Remote office network security protection method and system based on big data

Abstract

The invention provides a remote office network security protection method and system based on big data, and the method comprises the steps: firstly obtaining network activity data, including traffic, equipment states and user behavior data, of a plurality of terminal equipment in a remote office scene, and then carrying out the multi-dimensional security feature analysis of the network activity data, after a dynamic security feature set containing traffic, device fingerprints and behavior pattern features is generated, abnormal behaviors are identified through a multi-layer anomaly detection model, a detection result with an anomaly type and confidence is output, a target protection strategy is matched from a preset library according to the result, the weight is dynamically adjusted in combination with the anomaly confidence, and a real-time protection strategy instruction is generated. And finally, executing a protection strategy instruction to synchronously regulate and control network connection, equipment permission and a user access path, and feeding back regulated and controlled network state data to optimize abnormal identification logic, thereby realizing comprehensive and intelligent remote office network security protection.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a remote office network security protection method and system based on big data. Background Art

[0002] With the rapid development of information technology and the changing ways of working, remote working has gradually become the choice of many companies and workers. Remote working breaks the time and space limitations of traditional working and greatly improves the flexibility and efficiency of work. However, network security issues in remote working environments have also become prominent, bringing severe challenges to companies and users.

[0003] In the traditional network security field, early protection methods mainly focused on protecting the network boundary, such as blocking illegal external access through firewalls and other devices. However, this method is too simple and one-sided for remote office scenarios, and cannot effectively deal with various security risks generated by internal terminal devices in complex network environments.

[0004] The existing protection strategy formulation method is relatively rigid. Usually, a fixed set of protection strategies is set in advance. Regardless of the severity of the actual security threat, the same response measures are adopted. It is impossible to flexibly adjust according to specific abnormal situations, resulting in poor protection effects and unable to meet the diverse security protection needs in remote working environments.

[0005] Moreover, most traditional protection methods lack an effective feedback mechanism. After implementing protection measures, it is impossible to promptly feed back information about changes in network status to the detection model, which makes it impossible for the detection model to optimize its own recognition logic based on the actual protection effect. This makes it difficult for the protection system to continue to evolve with the continuous changes in the network environment, and gradually unable to adapt to the increasingly complex security challenges of remote office networks. Summary of the invention

[0006] In view of the above-mentioned problems, in combination with the first aspect of the present application, an embodiment of the present application provides a remote office network security protection method based on big data, the method comprising: Acquire network activity data generated by multiple terminal devices in a remote office scenario, wherein the network activity data includes traffic data, device status data, and user behavior data; Performing a multi-dimensional security feature analysis on the network activity data to generate a dynamic security feature set corresponding to the network activity data, wherein the dynamic security feature set includes traffic features, device fingerprint features, and behavior pattern features; Based on the dynamic security feature set, the network activity data is subjected to abnormal behavior identification through a multi-layer anomaly detection model, and an anomaly detection result including anomaly type and anomaly confidence is output; According to the anomaly detection result, a target protection strategy corresponding to the anomaly type is matched from a preset protection strategy library, and a dynamic weight adjustment is performed on the target protection strategy based on the anomaly confidence level to generate a real-time protection strategy instruction; The real-time protection strategy instructions are executed to synchronously regulate the network connection, device permissions and user access paths in the remote office scenario, and the regulated network status data is fed back to the multi-layer anomaly detection model to optimize the anomaly identification logic.

[0007] On the other hand, an embodiment of the present application also provides a remote office protection system, including a processor and a machine-readable storage medium, wherein the machine-readable storage medium is connected to the processor, the machine-readable storage medium is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the machine-readable storage medium to implement the above method.

[0008] Based on the above aspects, the embodiment of the present application constructs a comprehensive, multi-dimensional network activity portrait by comprehensively acquiring network activity data including traffic data, device status data and user behavior data generated by multiple terminal devices in the remote office scenario. When performing multi-dimensional security feature analysis on the network activity data and generating a dynamic security feature set, the traffic features, device fingerprint features and behavior pattern features contained in the dynamic security feature set are not simply static feature lists. The dynamic security feature set will be continuously updated with the real-time changes in network activities, and can adapt to the diverse and changeable network behavior patterns in remote office scenarios. Compared with the traditional fixed feature analysis method, it can more accurately portray the real security status of network activities at each moment and effectively identify the evolving new network attack patterns.

[0009] The multi-layer anomaly detection model identifies abnormal behaviors of network activity data based on a dynamic security feature set, and outputs anomaly detection results including anomaly types and anomaly confidence levels. This not only improves the accuracy and reliability of detection, but also enables the mining of abnormal behaviors from different angles through multi-level analysis, greatly reducing the false alarm rate and missed alarm rate. Then, according to the anomaly detection results, the target protection strategy is matched from the preset protection strategy library, and the dynamic weight is adjusted based on the anomaly confidence level to generate real-time protection strategy instructions, abandoning the limitations of traditional fixed protection strategies, and being able to flexibly adjust the intensity of protection measures according to the severity and credibility of the abnormal situation, and can be accurately customized according to the actual threat situation, significantly improving the pertinence and effectiveness of the protection strategy.

[0010] Finally, the real-time protection policy instructions are executed to synchronously regulate the network connection, device permissions and user access paths in the remote office scenario, and the regulated network status data is fed back to the multi-layer anomaly detection model to optimize the anomaly identification logic, realizing dynamic self-adjustment and continuous optimization of the protection process. It can continuously improve the anomaly identification logic as the network environment changes, so that the protection system can always maintain an efficient response capability to various security threats, providing an adaptive, intelligent and constantly evolving protection guarantee for remote office network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a schematic diagram of the execution flow of the remote office network security protection method based on big data provided in an embodiment of the present application.

[0012] Figure 2 It is a schematic diagram of the hardware architecture of the remote office protection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0013] The present application will be described in detail below with reference to the accompanying drawings. Figure 1 This is a flow chart of a remote office network security protection method based on big data provided by an embodiment of the present application. The remote office network security protection method based on big data is introduced in detail below.

[0014] Step S110, obtaining network activity data generated by multiple terminal devices in a remote office scenario, wherein the network activity data includes traffic data, device status data, and user behavior data.

[0015] In this embodiment, in a remote office scenario of an enterprise, employees connect to the company's office network through various terminal devices (such as laptops, tablets, and smart phones, etc.) These terminal devices generate a large amount of network activity data during daily office work.

[0016] For traffic data, when employees use office software (such as corporate email clients, project management tools, etc.) to interact with company servers, each data transfer will generate traffic data. For example, when employee A downloads an important project document from the company server, the data transmission volume, transmission protocol (such as HTTP or HTTPS) and other information during the download process will be recorded as traffic data. At the same time, when employees use instant messaging tools to communicate with colleagues, the messages sent and received will also generate certain traffic data, including traffic information involved in operations such as chat messages and file transfers.

[0017] In terms of device status data, taking employee B's laptop as an example, the device's hardware identification features (such as MAC address, etc.) are the information that uniquely identifies the device. If there is a vulnerability in the laptop's operating system, it can be recorded in the device status data. For example, the operating system detects that a security patch is not installed, which constitutes an operating system vulnerability feature. In addition, during the office process, the resource usage of various processes will also be recorded. For example, when employee B opens multiple office software (such as document editing software, spreadsheet software, and presentation software) at the same time, the CPU usage, memory usage, and other information occupied by each software process are all part of the device status data.

[0018] User behavior data is also rich and varied. The time when employee C logs into the company's office system every morning is part of his login time series characteristics. When employee C operates files during the office process, such as creating new documents in shared folders, modifying existing documents, or deleting useless documents, the trajectories of these file operations will be recorded as file operation trajectory characteristics. If employee C's role permissions change, such as being promoted from an ordinary employee to a project leader, the corresponding permission change history characteristics will also be recorded. These traffic data, device status data, and user behavior data are collected centrally to provide a basis for subsequent security analysis.

[0019] Step S120, performing a multi-dimensional security feature analysis on the network activity data to generate a dynamic security feature set corresponding to the network activity data, wherein the dynamic security feature set includes traffic features, device fingerprint features, and behavior pattern features.

