Network security risk sensing method and device and computer equipment

Abstract

The invention provides a network security sensing method and device and computer equipment. The method comprises the following steps: collecting log events of security equipment; analyzing the collected log events of the security devices according to different preset analysis rules to form security events; matching the security events of the security devices with a preset attack sequence model through an event sequence algorithm, and forming a security event chain according to event sequences of the security events; judging whether the similarity of the security event chain reaches a preset similarity threshold value or not; and if the similarity of the security event chain reaches a preset similarity threshold, judging that an abnormal behavior occurs, and sending a security alarm to the user. The method has the beneficial effects that the network security state can be monitored and managed more efficiently, and various security threats can be found and dealt with in time, so that the efficiency and level of network security management are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security risk perception method, device and computer equipment. Background Art

[0002] In the current network security field, enterprises are facing a variety of network security threats from both inside and outside, which may include malware, network intrusion, data leakage, identity theft, etc. In order to protect network assets and information security, enterprises usually use various security management tools and data sources, such as firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), security information and event management systems (SIEM), etc. However, these tools and data sources often have the following problems:

[0003] Dispersed security management tools and data sources: Enterprises may use multiple security tools and data sources at the same time, such as firewalls, IDS / IPS from different manufacturers. These tools and data sources may be independent systems, making it difficult to achieve comprehensive information aggregation and unified management.

[0004] Lack of an overall unified management platform: Due to the dispersion of security tools and data sources, enterprises lack an overall unified management platform and are unable to achieve comprehensive perception and unified control of network security situations.

[0005] Untimely information processing: Existing security management tools and data sources often have the problem of untimely information processing, which makes it impossible for enterprises to detect network security incidents and threats in a timely manner.

[0006] Insufficient intelligent analysis capabilities: Current security management tools often lack intelligent analysis capabilities and are unable to effectively analyze massive security events and logs, resulting in delayed and inaccurate security decisions. Summary of the invention

[0007] The technical problem to be solved by the present invention is to provide a network security risk perception method, device and computer equipment.

[0008] In order to solve the above technical problems, the technical solution adopted by the present invention is: a network security perception method, comprising:

[0009] Collect network security data from each security device;

[0010] Analyze the network security data collected from each security device according to different preset analysis rules to form security events;

[0011] The network security data of each security device is matched with the preset attack sequence model through the event sequence algorithm, and a security event chain is formed according to the event sequence of the security event;

[0012] Determine whether the similarity of the security event chain reaches a preset similarity threshold;

[0013] If the similarity of the security event chain reaches the preset similarity threshold, it is judged that abnormal behavior has occurred and a security alert is sent to the user.

[0014] Furthermore, the network security data includes: network traffic, device status and log events.

[0015] Furthermore, log events collected from various security devices include:

[0016] Collect log events from firewalls, intrusion detection systems, intrusion prevention systems, terminal security management systems, log management systems, traffic auditing systems, and vulnerability scanning systems.

[0017] Furthermore, the network security data collected from each security device is analyzed according to different preset analysis rules to form security events, including:

[0018] Perform keyword recognition on the collected network security data of each security device, and match the security device corresponding to each keyword;

[0019] Perform rule screening and matching based on the identified keywords to filter out the analysis rules of security devices that match the keywords;

[0020] The network security data containing the keyword is analyzed by using the analysis rule of the security device matching the keyword to generate a security event of the security device.

[0021] Furthermore, the network security data of each security device is matched with a preset attack sequence model through an event sequence algorithm, and a security event chain is formed according to the event sequence of the security event, specifically including:

[0022] The network security data of each security device corresponding to each stage is matched with the attack sequence model preset in the model library through the event sequence algorithm;

[0023] If the number of stages of the network security data of the security device matches the number of stages of the attack sequence model, the network security data of each stage of the security device is combined into a security event chain according to the event sequence of the security event.

[0024] Further, it is determined whether the similarity of the security event chain reaches a preset similarity threshold, specifically including:

[0025] Determine whether the matching degree between the network security data of the security device corresponding to each stage in the security event chain and each sequence of the attack sequence model reaches a preset similarity threshold.

