Anomaly detection method, anomaly detection system, detection proxy device, and management device

Abstract

The present application relates to the technical field of information, and discloses an anomaly detection method, an anomaly detection system, a detection proxy device, and a management device. First operation information obtained by the detection proxy device filtering second operation information has a smaller data volume than the second operation information, and the detection proxy device sends the first operation information to the management device, thereby reducing communication costs. The detection proxy device performs first proxy-end anomaly detection on the basis of the second operation information, and since the second operation information contains more content than the first operation information, the first proxy-end anomaly detection can complement the result of management-end anomaly detection. In response to a recall instruction, the detection proxy device sends supplementary operation information of a first system entity to the management device, so that the management device obtains more comprehensive operation information of the first system entity, and the management device performs comprehensive anomaly detection on the first system entity, thereby further improving the comprehensiveness and reliability of anomaly detection.

Description

Anomaly detection methods, anomaly detection systems, detection proxy devices, and management devices

[0001] This application claims priority to Chinese Patent Application No. 202510310164.2, filed on March 13, 2025, entitled "Anomaly Detection Method, Anomaly Detection System, Detection Agent Device and Management Device", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of information technology, and in particular to anomaly detection methods, anomaly detection systems, detection agent devices, and management devices. Background Technology

[0003] Cyberattacks refer to malicious acts such as damage, interference, or data theft against network services, network infrastructure, or network systems using various technical means. With the development of information technology, the types of cyberattacks are increasing and changing rapidly. Therefore, in the field of information technology, anomaly detection is used to determine whether various components of a network are malfunctioning due to cyberattacks.

[0004] Terminals are one of the network components that are vulnerable to network attacks. In related technologies, detection agent devices collect the running information of various processes, threads and other system entities running on the terminal, and report all or part of the collected running information to a centralized management device. The management device performs anomaly detection on the running information to determine whether there is any abnormal information in the running information, thereby determining whether the terminal has been subjected to a network attack.

[0005] However, due to the large amount of operational information collected, if the detection agent device reports all the collected operational information to the management device, it will consume a lot of transmission and storage resources. On the other hand, if the detection agent device only reports part of the collected operational information to the management device, the operational information not reported to the management device will create a detection blind spot, affecting the accuracy and comprehensiveness of the detection. Summary of the Invention

[0006] This application provides an anomaly detection method, anomaly detection system, a detection agent device, and a management device to improve the comprehensiveness and reliability of anomaly detection. The technical solution is as follows.

[0007] Firstly, an anomaly detection method is provided, which is executed by a detection agent device that runs on a terminal. The method includes: a detection agent sending first operational information of a terminal to a management device, the first operational information being used by the management device to perform management-end anomaly detection, the first operational information being obtained by the detection agent through filtering second operational information, the second operational information being used to describe the behavior of system entities running on the terminal, system entities including objects on the terminal used to implement system tasks; under the condition of satisfying agent-end anomaly detection, performing first agent-end anomaly detection based on the second operational information to obtain a first agent-end detection result, the first agent-end detection result indicating whether the terminal is under network attack; in response to receiving a recall instruction sent by the management device, sending supplementary operational information of a first system entity to the management device, the recall instruction including the identification information of the first system entity, the supplementary operational information of the first system entity including operational information related to the first system entity in the second operational information other than the first operational information, the supplementary operational information of the first system entity being used by the management device to perform supplementary detection on the first system entity; wherein, the detection method of one or more of the management-end anomaly detection, first agent-end anomaly detection, or supplementary detection is a multi-step behavior pattern based on network attacks and a provenance graph converted from the operational information corresponding to the anomaly detection. The graph (PG) is used for detection. The source graph includes multiple nodes and edges. Nodes represent system entities described by corresponding operation information, and the edges between two nodes represent the operational relationship between the two system entities represented by the two nodes.

[0008] The detection agent filters the second operational information to obtain the first operational information. Since the first operational information has a smaller data volume than the second operational information, sending the first operational information to the management device reduces communication costs and computational resources required for the management device to perform management-side anomaly detection based on the first operational information. When the conditions for agent-side anomaly detection are met, the detection agent performs first agent-side anomaly detection based on the second operational information. Because the second operational information contains more information than the first operational information, the first agent-side anomaly detection can supplement the management-side anomaly detection results, making the anomaly detection more comprehensive. When the detection agent receives a recall instruction for the first system entity, it sends supplementary operational information of the first system entity to the management device, enabling the management device to obtain all operational information of the first system entity. This allows the management device to perform comprehensive anomaly detection on the first system entity, further improving the comprehensiveness and reliability of anomaly detection.

[0009] Furthermore, detection based on source maps and multi-step behavior patterns can more accurately detect potential network attack behaviors. Therefore, at least one of the anomaly detection methods in management-side anomaly detection, first-agent-side anomaly detection, or supplementary detection should be based on source maps and multi-step behavior patterns, which can further improve the accuracy of anomaly detection.

[0010] In one possible implementation, the detection method of the first agent-end anomaly detection is based on the multi-step behavior pattern of the network attack and the source graph obtained by transforming the operation information corresponding to the anomaly detection; the first agent-end anomaly detection is performed based on the second operation information to obtain the first agent-end detection result, including: based on the detection statement, searching for nodes and edges that satisfy the multi-step behavior pattern of the network attack in the source graph obtained by transforming the second operation information to obtain the first agent-end detection result, and the detection statement describes the multi-step behavior pattern of the network attack through graph query syntax.

[0011] Using graph query syntax to describe the multi-step behavior pattern of network attacks can accurately describe the behavior of network attacks. The source graph can intuitively represent the behavior of various system entities. Therefore, the detection agent device can accurately and efficiently find the nodes and edges in the source graph that satisfy the multi-step behavior pattern of network attacks by searching the source graph based on the detection statement that describes the multi-step behavior pattern of network attacks using graph query syntax, thus achieving efficient and accurate anomaly detection of the first agent end.

[0012] In one possible implementation, before sending the terminal's first operating information to the management device, the method further includes: collecting second operating information; within a reference time period after collecting the second operating information, performing second proxy end anomaly detection based on the second operating information to obtain a second proxy end detection result, wherein the second proxy end detection result indicates whether the terminal is under network attack, and the type of network attack detected by the second proxy end anomaly detection is different from that detected by the first proxy end anomaly detection; and filtering the second operating information based on the second proxy end detection result to obtain the first operating information.

[0013] The detection agent device performs anomaly detection on the second agent end within a reference time after collecting the second operational information. This enables timely anomaly detection based on the second operational information, allowing for prompt determination of whether the terminal is under network attack. Furthermore, the types of network attacks detected by the second agent end anomaly detection differ from those detected by the first agent end anomaly detection. Combining the first and second agent end anomaly detections achieves more comprehensive anomaly detection and improves the reliability of anomaly detection. The second operational information is filtered based on the second agent end detection results, enabling efficient and accurate management end anomaly detection based on the filtered first operational information.

[0014] In one possible implementation, the detection result of the second agent end also indicates that the behavior described by the third operation information in the second operation information is performed by the terminal without being attacked by the network; based on the detection result of the second agent end, the second operation information is filtered to obtain the first operation information, including: filtering out the third operation information in the second operation information to obtain the first operation information.

[0015] Since the detection results from the second agent have been obtained, it can be determined that the third operation information was executed when the terminal was not under network attack. Therefore, the management device does not need to perform repeated anomaly detection based on the third operation information. Filtering out the third operation information allows the management device to perform anomaly detection based on the first operation information that does not include the third operation information, which can reduce the computing resources used by the management device in the process of anomaly detection.

[0016] In one possible implementation, after collecting the second operating information, the method further includes: sending the second operating information to a database connected to the detection agent device, the database being used to store the terminal's operating information; before performing first agent terminal anomaly detection based on the second operating information to obtain the first agent terminal detection result, the method further includes: reading the second operating information from the database, the detection method of the first agent terminal anomaly detection corresponding to the database's storage format for the second operating information.

[0017] Before the detection agent performs anomaly detection on the first agent based on the second operational information, the database connected to the detection agent stores the second operational information, which reduces the storage resource requirements of the detection agent. Since the second operational information used by the detection agent for anomaly detection on the first agent is operational information read from the database, and the format of the read second operational information is determined by the database's storage format, the detection method for anomaly detection on the first agent corresponds to the database's storage format for the second operational information. This ensures that the detection method for anomaly detection on the first agent matches the format of the read second operational information, thereby achieving efficient and accurate anomaly detection.

[0018] In one possible implementation, the anomaly detection conditions at the proxy end include at least one of the following: receiving an anomaly detection command sent by the management device; and the time interval between the last anomaly detection for a first type of network attack being greater than or equal to an interval threshold, where the first type includes the type of network attack detected by the first proxy end anomaly detection. Performing the first proxy end anomaly detection upon receiving the anomaly detection command from the management device enables on-demand detection, reducing the waste of detection resources. Performing the first proxy end anomaly detection within a time interval greater than or equal to the interval threshold enables periodic anomaly detection, improving the regularity and automation of anomaly detection.

[0019] In one possible implementation, the method further includes: performing statistics on the fourth operational information to obtain statistical results, the statistical results including the number of reference-type actions performed by the system entity running on the terminal, the fourth operational information including the second operational information; and sending the statistical results to a management device, the statistical results being used by the management device to determine whether the terminal is under network attack.

[0020] Since some network attacks manifest abnormally by controlling system entities to perform a certain type of behavior multiple times, by counting the number of times each system entity performs a reference type of behavior, it is possible to detect whether the terminal is under these network attacks, thereby achieving more comprehensive anomaly detection.

[0021] In one possible implementation, the first agent detection result further indicates the second system entity corresponding to the abnormal operation information generated when the terminal is under network attack, and the abnormal operation information belongs to the second operation information; after the first agent anomaly detection is performed based on the second operation information to obtain the first agent detection result, the method further includes: sending the first agent detection result to the management device; in response to receiving the first protection processing instruction sent by the management device based on the first agent detection result, performing the first protection processing on the second system entity, the first protection processing instruction including the identification information of the second system entity and information indicating the method of the first protection processing.

[0022] The detection result from the first agent indicates that the terminal is under network attack. Therefore, the detection agent sends the first agent detection result to the management device, enabling the management device to confirm that the terminal is under network attack. The management device then sends a first protection processing instruction to the detection agent, instructing it to perform timely first protection processing to reduce the impact of the network attack on the terminal. Furthermore, the first agent detection result also indicates the second system entity corresponding to the abnormal operation information, allowing the management device to determine a more precise first protection processing method for the second system entity. This improves the accuracy of the first protection processing based on the information indicating the first protection processing method in the first protection processing instruction.

[0023] In one possible implementation, after sending the first operating information of the terminal to the management device, the method further includes: in response to receiving a second protection processing instruction sent by the management device, performing a second protection processing on the third system entity. The second protection processing instruction includes identification information of the third system entity and information indicating the method of the second protection processing. The second protection processing instruction is determined by the management device based on the detection result of the first operating information.

[0024] When the management device detects that the terminal is under network attack based on the detection result of the first operating information, the management device sends a second protection processing instruction to the detection agent device. This enables the detection agent device to perform accurate second protection processing on the third system entity based on the identification information of the third system entity carried in the second protection processing instruction and the information indicating the method of second protection processing, thereby reducing the impact of network attacks on the terminal and improving the security of the terminal.

[0025] Secondly, an anomaly detection method is provided, applied to a management device. The method includes: receiving first operational information sent by a detection agent device, the first operational information being obtained by filtering second operational information, the second operational information describing the behavior of system entities running on the terminal, the second operational information being used by the detection agent device to perform agent-side anomaly detection, the detection agent device running on the terminal, and system entities including objects on the terminal used to implement system tasks; under the condition of meeting management-side anomaly detection requirements, performing first management-side anomaly detection based on the first operational information to obtain a first management-side detection result, the first management-side detection result indicating whether the terminal is under network attack; in response to receiving a recall operation for a first system entity, sending a recall instruction to the detection agent device, the recall instruction including identification information of the first system entity; receiving... The testing agent device receives supplementary operational information of the first system entity sent by the recall command. This supplementary operational information includes operational information related to the first system entity other than the first operational information in the second operational information. Based on the supplementary operational information and the first operational information, supplementary detection is performed to obtain supplementary detection results. These results indicate whether the first system entity is operating under network attack conditions. The detection method for one or more anomaly detection methods, such as agent-side anomaly detection, first management-side anomaly detection, or supplementary detection, is based on a multi-step behavior pattern of network attack and a source graph derived from the operational information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. Nodes represent system entities described by the operational information, and edges between two nodes indicate an operational relationship between the two system entities represented by the two nodes.

[0026] The first operational information is obtained by filtering the second operational information. The first operational information has a smaller data volume than the second operational information. Therefore, sending the first operational information to the management device by the detection agent reduces communication costs and computational resources required for the management device to perform management-end anomaly detection based on the first operational information. When the management-end anomaly detection conditions are met, the management device performs first agent-end anomaly detection based on the first operational information, while the second operational information is used by the detection agent to perform agent-end anomaly detection. Since the second operational information contains more information than the first operational information, agent-end anomaly detection can supplement the results of the first management-end anomaly detection, making the anomaly detection more comprehensive. When the management device receives a recall operation for the first system entity, it sends a recall command to the detection agent. The detection agent then sends supplementary operational information of the first system entity to the management device, enabling the management device to obtain full operational information of the first system entity. This allows the management device to perform comprehensive anomaly detection for the first system entity, further improving the comprehensiveness and reliability of anomaly detection.

[0027] Furthermore, detection based on source maps and multi-step behavior patterns can more accurately detect potential network attack behaviors. Therefore, at least one of the anomaly detection methods in the first management end anomaly detection, agent end anomaly detection, or supplementary detection is based on source maps and multi-step behavior patterns, which can further improve the accuracy of anomaly detection.

[0028] In one possible implementation, the detection method of the first management end anomaly detection is based on the multi-step behavior pattern of the network attack and the traceability graph transformed from the operation information corresponding to the anomaly detection; the first management end anomaly detection is performed based on the first operation information to obtain the first management end detection result, including: based on the detection statement, in the traceability graph transformed from the first operation information, searching for nodes and edges that satisfy the multi-step behavior pattern of the network attack to obtain the first management end detection result, and the detection statement describes the multi-step behavior pattern of the network attack through graph query syntax.

[0029] Using graph query syntax to describe the multi-step behavior pattern of network attacks can accurately describe the behavior of network attacks. The source graph can intuitively represent the behavior of each system entity. Therefore, the management device can accurately and efficiently find the nodes and edges in the source graph that satisfy the multi-step behavior pattern of network attacks by searching the source graph based on the detection statement that describes the multi-step behavior pattern of network attacks using graph query syntax, thus achieving efficient and accurate first-end anomaly detection.

[0030] In one possible implementation, after receiving the first operating information sent by the detection agent device, the method further includes: sending the first operating information to a database connected to the management device, the database being used to store the terminal's operating information; before performing a first management terminal anomaly detection based on the first operating information to obtain the first management terminal detection result, the method further includes: reading the first operating information from the database, the detection method of the first management terminal anomaly detection being related to the database's storage format for the first operating information.