[0020] When analyzing the collected network activity data, first extract various features from the traffic data. From the previously collected traffic data, we can look at the extraction of protocol type distribution features. For example, in the remote office network of the entire company, most normal business traffic uses the common HTTP or HTTPS protocols. However, if a terminal device is found to frequently use a less common protocol in a short period of time, such as a custom encryption protocol, this may be an abnormal situation. By capturing the nested relationship between the transport layer protocol and the application layer protocol in the traffic data, this unconventional protocol combination pattern can be identified. At the same time, the proportion of packets of different protocols under the same source address is counted to generate a protocol distribution vector. Assume that among the packets sent by an employee's terminal device in a day, 80% are HTTP protocols, 15% are HTTPS protocols, and 5% are other protocols. This ratio relationship is part of the protocol distribution vector. The protocol distribution vector is compared with the known malicious protocol library for similarity. If it is found that the similarity between a protocol used by the device and a malicious protocol in the malicious protocol library is greater than the dynamic setting score (for example, when the proportion of normal business traffic decreases, the dynamic setting score is lowered according to the rules, so that more protocols are regarded as risky protocols), then this protocol will be marked as a risky protocol.

[0021] Parse device fingerprint features from device status data. Taking employee D's device as an example, the device's hardware identification feature (MAC address) is like the device's ID card and is an important part of the device's fingerprint feature. If there is a vulnerability in the device's operating system, such as a remote execution vulnerability in the Windows system, this operating system vulnerability feature will be recorded. During the office process, when employee D opens multiple office software, the process resource usage feature will also be analyzed. For example, if an office software process suddenly occupies a large amount of CPU resources, this may be a sign that the software has failed or has been attacked by malware. This process resource usage feature is also part of the device fingerprint feature.

[0022] For the behavior pattern features in user behavior data, take employee E as an example. Employee E logs into the company's office system at a relatively fixed time every day. If the login time is suddenly advanced or delayed for a long time one day, this constitutes an abnormality in the login time series feature. When employee E operates files in a shared folder, the file operation trajectory features will be recorded in detail. Assuming that employee E normally only modifies files in a specific folder, but suddenly begins to frequently access other unrelated folders and delete files, this may be an abnormal behavior pattern. In addition, if employee E's permissions change, the permission change history feature will record the time of the change, the content of the change (such as from only being able to read certain files to being able to edit these files), and other information. Finally, the traffic features, device fingerprint features, and behavior pattern features are aligned by time window, for example, with each hour as a time window, and the aligned features are subjected to cross-dimensional correlation analysis. For example, based on the target address clustering features in the traffic features and the file operation trajectory features in the behavior pattern features, the abnormal data transmission path is identified. If it is found that the file operation track of employee F shows that he frequently transfers internal company files to an external suspicious address, and this external address matches the malicious address cluster in the target address cluster feature in the traffic feature, then the abnormal data transmission path is identified. Similarly, based on the process resource occupancy feature in the device fingerprint feature and the packet transmission frequency feature in the traffic feature, potential threats that do not match resource consumption and traffic can be detected. For example, if the process resource occupancy of a device is very high, but the packet transmission frequency is very low, this may mean that there are malicious programs on the device that occupy a large amount of resources in the background.

[0023] Step S130, based on the dynamic security feature set, abnormal behavior identification is performed on the network activity data through a multi-layer anomaly detection model, and an anomaly detection result including anomaly type and anomaly confidence is output.

[0024] The multi-layer anomaly detection model includes a primary detection layer, an intermediate aggregation layer, and a high-level decision-making layer. First, the dynamic security feature set is input into the primary detection layer. For traffic features, assuming that in the previous analysis, it was found that there is a suspicious protocol in the protocol type distribution feature of a terminal device, and the packet transmission frequency is abnormally high, the primary detection layer will independently score the traffic features according to predefined rules. In terms of device fingerprint features, if the operating system vulnerability feature of a device indicates a high-risk vulnerability, and the process resource occupancy feature shows that the resources are abnormally occupied, a corresponding anomaly score will also be obtained. For behavioral pattern features, if the login time series feature of employee G is abnormal, and the file operation trajectory feature shows that he has abnormal file access behavior, an anomaly score will also be obtained, thereby obtaining a primary anomaly score set.

[0025] The primary anomaly score set is input into the intermediate aggregation layer. For example, after receiving the traffic feature anomaly score, device fingerprint feature anomaly score and behavior pattern feature anomaly score in the primary anomaly score set, the feature attribute label and timestamp sequence corresponding to each anomaly score are extracted. Assume that the feature attribute label corresponding to the traffic feature anomaly score is "protocol anomaly" and the timestamp sequence shows that the anomaly occurs between 9 am and 10 am. Parse the combination logic rules defined in the threat scenario template, match the corresponding logical condition branches according to the feature attribute labels, and determine the dynamic weight coefficient of each anomaly score in the combination logic rule. If according to the threat scenario template, when the traffic feature anomaly score is higher than the first set score and the behavior pattern feature anomaly score is lower than the second set score, it is marked as a disguised attack scenario. In this case, if the traffic feature anomaly score is indeed higher than the first set score and the behavior pattern feature anomaly score is lower than the second set score, then the dynamic weight coefficient of the traffic feature anomaly score in the combination logic rule of this disguised attack scenario may be higher. Then, based on the timestamp sequence, the fluctuation trend analysis of the traffic feature anomaly score, the device fingerprint feature anomaly score and the behavior pattern feature anomaly score within the time window is performed to generate the trend intensity factor of each anomaly score. For example, if the traffic feature anomaly score continues to rise within an hour, its trend intensity factor may be high. Based on the product of the dynamic weight coefficient and the trend intensity factor, the weighted contribution values ​​of the traffic feature anomaly score, the device fingerprint feature anomaly score, and the behavior pattern feature anomaly score are calculated. The weighted contribution values ​​are accumulated according to the aggregation direction defined in the threat scenario template to generate the initial aggregation index. Assuming that during the calculation process, the initial aggregation index exceeds the upper limit of the indicator threshold range of the same threat scenario in the historical aggregation indicator library, the dynamic compensation mechanism will be triggered. For example, the attenuation rate of the weighted contribution value is adjusted according to the over-limit ratio of the initial aggregation indicator, and the adjusted attenuation rate is applied to the correlation constraint condition between the traffic feature anomaly score and the device fingerprint feature anomaly score, and finally the intermediate anomaly aggregation index is generated.

[0026] Input the intermediate anomaly aggregation indicators into the high-level decision layer. Parse the aggregate feature vector and time range mark in the intermediate anomaly aggregation indicator, and extract the traffic feature correlation strength, device fingerprint fluctuation amplitude and behavior pattern deviation in the aggregate feature vector. For example, the traffic feature correlation strength indicates the degree of deviation of the traffic feature from the normal mode, the device fingerprint fluctuation amplitude reflects the instability of the device state, and the behavior pattern deviation reflects the difference between the user behavior and the normal behavior pattern. According to the time range mark, retrieve the historical attack case fragments with the same time attribute from the historical anomaly case library to generate a candidate anomaly type set. Assuming that the time range mark is from 9 am to 10 am, then find similar attack case fragments that occurred in this time period from the historical anomaly case library. Perform multi-dimensional feature matching on the aggregate feature vector and each historical attack case fragment in the candidate anomaly type set. For example, calculate the similarity between the traffic feature correlation strength and the protocol anomaly indicator in the historical attack case fragment, the coverage of the device fingerprint fluctuation amplitude and the resource tampering indicator in the historical attack case fragment, and the overlap of the behavior pattern deviation and the authority abuse indicator in the historical attack case fragment. Based on the number of online devices, user activity level, and network throughput fluctuation value in the real-time network environment parameters, the similarity, coverage, and overlap are dynamically weighted and adjusted to generate a weighted matching list. The matching values ​​in the weighted matching list are sorted in descending order, and the historical attack case fragments corresponding to the first N matching values ​​are selected as target candidate cases. The anomaly type labels and confidence correction coefficients marked in the target candidate cases are extracted. For example, if the anomaly type label of the target candidate case is "disguised attack", the confidence correction coefficient is 0.8. According to the frequency of occurrence of the anomaly type label of the target candidate case and the confidence correction coefficient, the initial anomaly confidence corresponding to the intermediate anomaly aggregation indicator is calculated. Assuming that the frequency of occurrence of the "disguised attack" label in the target candidate case is high, the initial anomaly confidence is calculated to be 0.7. Based on the network status baseline data within the time range mark, the initial anomaly confidence is compensated for time decay. For example, if the network status baseline data shows that the network fluctuates greatly during this time period, the dynamic confidence threshold is obtained according to the time decay compensation rule (such as adjusting the slope of the decay curve of the initial anomaly confidence according to the duration length of the time range mark and the deviation rate of the network status baseline data, so that the confidence decay rate of the short-term high deviation scenario is lower than that of the long-term low deviation scenario). If the initial anomaly confidence continues to exceed the dynamic confidence threshold, the most frequently occurring anomaly type label in the target candidate case is determined as the final anomaly type, which is "disguised attack" here, and the "disguised attack" and the corresponding initial anomaly confidence are output as anomaly detection results, and the matching path association relationship between the aggregated feature vector and the target candidate case is written into the retrieval index structure of the historical anomaly case library to update the pattern matching logic.

