WO2019075637A1

WO2019075637A1 - Method and device for detecting input/output request behavior, and storage medium

Info

Publication number: WO2019075637A1
Application number: PCT/CN2017/106543
Authority: WO
Inventors: 谭喆; 姚开方; 裴卫斌
Original assignee: 深圳中兴力维技术有限公司
Priority date: 2017-10-17
Filing date: 2017-10-17
Publication date: 2019-04-25
Also published as: CN109716723B; CN109716723A

Abstract

A method and device for detecting an input/output request behavior, and a computer readable storage medium. The method comprises the steps of: filtering a network driver to intercept an input/output request behavior in the network driver; marking information in the intercepted input/output request behavior and generating a concept (11, 121); according to a trained concept lattice model, carrying out concept lattice pre-construction on the generated concept and determining whether a sub-top-layer concept can be generated (12); and if the sub-top-layer concept is generated, generating selection information about whether to pass or reject the input/output request behavior, and receiving a user's selection operation to perform corresponding processing (13). According to the method, a legitimate IO request behavior is permitted by means of a constructed concept lattice model. After a concept lattice model is constructed, the tendency towards an abnormal IO request behavior can be supervised, and self-learning and concept lattice structure optimization can be carried out by means of a user decision.

Description

Method and device for detecting input and output request behavior, storage medium

[0001] The present invention relates to the field of network security technologies, and in particular, to a method and device for detecting input and output request behavior, and a computer readable storage medium.

Background technique

[0002] With the development of the Internet, network security has become a major issue. Web (World wide Web, World Wide Web or World Wide Web) attacks, ARP (Address Resolution Protocol) attacks, SYN (Synchronous, synchronization) Attacks and other forms of network attacks are emerging one after another.

, seriously damage the normal use of the Internet.

[0003] Therefore, how to analyze, identify and filter the endless network attacks has become a very important research topic.

technical problem

The main object of the present invention is to provide a method and apparatus for detecting input and output request behavior, and a computer readable storage medium, aiming at solving the problems of the prior art.

Problem solution

Technical solution

[0005] In order to achieve the above object, a first aspect of the embodiments of the present invention provides a method for detecting an input/output request behavior, where the method includes the following steps:

[0006] filtering the network driver, intercepting the input and output request behavior in the network driver; marking the information in the intercepted input and output request behavior and generating a concept;

[0007] According to the trained concept lattice model, the concept of the generated concept is pre-constructed and judged whether a secondary top-level concept is generated;

[0008] If the secondary top-level concept is generated, the selection information of whether the input/output request behavior is passed or rejected is generated, and the user's selection operation is received to perform corresponding processing.

[0009] Optionally, the information in the input and output request behavior includes an input/output request packet body itself, source address information, destination address information, an input/output request occurrence time, and whether it is an intermediate routing packet. Or a variety.

[0010] Optionally, the trained concept lattice model is implemented by the following steps:

[0011] filtering the network driver, intercepting the input and output request behavior in the network driver; marking the information in the intercepted input and output request behavior and generating a concept;

[0012] The concept of minimizing the maximum connotation of the generated concept is recorded as the top-level concept, and the minimum connotation of the extension is most presumably recorded as the underlying concept, and the parent-child relationship of the top-level concept and the underlying concept is constructed and a concept lattice is formed.

[0013] selecting a generated concept, performing the work of extension and generalization based on the formed concept lattice from top to bottom, and generating a new concept; adjusting the parent-child relationship between the concepts for the generated new concept;

[0014] Repeat the previous step until all generated concepts complete the operation and generate the final concept lattice.

[0015] Optionally, the performing the top-down and the generalization of the content from top to bottom includes:

[0016] The epitaxial intersecting phase-phase operation is performed from top to bottom.

[0017] Optionally, the receiving the user's selection operation to perform corresponding processing includes:

[0018] if the selected user's selection operation is to request the behavior through the input and output, the generated concept is added to the trained concept lattice model, and a new concept lattice model is formed;

[0019] If the receiving operation of the received user is to reject the input/output request behavior, the execution thread of the input and output request behavior is blocked and reported to the user interface.

