XDR network end relation dynamic acquisition method, apparatus and device, and storage medium

Abstract

The invention discloses an XDR network end relation dynamic acquisition method, device and equipment and a storage medium. The method comprises the following steps: constructing an association relation table in a database; and judging the network hierarchical relationship between the EDR equipment and the NDR equipment, namely comparing whether the quintuple information of the EDR equipment and the quintuple information of the NDR equipment are consistent, if so, judging that the EDR equipment and the NDR equipment are the same equipment and recording the network hierarchical relationship in the association relationship table, and if not, judging that the EDR equipment and the NDR equipment are the same equipment and recording the network hierarchical relationship in the association relationship table. If so, comparing whether the tetrad information of the EDR equipment and the tetrad information of the NDR equipment are consistent, and if so, judging that the EDR equipment and the NDR equipment are the same equipment and recording the network hierarchical relationship in the association relationship table; and merging the equipment data of the EDR equipment and the NDR equipment based on the association relation table. According to the method, manual intervention is effectively reduced, and the equipment association efficiency is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer information security, and in particular to a method, device, equipment and storage medium for dynamically acquiring a network-end relationship of an XDR. Background Art

[0002] With the continuous development of information technology, the cybersecurity threats faced by enterprises are becoming increasingly complex and diverse. Traditional Security Operations Center (SOC) tools usually rely on a single security data source or control point, such as Endpoint Detection and Response (EDR) or Network Detection and Response (NDR), which makes threat detection and response capabilities appear one-sided and difficult to cope with increasingly complex attack methods. SOC is usually responsible for centralized management and response to various security threats, while EDR and NDR focus on data analysis at the endpoint and network levels respectively. Although they can independently identify and respond to potential threats to a certain extent, they are still limited in their ability to integrate information at different levels.

[0003] To make up for these shortcomings, Extended Detection and Response (XDR) technology came into being. XDR integrates data from multiple security control points, including endpoints, networks, and clouds, to provide comprehensive cross-platform security protection. The goal of XDR is to achieve more efficient and accurate threat detection and automatic response capabilities through comprehensive data integration and intelligent analysis. However, although XDR can integrate security data across domains, how to associate the activities and behaviors of devices at different security control points remains a difficult problem that needs to be solved.

[0004] Most current device association schemes rely on multiple static or dynamic identifiers for association, such as IP addresses, MAC addresses, etc. However, these methods have some significant limitations: first, IP and MAC addresses change with changes in the network environment and can be forged, making the device association process unstable and vulnerable to attacks; second, a single static association identifier cannot fully reflect the dynamic changes in device behavior and activities, and lacks the ability to adapt to complex network environments; finally, due to differences in different network policies and configurations, existing association methods are often not applicable in all scenarios, resulting in certain misjudgments and missed judgments, resulting in low association efficiency. Summary of the invention

[0005] The present invention proposes a method, device, equipment and storage medium for dynamically acquiring network-end relationships of XDR, so as to solve the problem of low efficiency of device association of existing XDR in a complex network environment.

[0006] The present invention achieves the above-mentioned purpose through the following technical solutions: A method for dynamically acquiring a network-side relationship of an XDR, comprising: Constructing an association relationship table in a database, wherein the association relationship table includes a data ID and a network hierarchical relationship, wherein the network hierarchical relationship includes an ID of an EDR device, an IP of an EDR device, an ID of an NDR device, and an IP of an NDR device; Acquire first information, where the first information includes quintuple information and quadruple information of all the EDR devices and NDR devices in the same network deployment architecture, where the quintuple information includes a source IP, a destination IP, a source port, a destination port, and a network transmission protocol, and the quadruple information includes any IP, a source port, a destination port, and a network transmission protocol; Determine the network hierarchical relationship between the EDR device and the NDR device, including comparing whether the five-tuple information of the EDR device and the NDR device is consistent, if they are consistent, determine that the EDR device and the NDR device are the same device and record the network hierarchical relationship in the association relationship table, if they are inconsistent, compare whether the four-tuple information of the EDR device and the NDR device is consistent, if they are consistent, determine that the EDR device and the NDR device are the same device and record the network hierarchical relationship in the association relationship table; Acquire second information, where the second information includes device data of all the EDR devices and the NDR devices in the same network deployment architecture; The device data of the EDR device and the NDR device are merged based on the association relationship table.

[0007] Further, obtaining the first information includes: Receive original five-tuple information and original four-tuple information of EDR devices and NDR devices in the same network deployment architecture; Converting the original five-tuple information and the original four-tuple information into standard five-tuple information and standard four-tuple information respectively; Time mapping and parsing are performed on the standard five-tuple information and the standard four-tuple information to obtain the first information.