[0027] Step S140, according to the anomaly detection result, matching the target protection strategy corresponding to the anomaly type from a preset protection strategy library, and dynamically adjusting the weight of the target protection strategy based on the anomaly confidence, to generate a real-time protection strategy instruction.

[0028] Assuming that the anomaly detection result is "disguised attack", first select the candidate policy set that meets the minimum response level from the protection policy library according to the threat level corresponding to the anomaly type. In the mapping relationship table between the defined threat level and the response level, the "disguised attack" scenario corresponds to the second-level response. Monitor the resource usage baseline of the available policies in the current protection policy library (including CPU usage, memory consumption, and network delay growth coefficient, which are calculated and updated in real time through the sliding window algorithm). If it is found that the resource demand of an available policy is greater than the upper limit of the system's idle resources, the minimum response level is raised to the next level (here is the first-level response). Filter out the candidate policy set that meets the second-level response from the protection policy library.

[0029] Prioritize the policies in the candidate policy set based on the anomaly confidence. For example, if the anomaly confidence is 0.7, for policies A, B, and C in the candidate policy set, according to the pre-set priority rules related to the anomaly confidence (such as the higher the anomaly confidence, the higher the priority of the policy that monitors network traffic more strictly), assuming that policy A monitors network traffic most strictly, then policy A has the highest priority and is selected as the basic protection policy.

[0030] Then, according to the bandwidth load rate, device online status and user role permissions in the real-time network environment parameters, the execution parameters of the basic protection strategy are dynamically adapted to generate a target protection strategy. For example, if the current bandwidth load rate is greater than the preset critical value, the traffic monitoring frequency is reduced and the device fingerprint verification strength is increased according to the rules. If a user with set permissions (such as a senior company manager) is detected online, external device access is restricted while retaining access to key data. Through these adjustments, a target protection strategy instruction for the "masquerade attack" scenario is generated.

[0031] Step S150, execute the real-time protection strategy instruction, synchronously regulate the network connection, device permissions and user access paths in the remote office scenario, and feed back the regulated network status data to the multi-layer anomaly detection model to optimize the anomaly recognition logic.

[0032] In this embodiment, the real-time protection policy instructions are decomposed into network connection control instructions, device permission reset instructions, and user access interception instructions. For example, the network connection control instruction may include operations of blocking certain suspicious IP address segments and disabling specific ports. When executing the network connection control instruction, verify its compatibility with the current network topology. Parse the IP address segment blocking list and port disabling list in the network connection control instruction, and compare the blocking list with the current active connection list. If it is found that there are overlapping address segments between the blocking list and the current active connection list, generate an address conflict report. According to the overlapping address segments in the address conflict report, query the corresponding device fingerprint features to determine the department to which the device belongs and the business importance level. For example, it is found that the device corresponding to a certain overlapping address segment is a device that the marketing department is promoting an important project, and its business importance level is high. Re-divide the blocked address segment based on the business importance level so that the connection of the core business device is not affected by the network connection control instruction. The re-divided blocked address segment is merged into the original network connection control instruction, and the final control instruction that passes the compatibility verification is generated and executed.

[0033] According to the device permission reset instruction, the file read and write permissions and peripheral interface enablement status of the target device (such as the device suspected of being affected by the masquerade attack) are modified in batches. For example, the read and write permissions of some suspicious files are changed from read and write to read-only, some unnecessary peripheral interfaces (such as USB interfaces) are disabled, and the permission difference log before and after the modification is recorded.

[0034] Based on user access interception instructions, virtual access paths are injected into user behavior data to induce attackers to trigger the protection mechanism, while backing up encrypted copies of real access paths. For example, after an employee logs into the login page of the office system, some seemingly valuable but actually virtual file access paths are created. If an attacker attempts to access these paths, the protection mechanism will be triggered. At the same time, the employee's normal real access path is encrypted and backed up.

[0035] Finally, the permission difference log and the encrypted copy are used as the regulated network status data and input into the multi-layer anomaly detection model. For example, the primary detection layer in the multi-layer anomaly detection model can re-evaluate the security of the device based on the permission change information in the permission difference log, and the intermediate aggregation layer can optimize the combination weight calculation rules in the threat scenario template based on the real access path information in the encrypted copy, thereby optimizing the anomaly identification logic and improving the entire system's ability to detect and prevent network security threats in remote office scenarios.

[0036] Based on the above steps, the embodiment of the present application constructs a comprehensive, multi-dimensional network activity portrait by comprehensively acquiring network activity data including traffic data, device status data and user behavior data generated by multiple terminal devices in the remote office scenario. When performing multi-dimensional security feature analysis on the network activity data and generating a dynamic security feature set, the traffic features, device fingerprint features and behavior pattern features contained in the dynamic security feature set are not simply static feature lists. The dynamic security feature set will be continuously updated with the real-time changes in network activities, and can adapt to the diverse and changeable network behavior patterns in remote office scenarios. Compared with the traditional fixed feature analysis method, it can more accurately portray the real security status of network activities at each moment and effectively identify the evolving new network attack patterns.

[0037] The multi-layer anomaly detection model identifies abnormal behaviors of network activity data based on a dynamic security feature set, and outputs anomaly detection results including anomaly types and anomaly confidence levels. This not only improves the accuracy and reliability of detection, but also enables the mining of abnormal behaviors from different angles through multi-level analysis, greatly reducing the false alarm rate and missed alarm rate. Then, according to the anomaly detection results, the target protection strategy is matched from the preset protection strategy library, and the dynamic weight is adjusted based on the anomaly confidence level to generate real-time protection strategy instructions, abandoning the limitations of traditional fixed protection strategies, and being able to flexibly adjust the intensity of protection measures according to the severity and credibility of the abnormal situation, and can be accurately customized according to the actual threat situation, significantly improving the pertinence and effectiveness of the protection strategy.

[0038] Finally, the real-time protection policy instructions are executed to synchronously regulate the network connection, device permissions and user access paths in the remote office scenario, and the regulated network status data is fed back to the multi-layer anomaly detection model to optimize the anomaly identification logic, realizing dynamic self-adjustment and continuous optimization of the protection process. It can continuously improve the anomaly identification logic as the network environment changes, so that the protection system can always maintain an efficient response capability to various security threats, providing an adaptive, intelligent and constantly evolving protection guarantee for remote office network security.

[0039] In a possible implementation, step S120 includes: Step S121, extracting the protocol type distribution characteristics, data packet transmission frequency characteristics and target address clustering characteristics from the traffic data to form the traffic characteristics.

[0040] In this embodiment, in the flow data, the extraction process of the distribution characteristics of the protocol type is relatively complicated. In the entire enterprise remote office network, the data interaction between the office software and the server will generate traffic, and these traffics are transmitted based on different protocols. For example, the standard IMAP or POP3 protocol is mainly used between the enterprise mailbox client and the server to obtain the email content, and the HTTPS protocol may also be involved in the transmission process to ensure the security of the data. By analyzing a large amount of flow data and capturing the nested relationship between the transport layer protocol and the application layer protocol, the conventional protocol combination pattern can be identified. The proportion of data packets of different protocols under the same source address is counted to generate a protocol distribution vector. For example, an employee's laptop is used as the source address. Among the data packets sent within a working day, the proportion of data packets related to the enterprise office system is 70%, of which the HTTP protocol accounts for 40%, the HTTPS protocol accounts for 30%, and the remaining 30% of the data packets are generated by other applications, which may contain a small amount of FTP protocol (accounting for 5%) for file sharing and other operations. This protocol distribution vector is compared with the known malicious protocol library for similarity. If the proportion of normal business traffic in the enterprise office network decreases, the dynamically set score is lowered according to the rules. This may cause some protocols that were originally considered normal to be marked as risky protocols under the new scoring standard. For example, a custom encryption protocol is considered normal when normal business traffic is sufficient, but as the proportion of normal business traffic decreases, it is marked as a risky protocol under the new score because it has a certain similarity with a malicious encryption protocol in the malicious protocol library.