[0031] Before the management device performs first management end anomaly detection based on the first operating information, the first operating information is stored in the database connected to the management device, which reduces the storage resource requirements of the management device. Since the first operating information on which the management device performs first management end anomaly detection is based is operating information read from the database, and the format of the read first operating information is determined by the database's storage format for the first operating information, the detection method of the first management end anomaly detection corresponds to the database's storage format for the first operating information. This ensures that the detection method of the first management end anomaly detection matches the format of the read first operating information, thereby achieving efficient and accurate anomaly detection.

[0032] In one possible implementation, the method further includes: receiving a first proxy detection result sent by the detection proxy device, the first proxy detection result being obtained by the detection proxy device based on second operational information; in response to the first proxy detection result indicating that the terminal is under network attack, the second system entity performs abnormal behavior, sending a first protection processing instruction to the detection proxy device, the first protection processing instruction including the identification information of the second system entity and information instructing the detection proxy device to perform the first protection processing.

[0033] The detection result from the first agent indicates that the terminal is under network attack. Therefore, the detection agent sends the first agent detection result to the management device, enabling the management device to confirm that the terminal is under network attack. The management device then sends a first protection processing instruction to the detection agent, instructing it to perform timely first protection processing to reduce the impact of the network attack on the terminal. Furthermore, the first agent detection result also indicates the second system entity corresponding to the abnormal operation information, allowing the management device to determine a more precise first protection processing method for the second system entity. This improves the accuracy of the first protection processing based on the information indicating the first protection processing method in the first protection processing instruction.

[0034] In one possible implementation, after receiving the first operating information sent by the detection agent device, the method further includes: within a reference time after receiving the first operating information, performing a second management terminal anomaly detection based on the first operating information to obtain a second management terminal detection result. The second management terminal detection result indicates whether the terminal is under network attack, and the type of network attack detected by the second management terminal anomaly detection is different from that detected by the first management terminal anomaly detection.

[0035] Within a reference time after receiving the first operating information, the management device performs a second management terminal anomaly detection, which enables timely anomaly detection based on the first operating information and timely determination of whether the terminal is under network attack. Furthermore, the types of network attacks detected by the second management terminal anomaly detection are different from those detected by the first management terminal anomaly detection. Combining the first and second management terminal anomaly detections can achieve more comprehensive anomaly detection and improve the reliability of anomaly detection.

[0036] In one possible implementation, the second management terminal detection result also indicates that the behavior described by the abnormal operation information in the first operation information is performed by the terminal under network attack. After the second management terminal anomaly detection is performed based on the first operation information to obtain the second management terminal detection result, the method further includes: sending a second protection processing instruction to the detection agent device. The second protection processing instruction includes the identification information of the third system entity and information indicating the method of the second protection processing. The third system entity is the system entity corresponding to the abnormal operation information.

[0037] When the management device detects that the terminal is under network attack based on the second management terminal detection result of the first operating information, the management device sends a second protection processing instruction to the detection agent device. This enables the detection agent device to perform accurate second protection processing on the third system entity based on the identification information of the third system entity carried in the second protection processing instruction and the information indicating the method of second protection processing, thereby reducing the impact of network attacks on the terminal and improving the security of the terminal.

[0038] In one possible implementation, the management-side anomaly detection conditions include at least one of the following: receiving an anomaly detection command; and the time interval between the previous anomaly detection for a first type of network attack being greater than or equal to an interval threshold, where the first type includes the type of network attack detected by the first management-side anomaly detection. Performing the first management-side anomaly detection upon receiving an anomaly detection command enables on-demand detection, reducing waste of detection resources. Performing the first management-side anomaly detection upon a time interval greater than or equal to the interval threshold enables periodic anomaly detection, improving the regularity and automation of anomaly detection.

[0039] In one possible implementation, the method further includes: receiving statistical results sent by a detection agent, the statistical results including the number of times a system entity running on the terminal performs a reference-type behavior; comparing the number of reference-type behaviors with a threshold number to obtain statistical detection results, which indicate whether the terminal is under network attack. Since some network attacks abnormally manifest as controlling system entities to perform a certain type of behavior multiple times, by statistically analyzing the number of times each system entity performs a reference-type behavior, it is possible to detect whether the terminal is under these network attacks, thereby achieving more comprehensive anomaly detection.

[0040] In one possible implementation, the management device is located in the cloud. This cloud-based management device interacts with a detection agent device located on the terminal to perform anomaly detection, achieving end-to-cloud integration for anomaly detection and improving overall performance.

[0041] Thirdly, an anomaly detection system is provided, which includes a detection agent device and a management device. The detection agent device is used to implement the anomaly detection method in the first aspect and any possible implementation thereof, and the management device is used to implement the anomaly detection method in the second aspect and any possible implementation thereof.

[0042] Fourthly, a detection proxy device is provided, which operates on a terminal, and the detection proxy device includes:

[0043] The sending module is used to send the first operating information of the terminal to the management device. The first operating information is used by the management device to perform management end anomaly detection. The first operating information is obtained by the detection agent device through filtering the second operating information. The second operating information is used to describe the behavior of the system entities running on the terminal. The system entities include objects on the terminal used to implement system tasks.

[0044] The detection module is used to perform first proxy anomaly detection based on second operating information when the proxy anomaly detection conditions are met, thereby obtaining the first proxy detection result, which indicates whether the terminal is under network attack.

[0045] The sending module is also used to respond to a recall instruction sent by the management device and send supplementary operating information of the first system entity to the management device. The recall instruction includes the identification information of the first system entity. The supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the operating information of the first system entity. The supplementary operating information of the first system entity is used by the management device to perform supplementary detection on the first system entity.

[0046] Among them, the detection method of one or more anomaly detections, such as management end anomaly detection, first agent end anomaly detection or supplementary detection, is based on the multi-step behavior pattern of network attack and the source graph obtained by converting the operation information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. Nodes represent system entities described by the corresponding operation information, and the edges between two nodes represent that there is an operational relationship between the two system entities represented by the two nodes.

[0047] In one possible implementation, the anomaly detection method of the first agent is based on the multi-step behavior pattern of the network attack and the source graph obtained by converting the operation information corresponding to the anomaly detection. The detection module is used to find the nodes and edges that satisfy the multi-step behavior pattern of the network attack in the source graph obtained by converting the second operation information based on the detection statement, so as to obtain the detection result of the first agent. The detection statement describes the multi-step behavior pattern of the network attack through graph query syntax.

[0048] In one possible implementation, the detection agent device further includes an acquisition module for collecting second operational information; the detection module is further configured to perform second agent end anomaly detection based on the second operational information within a reference time after the second operational information is collected, thereby obtaining a second agent end detection result, the second agent end detection result indicating whether the terminal is under network attack, and the type of network attack detected by the second agent end anomaly detection is different from that detected by the first agent end anomaly detection; the acquisition module is further configured to filter the second operational information based on the second agent end detection result, thereby obtaining first operational information.

[0049] In one possible implementation, the detection result of the second agent end also indicates that the behavior described by the third running information in the second running information is performed by the terminal without being subjected to a network attack; the acquisition module is used to filter out the third running information in the second running information to obtain the first running information.

[0050] In one possible implementation, the sending module is further configured to send second operating information to a database connected to the terminal detection agent device, the database being used to store the terminal's operating information; the obtaining module is further configured to read the second operating information from the database, the detection method of the first agent terminal anomaly detection corresponding to the database's storage format for the second operating information.

[0051] In one possible implementation, the agent-side anomaly detection conditions include at least one of the following: receiving an anomaly detection instruction sent by the management device; and the time interval between the last anomaly detection for a first type of network attack being greater than or equal to an interval threshold, wherein the first type includes the type of network attack detected by the first agent-side anomaly detection.

[0052] In one possible implementation, the detection module is further configured to perform statistics on the fourth operational information to obtain statistical results, which include the number of times the system entity running on the terminal performs reference-type actions, and the fourth operational information includes the second operational information; the sending module is further configured to send the statistical results to the management device, which uses the statistical results to determine whether the terminal is under network attack.

[0053] In one possible implementation, the first agent detection result also indicates the second system entity corresponding to the abnormal operation information generated when the terminal is under network attack, and the abnormal operation information belongs to the second operation information; the sending module is also used to send the first agent detection result to the management device; the protection module is also used to respond to receiving the first protection processing instruction sent by the management device based on the first agent detection result, and to perform the first protection processing on the second system entity, the first protection processing instruction including the identification information of the second system entity and information indicating the method of the first protection processing.

[0054] In one possible implementation, the protection module is further configured to perform second protection processing on the third system entity in response to receiving a second protection processing instruction sent by the management device. The second protection processing instruction includes identification information of the third system entity and information indicating the manner of the second protection processing. The second protection processing instruction is determined by the processing management device based on the detection results of the first operating information.

[0055] Fifthly, a management device is provided, the management device comprising:

[0056] The receiving module is used to receive first running information sent by the detection agent device. The first running information is obtained by filtering the second running information. The second running information is used to describe the behavior of the system entities running on the terminal. The second running information is used to detect the agent device to perform agent end anomaly detection. The detection agent device runs on the terminal. The system entities include objects on the terminal used to implement system tasks.

[0057] The detection module is used to perform first management terminal anomaly detection based on first operating information when the management terminal anomaly detection conditions are met, thereby obtaining the first management terminal detection result, which indicates whether the terminal is under network attack.

[0058] The sending module is used to send a recall instruction to the detection agent device in response to receiving a recall operation for the first system entity. The recall instruction includes the identification information of the first system entity.

[0059] The receiving module is also used to receive supplementary operating information of the first system entity sent by the detection agent device based on the recall instruction. The supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the first operating information.

[0060] The detection module is also used to perform supplementary detection based on the supplementary operation information and the first operation information, so as to obtain supplementary detection results. The supplementary detection results indicate whether the first system entity is running under network attack conditions.

[0061] Among them, the detection method of one or more anomaly detections, such as agent-end anomaly detection, first management end anomaly detection, or supplementary detection, is based on the multi-step behavior pattern of network attacks and the source graph obtained by transforming the operation information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. Nodes represent system entities described by the operation information, and the edges between two nodes represent that there is an operational relationship between the two system entities represented by the two nodes.

[0062] In one possible implementation, the first management end anomaly detection method is based on the multi-step behavior pattern of network attacks and the source graph obtained by converting the operation information corresponding to the anomaly detection; the detection module is used to find the nodes and edges that satisfy the multi-step behavior pattern of network attacks in the source graph obtained by converting the first operation information based on the detection statement, so as to obtain the detection result of the first management end. The detection statement describes the multi-step behavior pattern of network attacks through graph query syntax.

[0063] In one possible implementation, the sending module is further configured to send first operating information to a database connected to the management device, the database being used to store the terminal's operating information; the detection module is further configured to read the first operating information from the database, the detection method of the first management terminal anomaly detection being related to the database's storage format for the first operating information.

[0064] In one possible implementation, the receiving module is further configured to receive a first proxy end detection result sent by the detection proxy device, the first proxy end detection result being obtained by the detection proxy device based on second operating information; the sending module is further configured to, in response to the first proxy end detection result indicating that the terminal is under network attack, perform abnormal behavior of the second system entity, send a first protection processing instruction to the detection proxy device, the first protection processing instruction including the identification information of the second system entity and information instructing the detection proxy device to perform the first protection processing.

[0065] In one possible implementation, the detection module is further configured to perform second management terminal anomaly detection based on the first operation information within a reference time after receiving the first operation information, thereby obtaining a second management terminal detection result. The second management terminal detection result indicates whether the terminal is under network attack. The type of network attack detected by the second management terminal anomaly detection is different from that detected by the first management terminal anomaly detection.

[0066] In one possible implementation, the detection result of the second management terminal also indicates that the behavior described by the abnormal operation information in the first operation information is performed by the terminal under network attack; the sending module is also used to send a first protection processing instruction to the detection agent device, the first protection processing instruction includes the identification information of the second system entity and information indicating the method of the first protection processing, the second system entity is the system entity corresponding to the abnormal operation information.

[0067] In one possible implementation, the management end anomaly detection conditions include at least one of the following: obtaining an anomaly detection instruction; the time interval between the last anomaly detection performed by the management device for a first type of network attack is greater than or equal to an interval threshold, wherein the first type includes the type of network attack detected by the first management end anomaly detection.

[0068] In one possible implementation, the receiving module is further configured to receive statistical results sent by the detection agent, the statistical results including the number of times the system entity running on the terminal performs reference-type behaviors; the detection module is further configured to compare the number of reference-type behaviors with a number threshold to obtain statistical detection results, the statistical detection results indicating whether the terminal is under network attack.

[0069] In one possible implementation, the management device is located in the cloud.

[0070] Sixthly, a computer program (product) is provided, comprising: computer program code, which, when executed by a computer, causes the computer to perform the methods described in the above aspects.

[0071] In a seventh aspect, a computer-readable storage medium is provided that stores a program or instructions, wherein when the program or instructions are run on a computer, the methods described in the preceding aspects are performed.

[0072] Eighthly, a chip is provided, including a processor for retrieving and executing instructions stored in memory, causing a computer equipped with the chip to perform the methods described in the preceding aspects.

[0073] Ninthly, another chip is provided, comprising: an input interface, an output interface, a processor, and a memory, wherein the input interface, the output interface, the processor, and the memory are connected via an internal connection path, the processor is used to execute code in the memory, and when the code is executed, a computer with the chip installed performs the methods in the above aspects.

[0074] In a tenth aspect, an anomaly detection device is provided, including a processor coupled to a memory; the memory stores at least one instruction, which is loaded and executed by the processor to enable the anomaly detection device to implement methods in various aspects.

[0075] It should be understood that the beneficial effects achieved by the technical solutions and corresponding possible implementations of aspects three to ten of this application can be found in the technical effects of aspects one and two and their corresponding possible implementations described above, and will not be repeated here. Furthermore, the detection agent device mentioned in aspect four or the management device mentioned in aspect five may be the chip mentioned in aspect eight or nine, or may also be the device mentioned in aspect ten. Attached Figure Description

[0076] Figure 1 is a schematic diagram of an implementation scenario provided by an embodiment of this application;

[0077] Figure 2 is a flowchart illustrating an anomaly detection method provided in an embodiment of this application;

[0078] Figure 3 is an exemplary traceability diagram provided in an embodiment of this application;

[0079] Figure 4 is a flowchart illustrating another anomaly detection method provided in an embodiment of this application;

[0080] Figure 5 is a schematic diagram of an anomaly detection system provided in an embodiment of this application;

[0081] Figure 6 is a schematic diagram of an anomaly detection system performing an anomaly detection method according to an embodiment of this application;

[0082] Figure 7 is a schematic diagram of an anomaly detection process provided in an embodiment of this application;

[0083] Figure 8 is a schematic diagram of a detection agent device provided in an embodiment of this application;

[0084] Figure 9 is a schematic diagram of a management device provided in an embodiment of this application;

[0085] Figure 10 is a structural schematic diagram of an anomaly detection device provided in an embodiment of this application. Detailed Implementation

[0086] The terminology used in the implementation section of this application is for the purpose of explaining specific embodiments of this application only, and is not intended to limit this application.