[0026] Furthermore, if the similarity of the security event chain reaches a preset similarity threshold, it is determined that an abnormal behavior has occurred and a security alert is sent to the user, specifically including:

[0027] Send security alerts to users via DingTalk, email, enterprise WeChat, system notifications, and http notifications.

[0028] The present invention also provides a network security perception device, comprising:

[0029] A data collection module, used to collect network security data of various security devices;

[0030] The data analysis module is used to analyze the network security data collected from each security device according to different preset analysis rules to form security events;

[0031] The model matching module is used to match the network security data of each security device with a preset attack sequence model through an event sequence algorithm, and form a security event chain according to the event sequence of the security event;

[0032] A threshold judgment module is used to judge whether the similarity of the security event chain reaches a preset similarity threshold;

[0033] The alarm sending module is used to determine that abnormal behavior has occurred and send a security alarm to the user if the similarity of the security event chain reaches a preset similarity threshold.

[0034] The beneficial effects of the present invention are: it can more efficiently monitor and manage the network security status, timely discover and respond to various security threats, thereby improving the efficiency and level of network security management; it can reduce the workload of enterprise security managers and reduce the complexity of management; it can help enterprises enhance their perception and prevention capabilities of network security threats, effectively reduce network security risks, and ensure enterprise information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The specific structure of the present invention is described in detail below in conjunction with the accompanying drawings.

[0036] Figure 1 A flowchart of a network security perception method according to an embodiment of the present invention;

[0037] Figure 2 A block diagram of a network security perception device according to an embodiment of the present invention;

[0038] Figure 3 A system architecture diagram of a network risk perception system and a management and control platform according to an embodiment of the present invention;

[0039] Figure 4 A network topology diagram of a network risk perception system and a management and control platform according to an embodiment of the present invention;

[0040] Figure 5 A schematic block diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0043] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0044] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0045] See also Figure 1 In the specific embodiment shown, the present invention discloses a network security perception method, comprising:

[0046] S10, collecting network security data of each security device;

[0047] S20, analyzing the collected network security data of each security device according to different preset analysis rules to form a security event;

[0048] S30, matching the network security data of each security device with a preset attack sequence model through an event sequence algorithm, and forming a security event chain according to the event sequence of the security event;

[0049] S40, determining whether the similarity of the security event chain reaches a preset similarity threshold;

[0050] S50: If the similarity of the security event chain reaches a preset similarity threshold, it is determined that an abnormal behavior has occurred, and a security alert is sent to the user.

[0051] In this embodiment, the network security status can be monitored and managed more efficiently, and various security threats can be discovered and responded to in a timely manner, thereby improving the efficiency and level of network security management; it can reduce the workload of enterprise security managers and reduce the complexity of management; it can help enterprises enhance their perception and prevention capabilities of network security threats, effectively reduce network security risks, and ensure enterprise information security.

[0052] The network security data includes: network traffic, device status and log events.

[0053] Collecting log events of various security devices includes collecting log events of firewalls, intrusion detection systems, intrusion prevention systems, terminal security management systems, log management systems, traffic audit systems, and vulnerability scanning systems. Figure 3 The following is a system architecture diagram of the network risk perception system and management and control platform; Figure 4 As shown in the figure, the network topology diagram of the network risk perception system and the management and control platform.

[0054] In a specific embodiment, step S20, analyzing the collected network security data of each security device according to different preset analysis rules to form a security event specifically includes:

[0055] S21, performing keyword recognition on the collected network security data of each security device, and matching the security device corresponding to each keyword;

[0056] S22, performing rule screening and matching according to the identified keywords, and screening out analysis rules of security devices that match the keywords;

[0057] S23. Analyze the network security data containing the keyword using the analysis rule of the security device that matches the keyword, and generate a security event for the security device.

[0058] In this embodiment, different rules are formulated for each different security device, and the keywords of the reported events of each security device are different, for example, different security devices are distinguished by plug-in IDs, and different security events are distinguished by different sub-IDs. Security events include illegal external connections and port scanning.