[0041] The packet transmission frequency feature is also an important part of the traffic feature. In daily office work, employees use the office network at different frequencies in different time periods, which is reflected in the packet transmission frequency. For example, from 9 to 11 a.m. is the time when most employees focus on processing emails and communicating about projects. At this time, the packet transmission frequency in the office network is high, and a large amount of email data, instant messaging data, etc. are transmitted in the network. During lunch time, the packet transmission frequency will drop significantly. If a terminal device suddenly has an abnormally high packet transmission frequency during a normal low-traffic time period (such as lunch time), this may be a potential security threat signal.

[0042] In terms of target address clustering characteristics, terminal devices in an enterprise office network usually communicate with specific servers or other devices. For example, terminal devices in the finance department often interact with financial servers, and these frequently communicated target addresses can be clustered together. If a device suddenly starts to transmit a large amount of data to an external address that has never had a communication record, this external address does not match the normal target address clustering characteristics, which constitutes a suspicious target address clustering characteristic. These protocol type distribution characteristics, data packet transmission frequency characteristics, and target address clustering characteristics together constitute traffic characteristics.

[0043] Step S122, parsing the device hardware identification features, operating system vulnerability features and process resource occupancy features from the device status data to form the device fingerprint features.

[0044] The hardware identification feature of the device is the unique identification of the device. For example, the MAC address of the laptop used by employees is fixed. This hardware identification feature is recorded when the device is connected to the network and becomes the basic part of the device fingerprint feature. The operating system vulnerability feature is crucial to the security of the device. For example, most of the office computers of enterprises use the Windows operating system. When Microsoft releases a security update patch, if a device is not updated in time, its operating system may have known vulnerabilities. For example, a remote code execution vulnerability can be used by hackers to execute malicious code on the device without authorization. The process resource usage feature reflects the resource usage of the device during operation. When employees open multiple office software at the same time, such as document editing software, project management software, and instant messaging software, each software process will occupy a certain CPU usage and memory usage. If a process suddenly occupies too much CPU resources, for example, an office software process normally only occupies 10% of the CPU resources, but suddenly soars to 80%, and the memory usage also increases significantly, this may be due to a software failure or an attack by malware. This process resource usage feature becomes part of the device fingerprint feature. These device hardware identification features, operating system vulnerability features, and process resource usage features together constitute the device fingerprint features.

[0045] Step S123, identifying login time series features, file operation track features and permission change history features from the user behavior data to form the behavior pattern features.

[0046] For example, the login time series feature can reflect the employee's office routine. For example, an employee logs in to the company's office system at around 9 am every day, and this login time is relatively fixed. If one day the employee logs in to the office system at 3 am, this is inconsistent with the normal login time series feature, which may be a signal of security risks. The file operation trajectory feature records the employee's operation of files during the office process. In the company's shared folders, employees' operations such as creating, modifying, and deleting files will be recorded in detail. For example, an employee is mainly responsible for editing project documents, and he usually operates in a specific project folder. If it is suddenly discovered that the employee begins to frequently access other folders that are not related to work, and modifies or deletes some important confidential files, this constitutes an abnormal file operation trajectory feature. The permission change history feature records the changes in employees' permissions in the company's office system. For example, after an employee is promoted from an ordinary employee to a project leader, his permissions change from only being able to read certain project files to being able to edit and manage these files. The time of this permission change, the specific content of the change, and other information will be recorded. These login time series features, file operation trajectory features, and permission change history features together constitute the behavior pattern features.

[0047] Step S124, aligning the traffic features, device fingerprint features and behavior pattern features according to the time window, performing cross-dimensional correlation analysis on the aligned features, and generating the dynamic security feature set.

[0048] The cross-dimensional correlation analysis includes: identifying abnormal data transmission paths based on the target address clustering features in the traffic features and the file operation track features in the behavior pattern features. Detecting potential threats of mismatch between resource consumption and traffic based on the process resource occupancy features in the device fingerprint features and the data packet transmission frequency features in the traffic features.

[0049] For example, taking each hour as a time window, the traffic features, device fingerprint features and behavior pattern features within the same hour are associated. When performing cross-dimensional correlation analysis, the abnormal data transmission path is identified based on the target address clustering features in the traffic features and the file operation trajectory features in the behavior pattern features. For example, the department where an employee works mainly interacts with internal servers, and its target address clustering features show that the addresses he frequently visits are all server addresses within the enterprise. However, from the file operation trajectory features, it is found that the employee copied a large number of confidential files within the enterprise to an external address, which is completely different from the address in the normal target address clustering features. This identifies an abnormal data transmission path and may pose a risk of data leakage. Based on the process resource occupancy features in the device fingerprint features and the packet transmission frequency features in the traffic features, the potential threat of resource consumption not matching traffic is detected. For example, the process resource occupancy of a device is very high, such as the CPU usage rate remains above 80% for a long time, but its packet transmission frequency is very low, which indicates that there may be malicious programs on the device that occupy a large amount of resources in the background without normal network data interaction. This is a potential threat situation where resource consumption and traffic do not match. Through such cross-dimensional correlation analysis, a dynamic security feature set corresponding to network activity data is generated, providing an important basis for subsequent anomaly detection and other operations.

[0050] In a possible implementation, the multi-layer anomaly detection model includes a primary detection layer, a mid-level aggregation layer, and a high-level decision layer.

[0051] Step S130 includes: Step S131, input the dynamic security feature set into the primary detection layer, perform independent anomaly scoring on the traffic features, device fingerprint features and behavior pattern features, and obtain a primary anomaly score set.

[0052] In this embodiment, for traffic characteristics, if it is found in the analysis of traffic data that the protocol type distribution characteristics of a terminal device are abnormal, for example, a protocol that is highly similar to a malicious protocol is used, and the data packet transmission frequency characteristics show that the transmission frequency is too high, exceeding the average transmission frequency of the device during normal office hours, and the target address clustering characteristics show that the device frequently communicates with external suspicious addresses, then according to the predefined traffic characteristic anomaly scoring rules, the traffic characteristics of this device will receive a higher anomaly score.

[0053] In terms of device fingerprint features, if the operating system vulnerability features of a device indicate that there are multiple unpatched high-risk vulnerabilities, and the process resource usage features show that a process continues to occupy a large amount of CPU and memory resources, this abnormal resource usage situation is combined with the operating system vulnerability situation. According to the device fingerprint feature anomaly scoring rules, the device fingerprint feature of the device will be given a corresponding anomaly score.

[0054] From the perspective of behavioral pattern characteristics, the login time series characteristics of an employee show obvious anomalies, such as frequent logins during non-working hours, and the file operation trajectory characteristics show that he abnormally accesses and operates a large number of confidential files. The permission change history characteristics show that there are non-compliant permission changes. According to the behavioral pattern feature anomaly scoring rules, the corresponding behavioral pattern characteristics of the employee will also receive an anomaly score. These anomaly scores for traffic features, device fingerprint features, and behavioral pattern features together constitute the primary anomaly score set.

[0055] Step S132: input the primary anomaly score set into the intermediate aggregation layer, perform combined weight calculation on multiple primary anomaly scores according to a preset threat scenario template, and generate an intermediate anomaly aggregation index.

[0056] For example, in a possible implementation, step S132 includes: Step S1321, receiving the traffic feature anomaly score, the device fingerprint feature anomaly score and the behavior pattern feature anomaly score in the primary anomaly score set, and extracting the feature attribute label and timestamp sequence corresponding to each anomaly score.

[0057] Step S1322, parse the combination logic rules defined in the threat scenario template, match the corresponding logic condition branches according to the feature attribute labels, and determine the dynamic weight coefficient of each anomaly score in the combination logic rules.

[0058] Step S1323, based on the timestamp sequence, a fluctuation trend analysis is performed on the traffic feature anomaly score, the device fingerprint feature anomaly score and the behavior pattern feature anomaly score within a time window to generate a trend intensity factor for each anomaly score.