[0020] Secondly, in order to achieve the above object, a second aspect of the embodiments of the present invention provides a device for detecting an input/output request behavior, where the device includes a filtering module, a rule recognition determining module, and a behavior admission module; [0021] a filtering module, configured to filter the network driver, intercept the input and output request behavior in the network driver; mark the information in the intercepted input and output request behavior and generate a concept;

[0022] The rule recognition judging module is configured to pre-construct the concept generated by the filtering module according to the trained concept lattice model and determine whether a sub-top concept is generated;

[0023] The behavior admission module is configured to generate, if the secondary top-level concept is generated, whether to pass or reject the selection information of the input and output request behavior, and receive a user's selection operation to perform corresponding processing.

[0024] Optionally, the device further includes a concept lattice construction module;

[0025] the concept lattice construction module is configured to filter the network driver, intercept the input and output request behavior in the network driver, mark the information in the intercepted input and output request behavior, and generate a concept; [0026] The concept of minimizing the maximum connotation of the generated concept is recorded as the top-level concept, and the maximum concept of the extended minimum connotation is recorded as the underlying concept, and the parent-child relationship of the top-level concept and the underlying concept is constructed and a concept lattice is formed.

[0027] selecting a generated concept, performing the work of extension and generalization based on the formed concept lattice from top to bottom, and generating a new concept; adjusting the parent-child relationship between the concepts for the generated new concept;

[0028] Repeat the previous step until all generated concepts complete the operation and generate the final concept lattice.

[0029] Optionally, the behavior admission module includes a model lattice self-learning unit and a blocking unit;

[0030] the model lattice self-learning unit is configured to: if the receiving operation of the received user is to request the behavior through the input and output, add the generated concept to the trained concept lattice model, and form a new concept lattice Model

[0031] The blocking unit is configured to block the execution thread of the input and output request behavior and report to the user interface if the receiving operation of the received user is to reject the input/output request behavior.

[0032] Next, in order to achieve the above object, a third aspect of the embodiments of the present invention provides a device for detecting an input/output request behavior, where the apparatus for detecting input and output request behavior includes: a memory, a processor, and a memory stored in the memory And a detection program for input/output request behavior running on the processor, the detection program of the input/output request behavior being executed by the processor, and the step of implementing the detection method of the input/output request behavior described in the first aspect .

[0033] In order to achieve the above object, a fourth aspect of the embodiments of the present invention provides a computer readable storage medium, where the computer readable storage medium stores a detection program for input and output request behavior, and the input and output request The detection program of the behavior is executed by the processor, the step of implementing the detection method of the input/output request behavior described in the first aspect.

Advantageous effects of the invention

Beneficial effect

The method and device for detecting the input and output request behavior provided by the embodiment of the present invention, and the computer readable storage medium, can count the direction information of the request behavior, the time information, and the like, and form a binary structure, thereby The meta-sample structure is constructed as a concept lattice model; through the constructed concept lattice model, the legal 10 request behavior is allowed; the concept lattice model can guide the orientation of the anomaly 10 request behavior, and the user can decide to conduct self-learning and concept. Grid structure optimization. Brief description of the drawing

DRAWINGS

1 is a schematic diagram of a hierarchical structure of a network protocol stack filter driver according to an embodiment of the present invention;

2 is a schematic flow chart of a method for detecting an input/output request behavior according to a first embodiment of the present invention;

3 is a schematic flowchart of another method for detecting an input/output request behavior according to a first embodiment of the present invention; [0038] FIG. 4 and FIG. 8 are schematic diagrams showing a structure of a concept lattice construction process according to an embodiment of the present invention;

9 is a schematic structural diagram of an apparatus for detecting an input/output request behavior according to a second embodiment of the present invention;

10 is another schematic structural diagram of an apparatus for detecting an input/output request behavior according to a second embodiment of the present invention; [0041] FIG. 11 is a behavior admission module in an apparatus for detecting input and output request behavior according to a second embodiment of the present invention; Schematic;

12 is a schematic diagram showing the sequence structure of each module in the apparatus for detecting input and output request behavior according to the second embodiment of the present invention;

13 is a schematic structural diagram of an apparatus for detecting an input/output request behavior according to a third embodiment of the present invention.

The implementation, functional features, and advantages of the present invention will be further described with reference to the accompanying drawings.