[0008] Furthermore, after obtaining the first information and before determining the network hierarchy relationship between the EDR device and the NDR device, it also includes cutting the first information according to a preset time window and storing it in the database, and then determining the network hierarchy relationship between the EDR device and the NDR device within each time window.

[0009] Further, merging the device data of the EDR device and the NDR device based on the association relationship table includes: Identify the device data of all the EDR devices and the NDR devices to obtain third information, where the third information is the ID of the EDR device, the IP of the EDR device, the ID of the NDR device, and the IP of the NDR device corresponding to the device data of the EDR device and the NDR device; Filter out device data of the EDR device and the NDR device belonging to the same device according to the third information and the association relationship table; The device data of the EDR device and the NDR device belonging to the same device are merged.

[0010] The present invention also provides a device for dynamically acquiring a network-end relationship of an XDR, comprising: A construction module, wherein the construction module is used to construct an association relationship table in a database, wherein the association relationship table includes a data ID and a network hierarchical relationship, wherein the network hierarchical relationship includes an ID of an EDR device, an IP of an EDR device, an ID of an NDR device, and an IP of an NDR device; A first acquisition module, the first acquisition module is used to acquire first information, the first information includes five-tuple information and four-tuple information of all the EDR devices and NDR devices in the same network deployment architecture, the five-tuple information includes a source IP, a destination IP, a source port, a destination port and a network transmission protocol, and the four-tuple information includes any IP, a source port, a destination port and a network transmission protocol; A judgment module, the judgment module is used to judge the network hierarchical relationship between the EDR device and the NDR device, including comparing whether the five-tuple information of the EDR device and the NDR device is consistent, if consistent, judging that the EDR device and the NDR device are the same device and recording the network hierarchical relationship in the association relationship table, if inconsistent, comparing whether the four-tuple information of the EDR device and the NDR device is consistent, if consistent, judging that the EDR device and the NDR device are the same device and recording the network hierarchical relationship in the association relationship table; A second acquisition module, the second acquisition module is used to acquire second information, where the second information includes device data of all the EDR devices and the NDR devices in the same network deployment architecture; A merging module is used to merge the device data of the EDR device and the NDR device based on the association relationship table.

[0011] Furthermore, the first acquisition module includes: A receiving module, the receiving module is used to receive original five-tuple information and original four-tuple information of EDR devices and NDR devices in the same network deployment architecture; A conversion module, the conversion module is used to convert the original five-tuple information and the original four-tuple information into standard five-tuple information and standard four-tuple information respectively; A mapping module is used to perform time mapping analysis on the standard five-tuple information and the standard four-tuple information to obtain the first information.

[0012] Furthermore, the merging module includes: An identification module, wherein the identification module is used to identify the device data of all the EDR devices and the NDR devices, and obtain third information, wherein the third information is the ID of the EDR device, the IP of the EDR device, the ID of the NDR device, and the IP of the NDR device corresponding to the device data of the EDR device and the NDR device; A screening module, the screening module is used to screen out device data of the EDR device and the NDR device belonging to the same device according to the third information and the association relationship table; A merging submodule, wherein the merging submodule is used to merge the device data of the EDR device and the NDR device belonging to the same device.

[0013] The present invention also provides a device for dynamically acquiring a network-side relationship of an XDR, comprising: Memory for storing computer programs; A processor is used to implement the steps of the method for dynamically acquiring the network-end relationship of XDR when executing the computer program.

[0014] The present invention also provides a storage medium, which is a readable storage medium. A computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the method for dynamically acquiring the network-end relationship of an XDR are implemented.

[0015] The beneficial effects of the present invention are: The present invention automatically identifies network hierarchical relationships by comparing quintuple and quadruple information, laying the foundation for the association between terminals and network devices. This method does not rely on traditional complex association algorithms, but innovatively identifies the communication relationship between devices by comparing structured information, effectively reducing manual intervention and significantly improving association efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A method flow chart of a method for dynamically acquiring a network-end relationship of an XDR in an embodiment of the present application; Figure 2Schematic diagram of the association relationship table in the embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0018] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0020] In the description of the present invention, it should be understood that the terms "upper", "lower", "inside", "outside", "left", "right", etc. indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings, or are directions or positional relationships in which the product of the invention is usually placed when in use, or are directions or positional relationships commonly understood by those skilled in the art. These directions or positional relationships are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as a limitation on the present invention.

[0021] Furthermore, the terms “first”, “second”, etc. are merely used for distinguishing descriptions and should not be understood as indicating or implying relative importance.