[0059] In a specific embodiment, step S30, matching the network security data of each security device with a preset attack sequence model through an event sequence algorithm, and forming a security event chain according to the event sequence of the security event specifically includes:

[0060] S31, matching the network security data of each security device corresponding to each stage with the attack sequence model preset in the model library through the event sequence algorithm;

[0061] S32. If the number of stages of the network security data of the security device matches the number of stages of the attack sequence model, the network security data of each stage of the security device is combined into a security event chain according to the event sequence of the security event.

[0062] In this embodiment, the security event chain is divided into different stages, for example: attacker -> weak password cracking -> successful cracking and dropping of Trojan horse -> obtaining server permissions.

[0063] In a specific embodiment, step S40, determining whether the similarity of the security event chain reaches a preset similarity threshold, specifically includes:

[0064] Determine whether the matching degree between the network security data of the security device corresponding to each stage in the security event chain and each sequence of the attack sequence model reaches a preset similarity threshold.

[0065] For example, take this security event chain as an example: attacker -> weak password cracking -> successful cracking and Trojan horse delivery -> obtaining server permissions; the set threshold is above 60%; if the attack sequence model matching (weak password cracking -> successful cracking and Trojan horse delivery) is matched, the matching degree is 70%; the three stages are matched and the matching degree of two of them is 66% (2 / 3); then the similarity threshold requirement is met.

[0066] Among them, step S50, if the similarity of the security event chain reaches a preset similarity threshold, it is determined that abnormal behavior has occurred and a security alert is sent to the user, specifically including:

[0067] Send security alerts to users via DingTalk, email, enterprise WeChat, system notifications, and http notifications.

[0068] The core of the above implementation scheme is to build a unified security risk perception and control platform to meet the challenges faced by enterprise network security management. By building a unified security risk perception and control platform, comprehensive perception and unified control of enterprise network security conditions can be achieved, providing enterprises with highly visualized and intelligent security decision-making support, and effectively responding to complex and changing network security challenges.

[0069] The technical effects of the above embodiments are:

[0070] Real-time monitoring of network security status: The platform will have the ability to monitor network security status in real time, and can continuously monitor network traffic, device status, log events, etc. through security log events. By real-time monitoring of network security events and matching attack sequence models, abnormal behaviors and security threats in the network can be discovered in a timely manner, providing timely information support for security decision-making.

[0071] Highly visualized and intelligent: In order to improve user experience and decision-making efficiency, the platform will be highly visualized and intelligent. Users can understand the network security status and risk status in real time through intuitive charts, reports and dashboards. At the same time, the platform will use intelligent analysis technology to match network security events and attack sequence models to discover hidden threats and abnormal behaviors. Based on these analysis results, the platform will also provide intelligent security decision support and provide users with targeted security recommendations and response strategies, such as certain vulnerabilities that require patching the operating system and upgrading the corresponding software version.

[0072] Comprehensive security decision support: The platform will provide users with comprehensive security decision support. In addition to real-time monitoring and the intelligent analysis functions mentioned above, the platform will also provide risk assessment, security situation analysis, incident response and other functions to help users formulate and implement comprehensive security strategies and countermeasures.

[0073] like Figure 2 As shown, the present invention also provides a network security perception device, comprising:

[0074] A data collection module 10 is used to collect network security data of each security device;

[0075] The data analysis module 20 is used to analyze the network security data collected from each security device according to different preset analysis rules to form security events;

[0076] The model matching module 30 is used to match the network security data of each security device with a preset attack sequence model through an event sequence algorithm, and form a security event chain according to the event sequence of the security event;

[0077] A threshold determination module 40 is used to determine whether the similarity of the security event chain reaches a preset similarity threshold;

[0078] The alarm sending module 50 is used to determine that abnormal behavior has occurred and send a security alarm to the user if the similarity of the security event chain reaches a preset similarity threshold.

[0079] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned network security perception device can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and brevity of description, it will not be repeated here.

