Security Center:Intelligent behavior analysis

Overview

Intelligent behavior analysis uses AI to learn normal process behavior on servers and build a process allowlist. When a server executes a process outside the allowlist, the system triggers an alert or blocks the process based on the current running mode, identifying and handling potential security threats.

• Anomalous process detection: When malware or cryptomining trojans are implanted on a server, anomalous process behavior triggers a system alert or automatic blocking.

• Compliance auditing: Records all process behavior on servers to meet security compliance auditing requirements.

• Zero-trust protection: By default, only allowlisted processes are allowed to run, preventing unknown program execution at the source.

How it works

Before you begin

• Security Center agent installed on the target server.

• Server OS and kernel versions meeting the AliHips requirements, with the AliHips process running normally.

Activate Agent Endpoint Detection and Response(Agent EDR)

To use the intelligent behavior analysis feature, you must first purchase and activate Agent Endpoint Detection and Response.

Bind quotas

You must bind an EDR seats to each server before you can use Intelligent Behavior Analysis for learning and protection.

1. Go to the Security Center console - Overview page.

2. Go to the authorization page. The entry point varies by billing model:

   • Subscription / Hybrid billing: In the Subscription section, click Manage next to Agent Endpoint Detection and Response.

   • Pay-as-you-go: In the pay-as-you-go Pay-as-you-go section, click Quota Management next to Agent Endpoint Detection and Response.

3. In the Quota Management dialog box, Select Server Location (Chinese Mainland or Outside Chinese Mainland) to locate the target server.

4. For the target server, turn on the switch in the Agentic EDR Seat column.

   Important

   To automatically bind EDR seats to new servers, in the Automatically Add New Servers to Security Center section, select Automatically Enable Agentic EDR for New Hosts.

Create an analysis policy

Before enabling intelligent behavior analysis, you must create a protection policy to define the learning duration, allowlist mode, and target servers.

1. Access the Security Center console - Mitigation Settings - Host Protection - Intelligent Behavior Analysis. In the upper-left corner of the page, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

2. On the intelligent behavior analysis page, click Intelligent Behavior Analysis Settings.

3. In the dialog box, click Create Policy.

4. Configure the following parameters:

   Parameter	Description
   Policy Name	A custom name to identify the policy, for easy recognition and management.
   Learning Duration	The number of days for the model to learn after initial setup. During learning, the system records all process behavior. Note We recommend at least 7 days to ensure the learning covers a complete business cycle. If the server has strong business periodicity (for example, runs a scheduled task once a week), we recommend 14 days or more.
   Automatic End	If no new behaviors are detected for N consecutive days, learning ends automatically and Alert mode is enabled.
   Whitelist Mode	The allowlist matching method. Process Path: Matches by process file path (default). Process Hash: Matches by file MD5 hash value.
   Server selection	The scope of servers the policy applies to. Supports selecting all assets or by asset group. You can search by server name, public IP, or private IP.

5. Click OK.

6. Verify that the selected servers show the Learning status.

Manage the allowlist

After learning finishes, the system generates a process allowlist. View, add, or remove allowlisted process paths as needed.

Switch protection mode

The default protection mode after learning is Alert. Switch between modes as needed.

1. In the server list, click Switch Mode in the Actions column for the target server.

2. Select Alert or Block mode.

3. Click OK.

4. Verify that the Running status column reflects the new mode.

View and handle alerts

When a process is not in the allowlist, the system generates a security alert. View and handle alerts using the Alerts feature.

1. In the navigation pane on the left, select Detection and Response > Alerts. In the upper-left corner of the console, select the region where your assets are located: Chinese Mainland or Outside Chinese Mainland.

   Note

   If you have activated the Agentic SOC service, the navigation pane entry changes to Agentic SOC > Alerts.

2. On the CWPP tab, click the number below Host Abnormal Behavior Alert to open the alert list.

   Alert statuses:

   • Alert mode: Alert status is Alerts, requiring manual review.

   • Block mode: The process is blocked automatically. Alert status is Blocked.

