A tracking and tracing method and device based on WEB dynamic defense

Abstract

The present invention discloses a tracking and tracing method and device based on WEB dynamic defense. The method of the present application includes: obtaining a data source of a WEB attack event, the data source includes network attack threat data and clue data of a network attack event; querying the associated feature vector of the data source based on a network attack knowledge graph, the network attack knowledge graph is a knowledge base constructed according to existing network attack means; matching the corresponding tracing strategy through the associated feature vector; determining the attacker and attack organization of the WEB attack event according to the tracing strategy. The present invention analyzes the attack type and correlation of the WEB attack event from different dimensions based on the network attack knowledge graph, effectively identifies the relevant information of the attacker in an active tracing manner, cracks the hidden information of the hacker during the attack process, and effectively improves the tracing accuracy.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a tracking and tracing method and device based on WEB dynamic defense. Background Art

[0002] As the application scope of web services expands, they are not only used in the backend of websites, but are also increasingly used as the backend interface of mobile applications. Usually, websites and mobile applications are accessed by users at the same time. In order to provide users with safe and reliable services, the web as a backend server can not only process massive requests in real time, but also needs to efficiently and accurately identify web attacks. Hackers will use various means to hide their own information when attacking web services, which increases the difficulty for security personnel to track and trace the source.

[0003] In the prior art, the rule set matching method is widely used to defend against web attacks. The rule set matching method analyzes all malicious samples to form a series of rule matching sets. When the statement input by the user matches any one of the rule matching sets, it means that this is a malicious attack statement. However, this method has the possibility of underreporting or false positives, and also has the possibility of being bypassed due to its own loopholes or imperfect rules. In addition, the maintenance of the rule set is relatively difficult, which easily leads to the problem of not being able to accurately locate the identity or location of the attacker. Summary of the invention

[0004] The purpose of the present invention is to provide a tracing and source tracing method and device based on WEB dynamic defense, which is used to improve the tracing accuracy of WEB attack events.

[0005] The first aspect of the present invention provides a tracing and source tracing method based on WEB dynamic defense, comprising:

[0006] Acquire a data source of a WEB attack event, wherein the data source includes network attack threat data and clue data of the network attack event;

[0007] Querying the associated feature vector of the data source based on a network attack knowledge graph, wherein the network attack knowledge graph is a knowledge base constructed based on existing network attack methods;

[0008] Matching the corresponding tracing strategy in the network attack knowledge graph through the associated feature vector;

[0009] The attacker and attack organization of the WEB attack event are determined according to the tracing strategy.

[0010] Optionally, the querying of the associated feature vector of the data source based on the network attack knowledge graph is a knowledge base constructed according to existing network attack means, including:

[0011] Analyze the attack type of the data source in the network attack knowledge graph based on the network attack knowledge graph, where the network attack knowledge graph is a knowledge base constructed based on existing network attack methods;

[0012] Extracting associated feature vectors of the attack type from the network attack knowledge graph.

[0013] Optionally, before querying the associated feature vector of the data source based on the network attack knowledge graph, the method further includes:

[0014] Determine whether the data source is a newly added attack type in the network attack knowledge graph;

[0015] If not, execute the query operation;

[0016] If so, the network attack knowledge graph is updated after customizing the attack type to which the data source belongs.

[0017] Optionally, the attack type is a network security field type customized according to the normal operation of the WEB business system.

[0018] Optionally, matching the corresponding tracing strategy in the network attack knowledge graph by using the associated feature vector includes:

[0019] Calculating the feature correlation of the associated feature vector using a correlation coefficient calculation method;

[0020] The corresponding tracing strategy in the network attack knowledge graph is matched according to the feature correlation calculation result.

[0021] Optionally, the correlation calculation method includes cosine similarity, Pearson correlation and Jaccard similarity method.

[0022] A second aspect of the present invention provides a tracing and source tracking device based on WEB dynamic defense, comprising:

[0023] An acquisition unit, used to acquire a data source of a WEB attack event, wherein the data source includes network attack threat data and clue data of the network attack event;

[0024] A query unit, configured to query the associated feature vector of the data source based on a network attack knowledge graph, wherein the network attack knowledge graph is a knowledge base constructed based on existing network attack means;

[0025] A matching unit, configured to match a corresponding tracing strategy in the network attack knowledge graph through the associated feature vector;

[0026] A determination unit is used to determine the attacker and attack organization of the WEB attack event according to the tracing strategy.

[0027] Optionally, the query unit includes:

[0028] An analysis module, configured to analyze the attack type of the data source in the network attack knowledge graph based on the network attack knowledge graph, wherein the network attack knowledge graph is a knowledge base constructed based on existing network attack means;

[0029] The extraction module is used to extract the associated feature vector of the attack type from the network attack knowledge graph.