Embodiments of the invention

The specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0046] Various embodiments of the present invention will now be described with reference to the drawings. In the following description, the suffixes such as "module", "part" or "unit" used to denote elements are merely illustrative of the present invention, and are not intended to be specific in their own right.

[0047] It is further understood that the term "and/or" used in the description of the invention and the appended claims means any combination and all possible combinations of one or more of the associated listed items, and These combinations are included.

[0048] In order to facilitate an understanding of embodiments of the present invention, related technical terms are described below:

[0049] 1. Network Protocol Stack Filtering Drive Technology

[0050] Network protocol stack filter driver technology is a very mature technology. In the Windows NT operating system, the network protocol is hierarchical. From the bottom up, it is NIC (Network Interface Card) Adapter) Driver, NDIS (Network Driver Interface Specification), TCP/IP (Transmission Control Protocol/Internet Protocol) driver, AFD (Auxiliary Function)

Drive, auxiliary function driver), TDI (Transport Driver

Interface, Transport Driver Interface), Socket (Socket). The network protocol stack filter driver hierarchy can be seen in Figure 1. In a layered drive, a layer of filter drivers can be added between the two layers of drivers to intercept the network 10 (Input and Output, input). Output) Request the package for monitoring purposes. The intercepted content may be the source address of the 10 request packet, the source port, the destination address, the destination port, the uplink or the downlink, and the like.

[0051] 2. Concept lattice

[0052] Concept Lattice is a discrete mathematical model commonly used in data mining and machine learning. A concept lattice is a set of poses with a concept as an element. It can be visualized by a Haas diagram, where each node is a concept. The concept lattice structure model is derived from FCA (Formal Concept Analysis) theory and is the core data analysis tool in FCA. It essentially describes the relationship between objects (samples) and attributes (features). The formal background can be expressed as a triple T=(0, D, R), where 0 is the instance (object) set, D is the descriptor (attribute) set, and R is a binary relationship between 0 and D. There is a unique partial order set corresponding to it, and this partial order set produces a lattice structure. This lattice L induced by the background (0, D, R) is called a concept lattice. Each node in L is a sequence, called a concept, denoted as (X, Y), where X is called the extension of the concept (Χ, Υ); Y is called the concept (X, Y) Intent. There are many ways to construct a grid, including top-down algorithms, bottom-up algorithms, and enumeration algorithms. In the case of a large scale of concept, it is also possible to form a reduction concept lattice and an approximate concept lattice by reducing the behavior, thereby effectively controlling the scale and growth of the lattice.

First embodiment

[0054] As shown in FIG. 2, a first embodiment of the present invention provides a method for detecting an input/output request behavior, where the method includes the following steps:

[0055] 11. Filtering the network driver, intercepting the input and output request behavior in the network driver; marking the information in the intercepted input and output request behavior and generating a concept;

[0056] In this embodiment, the information in the input and output request behavior includes an input and output request packet body itself. , source address information, destination address information, input and output request occurrence time, whether it is one or more of the intermediate routing packets.

[0057] As an example, assume that the source address is 192.168.1.101. The extension attribute can be marked as 1, the extension source port.

3456 can be marked as 2, and the protocol family, buffer address, buffer length, etc. can also be used as an extension attribute. The I0 request packet itself can be marked as a connotation.

[0058] 12. According to the trained concept lattice model, the concept of the generated concept is pre-constructed and judged whether a sub-top concept is generated;

[0059] In this embodiment, according to the trained concept lattice model, if the concept lattice model is imagined as an inverted tree, the underlying concept is a tree root, and the first layer concept under the top concept is a leaf, and the top layer The concept is actually a leaf. The formation of leaves indicates that in addition to the top-level concept, the leaf node has the largest extension and the smallest connotation, which in turn can explain the latest process of request behavior.

[0060] Please refer to FIG. 3, in the embodiment, the trained concept lattice model is implemented by the following steps:

[0061] 121: Filter the network driver, intercept the input and output request behavior in the network driver; mark the information in the intercepted input and output request behavior and generate a concept;

[0062] 122. The concept of minimizing the maximum content of the extended concept in the generated concept is recorded as the top-level concept, the minimum content of the extension, and the maximum concept is recorded as the underlying concept, and the parent-child relationship of the top-level concept and the underlying concept is constructed and a concept lattice is formed;

[0063] 123, selecting a generated concept, performing the work of extension and generalization according to the formed concept lattice from top to bottom, and generating a new concept; adjusting the parent-child relationship between the concepts for the generated new concept; 0064] 124. Repeat the previous step until all generated concepts complete the operation and generate the final concept lattice.

