Attack behavior detection

An electronic device, comprising:

• at least one processing unit;
• at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit that, when executed by the at least one processing unit, cause the electronic device to perform actions comprising:
• obtaining attack behavior data and non-attack behavior data, the attack behavior data being collected from at least one honeypot host, and the non-attack behavior data being collected from at least one user host;
• according to keywords in the non-attack behavior data and keywords in the attack behavior data, filtering keywords from the attack behavior data to generate at least one attack behavior detection rule, wherein each attack behavior detection rule comprises at least one keyword for characterizing an attack behavior;
• and
• performing attack behavior detection on a target user host based on the at least one attack behavior detection rule.

A non-transitory computer readable storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to perform actions comprising:

• obtaining attack behavior data and non-attack behavior data, the attack behavior data being collected from at least one honeypot host, and the non-attack behavior data being collected from at least one user host;
• according to keywords in the non-attack behavior data and keywords in the attack behavior data, filtering keywords from the attack behavior data to generate at least one attack behavior detection rule, wherein each attack behavior detection rule comprises at least one keyword for characterizing an attack behavior;
• and
• performing attack behavior detection on a target user host based on the at least one attack behavior detection rule.