[0030] Optionally, before the query unit, the device further includes:

[0031] A judging unit, used to judge whether the data source is a newly added attack type in the network attack knowledge graph;

[0032] If not, execute the query operation;

[0033] If so, the network attack knowledge graph is updated after customizing the attack type to which the data source belongs.

[0034] Optionally, the matching unit includes:

[0035] A calculation module, used for calculating the feature correlation of the associated feature vector using a correlation coefficient calculation method;

[0036] A matching module is used to match the corresponding tracing strategy in the network attack knowledge graph according to the feature correlation calculation result.

[0037] The third aspect of the present invention provides a tracing and source tracking device based on WEB dynamic defense, comprising:

[0038] Processor, memory, input and output unit, bus;

[0039] The processor is connected to the memory, the input and output unit, and the bus;

[0040] The processor specifically performs the following operations:

[0041] Acquire a data source of a WEB attack event, wherein the data source includes network attack threat data and clue data of the network attack event;

[0042] Querying the associated feature vector of the data source based on a network attack knowledge graph, wherein the network attack knowledge graph is a knowledge base constructed based on existing network attack methods;

[0043] Matching the corresponding tracing strategy in the network attack knowledge graph through the associated feature vector;

[0044] The attacker and attack organization of the WEB attack event are determined according to the tracing strategy.

[0045] A fourth aspect of the present invention provides a computer-readable storage medium for tracing and tracing based on WEB dynamic defense, including:

[0046] The computer-readable storage medium stores a program, and the program executes the aforementioned WEB dynamic defense-based tracing method on a computer.

[0047] It can be seen from the above technical scheme that the present application has the following advantages: In the present application, network attack tracing requires security experts to first collect the data sources left over from the attack activities, and the data sources include threat intelligence data and clue data. After obtaining the data sources, the system queries the associated feature vectors of the data sources based on the network attack knowledge graph, wherein the network attack knowledge graph is constructed based on the existing network attack means to obtain the knowledge base, and then matches the corresponding tracing strategy through the associated feature vector, and finally determines the attacker and attack organization of the WEB attack event according to the tracing strategy. The present invention analyzes the attack type and correlation of the WEB attack event from different dimensions based on the network attack knowledge graph, and effectively identifies the attacker's attack path, attack means and IP address in an active tracing manner, while improving the tracing accuracy of the WEB attack event. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of an embodiment of a tracing and tracing method based on WEB dynamic defense in the present invention;

[0049] Figure 2 It is a flowchart of another embodiment of the tracing and tracing method based on WEB dynamic defense in the present invention;

[0050] Figure 3 It is the network attack knowledge graph based on WEB dynamic defense in the present invention;

[0051] Figure 4 This is a schematic diagram of the structure of an embodiment of a tracking and tracing device based on WEB dynamic defense in the present invention;

[0052] Figure 5 It is a schematic diagram of the structure of another embodiment of the tracking and tracing device based on WEB dynamic defense in the present invention. DETAILED DESCRIPTION

[0053] The embodiments of the present application provide a tracking and tracing method and device based on WEB dynamic defense, which are used to improve the accuracy of tracing the source of WEB attack events.

[0054] The method in the embodiments of the present application is applied to computing devices such as computers and servers, which is not limited to this, and can also be run on smart devices such as smart phones and tablet computers, which is not limited to this.

[0055] This embodiment uses the system as an example for illustration. Figures 1 to 3 In the embodiment of the present application, an embodiment of the tracing and tracing method based on WEB dynamic defense includes:

[0056] 101. The system obtains the data source of the WEB attack event, which includes threat intelligence data and clue data;

[0057] In this embodiment, during the data source stage of obtaining WEB attack events, the system mainly obtains two types of data: network security threat intelligence data and clue data of network attack events. Network security threat events and network attack events can be understood as information security events generated through the network that pose a threat or potential harm to the information system in electronic devices.

[0058] Cybersecurity threat intelligence data mainly refers to threat intelligence related to attackers collected from social networking sites such as Facebook / Twitter, threat intelligence sources such as OpenCTI / AlienVault / Weibu / VirusTotal, and organizations such as Mitre. The relevant threat intelligence can reveal the corresponding attackers, attacker motives, attack tools, infrastructure, attack methods, and attack patterns. In addition, cybersecurity threat intelligence data also includes threat intelligence related to historical network attack incidents, such as the attack targets, attackers, the geopolitical relationship between the attack targets and the regions to which the attackers belong, malicious IP addresses, malicious domain names, malicious email addresses, attack tools, vulnerabilities exploited by attack tools, and attack methods.