[0065] In order to better understand the construction process of the trained concept lattice model, an example will be described by taking FIG. 4-8 as an example.

[0066] If there is a background in the following form:

[]

[0067] Four concepts l#({2,3,5,7 },{a}), 2#({ 1,4,5,6,7,8 }, {b}) are generated after marking , 3#({4,5,7 },{ c}), 4#({ l,2,3,6,8 },{d}) and the top concept, the underlying concept 5#({ 1,2, 3,4,5,6,7,8 },{NULL}), 6#( {NUI },{abcd}).

[0068] The top-level concept 5#({ 1,2,3,4,5,6,7,8 } is the concept of the smallest maximum connotation of the extension, the underlying concept 6#({N ULL},{ab _C d}) In order to extend the concept of minimum connotation, the parent-child relationship between the top-level concept and the underlying concept is constructed and the initial concept lattice is formed, in which the top-level concept is on, the underlying concept is below, and the initial concept lattice is formed as shown in Figure 4.

[0069] The 1# concept is added to the initial concept lattice to perform the work of extension and generalization, and the parent-child relationship is updated. A new concept lattice can be formed as shown in FIG. 5. Specifically, the 1# concept and the top-level concept perform the extension and intersection of the top-level and the connotation, and the generated new concept is the same as the 1# concept, but the sub-concept as the top-level concept exists; 1# concept and the underlying concept extend the connotation In conjunction with the operation, the generated concept is also the same as the 1# concept, but the parent concept as the underlying concept exists.

[0070] It should be noted that the work of epitaxial instantiation and connotation generalization can be referred to the following formula: The intension generalization formula is intent(N3)=intent(Nl)Uintent(N2), and the formula of the extension formula is extent( N3)=extent(Nl)next ent(N2) , where N3 is a newly generated concept, and N1 and N2 are existing concepts.

[0071] Then add the 2# concept to the concept lattice in Fig. 5 to perform the parallel operation and the parallel operation, and update the parent-child relationship to form a new concept lattice. Specifically, each concept is operated and operated with the 2# concept, and the top-level concept and operation are still generated by the 2# concept, as a sub-concept of the top-level concept, and with the 1 # concept, and the operation is formed into a concept ( {5,7 },{a,b}) exists as a sub-concept of the 1# concept and the 2# concept, thereby forming a concept lattice structure as shown in FIG. 6.

[0072] The 3# concept is added to the concept lattice in FIG. 6 to perform the operation and update the parent-child relationship, and a new concept lattice is formed as shown in FIG. 7. Specifically, the 3# concept is added to the concept lattice structure shown in FIG. 6, and it can be seen that the 3# concept is a sub-concept of the 2# concept, and the 3# concept extension is a subset of the 2# concept, and 1# Concept and And the operation 吋 forms a new concept ({5, 7}, {a, b, _C }), and exists as a child node of the 3# concept, thus forming a concept lattice structure as shown in FIG.

[0073] The 4# concept is added to the concept lattice in FIG. 7 to perform the operation and update the parent-child relationship, and a new concept lattice is formed as shown in FIG. 8. So far the concept lattice is constructed.

[0074] 13. If the secondary top-level concept is generated, whether to select or reject the selection information of the input/output request behavior, and receive the user's selection operation to perform corresponding processing.

[0075] In this embodiment, the corresponding processing of the receiving user's selection operation includes:

[0076] if the selected user's selection operation is to request the behavior through the input and output, the generated concept is added to the trained concept lattice model, and a new concept lattice model is formed;

And [0077] if the receiving operation of the received user is to reject the input/output request behavior, the execution thread of the input/output request behavior is blocked and reported to the user interface.