[0087] As cyberattacks escalate, an increasing number of advanced threats and unknown attack samples cannot be detected and protected against using traditional security solutions. Endpoints are a crucial component of networks and a primary target of cyberattacks. Security solutions for endpoints typically rely on Endpoint Detection and Response (EDR) technology to detect and protect against cyberattacks. EDR-based security solutions comprehensively collect runtime information from the endpoint, including process execution logs and network connection records. This collected information is then analyzed using big data analytics to detect anomalies and implement appropriate measures based on the detection results, thus protecting the endpoint.

[0088] Security solutions based on EDR technology are typically implemented through a combination of a data collection agent deployed on the endpoint, a server-side management device with advanced analytics capabilities, and security operations personnel. The data collection agent on the endpoint, in addition to collecting fine-grained operational information and performing protective measures, also possesses some anomaly detection capabilities. Furthermore, the agent sends all or part of the collected raw operational information to the server-side, leveraging the server's big data analytics capabilities to perform in-depth analysis of network attacks or threats to the endpoint, achieving more accurate anomaly detection. Security operations personnel are responsible for analyzing and processing the detection results and for daily operations.

[0089] The server-side anomaly detection method based on the operational information collected from the agent is typically threat hunting. Threat hunting refers to the process of querying and investigating operational information based on specific security assumptions to discover hidden traces of network attacks; it is a retrospective form of anomaly detection. The security assumption is a pre-defined, speculative judgment or threat information based on existing network attack knowledge, experience, data, and an understanding of the overall network situation. This assumption can be a process attribute or behavior, such as a pre-defined potential security threat or a pre-existing network attack. Security assumptions can originate from threat information communities (platforms or organizations established for sharing and exchanging threat information), historical anomaly detection results, detection alert records, or alert records from artificial intelligence (AI) models.

[0090] In related technologies, threat hunting is often carried out using centralized storage, such as threat hunting based on centralized storage systems or centralized data infrastructures. The data infrastructure is the architecture that supports data storage, management, processing, and applications. For example, a centralized storage system may include a security information and event management (SIEM) system, while a data infrastructure may include a data lake, a relational database (RDB), a graph database (GDB), an online analytical processing (OLAP) engine, or an elastic search (ES) database, etc.

[0091] After receiving operational information from various data collection agents, the server stores this information through a centralized storage system or a centralized data platform. During threat hunting, security operations personnel write specific query scripts based on a search processing language (SPL). The server then uses these query scripts to query, filter, and analyze the operational information stored in the centralized storage system or centralized data platform to identify information related to potential threats, thereby enabling anomaly detection on the endpoint.

[0092] Centralized threat hunting requires collection agents on various terminals to upload all or part of the collected operational information to a server for centralized storage, resulting in significant transmission, storage, and computation costs. Due to the large volume of operational information collected by the collection agents, uploading all collected information to the server is practically impossible. Therefore, related technologies typically involve the collection agents filtering and merging the collected operational information, discarding some. This discarded information creates detection blind spots, making network attack behaviors or traces reflected in the discarded information undetectable, reducing the comprehensiveness, reliability, and accuracy of anomaly detection. Even if the operational information received by the server is filtered, the amount of filtered operational information stored on the server can accumulate significantly over time. When the server performs threat hunting based on this accumulated information, it still causes significant response delays, resulting in failures or an inability to support detailed investigations.

[0093] In another related technology, operational information is stored in a distributed manner on the endpoint, and endpoint devices, such as terminals or data acquisition agents, perform threat hunting based on the stored operational information. However, relying on endpoint-side storage of operational information and threat hunting cannot achieve cross-endpoint anomaly detection, lacking reliability and comprehensiveness.

[0094] Furthermore, most threat hunting using related technologies involves indicator of compromise (IOC) hunting. IOC hunting refers to actively searching for and discovering known intrusion indicators (or compromise indicators) using various techniques and tools to determine whether an attack has occurred or a security threat exists. These intrusion indicators are typically specific, identifiable characteristics, such as specific Internet Protocol (IP) addresses, malicious domain names, file hash values, specific registry keys, etc. IOC hunting usually employs simple matching and query methods, using security tools (such as antivirus software) or data analysis platforms to compare collected operational information with known intrusion indicators to find if matching intrusion indicators exist. For example, whether the operational information contains known malicious IP addresses or file hash values ​​can be used to determine if a network attack has occurred.

[0095] However, IOC hunting has certain limitations. For example, some cyberattacks control system entities on the terminal to perform abnormal behaviors, without necessarily producing static intrusion indicators. For instance, some cyberattacks aim to steal data from the terminal; during the attack, malware or devices may control system entities on the terminal to read data from numerous files without accessing malicious IP addresses or generating intrusion indicators. Therefore, detecting whether a terminal is under cyberattack through IOC hunting cannot guarantee the accuracy and comprehensiveness of the detection results.

[0096] This application provides an anomaly detection method that improves the comprehensiveness, accuracy, and reliability of detection. Referring to Figure 1, a schematic diagram of an implementation scenario provided by this application is shown, which includes an anomaly detection system. As shown in Figure 1, the anomaly detection system includes a detection agent device 12 on the terminal side and a management device 11 on the server side. The detection agent device 12 runs on the terminal and can be the terminal itself, a module or component on the terminal, or software or a system on the terminal. Optionally, the management device 11 is located on a public cloud, private cloud, or physical server, and can be a device, a device cluster, a software system or platform running on the device, etc. Both the detection agent device 12 and the management device 11 have anomaly detection capabilities, thus enabling end-to-cloud collaboration in anomaly detection through the detection agent device 12 and the management device 11.

[0097] Optionally, the management device 11 and the detection agent device 12 communicate via wired or wireless means. One management device 11 can connect to one or more detection agent devices 12. Different detection agent devices 12 operate on different terminals, and the types of different detection agent devices 12 are not necessarily the same, nor are the types of terminals to which different detection agent devices 12 belong. For example, the terminal includes one or more of desktop computers, laptops, handheld terminals, and servers. One detection agent device 12 can be managed by one management device 11 or by multiple management devices 11, and the types of multiple management devices 11 connected to one detection agent device 12 are not necessarily the same.

[0098] For example, the management device 11 and the detection agent device 12 are each connected to their own databases. The databases connected to the management device 11 and the detection agent device 12 are not necessarily of the same type, and the databases connected to by different detection agent devices 12 managed by the same management device 11 are also not necessarily of the same type. The database connected to the management device 11 is used to store information generated or received by the management device 11, and the database connected to the detection agent device 12 is used to store information generated or received by the detection agent device 12. Two different channels are established between the management device 11 and the detection agent device 12: an instruction channel and a data channel. The instruction channel is used by the management device 11 to issue various instructions to the detection agent device 12, and the data channel is used by the detection agent device 12 to send operating information and other data to the management device 11. Optionally, the instruction channel and the data channel between the management device 11 and the detection agent device 12 are connected to the same physical connection.

[0099] The anomaly detection methods provided in this application include anomaly detection methods executed by detection agent device 12 and anomaly detection methods executed by management device 11. The anomaly detection methods executed by the two devices will be described by way of example below.

[0100] Referring to Figure 2, a flowchart illustrating an anomaly detection method provided in an embodiment of this application is shown. This anomaly detection method is applied to a detection agent device 12 running on a terminal in the implementation scenario shown in Figure 1. As shown in Figure 2, the anomaly detection method includes, but is not limited to, steps S201 to S203 below.

[0101] S201, the first operating information of the terminal is sent to the management device. The first operating information is used by the management device to perform management terminal anomaly detection. The first operating information is obtained by filtering the second operating information. The second operating information is used to describe the behavior of system entities running on the terminal. The system entities include objects on the terminal used to implement system tasks.

[0102] The system entities running on the terminal include, but are not limited to, processes, threads, networks, files, registry entries, and domain names (DNs). These system entities perform various behaviors during terminal operation, such as creating child processes, accessing files, and reading / writing data. The second runtime information is the raw runtime information generated during terminal operation, i.e., runtime information that has not been filtered or modified. This second runtime information describes the behavior of the system entities running on the terminal.

[0103] This application does not limit the format and type of the second runtime information. For example, the second runtime information includes one or more of the following: logs, records, operations of each system entity, or attribute information of each system entity generated during the operation of each system entity. In some cases, the second runtime information collected by EDR technology exhibits obvious graph characteristics, or a subject-verb-object structure. The second runtime information describes the behavior of system entities through subject-verb-object statements. For example, the second runtime information describes the process fork (PROC_FORK) behavior of process A generating child process B, or the file write (FILE_WRITE) behavior of process A writing data to file C.

[0104] Since the behavior of system entities is constantly occurring during the operation of the terminal, the amount of data in the second operation information is usually very large. Therefore, in this embodiment of the application, the detection agent device filters the second operation information to obtain the first operation information and sends the first operation information to the management device. Since the amount of data in the first operation information is smaller than that in the second operation information, sending the first operation information to the management device can reduce the communication cost and resource consumption between the detection agent device and the management device.

[0105] For example, before the detection agent device sends the terminal's first operating information to the management device, the method further includes: the detection agent device collecting second operating information. This application embodiment does not limit the method by which the detection agent device collects the second operating information. Optionally, the detection agent device periodically collects the terminal's operating information to obtain the second operating information; or, the detection agent device collects the terminal's operating information upon receiving an information collection instruction from the management device to obtain the second operating information.

[0106] After collecting the second operational information, the detection agent device filters the second operational information in different ways to obtain the first operational information. For example, within a reference time period after collecting the second operational information, the detection agent device performs second agent end anomaly detection based on the second operational information to obtain a second agent end detection result. The second agent end detection result indicates whether the terminal is under network attack. Based on the second agent end detection result, the detection agent device filters the second operational information to obtain the first operational information.

[0107] The reference duration is set based on experience or user needs, such as 10 milliseconds or 50 milliseconds. Within this reference duration after collecting the second operational information, anomaly detection of the second agent is performed based on this information. This enables real-time detection of the second operational information, allowing for timely determination of whether the terminal is under network attack. Optionally, the network attack detected by the second agent anomaly detection is a time-sensitive attack, or an attack requiring immediate protection, such as a phishing attack or a distributed denial-of-service (DDoS) attack.

[0108] Furthermore, the detection agent device performs anomaly detection on the second agent end using different detection methods for different types of network attacks. Taking DDoS attacks as an example, the detection agent device searches for abnormal network access records, a large number of failed login attempts, or specific log information related to DDoS attacks in the second operational information to obtain the detection result of the second agent end. The detection result of the second agent end may optionally include abnormal operational information in the second operational information, or the identification information of abnormal system entities, the time of occurrence of the anomaly, etc.

[0109] For example, if the second operational information includes a large number of frequent access requests from the same IP address or different IP addresses, and the requested resources or behaviors are abnormal, then it is determined that the terminal has been subjected to a DDoS attack. The detection results of the second proxy end may optionally include information such as the abnormal IP address, the time of occurrence of the access request from the abnormal IP address, or the resource access path corresponding to the access request. The detection results of the second proxy end indicate that the terminal has been subjected to a network attack.

[0110] Alternatively, taking the network attack detected by the second agent as an example, which includes phishing attacks, the detection process searches the second operational information for abnormal login attempt records, file access records, or system entities related to phishing, thereby determining whether the terminal is under a phishing attack. If the second operational information contains descriptive information about abnormal login attempt records, file access records, or system entities related to phishing, the second agent detection result may optionally include the identification information of the abnormal login attempt records, file access records, or system entities related to phishing, indicating that the terminal is under a network attack.

[0111] If the second agent's detection result indicates that the terminal is under network attack, and the second agent's detection result also indicates that the behavior described by the third operational information in the second operational information was performed by the terminal without being under network attack, then the detection agent device filters the second operational information based on the second agent's detection result to obtain the first operational information, including: the detection agent device filters out the third operational information in the second operational information to obtain the first operational information.

[0112] Optionally, the third operational information is the operational information in the second operational information that hits the security whitelist. In this case, the second agent's detection result also includes a security whitelist hit identifier; the operational information marked with this hit identifier is the information that hits the security whitelist. The security whitelist refers to a list of behaviors of various system entities that have been confirmed to be normal. Accordingly, during the anomaly detection process of the detection agent device, it can not only detect whether each part of the operational information in the second operational information is abnormal, but also detect whether each part of the operational information hits the security whitelist, and mark the operational information that hits the security whitelist with a hit identifier.

[0113] In this scenario, the detection agent can filter the third operational information that matches the security whitelist in the second operational information. If a portion of the operational information matches the security whitelist, it means that the operational information is without anomalies. Therefore, the management device does not need to detect the non-anomaly operational information. Filtering out the operational information that matches the security whitelist in the second operational information can also reduce the waste of transmission resources and the computing resources of the management device, and improve the efficiency of anomaly detection by the management device.

[0114] Optionally, during the filtering of the second running information, the detection agent device may, based on the detection results of the second agent, filter out the third running information that matches the security whitelist, or filter out abnormal running information, or filter out both the third running information and the abnormal running information. All three implementation methods can be achieved in the embodiments of this application. Alternatively, the detection agent device may filter out duplicate running information in the second running information to obtain the first running information.

[0115] The embodiments of this application do not limit the timing or conditions under which the detection agent device sends the first operating information to the management device. For example, the detection agent device periodically sends the first operating information to the management device. Alternatively, the detection agent device sends the first operating information to the management device after receiving an operating information upload instruction from the management device. Or, the detection agent device or the memory or database connected to the detection agent device is configured with a designated storage space for storing first operating information that has not been sent to the management device. When the storage space is completely occupied by first operating information that has not been sent to the management device, the detection agent device sends the previously unsent first operating information to the management device. The size of the designated storage space is set based on experience or user needs. Each time the detection agent device sends the first operating information to the management device, it sends the operating information other than the previously sent operating information from the filtered first operating information; that is, it performs incremental sending of the first operating information.

[0116] In one possible implementation, after the detection agent device performs anomaly detection on the second agent end based on the second operational information and obtains the detection result of the second agent end, it further includes: the detection agent device performs protection processing on the system entity corresponding to the abnormal operational information in the second operational information. The method of protection processing is determined based on the mapping relationship between the type of network attack and the protection processing method and the type of network attack corresponding to the abnormal operational information.

[0117] Optionally, the mapping relationship between network attack types and protection methods is issued by the management device, statically configured on the monitoring device, or stored in a memory or database connected to the terminal. In this mapping relationship, different types of network attacks have corresponding protection methods, and these methods can be the same or different. For example, the protection method for phishing attacks is to stop the operation of the system entity corresponding to the phishing attack. This could include deleting phishing emails or disconnecting abnormal network connections.

[0118] By taking corresponding protective measures against network attacks that correspond to abnormal operation information, timely and accurate protection can be achieved, reducing the impact of network attacks on terminals and improving terminal security.