[0059] Network attack event clue data mainly refers to the attack tool fingerprints, attack IP, attack domain names and other clue data used by attackers extracted from the traffic data, alarm logs, host logs, configuration and other data sources of the network attack target by means of malicious code analysis, digital forensics and network forensics investigation. It also includes the CPE data of the host that the system may need to collect to expand the relevant data sources.

[0060] 102. Query the associated feature vector of the data source based on the network attack knowledge graph system, where the network attack knowledge graph is a knowledge base constructed based on existing network attack methods;

[0061] In this embodiment, the network attack knowledge graph is a knowledge base constructed based on existing network attack methods. Figure 3As shown in the above, the attack methods include DDoS attack, account and password acquisition attack, SQL injection, malicious applets, Trojan horse implantation, APT attack, etc. In addition, after collecting the existing attack methods, they need to be integrated and associated as a whole to form a complete attack knowledge base.

[0062] Specifically, after obtaining the data source, further data preprocessing is required, such as data cleaning and standardization. After data processing, some information features of the data source are extracted as vectors, such as attacker regional features, attack tool features, vulnerability features, and phishing email features. Then, the associated feature vectors of the data source can be queried through the ontology and rule reasoning technology of the knowledge graph. For example, if the staff finds that the server has been invaded, they can collect clue data after the invasion and extract feature vectors, and then query the constructed network attack graph to determine the vectors associated with the feature vectors involved in the attack event. For example, if the attack belongs to SQL injection, the system takes the host as the starting point and finds other types of feature vectors associated with SQL injection along the association relationships of different dimensions.

[0063] 103. The system matches the corresponding tracing strategy in the network attack knowledge graph by associating feature vectors;

[0064] After querying the associated feature vector of the data source, the system matches the corresponding tracing strategy from the attack knowledge graph, where the tracing strategy is a pre-built strategy based on various network attack methods. For example, when the staff finds that the server has been hacked, they query the network security knowledge graph to find the software used by the server, that is, the host asset that has been attacked. Then, starting from the host asset, they query the associated feature vector and the association relationship with it in different dimensions, find one or more tracing strategies in the graph, and finally execute these tracing strategies to obtain the backtracking results; if a vulnerability is found during the investigation and analysis process, and it is suspected that the attacker has used the vulnerability to launch an attack, the vulnerability is queried to find the host assets and attack threats associated with the vulnerability. Here, the host assets and attack threats refer to the associated feature vectors, and the correlation between the vulnerability and the associated feature vectors is calculated to obtain one or more tracing strategies, and finally these strategies are executed to find the attacker or attack organization.

[0065] 104. The system determines the attacker and attack organization of the WEB attack event based on the tracing strategy.

[0066] In this embodiment, the tracing strategy is to use a third-party attack to directly trace the attack, that is, to use an added attribute that records the method of using the tool. When executing the tool tracing strategy, it will rely on a certain trace or path. Therefore, it is necessary to query the knowledge graph to obtain the traces and locations that the strategy depends on and other feature vectors associated with it, and then deploy the correlation of these vectors. Finally, the tracing strategy uses these correlations to trace the attack, so as to find the attacker or attack organization.

[0067] See also Figure 2 Another embodiment of the tracing and tracing method based on WEB dynamic defense in the embodiment of the present application includes:

[0068] 201. The system obtains the data source of the WEB attack event, which includes threat intelligence data and clue data;

[0069] Step 201 in this embodiment is similar to step 101 in the aforementioned embodiment and will not be described in detail here.

[0070] 202. The system determines whether the data source is a newly added attack type in the network attack knowledge graph;

[0071] In this embodiment, the network attack knowledge graph is constructed based on existing attack methods. Figure 3 After the system obtains the knowledge contained in the attack means, it integrates and processes the knowledge, constructs an ontology, and forms a knowledge graph. Subsequently, knowledge reasoning technology can be used to discover potential knowledge or relationships. The knowledge graph needs to be quality evaluated and periodically updated during use. Therefore, before querying the network attack knowledge graph, it is necessary to determine whether it is a new attack type. The attack type is a customized network security field type based on the normal operation of the WEB business system.

[0072] 203. When the data source is a newly added attack type in the network attack knowledge graph, the system customizes the attack type to which the data source belongs and updates the network attack knowledge graph;

[0073] In this embodiment, when no relevant information about the data source can be found in the graph, it can be determined as a newly added attack type that does not exist in the network attack knowledge graph, and the system automatically updates the data source information to the knowledge graph.