The method for detecting an input/output request behavior provided by an embodiment of the present invention may count 10 direction information of request behavior, daytime information, and the like, and form a binary structure, thereby constructing these binary sample structures into a concept lattice. Model; Through the constructed concept lattice model, the legal 10 request behavior is allowed; the concept lattice model can guide the orientation of the anomaly 10 request behavior, and the user can decide to self-learn and conceptual lattice structure optimization.

Second Embodiment

[0080] As shown in FIG. 9, a second embodiment of the present invention provides a device for detecting input and output request behavior, wherein

The device includes a filtering module 21, a rule recognition determining module 22, and a behavior admission module 23;

[0081] The filtering module 21 is configured to filter the network driver, intercept the input and output request behavior in the network driver, mark the information in the intercepted input and output request behavior, and generate a concept;

[0082] The rule recognition judging module 22 is configured to pre-construct the concept generated by the filtering module 21 according to the trained concept lattice model and determine whether a sub-top concept is generated;

The behavior admission module 23 is configured to generate, if the secondary top-level concept is generated, whether to pass or reject the selection information of the input/output request behavior, and receive a user's selection operation to perform corresponding processing.

Referring to FIG. 11, in the embodiment, the behavior admission module 23 includes a model lattice self-learning unit.

231 and blocking unit 232;

[0085] the model lattice self-learning unit 231 is configured to: if the received user's selection operation is to input through the input When the request behavior is performed, the generated concept is added to the trained concept lattice model, and a new concept lattice model is formed;

[0086] The blocking unit 232 is configured to block the execution thread of the input and output request behavior and report to the user interface if the receiving operation of the received user is to reject the input/output request behavior.

[0087] Please refer to FIG. 10, in an embodiment, the device further includes a concept lattice construction module 24;

[0088] the concept lattice construction module 24 is configured to filter the network driver, intercept the input and output request behavior in the network driver, mark the information in the intercepted input and output request behavior, and generate a concept;

[0089] The concept of minimizing the maximum connotation of the generated concept is recorded as the top-level concept, and the minimum connotation of the extension is most presumably recorded as the underlying concept, and the parent-child relationship of the top-level concept and the underlying concept is constructed and a concept lattice is formed.

[0090] selecting a generated concept, performing the work of extension and generalization based on the formed concept lattice from top to bottom, and generating a new concept; adjusting the parent-child relationship between the concepts for the generated new concept;

[0091] Repeat the previous step until all generated concepts complete the operation and generate the final concept lattice.

[0092] In order to better illustrate the present embodiment, a schematic diagram of the sequence structure of each module of FIG. 12 will be described: [0093] As shown in FIG. 12, the filtering module filters the network driver and intercepts 10 of the network drivers. Request behavior (10 request packets in the figure); Marks the information in the intercepted 10 request behavior and generates the concept, and then the concept lattice construction module trains the concept lattice model according to the generated concept.

[0094] After that, the filtering module filters the network driver again, intercepts the 10 request behavior in the network driver, marks the information in the intercepted 10 request behavior, and generates a concept. The rule recognition judgment module constructs the concept lattice model trained by the module according to the concept lattice, and constructs the concept concept by the concept lattice construction module to determine whether the secondary top concept is generated.

[0095] If the secondary top-level concept is generated, the behavior admission module generates selection information whether to pass or reject the input/output request behavior, and receives the user's selection operation to perform corresponding processing.

[0096] If the selected user's selection operation is to request the behavior through the input and output, the generated concept is added to the trained concept lattice model by the model lattice self-learning unit, and a new concept lattice model is formed.

The apparatus for detecting input and output request behavior provided by the embodiment of the present invention may count 10 direction information of request behavior, time information, and the like, and form a binary structure, thereby constructing these binary sample structures into a concept lattice. Model; by constructing the concept lattice model, the legal 10 request behavior is allowed; After the model is built, it can guide the direction of the abnormal 10 request behavior, and the user can decide to self-learn and optimize the concept lattice structure.

Third Embodiment

[0099] As shown in FIG. 13, a third embodiment of the present invention provides a device for detecting input and output request behavior, and the device for detecting input and output request behavior includes: a memory 31, a processor 32, and a memory stored in the memory. An input/output request behavior detecting program running on the processor 32, the detection program of the input/output request behavior being executed by the processor 32, for implementing the input/output request behavior described below Steps of the detection method:

[0100] filtering the network driver, intercepting the input and output request behavior in the network driver; marking the information in the intercepted input and output request behavior and generating a concept;

[0101] According to the trained concept lattice model, the concept of the generated concept is pre-constructed and judged whether a secondary top-level concept is generated;

[0102] If the secondary top-level concept is generated, whether or not the selection information of the input/output request behavior is passed or rejected is generated, and the user's selection operation is received to perform corresponding processing.