[0119] Regardless of the method by which the detection agent filters the second operational information, and regardless of whether the detection agent performs protective processing after filtering, the detection agent sends the filtered first operational information to the management device. Optionally, if the detection agent filters the second operational information based on the detection results from the second agent end, and performs protective processing after obtaining the detection results from the second agent end, in this case, the detection agent can filter the second operational information and send the filtered first operational information to the management device before, after, or during the protective processing. The first operational information is used by the management device for anomaly detection at the management end.

[0120] Optionally, the management-side anomaly detection method includes detection based on intrusion indicators of network attacks and first operational information, i.e., IOC hunting. One or more intrusion indicators can be used during the detection process, achieving combined detection through multiple intrusion indicators. The IOC hunting method can be referred to the previous explanation and will not be repeated here. Alternatively, the management-side anomaly detection method includes detection based on multi-step behavior patterns of network attacks and a source map derived from the operational information corresponding to the management-side anomaly detection (i.e., first operational information), i.e., indicator of attack (IOA) hunting.

[0121] The source graph includes multiple nodes and edges. Nodes represent system entities described by the first runtime information, and edges between two nodes represent operational relationships between the two system entities represented by those nodes. As explained above, runtime information typically exhibits obvious graph characteristics. Therefore, runtime information can be mapped to dependency edges of "(head) - [edge] -> (tail)", and transformed into a source graph structure based on these dependency edges. Referring to Figure 3, an exemplary source graph provided by an embodiment of this application is shown. In this source graph, an ellipse represents a node, and a node represents a system entity. Different nodes in the source graph can represent different types of system entities. The operational relationships between system entities are represented by dependency edges, and the direction of the dependency edges represents the actual direction of dependency diffusion. For example, in Figure 3, the three ellipses represent the nodes corresponding to process A, child process B, and file C, respectively. The first runtime information describes the process fork (PROC_FORK) behavior of process A generating child process B. In the resulting source graph, there is an edge between the nodes corresponding to process A and child process B, with the edge pointing from process A to child process B. Similarly, the first runtime information describes the file write (FILE_WRITE) behavior of process A writing data to file C. In the resulting source graph, there is an edge between the nodes corresponding to process A and file C, with the edge pointing from process A to file C.

[0122] Optionally, nodes and edges in the source graph can carry additional attribute information, including identification information, operation information, etc., which are also obtained by converting runtime information. For example, each node in Figure 3 carries corresponding identification information: process A, child process B, and file C; each edge carries corresponding operation information such as FORK and WRITE, all of which are attribute information.

[0123] IOA hunting refers to hunting that does not rely on specific intrusion indicators such as domain names, hashes, or IP addresses, but rather uses graph query languages ​​to natively describe multi-step attack patterns. It primarily determines whether a system entity or its behavior exhibits anomalies by analyzing the relationships, sequence, and logical connections between the behaviors of multiple system entities. Since source graphs can represent the relationships, sequence, and logical connections between multiple system entities, based on source graphs and the multi-step behavioral patterns of network attacks, it is possible to determine whether there are abnormal system entities or their behaviors within the source graph, thus achieving anomaly detection.

[0124] For example, detection is performed based on the multi-step behavior pattern of a network attack and the source graph obtained by transforming the runtime information corresponding to anomaly detection. This includes: obtaining a detection statement, which describes the multi-step behavior pattern of the network attack using graph query syntax; and searching for nodes and edges in the source graph that satisfy the multi-step behavior pattern of the network attack based on the detection statement. The multi-step behavior pattern of the network attack is determined through descriptions of network attacks from information sources such as a current network threat database, cross-terminal events, and historical statistical data.

[0125] Optionally, the detection statement is set based on experience or user requirements. The graph query syntax on which the detection statement is based is, for example, Gremlin query syntax, Cypher syntax, or SPARQL query syntax. In the process of searching the source graph for nodes and edges that satisfy the multi-step behavior pattern of a network attack based on the detection statement, each node and edge in the source graph is described using graph query syntax, resulting in a description statement for the source graph. If the description statement of the source graph matches the detection statement, it means that the nodes and edges corresponding to the description statement satisfy the multi-step behavior pattern of a network attack.

[0126] Taking a phishing email attack as an example, the detection statement for the multi-step behavior pattern of a phishing email attack, expressed using Cypher syntax, is shown below.

[0127] match p=(emailServer:network)-[:connect]-(mailClient:process)-[:write]->(attachment:exe)where emailServer.dstPort in[25,465,587,110,143,995,993]return p;

[0128] The phrase "emailServer.dstPort in [25,465,587,110,143,995,993]" represents a common email service port. The path (emailServer:network)-[:connect]-(mailClient:process) allows the identification of all client processes accessing the email service on the network, without relying on specific program names or hashes. The complete multi-step behavior pattern (attack path) of a phishing email attack is described as "p = (emailServer:network)-[:connect]-(mailClient:process)-[:write]->(attachment:exe)", further limiting the search to the relevant runtime information of email client processes that store executable files. By combining the above detection statements with predefined EDR domain modeling and querying the source graph, it is possible to accurately determine whether there are nodes and edges matching the multi-step behavior pattern described in the detection statements, thereby determining whether there is abnormal runtime information, i.e., whether the terminal is under network attack.

[0129] Regardless of the detection method used by the management device to detect anomalies at the management end, after the detection agent device sends the terminal's first operational information to the management device, and the management device completes the management end anomaly detection, the detection agent device can also respond to the second protection processing instruction sent by the management device and perform second protection processing on the third system entity. The second protection processing instruction includes the identification information of the third system entity and information indicating the method of second protection processing. The second protection processing instruction is determined by the processing device based on the detection results of the first operational information. The third system entity is the system entity corresponding to the anomaly information in the first operational information, or in other words, the behavior of the third system entity is abnormal when the terminal is under network attack. The method of second protection processing is related to the type of network attack corresponding to the third system entity. After receiving the second protection processing instruction, the detection agent device identifies the third system entity running on the terminal based on the identification information of the third system entity, and performs second protection processing on the third system entity according to the information indicating the method of second protection processing, thereby reducing the impact of the third system entity on the terminal.

[0130] S202, if the conditions for agent-side anomaly detection are met, the first agent-side anomaly detection is performed based on the second operating information to obtain the first agent-side detection result, which indicates whether the terminal is under network attack.

[0131] Optionally, the anomaly detection conditions of the proxy end include at least one of the following: receiving an anomaly detection instruction sent by the management device; the time interval between the last anomaly detection for the first type of network attack being greater than or equal to an interval threshold, where the first type includes the type of network attack detected by the first proxy end anomaly detection. The interval threshold is set based on experience or user requirements, and the anomaly detection instruction includes information instructing the detection proxy device to perform anomaly detection, or includes the type of network attack detected by the anomaly detection, or includes a range of operational information used for anomaly detection.

[0132] The scope of operational information used for anomaly detection includes the time range in which the operational information was generated, or the scope of the system entities corresponding to the operational information. For example, if the scope of operational information used for anomaly detection includes the time range in which the operational information was generated from January 1, 2011 to January 2, 2011, then the operational information used by the detection agent during the first agent-side anomaly detection process is the operational information generated from January 1, 2011 to January 2, 2011 in the second operational information. As another example, if the scope of operational information used for anomaly detection includes the scope of the system entities corresponding to the operational information, such as system entity A, system entity B, and system entity C, then the operational information used by the detection agent during the first agent-side anomaly detection process is the operational information in the second operational information describing the behavior of system entities A, B, and C.

[0133] If the anomaly detection condition of the agent is receiving an anomaly detection instruction sent by the management device, then when the detection agent receives the anomaly detection instruction, the detection agent performs the first agent anomaly detection on the second operating information to achieve passive first agent anomaly detection; however, when the previous anomaly detection is completed, if no anomaly detection instruction is received, the detection agent does not perform the first agent anomaly detection.

[0134] If the anomaly detection condition of the proxy end is that the time interval between the last anomaly detection for the first type of network attack is greater than or equal to the interval threshold, then after the anomaly detection for the last type of network attack is completed, the detection proxy device starts timing. If the timing duration does not reach the interval threshold, the detection proxy device does not perform the first proxy end anomaly detection until the timing duration reaches the interval threshold, at which point the detection proxy device starts performing the first proxy end anomaly detection, thus achieving periodic anomaly detection. Optionally, during the periodic anomaly detection process of the detection agent device, the operational information based on each anomaly detection can be different. For example, the operational information based on the first anomaly detection may be the operational information collected between the time the detection agent device is activated and the time the first anomaly detection begins, as described in the second operational information. The operational information based on the second anomaly detection may be the operational information collected between the time the detection agent device is activated and the time the second anomaly detection begins, or the operational information based on the second anomaly detection may be the operational information collected between the time the detection agent device begins the first anomaly detection and the time the second anomaly detection begins, or the operational information based on the third anomaly detection may be the operational information collected between the time the detection agent device is activated and the time the third anomaly detection begins, or the operational information based on the third anomaly detection may be the operational information collected between the time the detection agent device begins the first anomaly detection and the time the third anomaly detection begins, or the operational information based on the third anomaly detection may be the operational information collected between the time the detection agent device begins the first anomaly detection and the time the third anomaly detection begins, as described in the second operational information. In other words, each anomaly detection performed by the detection agent is an anomaly detection of incremental operational information based on the collected operational information, or an anomaly detection of the full amount of operational information based on the collected operational information, or the operational information on which two anomaly detections are based may partially overlap.

[0135] When the conditions for anomaly detection at the proxy end include both receiving an anomaly detection command sent by the management device and the time interval between the last anomaly detection for the first type of network attack being greater than the interval threshold, the detection proxy device starts timing after completing an anomaly detection for the first type of network attack. If the detection proxy device does not receive an anomaly detection command before the timing interval threshold is reached, the detection proxy device will perform the first proxy end anomaly detection until the timing interval is reached, and restart timing after the first proxy end anomaly detection is completed. If the detection proxy device receives an anomaly detection command before the timing interval threshold is reached, the detection proxy device will promptly perform the first proxy end anomaly detection based on the anomaly detection command, and restart timing after the first proxy end anomaly detection is completed.

[0136] When the conditions for agent-side anomaly detection are met, the detection method for the first agent-side anomaly detection performed by the detection agent device can be based on intrusion indicators of network attacks and second operational information, or it can be based on multi-step behavior patterns of network attacks and the source map converted from the operational information corresponding to the management-side anomaly detection.

[0137] If the detection method of the first agent end anomaly detection is based on the multi-step behavior pattern of network attack and the source graph obtained by converting the operation information corresponding to the anomaly detection, then the detection agent device performs the first agent end anomaly detection based on the second operation information to obtain the first agent end detection result, including: based on the detection statement, searching for nodes and edges that satisfy the multi-step behavior pattern of network attack in the source graph obtained by converting the second operation information, thereby obtaining the first agent end detection result. The detection statement describes the multi-step behavior pattern of network attack through graph query syntax.

[0138] The process of detecting statements, converting the source graph based on the second operational information, and finding nodes and edges that satisfy the multi-step behavior pattern of a network attack can be referred to in S201, and will not be repeated here. Optionally, the detection statements come from the detection script preset on the detection agent device (if the anomaly detection is threat hunting, the detection script can also be called the hunting script), and the detection statements are the statements in the detection script used to perform anomaly detection against the first type of network attack. The detection statements may also be carried in the anomaly detection instructions, and the detection agent device can obtain the detection statements when it receives the anomaly detection instructions. The action of converting the second operational information into a source graph can be performed by the detection agent device or by other components on the terminal corresponding to the detection agent device. The detection results of the first agent end include one or more of the following: operational information corresponding to the abnormal nodes and edges, attribute information of the abnormal nodes and edges, or information indicating whether the terminal is under network attack.

[0139] If the detection method of the first agent terminal anomaly detection is based on intrusion indicators of network attacks and the second operational information, then the detection agent device performs the first agent terminal anomaly detection based on the second operational information to obtain the first agent terminal detection result, including: searching for operational information that matches the intrusion indicators in the second operational information; if there is operational information that matches the intrusion indicators, then the first agent terminal detection result can be a detection result indicating that the terminal has been subjected to a network attack; if there is no operational information that matches the intrusion indicators in the second operational information, then the first agent terminal detection result can be a detection result indicating that the terminal has not been subjected to a network attack.

[0140] Optionally, the detection method for the first agent terminal anomaly detection is specified by the user or instructed by the management device. For example, the anomaly detection instruction may also include information indicating the detection method for the first agent terminal anomaly detection. Alternatively, the detection method for the first agent terminal anomaly detection may be determined in other ways. For example, after the detection agent device collects the second operating information, the method further includes: the detection agent device sending the second operating information to a database connected to the detection agent device, the database being used to store the terminal's operating information; before the detection agent device performs the first agent terminal anomaly detection based on the second operating information and obtains the first agent terminal detection result, the method further includes: the detection agent device reading the second operating information from the database connected to the detection agent device, the detection method for the first agent terminal anomaly detection being related to the storage format of the second operating information in the database connected to the detection agent device.

[0141] The storage format of the second operational information in the database connected to the detection agent is related to the type of database to which the detection agent is connected. For example, if the database connected to the detection agent is a relational database, the database will store the second operational information in a table format. The table consists of rows and columns, with each row representing one operational information and each column representing a specific attribute or field. For example, the table may contain columns such as the identification information of the system entity, the type of the system entity, or the behavior of the system entity, and each row corresponds to one system entity. When the database connected to the detection agent is a relational database, the default detection method for the first agent-side anomaly detection of the detection agent is based on intrusion indicators of network attacks and the second operational information, that is, the default first agent-side anomaly detection is IOC hunting. Since the process of IOC hunting requires traversing the behavior of various system entities described by the second running information, storing the second running information in a table format can more intuitively display the content included in the second running information, making it easier to implement complex query operations, such as multi-table join queries and conditional filtering, so as to quickly filter out the running information that matches the intrusion indicators from a large amount of second running information. Therefore, when the database type connected to the terminal is a relational database, IOC hunting can be carried out efficiently and accurately, improving the efficiency and accuracy of anomaly detection on the first agent end.

[0142] It should be understood that the type of database connected to the detection agent is related to the detection method of the first agent's anomaly detection, but this does not mean that the detection method of the first agent's anomaly detection is only the detection method matched to the type of database connected to the detection agent. For example, the detection method matched to a relational database is IOC hunting, and the detection method of the first agent's anomaly detection can be either IOC hunting or IOA hunting. For example, the detection agent can use join syntax, such as one or more join syntaxes such as inner join, left join, or right join, to associate the various tables stored in the relational database, determine the relationships between the various tables, and thus determine the behavior path or behavior pattern of each system entity described by the second running information, so as to accurately implement IOA hunting based on the determined behavior path or behavior pattern.