[0059] Step S1324, calculating the weighted contribution values ​​of the traffic feature anomaly score, the device fingerprint feature anomaly score and the behavior pattern feature anomaly score according to the product of the dynamic weight coefficient and the trend strength factor.

[0060] Step S1325: Accumulate the weighted contribution values ​​according to the aggregation direction defined in the threat scenario template to generate an initial aggregation index.

[0061] Step S1326, detecting the initial aggregation indicator and the indicator threshold interval of the same threat scenario in the historical aggregation indicator library, and if the initial aggregation indicator exceeds the upper limit of the indicator threshold interval, triggering a dynamic compensation mechanism.

[0062] Step S1327: Perform nonlinear correction on the accumulated result of the weighted contribution value through the dynamic compensation mechanism to generate the intermediate abnormal aggregation index.

[0063] For example, the feature attribute label corresponding to the traffic feature anomaly score is "protocol and transmission anomaly", and the timestamp sequence shows that the anomaly occurred between 10 and 11 a.m.; the feature attribute label corresponding to the device fingerprint feature anomaly score is "resource and vulnerability anomaly", and the timestamp sequence is from 10:30 to 11 a.m.; the feature attribute label corresponding to the behavior pattern feature anomaly score is "login and operation anomaly", and the timestamp sequence is from 10:15 to 11 a.m.

[0064] Then, according to the threat scenario template, when the traffic feature anomaly score is higher than the first set score and the behavior pattern feature anomaly score is lower than the second set score, it can be marked as a disguised attack scenario. Assuming that the current traffic feature anomaly score is indeed higher than the first set score and the behavior pattern feature anomaly score is lower than the second set score, the dynamic weight coefficient of the traffic feature anomaly score in the combined logic rule related to this disguised attack scenario will be higher.

[0065] Furthermore, within the above time window (10:00 to 11:00 a.m.), if the traffic feature anomaly score continues to increase over time, then its trend strength factor will be higher; if the device fingerprint feature anomaly score is relatively stable during this time period, its trend strength factor may be lower; and if the behavior pattern feature anomaly score has a large fluctuation during this time period, its trend strength factor will also be higher.

[0066] Next, assuming that the dynamic weight coefficient of the traffic feature anomaly score is 0.6 and the trend strength factor is 0.8, the weighted contribution value is 0.6 * 0.8 = 0.48; the dynamic weight coefficient of the device fingerprint feature anomaly score is 0.3, the trend strength factor is 0.2, and the weighted contribution value is 0.3 * 0.2 = 0.06; the dynamic weight coefficient of the behavior pattern feature anomaly score is 0.1, the trend strength factor is 0.5, and the weighted contribution value is 0.1 * 0.5 = 0.05.

[0067] Therefore, it can be assumed that the initial aggregate index obtained by adding up the above three weighted contribution values ​​is 0.59. Detect the index threshold range of this initial aggregate index and the similar threat scenarios (such as disguised attack scenarios) in the historical aggregate index library. If the initial aggregate index exceeds the upper limit of the index threshold range, for example, the index threshold range of the disguised attack scenario is 0.3 - 0.5, and 0.59 exceeds this upper limit, the dynamic compensation mechanism is triggered.

[0068] Furthermore, assuming that the initial aggregation index exceeds the limit ratio (0.59 - 0.5) / 0.5 = 0.18, the attenuation rate of the weighted contribution value is adjusted according to this excess ratio. If the original correlation constraint between the traffic feature anomaly score and the device fingerprint feature anomaly score is that the sum of the two does not exceed 0.8, after adjusting the attenuation rate, this correlation constraint may become that the sum of the two does not exceed 0.7. After such nonlinear correction, the intermediate anomaly aggregation index is generated.

[0069] Step S133, input the intermediate anomaly aggregation index into the high-level decision layer, combine the pattern matching results in the historical anomaly case library and the real-time network environment parameters, calculate the anomaly confidence and determine the anomaly type.

[0070] The threat scenario template defines the following combination logic: when the traffic feature anomaly score is higher than the first set score and the behavior pattern feature anomaly score is lower than the second set score, it is marked as a disguise attack scenario. When the device fingerprint feature anomaly score continues to increase and is negatively correlated with the traffic feature anomaly score, it is marked as a device hijacking scenario.

[0071] In one possible implementation, the execution process of the dynamic compensation mechanism includes: adjusting the attenuation rate of the weighted contribution value according to the excess ratio of the initial aggregation index, and applying the adjusted attenuation rate to the correlation constraint condition between the traffic feature anomaly score and the device fingerprint feature anomaly score.

[0072] For example, in a possible implementation, step S133 includes: Step S1331, parsing the aggregate feature vector and time range mark in the intermediate abnormal aggregation index, extracting the flow feature correlation strength, device fingerprint fluctuation amplitude and behavior pattern deviation in the aggregate feature vector.

[0073] For example, the traffic feature correlation strength shows that the traffic deviates greatly from the normal pattern, the fluctuation range of the device fingerprint indicates that the device status is obviously unstable, the behavior pattern deviation reflects the large difference between user behavior and the normal pattern, and the time range is marked from 10 am to 11 am.

[0074] Step S1332: Retrieve historical attack case segments with the same time attribute from the historical anomaly case library according to the time range tag to generate a candidate anomaly type set.

[0075] For example, historical attack case fragments with the same time attribute (10 am to 11 am) are retrieved from the historical anomaly case library according to the time range tag to generate a set of candidate anomaly types. Assume that three historical attack case fragments are retrieved, namely, a disguised attack case, a device hijacking attack case, and a data leakage attack case.

[0076] Step S1333, perform multi-dimensional feature matching on the aggregated feature vector and each historical attack case fragment in the candidate anomaly type set, calculate the similarity between the traffic feature correlation strength and the protocol anomaly index in the historical attack case fragment, the coverage between the device fingerprint fluctuation amplitude and the resource tampering index in the historical attack case fragment, and the overlap between the behavior pattern deviation and the authority abuse index in the historical attack case fragment.

[0077] For example, for the disguised attack case fragment, the similarity between the traffic feature correlation strength and the protocol anomaly indicator is 0.6, the coverage between the device fingerprint fluctuation amplitude and the resource tampering indicator is 0.3, and the overlap between the behavior pattern deviation and the authority abuse indicator is 0.4.

[0078] Step S1334, based on the number of online devices, user activity level and network throughput fluctuation value in the real-time network environment parameters, dynamically weighted adjustment is performed on the similarity, coverage and overlap to generate a weighted matching list.

[0079] Assuming that there are a large number of online devices, a high user activity level, and a large fluctuation value of network throughput, the similarity, coverage, and overlap mentioned above are weighted and adjusted according to the pre-set weighting rules. For example, the weighted matching degree of the camouflage attack case fragment after adjustment is 0.7 * 0.6 + 0.2 * 0.3 + 0.1 * 0.4 = 0.52.

[0080] Step S1335, sorting the matching values ​​in the weighted matching list in descending order, selecting the historical attack case segments corresponding to the first N matching values ​​as target candidate cases, and extracting the anomaly type labels and confidence correction coefficients marked in the target candidate cases.

[0081] Assuming N = 2, after sorting, the weighted matching degree of the disguised attack case segment and the device hijacking attack case segment is high and is selected as the target candidate case. Then the abnormal type label and confidence correction coefficient marked in the target candidate case are extracted. The abnormal type label of the disguised attack case segment is "disguised attack", and the confidence correction coefficient is 0.8. The abnormal type label of the device hijacking attack case segment is "device hijacking", and the confidence correction coefficient is 0.7.

[0082] Step S1336, calculating the initial anomaly confidence corresponding to the intermediate anomaly aggregation index according to the occurrence frequency of the anomaly type label of the target candidate case and the confidence correction coefficient.

[0083] Assuming that the frequency of the "disguise attack" label in the target candidate cases is high, the initial anomaly confidence is 0.7 according to the calculation rules.

[0084] Step S1337: Based on the network status baseline data within the time range mark, time decay compensation is performed on the initial abnormality confidence to generate a dynamic confidence threshold.

