Attack behavior detection

1 . A method for attack behavior detection, comprising:

obtaining attack behavior data and non-attack behavior data, the attack behavior data being collected from at least one honeypot host, and the non-attack behavior data being collected from at least one user host;

obtaining a plurality of candidate keyword sets based on the attack behavior data;

clustering the plurality of candidate keyword sets to obtain at least one keyword set cluster;

for each of the at least one keyword set cluster, selecting an active keyword set from the keyword set cluster based on importance scores of respective keywords comprised in the keyword set cluster, an importance score indicating a degree to which the respective keyword is capable of characterizing an attack behavior;

determining at least one target keyword set based on the selected active keyword set, each target keyword set comprising at least one keyword for characterizing an attack behavior;

generating at least one attack behavior detection rule from the at least one target keyword set, respectively, wherein each attack behavior detection rule comprises at least one keyword for characterizing an attack behavior; and

performing attack behavior detection on a target user host based on the at least one attack behavior detection rule.

2 . The method of claim 1 , wherein obtaining a plurality of candidate keyword sets based on the attack behavior data comprises:

determining a plurality of honeypot instruction sequence sets from the attack behavior data, each honeypot instruction sequence set comprising an instruction sequence from a session on a honeypot host;

extracting the plurality of candidate keyword sets from the plurality of honeypot instruction sequence sets, respectively.

3 . The method of claim 1 , wherein an importance score of a keyword is obtained by:

determining the importance score of the keyword based on appearance frequencies of the keyword occurred in the keywords of the attack behavior data and the keywords of the non-attack behavior data.

4 . The method of claim 3 , wherein the non-attack behavior data comprises a plurality of user instruction sequence sets collected from the at least one user host, and a plurality of reference keyword sets are respectively extracted from the plurality of user instruction sequence sets; and

wherein the determining the importance score of the keyword comprises:

determining an inverse document frequency (IDF) of the keyword within the plurality of reference keyword sets and within the plurality of candidate keyword sets;

determining a word frequency (TF) of the keyword within a corresponding candidate keyword set; and

determining an importance score of the keyword based on the IDF and TF of the keyword.

5 . The method of claim 3 , wherein

each keyword set cluster comprises at least two candidate keyword sets.

6 . The method of claim 1 , wherein for each keyword set cluster, selecting an active keyword set from at least two candidate keyword sets comprised in the keyword set cluster comprises:

for each candidate keyword set of the at least two candidate keyword sets, determining the number of keywords in the candidate keyword set with importance scores exceeding a first predetermined threshold; and

selecting an active keyword set from the at least two candidate keyword sets based on the determined number of keywords with the importance scores exceeding the first predetermined threshold.

7 . The method of claim 1 , wherein determining the at least one target keyword set based on the selected active keyword set comprises:

deleting at least one keyword from the active keyword set based on a comparison between the importance sore of each keyword in the active keyword set and a second predetermined threshold, so as to obtain the target keyword set.

8 . The method of claim 1 , wherein determining the at least one target keyword set comprises: for each of the at least one target keyword set,

determining a trigger word for the target keyword set based on at least one of the following: importance scores of respective keywords in the active keyword set, or a character length of the respective keywords.

9 . The method of claim 8 , wherein the at least one keyword set cluster comprises a plurality of keyword set clusters, and wherein determining the at least one target keyword set further comprises:

if a trigger word of a first active keyword set and a trigger word of a second active keyword set in a plurality of active keyword sets selected for the plurality of keyword set clusters are the same, combining the first active keyword set and the second active keyword set to obtain a target keyword set, the target keyword set at least comprising the same trigger word.

10 . The method of claim 1 , wherein performing attack behavior detection on the target user host comprises:

determining whether at least one user instruction collected from the target user host satisfies the at least one attack behavior detection rule; and

determining an attack behavior detection result on the target user host based on the determination of whether the at least one user indication satisfies the at least one attack behavior detection rule, the attack behavior detection result indicating whether an attack behavior occurs.

11 . The method of claim 10 , wherein each of the at least one attack behavior detection rule comprises a trigger word and at least one keyword, and wherein determining whether at least one user instruction collected from the target user host satisfies the at least one attack behavior detection rule comprises:

determining a degree of matching between a first user instruction collected from the target user host and a trigger word in the at least one target attack behavior detection rule;

in response to a determination that the first user instruction matches a first trigger word in a first attack behavior detection rule, obtaining a plurality of user instructions from the target user host based on the first user instruction; and

determining whether the first attack behavior detection rule is satisfied based on a degree of matching between the plurality of user instructions and at least one keyword in the first attack behavior detection rule.