3. For each alert, choose one of the following handling methods:

   Dimension	Ignore	Add to Business Model
   Alert status after action	Changes to Ignored.	No change.
   Alert on next occurrence	Yes. The system generates another alert the next time the same process runs.	No. The process is allowed without generating an alert the next time it runs.
   Allowlist change	No change.	The process is added to the allowlist.
   Applicable scenario	Temporary tasks or suspected behavior that requires ongoing monitoring.	Confirmed legitimate business processes where you want to reduce alert noise.

Relearn process behavior

When business needs change, relearn process behavior to update the allowlist. Two methods are available:

1. On the Intelligent Behavior Analysis page, click Relearn or Start Incremental Learning in the Actions column for the target server.

2. After the operation, the Status changes to Learning.

   Important

   During Learning status, neither blocking nor alerting is in effect.

Billing

• Subscription:

  • Billing method: Billed based on the number of seat authorizations that you purchase. Binding one server consumes one seat authorization.

  • Billing rules:USD 6.876066 per seat per month.

• Pay-as-you-go:

  • Billing method: Billed based on the number of seat authorizations and the actual usage duration. Binding one server consumes one seat authorization. Servers without bound policies automatically stop billing.

  • Billing cycle: Billed daily.

  • Price: USD 0.014325 per seat per hour.

• Hybrid billing:

  • Billing method: Billed based on the number of seat authorizations that you purchase. Binding one server consumes one seat authorization.

  • Billing rules: After Burstable Protection is enabled, when the actual number of bound seats exceeds the subscription standard seats quota, the excess seats are billed as elastic protection seats.

    Important

    After the subscription expires, Burstable Protection is automatically disabled, and billing for elastic protection seats also stops automatically.

    • Agentic EDR standard seats: USD 6.876066 per seat per month.

    • Agentic EDR elastic protection seats: USD 0.014325 per seat per hour.

Close and Unsubscribe Service

If you no longer need the EDR service, refer to the following instructions based on your billing model.

• Close the entire service:

  • Subscription: Go to the or Refund Management page to submit a refund request for the EDR order. For details, see Refund policy.

  • Pay-as-you-go: On the Security Center console - Overview page, in the Pay-as-you-go section, turn off the Agent Endpoint Detection and Response switch.

• Close elastic protection:

  • Method 1: On the Security Center console - Overview page, in the Subscription section, turn off the Burstable Protection switch.

  • Method 2: After unsubscribing the subscription service, the Burstable Protection is also automatically disabled.

Data cleanup

After you close the service, unsubscribe from Agent EDR instances, or if your account is overdue, intelligent behavior analysis stops immediately. Data is retained as follows:

FAQ

• Does a Security Center instance expiration affect Agent EDR?

  No. Reasons:

  • Independent billing: Agent EDR is an independent billing module, billed separately from the Security Center instance.

  • Continued availability: As long as the Agent EDR instance is within its validity period, you can still use learning, server binding, and other features even if the Security Center instance has expired.

• Why can't I see the Burstable Protection switch?

  Burstable Protection is currently in the private preview phase. Contact your sales representative to enable it.

• Why is the allowlist empty after learning completes?

  An empty allowlist means no process activity was recorded during learning. Check the following, then click Relearn:

  • Is the server running and the Security Center agent online?

  • Is the AliHips process running? If not, check whether the OS and kernel versions meet the AliHips requirements.

  • Was there actual business traffic on the server during the learning phase?

• How do I prevent legitimate business processes from being blocked in enforcement mode?

  • Before switching to Block mode, verify that the learning duration was sufficient and the allowlist covers all legitimate processes.

  • Run in Alert mode first to check for false alerts on legitimate processes.

  • If a process is blocked, add it to the allowlist, then click Relearn or use incremental learning.

• Start Incremental Learning vs Relearn: What is the difference?

  • Incremental learning preserves the existing allowlist and learns only new behaviors. Suitable for minor business changes, and carries low risk.

  • Relearning clears all data and starts from scratch. Suitable for major business changes where the existing model no longer applies, and carries higher risk.