[0143] If the database connected to the terminal is a graph database, the second operational information will be stored in a graph format. For example, the second operational information can be converted into a source graph and stored; or it can be stored in a two-dimensional matrix format, where each element corresponds to a different system entity, and the attribute information or behavior of different system entities is represented by different values ​​of the elements. When the database connected to the terminal is a graph database, the default detection method for the first agent-end anomaly detection of the detection agent is based on the multi-step behavior pattern of network attacks and the source graph obtained from the operational information corresponding to the anomaly detection, i.e., IOA hunting. Since the graph database stores and represents the second operational information using nodes and edges, it can directly and naturally describe the complex relationships between various system entities, as well as the behavioral paths and patterns of each system entity. This facilitates the search for nodes and edges that satisfy the multi-step behavior pattern of network attacks, thereby improving the efficiency and accuracy of the first agent-end anomaly detection method, which is IOA hunting.

[0144] In one possible implementation, the types of network attacks detected by the second proxy-side anomaly detection differ from those detected by the first proxy-side anomaly detection. As explained in S201, the second proxy-side anomaly detection is a real-time anomaly detection, therefore the network attacks detected by the second proxy-side anomaly detection can be time-sensitive attacks. In contrast, the first proxy-side anomaly detection in this embodiment is threat hunting, a retrospective anomaly detection, therefore the network attacks detected by the first proxy-side anomaly detection include attacks with weak time sensitivity or long latency periods. For example, the network attacks detected by the first proxy-side anomaly detection include, but are not limited to, botnet attacks and advanced persistent threat (APT) attacks. Optionally, the types of network attacks detected by the first proxy-side anomaly detection can include not only attacks with weak time sensitivity or long latency periods but also attacks with strong time sensitivity, thus supplementing the detection results of the second proxy-side anomaly detection and further improving the comprehensiveness and reliability of the anomaly detection.

[0145] For example, if the first proxy detection result indicates that the terminal is under network attack, the first proxy detection result further indicates the second system entity corresponding to the abnormal operation information generated when the terminal is under network attack, and the abnormal operation information belongs to the second operation information. In this case, after the detection proxy device performs first proxy anomaly detection based on the second operation information to obtain the first proxy detection result, it further includes: the detection proxy device sending the first proxy detection result to the management device; in response to receiving the first protection processing instruction sent by the management device based on the first proxy detection result, the detection proxy device performs first protection processing on the second system entity, and the first protection processing instruction includes the identification information of the second system entity and information indicating the method of the first protection processing.

[0146] Optionally, the first proxy detection result sent by the detection agent to the management device includes information indicating anomalies in the third system entity, such as information describing the behavior of the third system entity and its attribute information. Optionally, if the second operational information sent by the detection agent to the management device includes information describing the behavior of the third system entity and its attribute information, the first proxy detection result only includes the identification information of the third system entity, reducing duplicate information transmission and waste of communication resources. If the second operational information does not include information describing the behavior of the third system entity and its attribute information, the first proxy detection result includes information describing the behavior of the third system entity and its attribute information, thereby enabling the management device to determine the anomaly of the third system entity and the type of network attack based on the first proxy detection result, and to determine an accurate first protection processing instruction.

[0147] Upon receiving the first protection processing instruction, the detection agent device identifies the second system entity based on its identification information and performs the first protection processing on the second system entity according to the instructions. This includes actions such as reducing the access permissions of the second system entity or adding an authentication step. This reduces the impact of the second system entity on the terminal and improves the terminal's security.

[0148] S203, in response to receiving a recall instruction sent by the management device, supplementary operating information of the first system entity is sent to the management device. The recall instruction includes the identification information of the first system entity. The supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the first operating information. The supplementary operating information of the first system entity is used by the management device to perform supplementary detection on the first system entity.

[0149] The recall instruction includes information that instructs the detection agent to send operational information of the first system entity. For example, the recall instruction may include the identification information of the first system entity and a recall identifier for the operational information. After collecting the second operational information from the terminal, the detection agent stores the entire amount of this information. Upon receiving the recall instruction, the detection agent filters out all operational information of the first system entity from the fully stored second operational information, using it as supplementary operational information for the first system entity, and sends it to the management device. This complete operational information includes operational information of the first system entity that was not sent to the management device before receiving the recall instruction.

[0150] Alternatively, the detection agent device filters the operational information of the first system entity based on the filtering record of the second operational information, obtaining the operational information of the first system entity that was not sent to the management device before receiving the recall instruction, as supplementary operational information for the first system entity. Optionally, the filtering record of the second operational information is generated during the process of filtering the second operational information to obtain the first operational information, or it is obtained by comparing the first operational information and the second operational information after the detection agent device sends the first operational information to the management device. The filtering record of the second operational information indicates which operational information belongs to the first operational information and which operational information does not belong to the first operational information.

[0151] The detection method for one or more anomaly detection methods, including management-side anomaly detection, first-agent-side anomaly detection, or supplementary detection, is based on a multi-step behavior pattern of network attacks and a source graph derived from the operational information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. Nodes represent system entities described by the corresponding operational information, and edges between two nodes represent operational relationships between the two system entities represented by the two nodes. For details regarding the source graph, the source graph derived from operational information, and the detection methods based on multi-step behavior patterns of network attacks and the source graph derived from the operational information corresponding to the anomaly detection, please refer to the previous explanation; they will not be repeated here.

[0152] In one possible implementation, the method further includes: the detection agent device performing statistics on the fourth operational information to obtain statistical results, the statistical results including the number of reference-type actions performed by the system entity running on the terminal, the fourth operational information including the second operational information; the detection agent device sending the statistical results to the management device, the statistical results being used by the management device to determine whether the terminal is under network attack.

[0153] Optionally, the detection agent performs statistics upon receiving statistical instructions from the management device, or performs statistics according to a specified period. The statistical results include summary data or profile data. Since some network attacks abnormally manifest as system entities repeatedly performing a certain type of behavior, such as repeatedly accessing files or connecting to different networks, these anomalies can be detected by statistically analyzing the number of times each system entity performs a certain type of behavior. The fourth operational information, including the second operational information, refers to operational information collected over a longer period. For example, the second operational information is the operational information of system entities running on the terminal within a first time period collected by the detection agent, and the fourth operational information is the operational information of system entities running on the terminal within a second time period collected by the detection agent, where the second time period includes the first time period. Statistical analysis of operational information collected over a longer time period allows for the determination of the number of times system entities perform reference-type behaviors over that longer period, making the statistical results more accurate and complete.

[0154] Optionally, the reference type can be set based on experience or user needs. The reference type can be, for example, accessing files, creating files, reading and writing data, or connecting to a network. The reference type can include a type of one behavior or a type of multiple behaviors.

[0155] In one possible implementation, if the management device determines that the terminal is under network attack based on statistical results, the management device can also send a protection processing instruction to the detection agent device, instructing the detection agent device to perform protection processing, thereby improving the security of the terminal.

[0156] Corresponding to the above-described anomaly detection method performed by a detection agent device, this application embodiment also provides an anomaly detection method performed by a management device. Referring to Figure 4, which shows a flowchart of another anomaly detection method provided by this application embodiment, this anomaly detection method applied to a management device includes, but is not limited to, the following steps S401 to S405.

[0157] S401, the management device receives the first operating information sent by the detection agent device. The first operating information is obtained by filtering the second operating information. The second operating information is used to describe the behavior of the system entities running on the terminal. The second operating information is used by the detection agent device to perform agent end anomaly detection. The system entities include objects on the terminal used to implement system tasks.

[0158] The management device may be connected to one or more detection agent devices. Therefore, the first operating information received by the management device may be the first operating information sent by one connected detection agent device, or it may include the first operating information sent by multiple connected detection agent devices. The process by which each detection agent device filters the second operating information to obtain the first operating information can be referred to the relevant description in S201 above, and will not be repeated here. Different detection agent devices may use the same or different methods to filter the second operating information to obtain the first operating information.

[0159] In one possible implementation, after the management device receives the first operating information sent by the detection agent device, it further includes: within a reference time after receiving the first operating information, the management device performs a second management terminal anomaly detection based on the first operating information to obtain a second management terminal detection result. The second management terminal detection result indicates whether the terminal is under network attack. The type of network attack detected by the second management terminal anomaly detection is different from that detected by the first management terminal anomaly detection.

[0160] The reference duration can be set based on experience or user needs, such as 10 milliseconds or 50 milliseconds. The reference duration set for the management device can be the same as or different from the management duration set for the detection agent device. Within the reference duration after receiving the first running information, the second management end anomaly detection is performed based on the first running information, enabling real-time detection of the first running information and thus timely determining whether the terminal managed by the management device is under network attack. Optionally, the type of network attack detected by the second management end anomaly detection can be a time-sensitive network attack, or a network attack that requires timely protection, such as a phishing attack or a distributed denial-of-service attack. In addition, if the first running information received by the management device includes the first running information of multiple terminals sent by multiple detection agent devices, the type of network attack detected by the second management end anomaly detection can also include cross-terminal network attacks, such as cross-terminal attacks exploiting vulnerabilities or multi-terminal phishing attacks, achieving joint detection or global detection of multiple terminals.

[0161] The management device performs second-end anomaly detection using different detection methods for different types of network attacks. Taking DDoS attacks as an example, the detection agent can obtain the second-end detection result by searching for abnormal network access records, a large number of failed login attempts, or specific log information related to DDoS attacks in the first operating information. The second-end detection result may include abnormal operating information in the first operating information, or the identification information of abnormal system entities, the time of the anomaly, etc.

[0162] For example, if the first operational information includes a large number of frequent access requests from the same IP address or different IP addresses, and the requested resources or behaviors are abnormal, it can be determined that the terminal has been subjected to a DDoS attack. The second management terminal detection result can include information such as abnormal IP addresses, the time of occurrence of access requests from abnormal IP addresses, and the resource access path corresponding to the access requests. The second management terminal detection result indicates that the terminal has been subjected to a network attack.

[0163] Alternatively, taking the network attack detected by the second management terminal anomaly detection as an example, which includes multi-terminal phishing attacks, the management device searches the first operational information sent by different detection agent devices for identical or similar abnormal login attempt records, file access records, or system entities related to phishing, thereby determining whether each terminal is under multi-terminal phishing attack. If the first operational information contains identical or similar descriptions of abnormal login attempt records, file access records, or system entities related to phishing, the second management terminal detection result may optionally include the identification information of the abnormal login attempt records, file access records, or system entities related to phishing, indicating that the terminal is under network attack.

[0164] In one possible implementation, the second management terminal detection result also indicates that the behavior described by the abnormal operation information in the first operation information is executed by a third system entity when the terminal is under network attack; after the management device performs the second management terminal anomaly detection based on the first operation information to obtain the second management terminal detection result, it further includes: the management device sending a second protection processing instruction to the detection agent device, the second protection processing instruction including the identification information of the third system entity and information indicating the method of the second protection processing, the third system entity being the system entity corresponding to the abnormal operation information.

[0165] Optionally, the second protection method is determined by the management device based on the type of network attack corresponding to the third system entity. For example, the management device determines the protection method for the network attack type corresponding to the third system entity based on the mapping relationship between network attack types and protection methods. The mapping relationship between network attacks and protection methods is set based on experience or user needs, or statically configured on the management device or in a memory or database connected to the management device, or sent to the management device by other devices. In this mapping relationship, different types of network attacks have corresponding protection methods, and the protection methods corresponding to different types of network attacks can be the same or different. For example, the protection method corresponding to a phishing attack is to stop the operation of the system entity corresponding to the phishing attack. This could be done by deleting phishing emails or disconnecting abnormal network connections.

[0166] After determining the second protection method, information indicating the second protection method is generated, such as an identifier corresponding to the second protection method or information describing the execution process of the second protection method. Then, the management device generates a second protection method instruction that includes the identifier information of the third system entity and the information of the second protection method, and sends it to the terminal running the third system entity, thereby instructing the terminal running the third system entity to perform corresponding protection methods and improve the security of the terminal.

[0167] S402, if the management terminal anomaly detection conditions are met, the first management terminal anomaly detection is performed based on the first operating information to obtain the first management terminal detection result, which indicates whether the terminal is under network attack.

[0168] Optionally, the anomaly detection conditions of the management end include at least one of the following: the management device obtains an anomaly detection instruction; the time interval between the last anomaly detection performed by the management device for the first type of network attack is greater than or equal to the interval threshold, and the first type includes the type of network attack detected by the first management end anomaly detection.

[0169] The interval threshold can be set based on experience or user needs. The interval threshold set for the management device can be the same as or different from the interval threshold set for the detection agent device. The management device obtains anomaly detection instructions, for example, by receiving anomaly detection instructions input by the administrator or by receiving anomaly detection instructions sent to the management device by other devices.

[0170] Anomaly detection instructions may include, for example, information instructing the management device to perform anomaly detection, or the type of network attack detected, or the scope of operational information used for anomaly detection. The scope of operational information used for anomaly detection may include, for example, the time range in which the operational information was generated, or the scope of system entities corresponding to the operational information. For example, if the scope of operational information used for anomaly detection includes the time range in which the operational information was generated from January 1, 2011 to January 2, 2011, then the operational information used by the management device during the first management-end anomaly detection process is the operational information generated from January 1, 2011 to January 2, 2011 within the first operational information. As another example, if the scope of operational information used for anomaly detection includes the scope of system entities corresponding to the operational information, such as system entity A, system entity B, and system entity C, then the operational information used by the management device during the first management-end anomaly detection process is the operational information in the first operational information describing the behavior of system entities A, B, and C.

[0171] If the management end anomaly detection condition is receiving an anomaly detection command sent by the management device, then when the management device receives the anomaly detection command, it performs the first management end anomaly detection on the first operating information, realizing the passive first management end anomaly detection; however, when the previous anomaly detection is completed, if no anomaly detection command is received, the management device does not perform the first management end anomaly detection.

[0172] When the anomaly detection condition of the management end is that the time interval between the previous anomaly detection for the first type of network attack is greater than or equal to the interval threshold, the management device starts a timer after the previous anomaly detection for the first type of network attack is completed. If the timer duration does not reach the interval threshold, the management device does not perform the first management end anomaly detection until the timer duration reaches the interval threshold, at which point the management device starts performing the first management end anomaly detection, thus achieving periodic anomaly detection. Optionally, during the periodic anomaly detection process, the operational information based on each anomaly detection can be different. For example, each anomaly detection performed by the management device may be an anomaly detection based on incremental operational information of the collected operational information, or an anomaly detection based on the full operational information of the collected operational information, or the operational information based on two anomaly detections may partially overlap.

[0173] When the conditions for anomaly detection at the management end include both receiving an anomaly detection command sent by the management device and the time interval between the last anomaly detection for the first type of network attack being greater than the interval threshold, the management device starts timing after completing an anomaly detection for the first type of network attack. If the management device does not receive an anomaly detection command before the timing duration reaches the interval threshold, the management device will perform the first management end anomaly detection until the timing duration reaches the interval threshold, and restart timing after the first management end anomaly detection is completed. If the management device receives an anomaly detection command before the timing duration reaches the interval threshold, the management device will promptly perform the first management end anomaly detection based on the anomaly detection command, and restart timing after the first management end anomaly detection is completed.