12 . The method of claim 11 , wherein obtaining a plurality of user instructions from the target user host based on the first user instruction comprises:

obtaining the plurality of user instructions from the target user host based on a host identifier and a session identifier of the first user instruction.

13 . The method of claim 1 , further comprising:

collecting additional attack behavior data from the at least one honeypot host;

updating the at least one attack behavior detection rule based on the additional attack behavior data; and

performing attack behavior detection on the target user host based on the updated at least one attack behavior detection rule.

14 . An electronic device, comprising:

at least one processing unit;

at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit that, when executed by the at least one processing unit, cause the electronic device to perform actions comprising:

obtaining attack behavior data and non-attack behavior data, the attack behavior data being collected from at least one honeypot host, and the non-attack behavior data being collected from at least one user host;

obtaining a plurality of candidate keyword sets based on the attack behavior data;

clustering the plurality of candidate keyword sets to obtain at least one keyword set cluster;

for each of the at least one keyword set cluster, selecting an active keyword set from the keyword set cluster based on importance scores of respective keywords comprised in the keyword set cluster, an importance score indicating a degree to which the respective keyword is capable of characterizing an attack behavior;

determining at least one target keyword set based on the selected active keyword set, each target keyword set comprising at least one keyword for characterizing an attack behavior;

generating at least one attack behavior detection rule from the at least one target keyword set, respectively, wherein each attack behavior detection rule comprises at least one keyword for characterizing an attack behavior; and

performing attack behavior detection on a target user host based on the at least one attack behavior detection rule.

15 . The electronic device of claim 14 , wherein obtaining a plurality of candidate keyword sets based on the attack behavior data comprises:

determining a plurality of honeypot instruction sequence sets from the attack behavior data, each honeypot instruction sequence set comprising an instruction sequence from a session on a honeypot host;

extracting the plurality of candidate keyword sets from the plurality of honeypot instruction sequence sets, respectively.

16 . The electronic device of claim 14 , wherein an importance score of a keyword is obtained by:

determining the importance score of the keyword based on appearance frequencies of the keyword occurred in the keywords of the attack behavior data and the keywords of the non-attack behavior data.

17 . The electronic device of claim 14 , wherein the non-attack behavior data comprises a plurality of user instruction sequence sets collected from the at least one user host, and a plurality of reference keyword sets are respectively extracted from the plurality of user instruction sequence sets; and

wherein the determining the importance score of the keyword comprises:

determining an inverse document frequency (IDF) of the keyword within the plurality of reference keyword sets and within the plurality of candidate keyword sets;

determining a word frequency (TF) of the keyword within a corresponding candidate keyword set; and

determining an importance score of the keyword based on the IDF and TF of the keyword.

18 . The electronic device of claim 16 , wherein

each keyword set cluster comprises at least two candidate keyword sets.

19 . The electronic device of claim 14 , wherein performing attack behavior detection on the target user host comprises:

determining whether at least one user instruction collected from the target user host satisfies the at least one attack behavior detection rule; and

determining an attack behavior detection result on the target user host based on the determination of whether the at least one user indication satisfies the at least one attack behavior detection rule, the attack behavior detection result indicating whether an attack behavior occurs.

20 . A non-transitory computer readable storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to perform actions comprising:

obtaining attack behavior data and non-attack behavior data, the attack behavior data being collected from at least one honeypot host, and the non-attack behavior data being collected from at least one user host;

obtaining a plurality of candidate keyword sets based on the attack behavior data;

clustering the plurality of candidate keyword sets to obtain at least one keyword set cluster;

for each of the at least one keyword set cluster, selecting an active keyword set from the keyword set cluster based on importance scores of respective keywords comprised in the keyword set cluster, an importance score indicating a degree to which the respective keyword is capable of characterizing an attack behavior;

determining at least one target keyword set based on the selected active keyword set, each target keyword set comprising at least one keyword for characterizing an attack behavior;

generating at least one attack behavior detection rule from the at least one target keyword set, respectively, wherein each attack behavior detection rule comprises at least one keyword for characterizing an attack behavior; and

performing attack behavior detection on a target user host based on the at least one attack behavior detection rule.