[0022] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms such as "setting" and "connection" should be understood in a broad sense. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0023] In the present invention, the term "XDR" means extended detection and response; "EDR" means terminal detection and response; and "NDR" means network detection and response.

[0024] The specific implementation modes of the present invention are described in detail below in conjunction with the accompanying drawings.

[0025] like Figure 1 As shown, a method for dynamically acquiring a network-side relationship of XDR includes: An association table is constructed in the database, wherein the association table includes data ID and network hierarchical relationship, wherein the network hierarchical relationship includes the ID of the EDR device, the IP of the EDR device, the ID of the NDR device, and the IP of the NDR device; for example, the association table is as follows: Figure 2 As shown. Where id represents the data ID, end-id represents the ID of the EDR device, end-ip represents the IP of the EDR device, net-id represents the ID of the NDR device, and net-ip represents the IP of the NDR device; Data collection: obtaining first information, the first information including five-tuple information and four-tuple information of all the EDR devices and NDR devices in the same network deployment architecture, the five-tuple information including source IP, destination IP, source port, destination port and network transmission protocol, the four-tuple information including any IP, source port, destination port and network transmission protocol; obtaining second information, the second information including device data of all the EDR devices and NDR devices in the same network deployment architecture; The device data includes: security events, security threats, and network anomalies of EDR devices; security events, security threats, and network anomalies of NDR devices.

[0026] Determine the network hierarchical relationship between the EDR device and the NDR device, including comparing whether the five-tuple information of the EDR device and the NDR device is consistent, if they are consistent, determine that the EDR device and the NDR device are the same device and record the network hierarchical relationship in the association relationship table, if they are inconsistent, compare whether the four-tuple information of the EDR device and the NDR device is consistent, if they are consistent, determine that the EDR device and the NDR device are the same device and record the network hierarchical relationship in the association relationship table; If the quintuple of the terminal device is exactly the same as that of the network device, this indicates that the terminal device communicates directly with the network device using the original IP address without passing through an intermediate device or proxy server. In this case, the terminal device and the network device can be defined as the same device.

[0027] The XDR system analyzes the four-tuple information of the terminal device and the network device. The four-tuple includes any IP (source IP or destination IP), source port, destination port, and network transmission protocol. In this case, although the five-tuples of the terminal device and the network device are not completely consistent, if their four-tuple information is consistent, it also indicates that the EDR device and the NDR device are the same device. Different source IPs indicate that the device source IP recorded by the network device is the IP address of the upper-layer routing device of the network where the terminal device is located. There may be some network-level forwarding or proxying. The communication between the terminal device and the network device does not occur directly, but passes through some intermediate-layer devices or proxies. Different destination IPs mean that the terminal device is accessing the IP address of the lower-layer routing device instead of directly accessing the destination IP address, which involves network-level routing forwarding or proxy services at the destination.

[0028] The device data of the EDR device and the NDR device are merged based on the association relationship table.

[0029] The network deployment architecture described therein is a cloud deployment architecture.

[0030] The present invention improves data analysis efficiency by analyzing the merged data of the association relationship table, thereby quickly analyzing potential security threats and network anomalies, thereby improving the understanding of the network environment and enhancing the detection and response capabilities to security incidents.

[0031] In some embodiments, data preprocessing is required for the first information, that is, obtaining the first information, including: Receive original five-tuple information and original four-tuple information of EDR devices and NDR devices in the same network deployment architecture; Converting the original five-tuple information and the original four-tuple information into standard five-tuple information and standard four-tuple information respectively; The standard five-tuple information and the standard four-tuple information are time-mapped and parsed to obtain the first information. A unified formatting process is performed according to the recorded time to ensure the consistency and accuracy of the data time.

[0032] In some embodiments, the second information is also preprocessed using the above data preprocessing means.

[0033] In some embodiments, after obtaining the first information and before determining the network hierarchical relationship between the EDR device and the NDR device, the first information is cut and stored in the database according to a preset time window, and then the network hierarchical relationship between the EDR device and the NDR device is determined in each time window. The selection of the time window is based on the frequency of network traffic changes and the needs of data analysis.

[0034] In some embodiments, merging the device data of the EDR device and the NDR device based on the association relationship table includes: Identify the device data of all the EDR devices and the NDR devices to obtain third information, where the third information is the ID of the EDR device, the IP of the EDR device, the ID of the NDR device, and the IP of the NDR device corresponding to the device data of the EDR device and the NDR device; Filter out device data of the EDR device and the NDR device belonging to the same device according to the third information and the association relationship table; The device data of the EDR device and the NDR device belonging to the same device are merged.