[0103] The detection program of the input/output request behavior is executed by the processor 32, and is also used to implement the steps of the detection method of the input/output request behavior described below:

[0104] The information in the input/output request behavior includes one or more of the input/output request packet body itself, the source address information, the destination address information, the input/output request occurrence time, and whether it is an intermediate routing packet.

[0105] The detection program of the input/output request behavior is executed by the processor 32, and is also used to implement the steps of the detection method of the input/output request behavior described below:

[0106] filtering the network driver, intercepting the input and output request behavior in the network driver; marking the information in the intercepted input and output request behavior and generating a concept;

[0107] The concept of minimizing the maximum connotation of the generated concept is recorded as the top-level concept, and the minimum connotation of the extension is most roughly referred to as the underlying concept, and the parent-child relationship of the top-level concept and the underlying concept is constructed and a concept lattice is formed.

[0108] selecting a generated concept, performing the work of extension and generalization based on the formed concept lattice from top to bottom, and generating a new concept; adjusting the parent-child relationship between the concepts for the generated new concept;

[0109] Repeat the previous step until all generated concepts complete the operation and generate the final concept lattice. [0110] The detection program of the input/output request behavior is executed by the processor 32, and is also used to implement the steps of the detection method of the input/output request behavior described below:

[0111] The work of performing epitaxial instantiation and connotation generalization from top to bottom includes:

[0112] The epitaxial intersecting phase-phase operation is performed from top to bottom.

[0113] The detection program of the input/output request behavior is executed by the processor 32, and is also used to implement the steps of the detection method of the input/output request behavior described below:

[0114] The corresponding operation of the receiving user's selection operation includes:

[0115] if the selected user's selection operation is to request the behavior through the input and output, the generated concept is added to the trained concept lattice model, and a new concept lattice model is formed;

[0116] If the selected user's selection operation is to reject the input/output request behavior, the execution thread of the input/output request behavior is blocked and reported to the user interface.

[0117] The apparatus for detecting input and output request behavior provided by the embodiment of the present invention may count 10 direction information of request behavior, time information, and the like, and form a binary structure, thereby constructing these binary sample structures into a concept lattice. Model; Through the constructed concept lattice model, the legal 10 request behavior is allowed; the concept lattice model can guide the orientation of the anomaly 10 request behavior, and the user can decide to self-learn and conceptual lattice structure optimization.

Fourth Embodiment

A fourth embodiment of the present invention provides a computer readable storage medium, wherein the computer readable storage medium stores a detection program for an input/output request behavior, and the detection program of the input/output request behavior is executed by a processor. The steps of the detection method of the input/output request behavior described in the first embodiment are implemented.

[0120] The computer readable storage medium provided by the embodiment of the present invention may count 10 direction information of request behavior, time information, and the like, and form a binary structure, thereby constructing these binary sample structures into a concept lattice model; Through the constructed concept lattice model, the legal 10 request behavior is allowed; the concept lattice model can guide the orientation of the anomaly 10 request behavior, and the user can decide to self-learn and conceptual lattice structure optimization.

[0121] It is to be understood that the term "comprising", "including" or any other variants thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device that comprises a Those elements, but also other elements that are not explicitly listed, or are included for this The elements inherent in a process, method, item, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional elements in the process, method, article, or device that comprises the element.

The above are only the preferred embodiments of the present invention, and are not intended to limit the scope of the present invention, and the equivalent structure or equivalent process transformations made by the description of the present invention and the contents of the drawings may be directly or indirectly applied to other related The technical field is equally included in the scope of patent protection of the present invention.

Industrial applicability

The method and device for detecting input and output request behavior and the computer readable storage medium provided by the embodiment of the present invention can count 10 direction information of request behavior, time information, etc., and form a binary structure, thereby The meta-sample structure is constructed as a concept lattice model; through the constructed concept lattice model, the legal 10 request behavior is allowed; the concept lattice model can guide the orientation of the anomaly 10 request behavior, and the user can decide to conduct self-learning and concept. Grid structure optimization.