[0074] 204. When the data source is not a newly added attack type in the network attack knowledge graph, the system analyzes the attack type of the data source in the network attack knowledge graph based on the network attack knowledge graph, and the network attack knowledge graph is a knowledge base constructed based on existing network attack methods;

[0075] In this embodiment, the attack types include host dimension, vulnerability dimension, attack threat dimension, attack trace dimension and attacker region dimension, etc. The system analyzes the attack types of the data source in the network attack knowledge graph based on the network attack knowledge graph. For example, the attacker region information mainly refers to the path of traces or evidence left by the network attack after the network attack occurs, including the path where viruses or Trojans may appear. The most important source of data is log information, including the location of system log files and the location information of each application. That is, thinking about it in reverse, when the system obtains the location of log files and the location information of each application in the log information included in the data source, it can be analyzed that the data source belongs to the attack type of the attacker region dimension, and other feature vectors associated with the region are associated based on the knowledge graph.

[0076] 205. The system extracts the associated feature vector of the attack type from the network attack knowledge graph;

[0077] After determining the attack type of the data source, the system extracts the associated feature vector from the network attack knowledge graph. For example, each network attack may leave traces of the attack, so the attack threat dimension and the trace dimension are associated. For another example, the trace exists in a certain location of the system, so the attack threat dimension can be associated with the attacker area dimension.

[0078] 206. The system calculates the feature correlation of the associated feature vector using a correlation coefficient calculation method;

[0079] After the system extracts relevant features, it uses the correlation coefficient to calculate the correlation of the attack types of these organizations. The correlation calculation can be performed pairwise using methods such as cosine similarity, Pearson correlation, and Jaccard correlation to obtain the degree of similarity between them, and thus obtain one or more corresponding tracing strategies.

[0080] 207. The system matches the corresponding tracing strategy in the network attack knowledge graph based on the feature correlation calculation results;

[0081] Finally, the system matches the corresponding traceability strategy according to the correlation calculation structure, wherein the matching process is similar to the aforementioned step 103 and will not be described in detail here.

[0082] 208. The system determines the attacker and attack organization of the WEB attack event based on the tracing strategy.

[0083] Step 208 in this embodiment is similar to step 104 in the above embodiment and will not be described in detail here.

[0084] See also Figure 4 In the embodiment of the present application, an embodiment of the device for tracing and tracing based on WEB dynamic defense includes:

[0085] An acquisition unit 401 is used to acquire a data source of a WEB attack event, where the data source includes network attack threat data and clue data of the network attack event;

[0086] A judgment unit 402 is used to judge whether the data source is a newly added attack type in the network attack knowledge graph;

[0087] An updating unit 403 is used to update the network attack knowledge graph after customizing the attack type to which the data source belongs when the data source is a newly added attack type in the network attack knowledge graph;

[0088] A query unit 404 is used to query the associated feature vector of the data source based on the network attack knowledge graph when the data source is not a newly added attack type in the network attack knowledge graph, and the network attack knowledge graph is a knowledge base constructed according to existing network attack means;

[0089] A matching unit 405 is used to match the corresponding tracing strategy in the network attack knowledge graph through the associated feature vector;

[0090] The determination unit 406 is used to determine the attacker and the attacking organization of the WEB attack event according to the tracing strategy.

[0091] In this embodiment, the query unit 404 includes an analysis module 4041 and an extraction module 4042 .

[0092] An analysis module 4041 is used to analyze the attack type of the data source in the network attack knowledge graph based on the network attack knowledge graph, where the network attack knowledge graph is a knowledge base constructed based on existing network attack methods;

[0093] The extraction module 4042 is used to extract the associated feature vector of the attack type from the network attack knowledge graph.

[0094] In this embodiment, the matching unit 405 includes a calculation module 4051 and a matching module 4052 .

[0095] A calculation module 4051 is used to calculate the feature correlation of the associated feature vector using a correlation coefficient calculation method;

[0096] The matching module 4052 is used to match the corresponding tracing strategy according to the feature correlation calculation result.

[0097] In this embodiment, the system obtains the data source of the WEB attack event through the acquisition unit 401, where the data source includes network attack threat data and clue data of the network attack event; before querying the relevant feature vector of the data source, the judgment unit 402 judges whether the data source is a newly added attack type in the network attack knowledge graph, where the network attack knowledge graph is a knowledge base constructed according to existing network attack means. If so, the knowledge graph is updated; if not, the analysis module 4041 in the query unit 403 analyzes the attack type of the data source in the network attack knowledge graph based on the network attack knowledge graph, and the extraction module 4042 extracts the associated feature vector of the attack type from the network attack knowledge graph. The calculation module 3051 in the matching unit 405 calculates the feature correlation of the associated feature vector using the correlation coefficient calculation method, and the matching module 4052 matches the corresponding tracing strategy according to the feature correlation calculation result. Finally, the determination unit 406 determines the attacker and attack organization of the WEB attack event according to the tracing strategy. The present invention analyzes the attack types and correlations of WEB attack events from different dimensions based on the network attack knowledge graph, effectively identifies the attacker's relevant information in an active tracing manner, cracks the hacker's hidden information during the attack process, and effectively improves the tracing accuracy.