[0035] The present invention also provides a device for dynamically acquiring a network-end relationship of an XDR, comprising: A construction module, wherein the construction module is used to construct an association relationship table in a database, wherein the association relationship table includes a data ID and a network hierarchical relationship, wherein the network hierarchical relationship includes an ID of an EDR device, an IP of an EDR device, an ID of an NDR device, and an IP of an NDR device; A first acquisition module, the first acquisition module is used to acquire first information, the first information includes five-tuple information and four-tuple information of all the EDR devices and NDR devices in the same network deployment architecture, the five-tuple information includes a source IP, a destination IP, a source port, a destination port and a network transmission protocol, and the four-tuple information includes any IP, a source port, a destination port and a network transmission protocol; A judgment module, the judgment module is used to judge the network hierarchical relationship between the EDR device and the NDR device, including comparing whether the five-tuple information of the EDR device and the NDR device is consistent, if consistent, judging that the EDR device and the NDR device are the same device and recording the network hierarchical relationship in the association relationship table, if inconsistent, comparing whether the four-tuple information of the EDR device and the NDR device is consistent, if consistent, judging that the EDR device and the NDR device are the same device and recording the network hierarchical relationship in the association relationship table; A second acquisition module, the second acquisition module is used to acquire second information, where the second information includes device data of all the EDR devices and the NDR devices in the same network deployment architecture; A merging module is used to merge the device data of the EDR device and the NDR device based on the association relationship table.

[0036] In some embodiments, the first acquisition module includes: A receiving module, the receiving module is used to receive original five-tuple information and original four-tuple information of EDR devices and NDR devices in the same network deployment architecture; A conversion module, the conversion module is used to convert the original five-tuple information and the original four-tuple information into standard five-tuple information and standard four-tuple information respectively; A mapping module is used to perform time mapping analysis on the standard five-tuple information and the standard four-tuple information to obtain the first information.

[0037] In some embodiments, the merging module includes: An identification module, wherein the identification module is used to identify the device data of all the EDR devices and the NDR devices, and obtain third information, wherein the third information is the ID of the EDR device, the IP of the EDR device, the ID of the NDR device, and the IP of the NDR device corresponding to the device data of the EDR device and the NDR device; A screening module, the screening module is used to screen out device data of the EDR device and the NDR device belonging to the same device according to the third information and the association relationship table; A merging submodule, wherein the merging submodule is used to merge the device data of the EDR device and the NDR device belonging to the same device.

[0038] The present invention also provides a device for dynamically acquiring a network-side relationship of an XDR, comprising: Memory for storing computer programs; A processor is used to implement the steps of the method for dynamically acquiring the network-end relationship of XDR when executing the computer program.

[0039] The present invention also provides a storage medium, which is a readable storage medium. A computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the method for dynamically acquiring the network-end relationship of an XDR are implemented.

[0040] Through the above-mentioned present invention, the XDR system collects data from EDR (endpoint detection and response) and NDR (network detection and response), extracts the correlation relationship in the communication records, and through the correlation relationship, the XDR system can discover potential security threats and network anomalies, thereby improving the understanding of the network environment and enhancing the detection and response capabilities of security incidents.

[0041] It can be seen that the XDR system according to the present invention can effectively compare and merge the records of terminal devices and network devices. The analysis of quintuples and quadruple ensures the accuracy of communication between devices, and the merged asset information provides clear and consistent asset records. This method improves the accuracy and reliability of asset management and contributes to better network security and performance monitoring. It greatly improves the management efficiency of the XDR system and provides accurate device data management support for network security. It ensures that the system can adapt to the dynamically changing network environment and improves the efficiency of data analysis and the accuracy of association.

[0042] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for dynamically acquiring a network-end relationship of an XDR, characterized in that: include: Constructing an association relationship table in a database, wherein the association relationship table includes a data ID and a network hierarchical relationship, wherein the network hierarchical relationship includes an ID of an EDR device, an IP of an EDR device, an ID of an NDR device, and an IP of an NDR device; Acquire first information, where the first information includes quintuple information and quadruple information of all the EDR devices and NDR devices in the same network deployment architecture, where the quintuple information includes a source IP, a destination IP, a source port, a destination port, and a network transmission protocol, and the quadruple information includes any IP, a source port, a destination port, and a network transmission protocol; Acquire second information, where the second information includes device data of all the EDR devices and the NDR devices in the same network deployment architecture; Determine the network hierarchical relationship between the EDR device and the NDR device, including comparing whether the five-tuple information of the EDR device and the NDR device is consistent, if they are consistent, determine that the EDR device and the NDR device are the same device and record the network hierarchical relationship in the association relationship table, if they are inconsistent, compare whether the four-tuple information of the EDR device and the NDR device is consistent, if they are consistent, determine that the EDR device and the NDR device are the same device and record the network hierarchical relationship in the association relationship table; The device data of the EDR device and the NDR device are merged based on the association relationship table.