[0080] The network security perception device can be implemented in the form of a computer program. Figure 5 Runs on the computer device shown.

[0081] See also Figure 5 , Figure 5 5 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 may be a terminal or a server, wherein the terminal may be an electronic device with communication functions such as a smart phone, a tablet computer, a laptop computer, a desktop computer, a personal digital assistant, and a wearable device. The server may be an independent server or a server cluster composed of multiple servers.

[0082] See also Figure 5 The computer device 500 includes a processor 502 , a memory and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0083] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, and when the program instructions are executed, the processor 502 can execute a data encryption method based on an encryption algorithm.

[0084] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

[0085] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a network security awareness method.

[0086] The network interface 505 is used to communicate with other devices over the network. Figure 5 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0087] The processor 502 is used to run a computer program 5032 stored in a memory to implement the network security awareness method as described above.

[0088] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0089] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiment of the above method.

[0090] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the network security perception method as described above.

[0091] The storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, or any other computer-readable storage medium that can store program codes.

[0092] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0093] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0094] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the device of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0095] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0096] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network security perception method, characterized in that: include: Collect network security data from each security device; Analyze the network security data collected from each security device according to different preset analysis rules to form security events; The network security data of each security device is matched with the preset attack sequence model through the event sequence algorithm, and a security event chain is formed according to the event sequence of the security event; Determine whether the similarity of the security event chain reaches a preset similarity threshold; If the similarity of the security event chain reaches the preset similarity threshold, it is judged that abnormal behavior has occurred and a security alert is sent to the user.

2. The network security perception method according to claim 1, characterized in that: The network security data includes: network traffic, device status and log events.

3. The network security perception method according to claim 2, characterized in that: The log events collected from various security devices include: Collect log events from firewalls, intrusion detection systems, intrusion prevention systems, terminal security management systems, log management systems, traffic auditing systems, and vulnerability scanning systems.

4. The network security perception method according to claim 1, characterized in that: The network security data collected from each security device is analyzed according to different preset analysis rules to form security events, including: Perform keyword recognition on the collected network security data of each security device, and match the security device corresponding to each keyword; Perform rule screening and matching based on the identified keywords to filter out the analysis rules of security devices that match the keywords; The network security data containing the keyword is analyzed by using the analysis rule of the security device matching the keyword to generate a security event of the security device.

5. The network security perception method according to claim 1, characterized in that: The network security data of each security device is matched with the preset attack sequence model through the event sequence algorithm, and a security event chain is formed according to the event sequence of the security event, including: The network security data of each security device corresponding to each stage is matched with the attack sequence model preset in the model library through the event sequence algorithm; If the number of stages of the network security data of the security device matches the number of stages of the attack sequence model, the network security data of each stage of the security device is combined into a security event chain according to the event sequence of the security event.

6. The network security perception method according to claim 1, characterized in that: Determine whether the similarity of the security event chain reaches the preset similarity threshold, including: Determine whether the matching degree between the network security data of the security device corresponding to each stage in the security event chain and each sequence of the attack sequence model reaches a preset similarity threshold.

7. The network security perception method according to claim 1, characterized in that: If the similarity of the security event chain reaches the preset similarity threshold, it is judged that abnormal behavior has occurred and a security alert is sent to the user, including: Send security alerts to users via DingTalk, email, enterprise WeChat, system notifications, and http notifications.

8. A network security perception device, characterized in that: include: A data collection module, used to collect network security data of various security devices; The data analysis module is used to analyze the network security data collected from each security device according to different preset analysis rules to form security events; The model matching module is used to match the network security data of each security device with a preset attack sequence model through an event sequence algorithm, and form a security event chain according to the event sequence of the security event; A threshold judgment module is used to judge whether the similarity of the security event chain reaches a preset similarity threshold; The alarm sending module is used to determine that abnormal behavior has occurred and send a security alarm to the user if the similarity of the security event chain reaches a preset similarity threshold.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the network security perception method according to any one of claims 1 to 7 when executing the computer program.

10. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the network security perception method as described in any one of claims 1 to 7 can be implemented.

Images