[0174] When the conditions for anomaly detection at the management end are met, the detection method for the first anomaly detection at the management end performed by the detection agent can be based on intrusion indicators and second operational information of network attacks, or it can be based on multi-step behavior patterns of network attacks and the source map converted from the operational information corresponding to the anomaly detection at the agent end.

[0175] The detection method of the first management terminal anomaly detection is based on the multi-step behavior pattern of network attack and the traceability graph obtained by converting the operation information corresponding to the anomaly detection. The management device performs the first management terminal anomaly detection based on the first operation information and obtains the first management terminal detection result, including: based on the detection statement, searching for nodes and edges that satisfy the multi-step behavior pattern of network attack in the traceability graph obtained by converting the first operation information, and obtaining the first management terminal detection result. The detection statement describes the multi-step behavior pattern of network attack through graph query syntax.

[0176] The process of detecting statements, converting the source graph based on the second operational information, and finding nodes and edges that satisfy the multi-step behavior pattern of a network attack can be referred to in S201, and will not be repeated here. Optionally, the detection statements can come from a detection script preset on the management device. The detection statements are statements in the detection script used to perform anomaly detection for the first type of network attack. The detection statements can also be carried in anomaly detection instructions. When the management device receives anomaly detection instructions, it can obtain the detection statements. The detection results of the first management end include, for example, one or more of the following: operational information corresponding to the abnormal nodes and edges, attribute information of the abnormal nodes and edges, or information indicating whether the terminal is under network attack.

[0177] If the detection method of the first management terminal anomaly detection is based on intrusion indicators of network attacks and the first operating information, then the management device performs the first management terminal anomaly detection based on the first operating information to obtain the first management terminal detection result, including: searching for operating information that matches the intrusion indicators in the first operating information; if there is operating information that matches the intrusion indicators, then the first management terminal detection result can be a detection result indicating that the terminal has been subjected to a network attack; if there is no operating information that matches the intrusion indicators in the first operating information, then the first management terminal detection result can be a detection result indicating that the terminal has not been subjected to a network attack.

[0178] In one possible implementation, optionally, the detection method for the first management terminal anomaly detection is specified by the user or instructed by security operations personnel. For example, the anomaly detection instruction may also include information indicating the detection method for the first management terminal anomaly detection. Alternatively, the detection method for the first management terminal anomaly detection may also be determined in other ways. Exemplarily, after the management device receives the first operating information sent by the detection agent device, the method further includes: the management device sending the first operating information to a database connected to the management device, the database being used to store the terminal's operating information; before the management device performs the first management terminal anomaly detection based on the first operating information and obtains the first management terminal detection result, the method further includes: the management device reading the first operating information from the database, the detection method for the first management terminal anomaly detection being related to the database's storage format for the first operating information.

[0179] The storage format of the second operational information in the database connected to the management device is related to the database type. For example, if the database connected to the management device is a relational database, the database will store the second operational information in a table format. The table consists of rows and columns, with each row representing a piece of operational information and each column representing a specific attribute or field. For example, the table may contain columns such as the identification information of the system entity, the type of the system entity, or the behavior of the system entity, with each row corresponding to a system entity. When the database connected to the management device is a relational database, the default detection method for the first management end anomaly detection is based on intrusion indicators of network attacks and the first operational information; that is, the default first management end anomaly detection is IOC hunting. Since the process of IOC hunting requires traversing the behavior of various system entities described by the first running information, storing the first running information in a table format can more intuitively display the content included in the first running information, making it easier to implement complex query operations, such as multi-table join queries and conditional filtering, so as to quickly filter out the running information that matches the intrusion indicators from a large amount of first running information. Therefore, when the database connected to the management device is a relational database, IOC hunting can be implemented efficiently and accurately, improving the efficiency and accuracy of anomaly detection on the first management end.

[0180] If the database connected to the management device is a graph database, the database will store the first operational information in a graph format. For example, the first operational information can be converted into a source graph and stored; or it can be stored in a two-dimensional matrix format, where each element corresponds to a different system entity, and the attribute information or behavior of different system entities is represented by different values ​​of the elements. When the database connected to the management device is a graph database, the default detection method for the first management end anomaly detection is based on the multi-step behavior pattern of network attacks and the source graph obtained from the operational information corresponding to the anomaly detection, i.e., IOA hunting. Because the graph database stores and represents the first operational information using nodes and edges, it can directly and naturally describe the complex relationships between various system entities, as well as the behavioral paths and patterns of each system entity. This facilitates the search for nodes and edges that satisfy the multi-step behavior pattern of network attacks, thereby improving the efficiency and accuracy of the first management end anomaly detection method, which is IOA hunting.

[0181] It should be understood that the type of database connected to the management device is related to the detection method of the first management terminal anomaly detection, but this does not mean that the detection method of the first management terminal anomaly detection is only the detection method matched to the type of database connected to the management device. For example, the detection method matched to a relational database is IOC hunting, and the detection method of the first management terminal anomaly detection can be either IOC hunting or IOA hunting. Exemplarily, the management device can use join syntax, such as one or more join syntaxes such as inner join, left join, or right join, to associate the various tables stored in the relational database, determine the relationships between the various tables, and thereby determine the behavior path or behavior pattern of each system entity described by the second running information, so as to accurately implement IOA hunting based on the determined behavior path or behavior pattern.

[0182] In this embodiment, the database connected to the management device and the database connected to the detection agent device are not necessarily of the same type. For example, if the database connected to the management device is a graph database and the database connected to the detection agent device is a relational database, then the management device can perform IOA hunting during the first management end anomaly detection process, and the detection agent device can perform IOC hunting during the first agent end anomaly detection process.

[0183] Compared to single-type databases, which cannot effectively handle all hunting scenarios (for example, graph databases excel at association and multi-hop queries but are not good at multi-attribute combination searches and divide-and-conquer searches), relational databases excel at multi-attribute combination searches and time-based and terminal-based sharded searches but are not suitable for multi-hop queries), the databases connected to the management device and the databases connected to the detection agent device are of different types, enabling the collaboration of various anomaly detection methods. Based on the database's storage format for runtime information, an appropriate anomaly detection method can be selected to improve anomaly detection efficiency and accuracy, reduce computational waste, and cover more anomaly detection scenarios and modes.

[0184] In one possible implementation, the types of network attacks detected by the second management terminal anomaly detection differ from those detected by the first management terminal anomaly detection. As described in S401, the second management terminal anomaly detection is a real-time anomaly detection, therefore the network attacks detected by the second management terminal anomaly detection can be time-sensitive attacks. In contrast, the first management terminal anomaly detection in this embodiment is threat hunting, a retrospective anomaly detection, therefore the network attacks detected by the first management terminal anomaly detection can include attacks with weak time sensitivity or long latency periods, such as botnet attacks and advanced persistent threat (APS) attacks. Optionally, the types of network attacks detected by the first management terminal anomaly detection can include not only attacks with weak time sensitivity or long latency periods but also attacks with strong time sensitivity, thus supplementing the detection results of the second management terminal anomaly detection and further improving the comprehensiveness and reliability of anomaly detection.

[0185] S403, in response to receiving a recall operation for the first system entity, the management device sends a recall instruction to the detection agent device, the recall instruction including the identification information of the first system entity.

[0186] Optionally, the recall operation for the first system entity is input or performed by security operations personnel on the management device's operating platform. The content of the recall operation for the first system entity is optional, and may include, for example, the identification information of the first system entity, information instructing the management device to generate a recall command, or the identification information of the terminal, etc. The terminal identification information indicates the terminal to which the detection agent device that needs to complete the recall operation belongs.

[0187] Upon receiving a recall operation, the management device generates a recall instruction. The recall instruction includes the identification information of the first system entity. Optionally, the recall instruction also includes information or an identifier instructing the detection agent device to return supplementary operational information. The management device sends the recall instruction via methods such as broadcast, multicast, or unicast. If it is unicast, the receiving end of the recall instruction is the terminal to which the detection agent device that needs to complete the recall operation belongs.

[0188] S404, the management device receives supplementary operating information of the first system entity sent by the detection agent device based on the recall instruction. The supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the first operating information.

[0189] Optionally, in one case, the supplementary operational information of the first system entity includes all operational information of the first system entity. In another case, the supplementary operational information of the first system entity includes only the operational information related to the first system entity from the second operational information, excluding the first operational information.

[0190] S405, the management device performs supplementary detection based on supplementary operation information and second operation information to obtain supplementary detection results, which indicate whether the first system entity is operating under network attack conditions.

[0191] Optionally, the supplementary detection is IOC hunting or IOA hunting. In this embodiment, the detection method of one or more of the following anomaly detection methods—agent-side anomaly detection, first management-side anomaly detection, or supplementary detection—is based on a multi-step behavior pattern of network attacks and a source graph obtained by converting the runtime information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. Nodes represent system entities described by runtime information, and edges between two nodes represent operational relationships between the two system entities represented by the two nodes.

[0192] In one possible implementation, the method further includes: a management device receiving statistical results sent by a detection agent, the statistical results including the number of times a reference type of behavior is performed by a system entity running on the terminal; the management device comparing the number of reference type behaviors with a threshold number to obtain statistical detection results, the statistical detection results indicating whether the terminal is under network attack.

[0193] Optionally, the frequency threshold is set based on experience or user needs. The frequency threshold represents the maximum number of times various system entities execute a reference type of behavior when the terminal is not under network attack. The frequency thresholds for different reference types of behavior may not be the same. If any system entity executes any reference type of behavior more than the frequency threshold corresponding to that reference type, then that system entity is determined to be an abnormal system entity, and the resulting statistical detection result indicates that the terminal is under network attack. If the number of times any system entity executes any reference type of behavior does not exceed the frequency threshold corresponding to that reference type, then it is determined that each system entity is not under network attack corresponding to that reference type of behavior, and the resulting statistical detection result indicates that the terminal is not under network attack corresponding to that reference type of behavior.

[0194] In one possible implementation, a first proxy-end detection result sent by a detection proxy device is received. This first proxy-end detection result is obtained by the detection proxy device based on second operational information. In response to the first proxy-end detection result indicating that the terminal is under network attack, and the behavior of the second system entity is abnormal, a first protection processing instruction is sent to the detection proxy device. This first protection processing instruction includes the identification information of the second system entity and information instructing the detection proxy device to perform the first protection processing. The process of generating the first protection processing instruction based on the first proxy-end detection result can refer to the process of generating the second protection processing instruction based on the second management-end detection result described above, and will not be repeated here.

[0195] All types of detection results received or generated by the management device, as well as the received operational information, can be displayed to security operations personnel through the management analysis interface on the management device. Based on the displayed content, security operations personnel can then control the management device and the detection agent device. For example, after receiving the first agent-end detection result sent by the detection agent device, the management device displays the first agent-end detection result to the security operations personnel through the management analysis interface. The security operations personnel can then control the management device to generate a first protection processing instruction and the content of the generated first protection processing instruction through the management analysis interface. This application embodiment does not limit the method by which the management device displays operational information or detection results through the management analysis platform; for example, it can display operational information in a graph structure, detection results in the form of a threat graph, or operational information in a table structure.

[0196] Optionally, the various instructions or information sent by the management device to the detection agent device are sent by the management device upon receiving various operations performed by the security operations personnel on the management device. For example, the aforementioned recall instruction is sent by the management device upon receiving a recall operation from the security operations personnel. In addition, anomaly detection instructions, second operational information collection instructions, first protection instructions, second protection instructions, or detection statements can all be issued by the management device to the detection agent device after receiving corresponding operations from the security operations personnel.

[0197] In summary, the detection agent filters the second operational information to obtain the first operational information. The first operational information has a smaller data volume than the second operational information. Therefore, sending the first operational information to the management device reduces communication costs and the computational resources required for the management device to perform management-side anomaly detection based on the first operational information. When the conditions for agent-side anomaly detection are met, the detection agent performs first agent-side anomaly detection based on the second operational information. Since the second operational information contains more information than the first operational information, the first agent-side anomaly detection can supplement the management-side anomaly detection results, making the anomaly detection more comprehensive and effectively utilizing the advantages of distributed computing. When the detection agent receives a recall instruction for the first system entity, it sends supplementary operational information of the first system entity to the management device, enabling the management device to obtain all operational information of the first system entity. This allows the management device to perform comprehensive anomaly detection on the first system entity, further improving the comprehensiveness and reliability of the anomaly detection.

[0198] In an exemplary embodiment, an anomaly detection system is provided, comprising a detection agent device and a management device. The detection agent device is used to implement the anomaly detection method shown in FIG2, and the management device is used to implement the anomaly detection method shown in FIG4. The structure of the anomaly detection system can be referred to FIG1 and its description.

[0199] Referring to Figure 5, a schematic diagram of an anomaly detection system provided in an embodiment of this application is shown. The anomaly detection system shown in Figure 5 is an application example of the anomaly detection system shown in Figure 1. The anomaly detection system shown in Figure 5 includes a server-side management device and an endpoint-side detection agent device. A management analysis platform runs on the management device. This platform serves as a work platform for security operations personnel, enabling human-computer interaction between security operations personnel and the management device. For example, it allows security operations personnel to input detection statements and anomaly detection commands. The management device includes an interface display module, a configuration distribution module, an analysis module, and a threat hunting module. The interface display module displays anomaly detection results or progress information to security operations personnel through the management analysis platform. The configuration distribution module issues anomaly detection commands or recall commands to the detection agent device. The analysis module performs real-time analysis of received operational information to achieve real-time anomaly detection. The threat hunting module performs retrospective anomaly detection, such as performing management-side anomaly detection based on first operational information. The management device is connected to a database, which stores anomaly detection results or received operational information.

[0200] The management device connects to one or more detection agent devices, each of which includes a data acquisition module, a detection module, and a reporting module. The data acquisition module collects operational information generated by the terminal; optionally, it also filters the collected operational information. The detection module performs anomaly detection. The reporting module sends operational information or detection results to the management device. Each detection agent device is connected to a database for storing the operational information or detection results collected by the detection agent device.

[0201] As shown in Figure 6, the anomaly detection methods performed by the detection agent device and the management device in the anomaly detection system shown in Figure 5 include, but are not limited to, the following S601 to S608.

[0202] S601, the detection agent sends the terminal's first operating information to the management device. The first operating information is used by the management device to perform management terminal anomaly detection. The first operating information is obtained by filtering the second operating information. The second operating information is used to describe the behavior of system entities running on the terminal. The system entities include objects on the terminal used to implement system tasks.

[0203] S602, the management device receives the first operating information sent by the detection agent device. The first operating information is obtained by filtering the second operating information. The second operating information is used to describe the behavior of the system entity running on the terminal. The second operating information is used by the detection agent device to perform agent end anomaly detection.

[0204] S603, when the conditions for agent end anomaly detection are met, the detection agent device performs first agent end anomaly detection based on the second operating information, thereby obtaining the first agent end detection result, which indicates whether the terminal is under network attack.

[0205] S604, if the management terminal anomaly detection conditions are met, the management device performs a first management terminal anomaly detection based on the first operating information, thereby obtaining a first management terminal detection result, which indicates whether the terminal is under network attack.

