious behavior and a behavior type predicted label corresponding to the suspicious behavior.

[0109] Further, as shown in FIG. 5, the electronic device further includes: a power component 504, a display component 505, an audio component 506, and other components. Only some components are shown in FIG. 5, which does not mean that the electronic device only includes the components shown in FIG. 5. In FIG. 5, the components in the dashed box are optional components, not mandatory components, and the specific components can be determined according to the product form of the electronic device. The electronic device of the embodiment can be implemented as a desktop computer, a notebook computer, a smart phone, or an IOT device, etc. terminal device, or a conventional server, a cloud server, or a server array, etc. server device. If the electronic device of the embodiment is implemented as a desktop computer, a notebook computer, a smart phone, etc. terminal device, it can include the components in the dashed box in FIG. 5; if the electronic device of the embodiment is implemented as a conventional server, a cloud server, or a server array, etc. server device, it can not include the components in the dashed box in FIG. 5.

[0110] The memory 501 can be implemented by any type of volatile or nonvolatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic or optical disk.

[0111] The communication component 503 is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as Wi-Fi, 2G (e.g., Global System for Mobile Communications (GSM)), 3G (e.g., Wideband Code Division Multiple Access (WCDMA)), 4G (e.g., Long Term Evolution (LTE)), 4G+ (e.g., LTE-Advanced (LTE-A)), or 5G (5th Generation Mobile Communication Technology), or a combination thereof. In an example embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an example embodiment, the communication component can be implemented based on a Near Field Communication (NFC) technology, a Radio Frequency Identification (RFID) technology, an Infrared Data Association (IrDA) technology, an Ultra Wide Band (UWB) technology, a Bluetooth (BT) technology, and other technologies.

[0112] The power supply component 504 is configured to supply power to various components of the device where the power supply component is located. The power supply component can include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device where the power supply component is located.

[0113] The display component includes a screen, which can include a Liquid Crystal Display (LCD) and a Touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense a touch, a swiping motion, and a gesture on the touch panel. The touch sensor can not only sense a boundary of a touch or a swiping motion, but also detect a duration and a pressure associated with the touch or the swiping motion.

[0114] The audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive an external audio signal when the device on which the audio component is located is in an operating mode such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory or transmitted via the communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0115] In the embodiment, when detecting suspicious behavior on the target host, behavior data corresponding to the suspicious behavior can be acquired, and an interception rule corresponding to the suspicious behavior is acquired according to the behavior data, wherein the interception rule is determined by using an attack analysis model. Based on the interception rule, the suspicious behavior can be intercepted. In this implementation, the attack analysis model is obtained by training on the behavior data samples of the processes corresponding to the historical network attack behaviors, so that the attack analysis model can better master the knowledge in the field of network attacks and better understand and process the tasks in the field of network attacks. Based on this, when analyzing the behavior data of the process of the suspicious behavior, the attack analysis model can more accurately identify and judge the behavior of the process, thereby generating an interception rule with stronger countermeasures. Based on the interception rule with stronger countermeasures, the client can more accurately identify network attack behaviors, thereby quickly discovering potential security threats corresponding to suspicious behaviors, reducing the risk of missing potential attacks, reducing false positives and false negatives, and improving defense capabilities.

[0116] Correspondingly, the embodiment of the disclosure also provides a computer readable storage medium storing a computer program, the computer program is executed to be able to realize each step that can be executed by the electronic device in the method embodiment.

[0117] The embodiment of the disclosure also provides a computer program product, comprising: computer programs / instructions, the computer programs / instructions are executed by the processor to be able to realize the steps in the method provided by the embodiment of the disclosure.

[0118] Those skilled in the art will appreciate that embodiments of the disclosure can be supplied as a method, a system, or a computer program product. Accordingly, the disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the disclosure can take the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk memory, CD-ROMs (Compact Disc Read-Only Memory), optical storage devices, etc.) embodying computer readable program code.

[0119] The disclosure is described in reference to the flowchart and / or block diagrams of the method, apparatus (system) and computer program product according to embodiments of the disclosure. It should be understood that each flow and / or block in the flowchart and / or block diagram, as well as a combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions, which are executed via the processor of the computer or other programmable data processing apparatus, generate means for implementing the functions specified in one or more flows in the flowchart and / or one or more blocks in the block diagram.

[0120] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including instruction means, which implements the functions specified in one or more flows in the flowchart and / or one or more blocks in the block diagram.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, so that a series of operational steps are performed on the computer or other programmable data processing apparatus to generate a computer implemented process, so that the instructions executed on the computer or other programmable data processing apparatus provide steps for implementing the functions specified in one or more flows in the flowchart and / or one or more blocks in the block diagram.

[0122] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interfaces, network interfaces, and memory.

[0123] The memory can include non-persistent memory in the computer readable medium, random access memory (RAM), and / or non-volatile memory, such as read-only memory (ROM) or flash memory. The memory is an example of computer readable media.

[0124] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, a parallel random access machine (PRAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), other types of random access memory (RAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory or other memory technology, a compact disc read-only memory (CD-ROM), a digital video disc (DVD) or other optical storage, a magnetic cassette, a magnetic disk storage or other magnetic storage device, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0125] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, product or apparatus that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such a process, method, product or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, product or apparatus that includes the element.