2. The method for dynamically acquiring the network-end relationship of XDR according to claim 1, characterized in that: Obtain the first information, including: Receive original five-tuple information and original four-tuple information of EDR devices and NDR devices in the same network deployment architecture; Converting the original five-tuple information and the original four-tuple information into standard five-tuple information and standard four-tuple information respectively; Time mapping and parsing are performed on the standard five-tuple information and the standard four-tuple information to obtain the first information.

3. A method for dynamically acquiring XDR network-end relationship according to claim 1 or 2, characterized in that: After obtaining the first information, and before determining the network hierarchy relationship between the EDR device and the NDR device, the method further includes cutting the first information according to a preset time window and storing it in the database, and then determining the network hierarchy relationship between the EDR device and the NDR device within each time window.

4. The method for dynamically acquiring the network-end relationship of XDR according to claim 1, characterized in that: The device data of the EDR device and the NDR device are merged based on the association relationship table, including: Identify the device data of all the EDR devices and the NDR devices to obtain third information, where the third information is the ID of the EDR device, the IP of the EDR device, the ID of the NDR device, and the IP of the NDR device corresponding to the device data of the EDR device and the NDR device; Filter out device data of the EDR device and the NDR device belonging to the same device according to the third information and the association relationship table; The device data of the EDR device and the NDR device belonging to the same device are merged.

5. A device for dynamically acquiring a network-end relationship of XDR, characterized in that: include: A construction module, wherein the construction module is used to construct an association relationship table in a database, wherein the association relationship table includes a data ID and a network hierarchical relationship, wherein the network hierarchical relationship includes an ID of an EDR device, an IP of an EDR device, an ID of an NDR device, and an IP of an NDR device; A first acquisition module, the first acquisition module is used to acquire first information, the first information includes five-tuple information and four-tuple information of all the EDR devices and NDR devices in the same network deployment architecture, the five-tuple information includes a source IP, a destination IP, a source port, a destination port and a network transmission protocol, and the four-tuple information includes any IP, a source port, a destination port and a network transmission protocol; A judgment module, the judgment module is used to judge the network hierarchical relationship between the EDR device and the NDR device, including comparing whether the five-tuple information of the EDR device and the NDR device is consistent, if consistent, judging that the EDR device and the NDR device are the same device and recording the network hierarchical relationship in the association relationship table, if inconsistent, comparing whether the four-tuple information of the EDR device and the NDR device is consistent, if consistent, judging that the EDR device and the NDR device are the same device and recording the network hierarchical relationship in the association relationship table; A second acquisition module, the second acquisition module is used to acquire second information, where the second information includes device data of all the EDR devices and the NDR devices in the same network deployment architecture; A merging module is used to merge the device data of the EDR device and the NDR device based on the association relationship table.

6. The device for dynamically acquiring the network-end relationship of XDR according to claim 5, characterized in that: The first acquisition module includes: A receiving module, the receiving module is used to receive original five-tuple information and original four-tuple information of EDR devices and NDR devices in the same network deployment architecture; A conversion module, the conversion module is used to convert the original five-tuple information and the original four-tuple information into standard five-tuple information and standard four-tuple information respectively; A mapping module is used to perform time mapping analysis on the standard five-tuple information and the standard four-tuple information to obtain the first information.

7. The device for dynamically acquiring the network-end relationship of XDR according to claim 5, characterized in that: The merging module comprises: An identification module, wherein the identification module is used to identify the device data of all the EDR devices and the NDR devices, and obtain third information, wherein the third information is the ID of the EDR device, the IP of the EDR device, the ID of the NDR device, and the IP of the NDR device corresponding to the device data of the EDR device and the NDR device; A screening module, the screening module is used to screen out device data of the EDR device and the NDR device belonging to the same device according to the third information and the association relationship table; A merging submodule, wherein the merging submodule is used to merge the device data of the EDR device and the NDR device belonging to the same device.

8. An XDR network-side relationship dynamic acquisition device, characterized in that: include: Memory for storing computer programs; A processor is used to implement the steps of a method for dynamically acquiring a network-end relationship of an XDR as claimed in any one of claims 1 to 4 when executing the computer program.

9. A storage medium, characterized in that: The storage medium is a readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the method for dynamically acquiring the network-end relationship of XDR as claimed in any one of claims 1 to 4 are implemented.

Images