[0085] The slope of the decay curve of the initial anomaly confidence is adjusted according to the duration of the time range mark (10 am to 11 am) and the deviation rate of the network status baseline data, so that the confidence decay rate of the short-term high deviation scenario is lower than that of the long-term low deviation scenario. For example, if the network status baseline data deviates greatly during this time period, but the time is short, the adjusted decay curve slope will make the confidence decay rate slower. After time decay compensation, a dynamic confidence threshold is generated.

[0086] Step S1338, comparing the initial anomaly confidence with the dynamic confidence threshold, if the initial anomaly confidence continues to exceed the dynamic confidence threshold, determining the anomaly type label with the highest frequency in the target candidate case as the final anomaly type.

[0087] Step S1339, outputting the final anomaly type and the corresponding initial anomaly confidence as the anomaly detection result, and writing the matching path association relationship between the aggregated feature vector and the target candidate case into the retrieval index structure of the historical anomaly case library to update the pattern matching logic.

[0088] Among them, the execution process of the time decay compensation includes: adjusting the slope of the decay curve of the initial abnormality confidence according to the duration length of the time range mark and the deviation rate of the network status baseline data, so that the confidence decay rate of the short-term high deviation scenario is lower than that of the long-term low deviation scenario.

[0089] Assuming that the initial anomaly confidence of 0.7 continues to exceed the dynamic confidence threshold, since the "disguised attack" label appears most frequently in the target candidate cases, the final anomaly type is determined to be "disguised attack", and "disguised attack" and the corresponding initial anomaly confidence are output as the anomaly detection results. At the same time, the association relationship between the aggregated feature vector and the matching path of the target candidate case is written into the retrieval index structure of the historical anomaly case library to update the pattern matching logic.

[0090] In a possible implementation, step S140 includes: Step S141 , according to the threat level corresponding to the abnormality type, a candidate policy set that meets the minimum response level is screened from the protection policy library.

[0091] In this embodiment, in the protection policy library of this enterprise, corresponding protection policies are set for different threat levels. For the abnormal type of disguised attack, its corresponding threat level is defined as a specific level (for example, the second-level threat level). The policies in the protection policy library are divided into different response levels, and each level contains multiple protection measures. According to the mapping relationship between the threat level and the response level, all policies that meet the second-level response level are screened out, and these policies constitute a candidate policy set. For example, one of the policies may be to strengthen the protocol analysis of network traffic, and another policy may be to conduct more frequent audits of specific user behaviors.

[0092] Step S142: Prioritize the strategies in the candidate strategy set based on the anomaly confidence level, and select the strategy with the highest priority as the basic protection strategy.

[0093] For example, the anomaly confidence of the disguised attack calculated previously is 0.7, and this confidence value will affect the priority of the policy. The various policies in the candidate policy set are sorted according to the pre-set priority rules related to the anomaly confidence. For example, for situations with higher anomaly confidence, those policies that can more directly target possible attack paths of disguised attacks (such as network traffic disguise, user identity disguise, etc.) and have better protection effects will be given higher priorities. Assuming that there is a policy in the candidate policy set that performs deep detection on the disguised source in the network traffic and is set to have a higher priority when the anomaly confidence is high, this policy will be selected as the basic protection policy.

[0094] Step S143, dynamically adapting the execution parameters of the basic protection strategy according to the bandwidth load rate, device online status and user role authority in the real-time network environment parameters to generate the target protection strategy.

[0095] The dynamic adaptation includes: when the bandwidth load rate is greater than a preset critical value, reducing the traffic monitoring frequency and increasing the device fingerprint verification strength. When a user with set permissions is detected to be online, retaining the key data access channel while limiting the access of external devices.

[0096] For example, in the current remote office scenario, the network environment is in dynamic change. If the bandwidth load rate is detected to be greater than the preset critical value, it means that network resources are relatively tight. According to the dynamic adaptation rules, it is necessary to reduce the frequency of traffic monitoring to reduce the network burden, and increase the strength of device fingerprint verification to ensure the legitimacy of the device. For example, the original traffic monitoring was performed every 10 seconds, but now it is adjusted to every 30 seconds; and in terms of device fingerprint verification, it has been increased from the previous single hardware identification verification to a joint verification of hardware identification, operating system characteristics and other aspects.

[0097] When it is detected that a user with set permissions (such as senior corporate executives or core project leaders) is online, in order to ensure their normal office operations, it is necessary to restrict external device access while retaining key data access channels. For example, for senior corporate executives, they need to access key data such as the company's core financial data and strategic planning documents, so it is necessary to ensure that the channels through which they can normally access these data remain unobstructed. At the same time, in order to prevent security risks that may be brought by external devices (such as malicious devices accessing to steal data or attacking, etc.), the access of external devices (such as unauthorized mobile hard disks, USB flash drives, etc.) is restricted. Through these dynamic adaptation operations based on real-time network environment parameters, the execution parameters of the basic protection strategy are adjusted, and finally a target protection strategy for the camouflage attack scenario is generated to ensure network security while ensuring office efficiency.

[0098] In a possible implementation, step S150 includes: Step S151, decomposing the real-time protection policy instruction into a network connection control instruction, a device permission reset instruction and a user access interception instruction.

[0099] Taking the previously detected masquerade attack as an example, the network connection control instruction may include restricting the connection between a specific suspicious IP address segment and the corporate office network, prohibiting communication on certain ports, etc. The device permission reset instruction involves adjusting the permissions of the device suspected of being affected by the masquerade attack. For example, the target device may be an employee's laptop, which is detected to have abnormal network activity. The user access interception instruction is designed to monitor and restrict user access behavior to prevent attackers from further obtaining sensitive corporate information.

[0100] Step S152, verifying the compatibility of the network connection control instruction with the current network topology structure. If there is a conflict between the network connection control instruction and the current network topology structure, reallocating the IP address pool according to the device fingerprint feature.

[0101] The network topology of an enterprise is relatively complex, including the subnets of multiple departments, server groups, and the connection relationships between various network devices (such as routers, switches, etc.). When executing a network connection control instruction, for example, if the instruction requires blocking a certain IP address segment, it is necessary to compare the blocking list of this IP address segment with the current active connection list. If it is found that there are overlapping address segments in the blocking list and the current active connection list, an address conflict report will be generated. Suppose there is an IP address segment in the blocking list that overlaps with the IP address of the device that the marketing department is promoting an important project and requires continuous network connection. At this time, the IP address pool is reallocated according to the device fingerprint features. By querying the device fingerprint features (such as the MAC address of the device, the operating system type, etc.), it is determined that the department to which the device belongs is the marketing department, and because it is promoting an important project, the business importance level is high. Based on this, the blocked address segment is re-divided so that the device connection of the marketing department is not affected, and then the re-divided blocked address segment is merged into the original network connection control instruction, and the final control instruction that has passed the compatibility verification is generated and executed, thereby ensuring that the network connection control instruction effectively protects network security without affecting the connection of important business equipment.

[0102] Step S153, according to the device permission reset instruction, batch modify the file read and write permissions and the peripheral interface enabling status of the target device, and record the permission difference log before and after the modification.

[0103] According to the device permission reset instruction, the file read and write permissions and the enabled status of peripheral interfaces of the target devices (such as employee laptops suspected of being at risk of camouflage attacks) are modified in batches. For example, for confidential files within the enterprise, the read and write permissions of these files on the target device are changed from read and write to read-only to prevent attackers from tampering with or stealing the file content. For peripheral interfaces, such as USB interfaces, their enabled status is changed from the default usable to disabled to prevent external devices (such as USB flash drives that may be implanted with malicious programs) from being inserted into the device to steal data or spread malware. While performing these permission modification operations, the permission difference log before and after the modification is recorded, which details which file permissions have changed, what permissions have changed to what permissions, and how the enabled status of the peripheral interface has changed.

[0104] Step S154, based on the user access interception instruction, inject a virtual access path into the user behavior data to induce the attacker to trigger the protection mechanism, and at the same time back up an encrypted copy of the real access path.

[0105] For example, in the operation interface after an employee logs into the corporate office system, some seemingly valuable but actually virtual file access paths are created. These virtual access paths may look like paths leading to the core confidential files of the enterprise, but they are actually specially set traps. If an attacker attempts to access these virtual paths by disguising as a legitimate user, protection mechanisms will be triggered, such as sounding an alarm and restricting the attacker's further operations. At the same time, the normal real access paths of employees are encrypted and backed up to ensure that the normal office operations of employees are not affected, and the real access paths can be restored based on the encrypted copies when necessary.