[0126] The above only describes the embodiments of the present disclosure and is not intended to limit the present disclosure. The present disclosure can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principles of the present disclosure shall be included in the scope of claims of the present disclosure.

Claims

1. A method of handling a network attack, wherein, The method comprises the following steps: Upon detecting suspicious behavior on a target host, obtaining behavior data of a process corresponding to the suspicious behavior; According to the behavior data, obtaining an interception rule corresponding to the suspicious behavior; wherein the interception rule is determined based on a preset attack analysis model, and the attack analysis model is a deep learning model trained according to behavior data samples of processes corresponding to historical network attack behaviors; According to the interception rule, intercepting the suspicious behavior.

2. The method of claim 1, wherein, According to the behavior data, obtaining an interception rule corresponding to the suspicious behavior, comprises: Sending the behavior data to a server, so that the server inputs the behavior data into the attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; Receiving the interception rule corresponding to the suspicious behavior returned by the server, which is generated by the server using the attack analysis model after determining that the suspicious behavior is a network attack behavior according to the behavior type prediction label.

3. The method of claim 1, wherein, According to the behavior data, obtaining an interception rule corresponding to the suspicious behavior, comprises: Sending the behavior data to a server, so that the server inputs the behavior data into the attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; Receiving the behavior type prediction label corresponding to the suspicious behavior returned by the server; If the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, determining an interception rule corresponding to the behavior type prediction label from at least one interception rule generated by the attack analysis model that has been saved, as the interception rule corresponding to the suspicious behavior.

4. The method of claim 2 or 3, wherein, Sending the behavior data to a server, comprises: Sending the behavior data to a server through a long connection between the server and the client.

5. The method according to any one of claims 1 to 4, wherein, Obtaining behavior data of a process corresponding to the suspicious behavior, comprises: Obtaining a danger level of an operation corresponding to the suspicious behavior; If the danger level of the operation corresponding to the suspicious behavior is greater than a preset level threshold, obtaining behavior data of a process corresponding to the suspicious behavior.

6. A method of handling a network attack, wherein The method comprises the following steps: Receiving behavior data of a process corresponding to suspicious behavior sent by a client, wherein the behavior data is obtained by the client when detecting the suspicious behavior on a target host; Inputting the behavior data into a preset attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; wherein the attack analysis model is a deep learning model trained according to behavior data samples of processes corresponding to historical network attack behaviors; If the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, determining an interception rule corresponding to the suspicious behavior, wherein the interception rule is generated by the attack analysis model; Downloading the interception rule to the client, wherein the interception rule is used to intercept the suspicious behavior.

7. The method of claim 6, wherein, Determining an interception rule corresponding to the suspicious behavior, comprises: According to the behavior data, the attack analysis model is used to generate an interception rule corresponding to the suspicious behavior, or the interception rule corresponding to the behavior type prediction label is determined from at least one interception rule generated by the attack analysis model that has been saved, as the interception rule corresponding to the suspicious behavior.

8. The method of claim 6 or 7, wherein, Further comprising: Obtaining behavior data samples of processes corresponding to historical network attack behaviors, the behavior data samples including at least one group of behavior data and respective behavior type real labels of the at least one group of behavior data; Inputting the at least one group of behavior data into a preset base model to obtain respective behavior type prediction labels of the at least one group of behavior data; the base model including a content generation type deep learning model; According to errors between the respective behavior type real labels and the behavior type prediction labels of the at least one group of behavior data, the base model is fine-tuned until the base model converges, and the converged base model is taken as the attack analysis model.

9. The method according to any one of claims 6-8, wherein, Further comprising: Obtaining a behavior type real label corresponding to the suspicious behavior; Under triggering of a model update event, the attack analysis model is fine-tuned to reduce errors between the behavior type real label corresponding to the suspicious behavior and a behavior type prediction label corresponding to the suspicious behavior.

10. A cyber attack handling system, wherein, Comprising: A client and a server; The client is configured to: when detecting a suspicious behavior on a target host, obtain behavior data of a process corresponding to the suspicious behavior; send the behavior data to the server and receive an interception rule corresponding to the suspicious behavior returned by the server; and intercept the suspicious behavior according to the interception rule. The server is configured to: receive behavior data of a process corresponding to a suspicious behavior sent by the client; input the behavior data into a preset attack analysis model to obtain a behavior type prediction label corresponding to the suspicious behavior; if the behavior type prediction label indicates that the suspicious behavior is a network attack behavior, determine an interception rule corresponding to the suspicious behavior; and return the interception rule to the client; the attack analysis model is a deep learning model trained according to behavior data samples of processes corresponding to historical network attack behaviors.

11. An electronic device, comprising: Comprising: A memory and a processor; The memory is configured to store one or more computer instructions; The processor is configured to execute the one or more computer instructions to perform steps in the method of any one of claims 1-9.

12. A computer readable storage medium storing a computer program, wherein, A computer program is executed by a processor to implement the network attack processing method of any one of claims 1-9.

13. A computer program product, wherein, Comprising: A computer program / instruction, which is executed by a processor to implement the network attack processing method of any one of claims 1-9.

Images