[0098] See also Figure 5 Another embodiment of the device for tracing and tracing based on WEB dynamic defense in the embodiment of the present application includes:

[0099] Processor 501, memory 502, input and output unit 503, bus 504;

[0100] The processor 501 is connected to the memory 502, the input and output unit 503 and the bus 504;

[0101] The processor 501 performs the following operations:

[0102] Obtain the data source of WEB attack events, including network attack threat data and clue data of network attack events;

[0103] Query the associated feature vectors of the data source based on the network attack knowledge graph, where the network attack knowledge graph is a knowledge base constructed based on existing network attack methods;

[0104] Match the corresponding tracing strategy in the network attack knowledge graph by associating feature vectors;

[0105] Determine the attacker and attack organization of the WEB attack incident based on the tracing strategy.

[0106] Optionally, the function of the processor 501 is the same as that of the aforementioned Figure 1 to Figure 2 The steps in the illustrated embodiments correspond to each other and are not described in detail here.

[0107] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0108] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0109] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0110] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0111] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A tracing method based on WEB dynamic defense, characterized in that: include: Acquire a data source of a WEB attack event, wherein the data source includes network attack threat data and clue data of the network attack event; Querying the associated feature vector of the data source based on a network attack knowledge graph, wherein the network attack knowledge graph is a knowledge base constructed based on existing network attack methods; Matching the corresponding tracing strategy in the network attack knowledge graph through the associated feature vector; Determine the attacker and attack organization of the WEB attack event according to the tracing strategy; The associated feature vector of the data source is queried based on the network attack knowledge graph, wherein the network attack knowledge graph is a knowledge base constructed according to existing network attack means, including: Analyze the attack type of the data source in the network attack knowledge graph based on the network attack knowledge graph, where the network attack knowledge graph is a knowledge base constructed based on existing network attack methods; Extracting the associated feature vector of the attack type from the network attack knowledge graph; The matching of the corresponding tracing strategy in the network attack knowledge graph by the associated feature vector includes: Calculating the feature correlation of the associated feature vector using a correlation coefficient calculation method; The corresponding tracing strategy in the network attack knowledge graph is matched according to the feature correlation calculation result.

2. The method according to claim 1, characterized in that Before querying the associated feature vector of the data source based on the network attack knowledge graph, the method further includes: Determine whether the data source is a newly added attack type in the network attack knowledge graph; If not, execute the query operation; If so, the network attack knowledge graph is updated after customizing the attack type to which the data source belongs.

3. The method according to any one of claims 1 to 2, characterized in that The attack type is a network security field type that is customized according to the normal operation of the WEB business system.

4. The method according to claim 1, characterized in that The correlation coefficient calculation method includes cosine similarity, Pearson correlation and Jaccard similarity method.

5. A tracing and source tracking device based on WEB dynamic defense, characterized in that: include: An acquisition unit, used to acquire a data source of a WEB attack event, wherein the data source includes network attack threat data and clue data of the network attack event; A query unit, configured to query the associated feature vector of the data source based on a network attack knowledge graph, wherein the network attack knowledge graph is a knowledge base constructed based on existing network attack means; A matching unit, configured to match a corresponding tracing strategy in the network attack knowledge graph through the associated feature vector; A determination unit, configured to determine the attacker and the attacking organization of the WEB attack event according to the tracing strategy; The query unit comprises: An analysis module, configured to analyze the attack type of the data source in the network attack knowledge graph based on the network attack knowledge graph, wherein the network attack knowledge graph is a knowledge base constructed based on existing network attack means; An extraction module, used to extract the associated feature vector of the attack type from the network attack knowledge graph; The matching unit comprises: A calculation module, used for calculating the feature correlation of the associated feature vector using a correlation coefficient calculation method; A matching module is used to match the corresponding tracing strategy in the network attack knowledge graph according to the feature correlation calculation result.

6. The device according to claim 5, characterized in that Before the query unit, the device further includes: A judging unit, used to judge whether the data source is a newly added attack type in the network attack knowledge graph; If not, execute the query operation; If so, the network attack knowledge graph is updated after customizing the attack type to which the data source belongs.

Images