[0106] Step S155, using the permission difference log and the encrypted copy as the regulated network status data, and inputting them into the multi-layer anomaly detection model to update the combination weight calculation rules in the threat scenario template.

[0107] The primary detection layer in the multi-layer anomaly detection model can re-evaluate the security of the device based on the permission change information in the permission difference log. For example, if the file read and write permissions of a device are changed, and its subsequent network activity data shows an abnormal decrease or increase, this may indicate that the device has other potential security issues. The intermediate aggregation layer can optimize the combined weight calculation rules in the threat scenario template based on the real access path information in the encrypted copy. For example, if it is found that the characteristics of a real access path in the encrypted copy are similar to the access path characteristics in the previously detected disguised attack, the corresponding combined weight calculation rules can be adjusted so that similar disguised attacks can be more accurately identified in future detections, thereby improving the entire system's ability to detect and prevent network security threats in remote office scenarios.

[0108] In a possible implementation, step S121 includes: Step S1211, capturing the nested relationship between the transport layer protocol and the application layer protocol in the traffic data, and identifying unconventional protocol combination patterns.

[0109] In the remote office network of an enterprise, traffic data contains a lot of information about network activities. First, a specific network monitoring technology is used to capture the nested relationship between the transport layer protocol and the application layer protocol in the traffic data, so as to identify unconventional protocol combination patterns. For example, in the enterprise office network, common transport layer protocols such as TCP and UDP have a normal nested relationship with application layer protocols such as HTTP, HTTPS, SMTP, etc. Employees use corporate email clients (sending emails based on the SMTP protocol and receiving emails based on the POP3 or IMAP protocol) to communicate with the corporate email server. This is a normal application scenario, in which the nested relationship between the transport layer protocol and the application layer protocol is clear and in line with the norm. However, when an uncommon nested relationship appears in the traffic data of a certain terminal device, such as a custom encryption protocol is nested on the UDP protocol, and this combination has never appeared in the normal business of the enterprise office network, it is identified as an unconventional protocol combination pattern.

[0110] Step S1212: Count the proportions of data packets of different protocols under the same source address and generate a protocol distribution vector.

[0111] Taking a laptop of an employee in the enterprise as the source address, the traffic data generated by it is analyzed in a specific time period (such as a working day). The laptop interacts with the internal server of the enterprise, other employee devices, and external networks (such as accessing the Internet to obtain business-related information). Through statistics, it is found that among all the data packets generated during this period, the number of data packets based on the HTTP protocol accounts for 40%, which are mainly generated by employees using browsers to access the internal office system webpage of the enterprise; the number of data packets based on the HTTPS protocol accounts for 30%, which may be used for secure file transfer or logging into the enterprise encryption service; another 15% of the data packets are based on the FTP protocol, which is due to employees downloading some large project files from the internal file server of the enterprise; the remaining 15% are data packets generated by various other protocols, such as the SNMP protocol for network management. In this way, a protocol distribution vector based on the source address is generated, namely [HTTP: 40%, HTTPS: 30%, FTP: 15%, others: 15%].

[0112] Step S1213, the protocol distribution vector is compared with a known malicious protocol library for similarity, and if the similarity is greater than the dynamically set score, the corresponding protocol is marked as a risky protocol.

[0113] The dynamically set score is automatically adjusted according to the proportion of normal business traffic in the current network environment: when the proportion of normal business traffic decreases, the dynamically set score is reduced to expand the risk protocol identification scope.

[0114] For example, the known malicious protocol library contains a series of protocol features that are confirmed to have malicious intent or are highly related to malicious activities. In a normal enterprise office network environment, when the proportion of normal business traffic is high, the dynamic setting score is at a relatively high level. For example, the set dynamic setting score is 0.8. When comparing, if the similarity calculated between a certain protocol in the protocol distribution vector and the protocol features in the known malicious protocol library is less than 0.8, then the protocol is considered a normal protocol. However, when the proportion of normal business traffic in the enterprise office network decreases, in order to expand the scope of risk protocol identification, the dynamic setting score will be reduced. Assume that the proportion of normal business traffic decreases to a certain extent due to some reason (such as network attacks causing some business services to be interrupted), the dynamic setting score is reduced to 0.6. If in this case, a protocol that was previously considered normal (such as a rarely used custom encryption protocol, whose similarity with the malicious protocol library is calculated to be 0.7 when the proportion of normal business traffic is high, and is considered normal if it is less than 0.8), due to the reduction of the dynamic setting score, its similarity with the malicious protocol library is calculated to be 0.65, which is greater than 0.6, then this protocol will be marked as a risky protocol. This mechanism, which automatically adjusts the dynamic scoring based on the proportion of normal business traffic in the network environment, helps to more accurately identify protocols that may pose risks under different network conditions, thereby improving the security of the entire network and ensuring the normal operation of remote work for enterprises.

[0115] In a possible implementation, the process of constructing the historical abnormal case library includes: Step S210, collect the full life cycle data of historical network attack events, extract the characteristics of the initial stage of the attack, the characteristics of the lateral movement path, and the characteristics of the data leakage node.

[0116] In the corporate network environment, there have been many cyber attacks in history. For each attack, the full life cycle data covers all relevant information from the beginning to the end of the attack. Taking an attack on the data of the corporate finance department as an example, the characteristics of the initial stage of the attack may include the IP address of the attack source (assuming it is from an external suspicious IP address segment), the time when the attack was launched (such as 2 a.m., which is a non-working time and does not conform to the normal office network activity pattern) and the initial means used in the attack (for example, the use of an operating system vulnerability that has not been updated in time on a device in the finance department, the number and type of this vulnerability, etc.).

[0117] The lateral movement path feature describes the attacker's activity trajectory after entering the enterprise network. The attacker may first hack into an edge device in the finance department, and then use the permissions of this device to access devices in other departments through the enterprise internal network. For example, the attacker uses the permissions of the internal network share to move laterally from the finance department's device to the human resources department's device. In this process, specific protocols (such as the SMB protocol in Windows networks) may be used for data transmission and permission acquisition.

[0118] Data leakage node features involve information about attackers obtaining sensitive corporate data and attempting to transfer it out of the corporate network. For example, an attacker finds a database file containing corporate employee salary information on the HR department's device, encrypts and compresses the file, and attempts to leak data through a hidden external channel (such as disguising it as normal network traffic and sending it to an overseas server). These attack initial stage features, lateral movement path features, and data leakage node features are carefully extracted from the full life cycle data to provide a basis for subsequent processing.

[0119] Step S220, performing event slicing processing on the full life cycle data to generate multiple independent attack stage cases.

[0120] For the above-mentioned attacks on the data of the enterprise's finance and human resources departments, the starting point of slicing is the time when the attacker first breaks through the network boundary, which may be the moment when the attacker successfully invades by exploiting the operating system vulnerability of the finance department's equipment. The ending point of slicing is the time when the attacker obtains key data (such as the database file of the enterprise's employee salary information) or triggers the protection mechanism (assuming that the enterprise's intrusion detection system detects abnormal traffic and issues an alarm).

[0121] Between the starting and ending slice points, sub-slices are divided at fixed time intervals or key operation events. For example, sub-slices are divided at intervals of every 10 minutes, or when the attacker performs key operations (such as obtaining new device permissions, encrypting data, etc.). For each sub-slice, the following features are extracted: the vulnerability number used (such as the vulnerability number CVE-2021-1234), the protocol type used for lateral movement (such as the SMB protocol mentioned earlier), and the hash value of the injected malicious payload (assuming that the malicious payload is hashed to obtain a specific hash value, such as abcdef1234567890).

[0122] In this way, the entire life cycle data of the attack event is divided into multiple independent sub-slices, each of which represents a specific stage in the attack process. These independent sub-slices generate multiple independent attack stage cases.

[0123] Step S230, annotating each attack stage case with a corresponding protection strategy effectiveness label, wherein the protection strategy effectiveness label includes a strategy response speed, a resource consumption ratio, and a false interception rate.

[0124] For each independent attack phase case, analyze the effectiveness of the protection strategy adopted at that phase. For example, in the initial stage of the attack, the enterprise deployed a signature-based intrusion detection system as a protection strategy. In terms of the strategy response speed of this strategy, the time interval from the start of the attack to the intrusion detection system issuing an alarm is 5 minutes, which is recorded as the strategy response speed.