Claims

Claim

A method for detecting input and output request behavior, wherein the method comprises the steps of: filtering a network driver, intercepting an input and output request behavior in a network driver; marking information in the intercepted input and output request behavior and generating a concept ;

According to the trained concept lattice model, the generated concept is pre-constructed and the sub-top concept is generated.

If the secondary top-level concept is generated, the selection information of whether the input/output request behavior is passed or rejected is generated, and the user's selection operation is received to perform corresponding processing.

The method for detecting an input/output request behavior according to claim 1, wherein the information in the input/output request behavior includes an input/output request packet body itself, source address information, destination address information, and an input/output request. Whether it is one or more of the intermediate routing packages.

A method for detecting input and output request behavior according to claim 1, wherein said trained concept lattice model is implemented by the following steps:

Filtering the network driver, intercepting the input and output request behavior in the network driver; marking the information in the intercepted input and output request behavior and generating a concept;

The concept of minimizing the maximum connotation of the generated concept is recorded as the top-level concept, and the maximum concept of the extension of the minimum is recorded as the underlying concept, and the parent-child relationship of the top-level concept and the underlying concept is constructed and the concept lattice is formed;

Select a generated concept, and carry out the work of extension and internalization according to the formed concept lattice from top to bottom and generate new concepts; adjust the parent-child relationship between concepts for the new concept generated;

Repeating the previous step until all the generated concepts complete the operation and generating the final concept lattice. According to claim 3, an input/output request behavior detecting method is described, wherein the top-down generalization and connotation are performed. The work includes:

The epitaxial intersecting phase-phase operation is performed from top to bottom.

A method for detecting an input/output request behavior according to claim 1, wherein The corresponding processing of the receiving user's selection operation includes:

If the selected user's selection operation is to request the behavior through the input and output, the generated concept is added to the trained concept lattice model, and a new concept lattice model is formed; if the received user's selection operation is to reject the The input and output request behavior blocks the execution thread of the input and output request behavior and reports to the user interface.

[Claim 6] The apparatus for detecting input and output request behavior, wherein the apparatus includes a filtering module, a rule identification determining module, and a behavior admission module;

The filtering module is configured to filter the network driver, intercept the input and output request behavior in the network driver, mark the information in the intercepted input and output request behavior, and generate a concept;

The rule recognition judging module is configured to pre-construct the concept generated by the filtering module according to the trained concept lattice model, and determine whether a sub-top concept is generated; the behavior admission module is used to The secondary top-level concept is generated, and the selection information of whether the input/output request behavior is passed or rejected is generated, and the user's selection operation is received to perform corresponding processing.

[Claim 7] The apparatus for detecting input and output request behavior according to claim 6, wherein the apparatus further includes a concept lattice construction module;

The concept lattice construction module is configured to filter the network driver, intercept the input and output request behavior in the network driver, mark the information in the intercepted input and output request behavior, and generate a concept;

Repeat the previous step until all generated concepts complete the operation and generate the final concept lattice [Claim 8] The apparatus for detecting input and output request behavior according to claim 6, wherein the behavior admission module comprises a model lattice self-learning unit and a blocking unit;

The model lattice self-learning unit is configured to: if the receiving operation of the received user is to output a request behavior through the input, add the generated concept to the trained concept lattice model, and form a new concept lattice model;

The blocking unit is configured to block the execution thread of the input and output request behavior and report to the user interface if the receiving operation of the received user is to reject the input and output request behavior

[Claim 9] A detecting device for inputting and outputting a request behavior, wherein the detecting means for inputting and outputting a request behavior comprises: a memory, a processor, and an input stored on the memory and operable on the processor A detection program for outputting a request behavior, the detection program of the input/output request behavior being executed by the processor, the step of implementing the detection method of the input/output request behavior according to any one of claims 1 to 5.

[Claim 10] A computer readable storage medium, wherein the computer readable storage medium stores a detection program of an input/output request behavior, and the detection program of the input/output request behavior is executed by a processor, such as a right The step of detecting the input/output request behavior described in any one of 1 to 5.