[0206] S605, in response to receiving a recall operation for the first system entity, the management device sends a recall instruction to the detection agent device, the recall instruction including the identification information of the first system entity.

[0207] S606, in response to receiving a recall instruction sent by the management device, the detection agent sends supplementary operating information of the first system entity to the management device. The recall instruction includes the identification information of the first system entity, and the supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the first operating information. The supplementary operating information of the first system entity is used by the management device to perform supplementary detection on the first system entity.

[0208] S607, the management device receives supplementary operating information of the first system entity sent by the detection agent device based on the recall instruction. The supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the first operating information.

[0209] S608, the management device performs supplementary detection based on supplementary operation information and second operation information to obtain supplementary detection results, which indicate whether the first system entity is operating under network attack conditions.

[0210] For explanations of each step in Figure 6, please refer to the relevant explanations of S201 to S203 and S401 to S405 above, which will not be repeated here.

[0211] Referring to Figure 7, a schematic diagram of an anomaly detection process provided by an embodiment of this application is shown. The anomaly detection process is executed by the detection agent device and management device shown in Figure 5 or Figure 6 above, and the security operations personnel interact with the management device through the management analysis platform to realize the complete anomaly detection process.

[0212] During anomaly detection, the detection agent collects operational information, which is the complete set of operational information, corresponding to the second operational information mentioned above. After analysis by the detection engine, the complete operational information collected by the detection agent is stored in the database connected to the detection agent. The detection engine analysis corresponds to the anomaly detection at the second agent end. The detection agent filters the collected complete operational information. After filtering and merging, the filtered non-complete operational information, i.e., the first operational information, is sent to the management device.

[0213] The management device receives incomplete operational information sent by the detection agent device and analyzes it, i.e., performs second-level management-end anomaly detection, achieving real-time anomaly detection based on incomplete operational information. After analysis, the incomplete operational information is stored in a database connected to the management device. Security operations personnel initiate threat hunting through the management analysis platform, i.e., instruct the management device to perform first-level management-end anomaly detection. The management device performs threat hunting on the operational information stored in the database connected to it, obtaining hunting results, and reports the hunting results through the management analysis platform. The hunting results correspond to the first-level management-end detection results mentioned above.

[0214] Safety operations personnel retrieve supplementary operational information from the detection agent device through the management and analysis platform. The supplementary operational information is then sent from the detection agent device to the management device. Based on the supplementary operational information and the operational information stored in the database connected to the management device, the management device performs supplementary detection and reports the detection results of the supplementary detection through the management and analysis platform.

[0215] Security operations personnel push down the management analysis platform to the detection agent device to carry out threat hunting, that is, instruct the detection agent device to perform anomaly detection at the first agent end. The detection agent device performs threat hunting based on the collected full operational information, thereby obtaining the hunting results and reporting the hunting results to the management device. The management device then reports the hunting results through the management analysis platform, and the hunting results correspond to the detection results at the first agent end.

[0216] The detection agent also periodically compiles statistics on the collected full operational information, obtaining statistical results. These results include the number of times reference-type behaviors were executed by system entities running on the terminal. After obtaining the statistical results, the detection agent sends them to the management device, thus achieving statistical reporting.

[0217] The anomaly detection method executed by the detection agent device and the management device in the anomaly detection system provided in this application embodiment can be referred to the relevant descriptions in the above method embodiments. The beneficial effects of anomaly detection through the anomaly detection system can also be referred to the relevant descriptions in the above method embodiments, and will not be repeated here.

[0218] The above describes the anomaly detection method and system provided in the embodiments of this application. Corresponding to the above method and system, the embodiments of this application also provide a detection proxy device. This device is used to execute the anomaly detection method executed by the detection proxy device in Figure 2 through the various modules shown in Figure 8. As shown in Figure 8, the detection proxy device provided in the embodiments of this application includes the following modules.

[0219] The sending module 801 is used to send the first operating information of the terminal to the management device. The first operating information is used by the management device to perform management end anomaly detection. The first operating information is obtained by the detection agent device through filtering the second operating information. The second operating information is used to describe the behavior of the system entities running on the terminal. The system entities include objects on the terminal used to implement system tasks.

[0220] The detection module 802 is used to perform first proxy end anomaly detection based on second operating information when the proxy end anomaly detection conditions are met, thereby obtaining the first proxy end detection result, which indicates whether the terminal is under network attack.

[0221] The sending module 801 is also used to respond to receiving a recall instruction sent by the management device and send supplementary operating information of the first system entity to the management device. The recall instruction includes the identification information of the first system entity. The supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the operating information of the first system entity. The supplementary operating information of the first system entity is used by the management device to perform supplementary detection on the first system entity.

[0222] Among them, the detection method of one or more anomaly detections, such as management end anomaly detection, first agent end anomaly detection or supplementary detection, is based on the multi-step behavior pattern of network attack and the source graph obtained by converting the operation information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. Nodes represent system entities described by the corresponding operation information, and the edges between two nodes represent that there is an operational relationship between the two system entities represented by the two nodes.

[0223] In one possible implementation, the anomaly detection method of the first agent is based on the multi-step behavior pattern of the network attack and the source graph obtained by converting the operation information corresponding to the anomaly detection; the detection module 802 is used to find the nodes and edges that satisfy the multi-step behavior pattern of the network attack in the source graph obtained by converting the second operation information based on the detection statement, so as to obtain the detection result of the first agent. The detection statement describes the multi-step behavior pattern of the network attack through graph query syntax.

[0224] In one possible implementation, the detection agent device further includes an acquisition module for collecting second operational information; the detection module 802 is also used to perform second agent end anomaly detection based on the second operational information within a reference time after the second operational information is collected, thereby obtaining a second agent end detection result, the second agent end detection result indicating whether the terminal is under network attack, and the type of network attack detected by the second agent end anomaly detection is different from that detected by the first agent end anomaly detection; the acquisition module is also used to filter the second operational information based on the second agent end detection result, thereby obtaining the first operational information.

[0225] In one possible implementation, the detection result of the second agent end also indicates that the behavior described by the third running information in the second running information is performed by the terminal without being subjected to a network attack; the acquisition module is used to filter out the third running information in the second running information to obtain the first running information.

[0226] In one possible implementation, the sending module 801 is further configured to send second operating information to the database connected to the terminal detection agent device, the database being used to store the terminal's operating information; the obtaining module is further configured to read the second operating information from the database, the detection method of the first agent terminal anomaly detection corresponding to the database's storage format for the second operating information.

[0227] In one possible implementation, the agent-side anomaly detection conditions include at least one of the following: receiving an anomaly detection instruction sent by the management device; and the time interval between the last anomaly detection for a first type of network attack being greater than or equal to an interval threshold, wherein the first type includes the type of network attack detected by the first agent-side anomaly detection.

[0228] In one possible implementation, the detection module 802 is further configured to perform statistics on the fourth operating information to obtain statistical results, the statistical results including the number of times the system entity running on the terminal performs reference type actions, the fourth operating information including the second operating information; the sending module 801 is further configured to send the statistical results to the management device, the statistical results being used by the management device to determine whether the terminal is under network attack.

[0229] In one possible implementation, the first agent detection result also indicates the second system entity corresponding to the abnormal operation information generated when the terminal is under network attack, and the abnormal operation information belongs to the second operation information; the sending module 801 is also used to send the first agent detection result to the management device; the protection module is also used to respond to receiving the first protection processing instruction sent by the management device based on the first agent detection result, and to perform the first protection processing on the second system entity, the first protection processing instruction including the identification information of the second system entity and information indicating the method of the first protection processing.

[0230] In one possible implementation, the protection module is further configured to perform second protection processing on the third system entity in response to receiving a second protection processing instruction sent by the management device. The second protection processing instruction includes identification information of the third system entity and information indicating the manner of the second protection processing. The second protection processing instruction is determined by the processing management device based on the detection results of the first operating information.

[0231] This application embodiment also provides a management device. This device is used to execute the anomaly detection method performed by the management device in Figure 4 through the various modules shown in Figure 9. As shown in Figure 9, the management device provided in this application embodiment includes the following modules.

[0232] The receiving module 901 is used to receive first running information sent by the detection agent device. The first running information is obtained by filtering the second running information. The second running information is used to describe the behavior of the system entity running on the terminal. The second running information is used to detect the agent device to perform agent end anomaly detection. The detection agent device runs on the terminal. The system entity includes objects on the terminal used to implement system tasks.

[0233] The detection module 902 is used to perform first management terminal anomaly detection based on first operating information when the management terminal anomaly detection conditions are met, thereby obtaining a first management terminal detection result. The first management terminal detection result indicates whether the terminal is under network attack.

[0234] The sending module 903 is used to send a recall instruction to the detection agent device in response to receiving a recall operation for the first system entity. The recall instruction includes the identification information of the first system entity.

[0235] The receiving module 901 is also used to receive supplementary operating information of the first system entity sent by the detection agent based on the recall instruction. The supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the first operating information.

[0236] The detection module 902 is also used to perform supplementary detection based on the supplementary operation information and the first operation information, so as to obtain the supplementary detection result. The supplementary detection result indicates whether the first system entity is running under network attack conditions.

[0237] Among them, the detection method of one or more anomaly detections, such as agent-end anomaly detection, first management end anomaly detection, or supplementary detection, is based on the multi-step behavior pattern of network attacks and the source graph obtained by transforming the operation information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. Nodes represent system entities described by the operation information, and the edges between two nodes represent that there is an operational relationship between the two system entities represented by the two nodes.

[0238] In one possible implementation, the detection method of the first management end anomaly detection is based on the multi-step behavior pattern of network attack and the traceability graph obtained by converting the operation information corresponding to the anomaly detection; the detection module 902 is used to find the nodes and edges that satisfy the multi-step behavior pattern of network attack in the traceability graph obtained by converting the first operation information based on the detection statement, so as to obtain the detection result of the first management end. The detection statement describes the multi-step behavior pattern of network attack through graph query syntax.

[0239] In one possible implementation, the sending module 903 is further configured to send first operating information to a database connected to the management device, the database being used to store the terminal's operating information; the detection module 902 is further configured to read the first operating information from the database, the detection method of the first management terminal anomaly detection being related to the database's storage format for the first operating information.

[0240] In one possible implementation, the receiving module 901 is further configured to receive a first proxy end detection result sent by the detection proxy device, the first proxy end detection result being obtained by the detection proxy device based on the second operating information; the sending module 903 is further configured to, in response to the first proxy end detection result indicating that the terminal is under network attack, perform abnormal behavior of the second system entity, send a first protection processing instruction to the detection proxy device, the first protection processing instruction including the identification information of the second system entity and information instructing the detection proxy device to perform the first protection processing.

[0241] In one possible implementation, the detection module 902 is further configured to perform a second management terminal anomaly detection based on the first operation information within a reference time after receiving the first operation information, thereby obtaining a second management terminal detection result. The second management terminal detection result indicates whether the terminal is under network attack. The type of network attack detected by the second management terminal anomaly detection is different from that detected by the first management terminal anomaly detection.

[0242] In one possible implementation, the detection result of the second management terminal also indicates that the behavior described by the abnormal operation information in the first operation information is performed by the terminal under network attack; the sending module 903 is also used to send a first protection processing instruction to the detection agent device. The first protection processing instruction includes the identification information of the second system entity and information indicating the method of the first protection processing. The second system entity is the system entity corresponding to the abnormal operation information.

[0243] In one possible implementation, the management end anomaly detection conditions include at least one of the following: obtaining an anomaly detection instruction; the time interval between the last anomaly detection performed by the management device for a first type of network attack is greater than or equal to an interval threshold, wherein the first type includes the type of network attack detected by the first management end anomaly detection.

[0244] In one possible implementation, the receiving module 901 is further configured to receive statistical results sent by the detection agent, the statistical results including the number of times the system entity running on the terminal performs reference type behaviors; the detection module 902 is further configured to compare the number of reference type behaviors with a number threshold to obtain statistical detection results, the statistical detection results indicating whether the terminal is under network attack.

[0245] In one possible implementation, the management device is located in the cloud.

[0246] Referring to Figure 10, which shows a schematic diagram of the structure of an exemplary anomaly detection device 1000 of this application, the anomaly detection device 1000 includes at least one processor 1001, a memory 1003 and at least one network interface 1004.

[0247] Processor 1001 may be, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits or application-specific integrated circuits (ASICs), programmable logic devices (PLDs), other general-purpose processors or other programmable logic devices, discrete gates, transistor logic devices, discrete hardware components, or any combination thereof for implementing the scheme of this application. A PLD may be, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. A general-purpose processor may be a microprocessor or any conventional processor. It is worth noting that the processor may be a processor supporting an advanced reduced instruction set machine (RISC) machine (ARM) architecture. It can implement or execute various logic blocks, modules, and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0248] Optionally, the anomaly detection device 1000 also includes a bus 1002. The bus 1002 is used to transmit information between the components of the anomaly detection device 1000. The bus 1002 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus 1002 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one line is used in Figure 10, but this does not mean that there is only one bus or one type of bus.

[0249] The memory 1003 may be, for example, volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory may be random access memory (RAM), which is used as an external cache.

[0250] By way of example, but not limitation, many forms of ROM and RAM are available. For example, ROM is a compact disc read-only memory (CD-ROM). RAM includes, but is not limited to, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0251] The memory 1003 can also be other types of storage devices capable of storing static information and instructions. Alternatively, it can be other types of dynamic storage devices capable of storing information and instructions. It can also be other optical disc storage, optical disk storage (including compressed optical discs, laser discs, optical discs, digital versatile optical discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. The memory 1003 may exist independently and be connected to the processor 1001 via bus 1002. The memory 1003 may also be integrated with the processor 1001.

[0252] Network interface 1004 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), or wireless local area network (WLAN). Network interface 1004 may include wired network interfaces and wireless network interfaces. Specifically, network interface 1004 can be an Ethernet interface, such as Fast Ethernet (FE), Gigabit Ethernet (GE), Asynchronous Transfer Mode (ATM), WLAN, cellular network, or combinations thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In some embodiments of this application, network interface 1004 can be used for anomaly detection device 1000 to communicate with other devices.

[0253] In specific implementations, as some embodiments, processor 1001 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG10. Each of these processors may be a single-core processor or a multi-core processor. Here, processor may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0254] In specific implementations, as some embodiments, the anomaly detection device 1000 may include multiple processors, such as processor 1001 and processor 1005 as shown in FIG10. Each of these processors may be a single-core processor or a multi-core processor. Here, a processor may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0255] In some embodiments, the memory 1003 is used to store program instructions 1010 for executing the solution of this application, and the processor 1001 can execute the program instructions 1010 stored in the memory 1003. That is, the anomaly detection device 1000 can implement the method provided in the method embodiment, i.e., the method of FIG2 or FIG4, through the processor 1001 and the program instructions 1010 in the memory 1003. The program instructions 1010 may include one or more software modules. Optionally, the processor 1001 itself may also store program instructions for executing the solution of this application.

[0256] The anomaly detection device 1000 can also correspond to the device shown in Figure 8 or Figure 9 above. Each functional module in the device shown in Figure 8 or Figure 9 is implemented using software from the anomaly detection device 1000. In other words, the functional modules included in the device shown in Figure 8 or Figure 9 are generated by the processor 1001 of the anomaly detection device 1000 reading the program instructions 1010 stored in the memory 1003.

[0257] In the method shown in Figure 2 or Figure 4, each step is completed by the integrated logic circuitry of the hardware or by instructions in the software form of the processor of the anomaly detection device 1000. The steps of the method embodiments disclosed in this application can be directly implemented by the hardware processor, or by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. Since the storage medium is located in memory, the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method embodiments; to avoid repetition, these will not be described in detail here.

[0258] In an exemplary embodiment, a computer program (product) is provided, comprising: computer program code, which, when executed by a computer, causes the computer to perform the method shown in FIG2 or FIG4.

[0259] In an exemplary embodiment, a computer-readable storage medium is provided that stores a program or instructions, which, when executed on a computer, cause the computer to perform the method described in FIG2 or FIG4.

[0260] In an exemplary embodiment, a chip is provided, including a processor for calling and executing instructions stored in a memory, such that a computer with the chip installed performs the method of FIG2 or FIG4.

[0261] In an exemplary embodiment, another chip is provided, including: an input interface, an output interface, a processor, and a memory. The input interface, the output interface, the processor, and the memory are connected through an internal connection path. The processor is used to execute code in the memory. When the code is executed, a computer with the chip installed performs the method in Figure 2 or Figure 4.

[0262] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk).

[0263] In this application, the terms "first," "second," etc., are used to distinguish identical or similar items with substantially the same function. It should be understood that there is no logical or temporal dependency between "first," "second," and "nth," nor does it limit the quantity or order of execution. It should also be understood that although the following description uses the terms "first," "second," etc., to describe various elements, these elements should not be limited by the terms. These terms are merely used to distinguish one element from another.

[0264] It should also be understood that, in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0265] In this application, the term "at least one" means one or more, and the term "multiple" means two or more. For example, multiple second devices means two or more second devices. The terms "system" and "network" are often used interchangeably herein.

[0266] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0267] It should also be understood that the term "and / or" as used herein refers to and covers any and all possible combinations of one or more of the associated listed items. The term "and / or" describes an association between related objects, indicating that three relationships can exist; for example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " in this application generally indicates that the preceding and following related objects are in an "or" relationship.

[0268] It should also be understood that the terms “if” and “if” can be interpreted as meaning “when” or “upon”, or “in response to determination” or “in response to detection”. Similarly, depending on the context, the phrases “if determination…” or “if detection [the stated condition or event]” can be interpreted as meaning “when determination…”, or “in response to determination…”, or “when detection [the stated condition or event]” or “in response to detection [the stated condition or event]”.

[0269] The above description is merely an embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. An anomaly detection method, characterized in that, The method is executed by a detection agent device, which runs on a terminal, and the method includes: The first operating information of the terminal is sent to the management device. The first operating information is used by the management device to perform management terminal anomaly detection. The first operating information is obtained by the detection agent device by filtering the second operating information. The second operating information is used to describe the behavior of the system entities running on the terminal. The system entities include objects on the terminal used to implement system tasks. If the conditions for agent-end anomaly detection are met, the first agent-end anomaly detection is performed based on the second operation information to obtain the first agent-end detection result, which indicates whether the terminal is under network attack. In response to receiving a recall instruction sent by the management device, supplementary operating information of the first system entity is sent to the management device. The recall instruction includes the identification information of the first system entity. The supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the first operating information. The supplementary operating information of the first system entity is used by the management device to perform supplementary detection on the first system entity. The detection method of one or more of the following anomaly detection methods—management end anomaly detection, first agent end anomaly detection, or supplementary detection—is based on a multi-step behavior pattern of network attacks and a source graph obtained by converting the operation information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. The nodes represent the system entities described by the corresponding operation information, and the edges between two nodes represent that there is an operational relationship between the two system entities represented by the two nodes.

2. The method according to claim 1, characterized in that, The first agent-side anomaly detection method is based on the multi-step behavior pattern of network attacks and the source map obtained by converting the operation information corresponding to the anomaly detection; The step of performing anomaly detection on the first agent based on the second operational information to obtain the detection result of the first agent includes: Based on the detection statement, in the source graph obtained by transforming the second running information, nodes and edges that satisfy the multi-step behavior pattern of the network attack are searched, thereby obtaining the detection result of the first agent end. The detection statement describes the multi-step behavior pattern of the network attack through graph query syntax.

3. The method according to claim 1 or 2, characterized in that, Before sending the first operating information of the terminal to the management device, the method further includes: Collect the second operational information; Within a reference time after the second operational information is collected, a second proxy end anomaly detection is performed based on the second operational information to obtain a second proxy end detection result. The second proxy end detection result indicates whether the terminal is under network attack. The type of network attack detected by the second proxy end anomaly detection is different from that detected by the first proxy end anomaly detection. Based on the detection results from the second agent, the second running information is filtered to obtain the first running information.

4. The method according to claim 3, characterized in that, The second agent detection result also indicates that the behavior described by the third operation information in the second operation information was performed by the terminal without being subjected to a network attack; The step of filtering the second running information based on the detection result of the second agent to obtain the first running information includes: The third running information in the second running information is filtered out to obtain the first running information.

5. The method according to claim 3 or 4, characterized in that, After collecting the second operational information, the method further includes: The second operating information is sent to a database connected to the detection agent device, the database being used to store the operating information of the terminal; Before obtaining the first agent detection result by performing anomaly detection based on the second operational information, the method further includes: The second running information is read from the database, and the detection method of the first agent-end anomaly detection corresponds to the storage format of the second running information in the database.

6. The method according to any one of claims 1-5, characterized in that, The abnormal detection conditions for the agent end include at least one of the following: Received an anomaly detection command sent by the management device; The time interval between the last anomaly detection for the first type of network attack is greater than or equal to the interval threshold, where the first type includes the type of network attack detected by the first agent anomaly detection.

7. The method according to any one of claims 1-6, characterized in that, The method further includes: The fourth running information is statistically analyzed to obtain statistical results, which include the number of reference type behaviors performed by the system entity running the terminal, and the fourth running information includes the second running information; The statistical results are sent to the management device, and the statistical results are used by the management device to determine whether the terminal is under network attack.

8. The method according to any one of claims 1-7, characterized in that, The first agent detection result also indicates the second system entity corresponding to the abnormal operation information generated when the terminal is under network attack, and the abnormal operation information belongs to the second operation information; After obtaining the first agent detection result by performing anomaly detection on the first agent based on the second operational information, the method further includes: Send the first agent detection result to the management device; In response to receiving a first protection processing instruction sent by the management device based on the detection result of the first agent, a first protection processing is performed on the second system entity. The first protection processing instruction includes the identification information of the second system entity and information indicating the method of the first protection processing.

9. The method according to any one of claims 1-8, characterized in that, After sending the first operating information of the terminal to the management device, the method further includes: In response to receiving a second protection processing instruction sent by the management device, a second protection processing is performed on the third system entity. The second protection processing instruction includes the identification information of the third system entity and information indicating the method of the second protection processing. The second protection processing instruction is determined by the management device based on the detection result of the first operating information.

10. An anomaly detection method, characterized in that, The method is applied to a management device, and the method includes: The system receives first running information sent by a detection agent device. The first running information is obtained by filtering second running information. The second running information is used to describe the behavior of system entities running on the terminal. The second running information is used by the detection agent device to perform agent end anomaly detection. The detection agent device runs on the terminal. The system entities include objects on the terminal used to implement system tasks. If the conditions for management terminal anomaly detection are met, a first management terminal anomaly detection is performed based on the first operating information to obtain a first management terminal detection result. The first management terminal detection result indicates whether the terminal is under network attack. In response to receiving a recall operation for a first system entity, a recall instruction is sent to the detection agent device, the recall instruction including the identification information of the first system entity; The system receives supplementary operational information of the first system entity sent by the detection agent based on the recall instruction. The supplementary operational information of the first system entity includes operational information related to the first system entity in the second operational information other than the first operational information. Based on the supplementary operating information and the first operating information, supplementary detection is performed to obtain supplementary detection results, which indicate whether the first system entity is operating under network attack conditions. The detection method of one or more of the following anomaly detection methods—the agent-end anomaly detection, the first management-end anomaly detection, or the supplementary detection—is based on a multi-step behavior pattern of network attacks and a source graph obtained by converting the operation information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. The nodes represent the system entities described by the operation information, and the edges between two nodes represent that there is an operational relationship between the two system entities represented by the two nodes.

11. The method according to claim 10, characterized in that, The first management terminal anomaly detection method is based on the multi-step behavior pattern of network attacks and the source map obtained by converting the operation information corresponding to the anomaly detection; The step of performing anomaly detection on the first management terminal based on the first operational information to obtain the detection result of the first management terminal includes: Based on the detection statement, in the source graph converted from the first running information, nodes and edges that satisfy the multi-step behavior pattern of the network attack are searched, thereby obtaining the first management terminal detection result. The detection statement describes the multi-step behavior pattern of the network attack through graph query syntax.

12. The method according to claim 10 or 11, characterized in that, After receiving the first operation information sent by the detection agent device, the method further includes: The first operating information is sent to a database connected to the management device, the database being used to store the operating information of the terminal; Before obtaining the first management terminal detection result by performing first management terminal anomaly detection based on the first operational information, the method further includes: The first running information is read from the database, and the detection method of the first management terminal anomaly detection is related to the storage format of the first running information in the database.

13. The method according to any one of claims 10-12, characterized in that, The method further includes: The system receives a first agent-end detection result sent by the detection agent device, wherein the first agent-end detection result is obtained by the detection agent device based on the second operation information. In response to the abnormal behavior of the second system entity when the detection result of the first agent indicates that the terminal is under network attack, a first protection processing instruction is sent to the detection agent device. The first protection processing instruction includes the identification information of the second system entity and information instructing the detection agent device to perform the first protection processing.

14. The method according to any one of claims 10-13, characterized in that, After receiving the first operation information sent by the detection agent device, the method further includes: Within a reference time after receiving the first operation information, a second management terminal anomaly detection is performed based on the first operation information to obtain a second management terminal detection result. The second management terminal detection result indicates whether the terminal is under network attack. The type of network attack detected by the second management terminal anomaly detection is different from that detected by the first management terminal anomaly detection.

15. The method according to claim 14, characterized in that, The second management terminal detection result also indicates that the behavior described by the abnormal operation information in the first operation information was performed by the terminal under network attack. After obtaining the second management terminal detection result by performing anomaly detection based on the first operational information, the method further includes: A second protection processing instruction is sent to the detection agent device. The second protection processing instruction includes the identification information of a third system entity and information indicating the method of the second protection processing. The third system entity is the system entity corresponding to the abnormal operation information.

16. The method according to any one of claims 10-15, characterized in that, The anomaly detection conditions of the management terminal include at least one of the following: Obtain an anomaly detection command; The time interval between the last anomaly detection for the first type of network attack is greater than or equal to the interval threshold, where the first type includes the type of network attack detected by the first management terminal anomaly detection.

17. The method according to any one of claims 10-16, characterized in that, The method further includes: Receive statistical results sent by the detection agent device, the statistical results including the number of times the system entity running on the terminal performed the reference type behavior; The number of behaviors of the reference type is compared with a threshold number to obtain a statistical detection result, which indicates whether the terminal is under network attack.

18. The method according to any one of claims 1-17, characterized in that, The management device is located in the cloud.

19. An anomaly detection system, characterized in that, The anomaly detection system includes a detection agent device and a management device. The detection agent device is used to implement the anomaly detection method according to any one of claims 1-9 or 18. The management device is used to implement the anomaly detection method according to any one of claims 10-18.

20. A detection proxy device, characterized in that, The detection proxy device runs on the terminal, and the detection proxy device includes: The sending module is used to send the first operating information of the terminal to the management device. The first operating information is used by the management device to perform management terminal anomaly detection. The first operating information is obtained by the detection agent device through filtering second operating information. The second operating information is used to describe the behavior of system entities running on the terminal. The system entities include objects on the terminal used to implement system tasks. The detection module is used to perform first proxy terminal anomaly detection based on the second operating information when the proxy terminal anomaly detection conditions are met, thereby obtaining the first proxy terminal detection result, which indicates whether the terminal is under network attack. The sending module is further configured to, in response to receiving a recall instruction sent by the management device, send supplementary operating information of the first system entity to the management device. The recall instruction includes the identification information of the first system entity. The supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the operating information of the first system entity. The supplementary operating information of the first system entity is used by the management device to perform supplementary detection on the first system entity. The detection method of one or more of the following anomaly detection methods—management end anomaly detection, first agent end anomaly detection, or supplementary detection—is based on a multi-step behavior pattern of network attacks and a source graph obtained by converting the operation information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. The nodes represent the system entities described by the corresponding operation information, and the edges between two nodes represent that there is an operational relationship between the two system entities represented by the two nodes.

21. A management device, characterized in that, The management device includes: A receiving module is used to receive first running information sent by a detection agent device. The first running information is obtained by filtering second running information. The second running information is used to describe the behavior of system entities running on the terminal. The second running information is used by the detection agent device to perform agent end anomaly detection. The detection agent device runs on the terminal. The system entities include objects on the terminal used to implement system tasks. The detection module is used to perform a first management terminal anomaly detection based on the first operating information when the management terminal anomaly detection conditions are met, thereby obtaining a first management terminal detection result. The first management terminal detection result indicates whether the terminal is under network attack. The sending module is configured to send a recall instruction to the detection agent device in response to receiving a recall operation for the first system entity, the recall instruction including the identification information of the first system entity; The receiving module is further configured to receive supplementary operating information of the first system entity sent by the detection agent device based on the recall instruction, wherein the supplementary operating information of the first system entity includes operating information related to the first system entity in the second operating information other than the first operating information; The detection module is also used to perform supplementary detection based on the supplementary operating information and the first operating information, thereby obtaining supplementary detection results, wherein the supplementary detection results indicate whether the first system entity is operating under the condition that the terminal is subjected to a network attack; The detection method of one or more of the following anomaly detection methods—the agent-end anomaly detection, the first management-end anomaly detection, or the supplementary detection—is based on a multi-step behavior pattern of network attacks and a source graph obtained by converting the operation information corresponding to the anomaly detection. The source graph includes multiple nodes and edges. The nodes represent the system entities described by the operation information, and the edges between two nodes represent that there is an operational relationship between the two system entities represented by the two nodes.

22. An anomaly detection device, characterized in that, The device includes a processor coupled to a memory; the memory stores at least one instruction, which is loaded and executed by the processor to enable the anomaly detection device to implement the anomaly detection method according to any one of claims 1-18.

23. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction, which is loaded and executed by a processor to implement the anomaly detection method as described in any one of claims 1-18.

24. A computer program product, characterized in that, The computer program product includes a computer program / instruction that is executed by a processor to enable a computer to implement the anomaly detection method according to any one of claims 1-18.

Images