[0125] In terms of resource consumption ratio, the intrusion detection system occupies a certain amount of CPU resources and memory resources during operation. Assuming that when detecting this attack phase, the CPU usage of the intrusion detection system is an average of 10%, and the memory consumption is 500MB (relative to the total resources of the enterprise server), these resource consumption conditions are calculated as the resource consumption ratio.

[0126] In terms of false interception rate, if during the detection process, the intrusion detection system mistakenly intercepts some normal office network traffic (such as normal file download traffic of employees) as attack traffic, the proportion of the falsely intercepted traffic to the total detection traffic is calculated, assuming it is 2%, and this proportion is the false interception rate. Then these policy response speeds, resource consumption ratios and false interception rates are marked on the corresponding attack stage cases.

[0127] Step S240: clustering the marked attack stage cases according to the attack type to form a retrieval index structure of the historical abnormal case library.

[0128] The retrieval index structure adopts a multi-dimensional hash map, and the dimensions of the multi-dimensional hash map include attack tool hash, vulnerability exploit hash and data encryption method hash.

[0129] In the historical cyber attack incidents of enterprises, there are different types of attacks, such as the attacks on data theft mentioned above, denial of service attacks, malware implantation attacks, etc. The annotated attack stage cases are clustered according to the attack type. For example, all attack stage cases related to data theft are clustered together to form a cluster of data theft attack types.

[0130] For this cluster, its retrieval index structure uses a multidimensional hash map. Taking the previously mentioned attack on enterprise data theft as an example, the dimensions of the multidimensional hash map include attack tool hash, vulnerability exploit hash, and data encryption method hash. Assume that the attacker uses a specific hacking tool during the attack. This tool is hashed to obtain a unique hash value as the attack tool hash. If the attacker exploits a specific vulnerability (such as the previously mentioned CVE-2021-1234 vulnerability), the vulnerability exploit method is hashed to obtain the vulnerability exploit hash. When the attacker encrypts the stolen data (such as using the AES encryption algorithm), the encryption method is hashed to obtain the data encryption method hash. A multidimensional hash map is constructed through these hash values ​​to form a retrieval index structure for the historical anomaly case library, so that relevant cases can be quickly and accurately located when querying and matching similar attack cases in the future.

[0131] In a possible implementation manner, the step of determining the minimum response level includes: Step S310, defining a mapping relationship table between threat levels and response levels, wherein the device hijacking scenario corresponds to a first-level response, and the camouflage attack scenario corresponds to a second-level response.

[0132] In this embodiment, the mapping relationship between different threat levels and response levels is clearly defined in the enterprise's network security policy. For device hijacking scenarios, this is a very serious threat because the attacker may have complete control over the company's important equipment, such as core servers or key office equipment. In this case, it is defined as a level one response, which means that the most stringent and rapid protective measures need to be taken. For example, a level one response may include immediately cutting off the network connection of the hijacked device, performing a comprehensive security check and recovery operation on the device, and conducting an in-depth investigation of other devices that have communicated with the hijacked device.

[0133] Although the disguised attack scenario is also a threat, it is less harmful than device hijacking. In this scenario, the attacker may disguise himself as a legitimate user to obtain sensitive enterprise information. The corresponding secondary response is to take protective measures such as strengthening user identity authentication, monitoring and auditing suspicious disguised behaviors, etc.

[0134] Step S320, monitoring the resource occupancy baseline of the available policies in the current protection policy library, if the resource demand of the available policies is greater than the upper limit of the system idle resources, the minimum response level is increased to the next level.

[0135] In the enterprise's network environment, monitor the resource usage of available policies in the protection policy library in real time. The protection policy will occupy a certain amount of CPU, memory and network resources during execution. For example, the enterprise deploys an intrusion prevention system (IPS) as a protection policy. When the IPS is operating normally, the average CPU usage is 5%, the memory consumption is 300MB, and the network delay growth factor is 0.1 (indicates the proportion of network delay increase due to the existence of IPS under normal network traffic). These constitute the resource usage baseline.

[0136] If the upper limit of the idle resources of the enterprise network is 30% of the CPU idle rate, 1GB of the memory idle amount, and the network delay growth coefficient does not exceed 0.2. When a certain threat situation occurs (such as a suspected masquerade attack), it is necessary to start a protection strategy. If it is found that the resource requirements of the available protection strategy (such as an advanced user behavior analysis protection strategy) are 20% of the CPU occupancy rate (greater than the upper limit of the idle resources of 30%), 800MB of memory consumption (less than 1GB of memory idle amount), and 0.3 of the network delay growth coefficient (greater than 0.2 of the network delay growth coefficient), because its CPU occupancy rate and network delay growth coefficient exceed the upper limit of the idle resources of the system, then the second-level response level originally corresponding to the masquerade attack scenario will be upgraded to the first-level response level to ensure that the threat can be dealt with more effectively under the condition of limited resources.

[0137] Step S330: When multiple abnormality types are detected concurrently, the response level corresponding to the abnormality type with the highest threat level is selected as the global minimum response level.

[0138] The resource occupancy baseline includes CPU occupancy, memory consumption and network delay growth coefficient, which are calculated and updated in real time through a sliding window algorithm.

[0139] In detail, during the enterprise's network monitoring process, multiple types of anomalies may be detected at the same time. For example, at a certain moment, signs of both masquerade attacks (such as abnormal login behavior of certain users, suspected of masquerade) are detected, and at the same time, abnormal resource usage of some devices is found, which may be a prelude to device hijacking. Since the threat level of the device hijacking scenario is higher than that of the masquerade attack scenario, according to the rules, the first-level response corresponding to the device hijacking scenario is selected as the global minimum response level. This means that in this concurrent abnormal situation, the entire network security protection system will initiate the most stringent protection measures in accordance with the requirements of the first-level response, and comprehensively protect and investigate all devices and network areas that may be threatened.

[0140] In a possible implementation, step S152 includes: Step S1521, parsing the IP address segment blocking list and the port prohibition list in the network connection control instruction.

[0141] In detail, when a security threat is detected, a network connection control instruction can be generated. For example, when it is suspected that an external malicious attack source is trying to invade the enterprise network, the IP address segment blocking list in the network connection control instruction may include an external suspicious IP address segment (such as an IP address segment from a specific country or region, which is considered to be related to malicious activities in previous security analysis). The port ban list may include some common ports that are exploited by attacks, such as port 8080 (assuming that this port is found to have a security vulnerability and may be exploited by attackers for malicious access). By parsing these IP address segment blocking lists and port ban lists, the network connection range that the network connection control instruction is to restrict is clarified.

[0142] Step S1522: compare the blocking list with the current active connection list, and if there are overlapping address segments between the blocking list and the current active connection list, generate an address conflict report.

[0143] In this embodiment, the enterprise's network management system maintains a current active connection list, which records the IP addresses and port information of the devices currently communicating in the enterprise network. The IP address segment blocking list and port disabled list in the network connection control instruction are compared with the current active connection list. For example, in the blocking list, there is an IP address segment of 192.168.1.10 - 192.168.1.20, and in the current active connection list, it is found that the IP address of the device that the enterprise marketing department is promoting an important project is 192.168.1.15, which means there is an overlapping address segment. At this time, the system will generate an address conflict report, which records the overlapping IP address segments and related device information in detail.

[0144] Step S1523: According to the overlapping address segments in the address conflict report, query the corresponding device fingerprint features to determine the department to which the device belongs and the business importance level.

[0145] Specifically, based on the overlapping address segments (such as 192.168.1.15) in the address conflict report, the device fingerprint features are queried. The device fingerprint features include the device's MAC address, operating system type, installed software and other information. By querying these device fingerprint features, it can be determined that the department to which the device belongs is the marketing department. Then, based on the business importance assessment criteria pre-set by the enterprise, the business importance level of the device is determined. For example, because the marketing department is promoting an important project, the business importance level of the device is determined to be high.

[0146] Step S1524: re-divide the blocked address segments based on the service importance level so that the connection of the core service device is not affected by the network connection control instruction.

[0147] Specifically, the blocked address segments can be re-divided based on the high business importance level of the marketing department's equipment. For example, the original IP address segment blocking list 192.168.1.10 - 192.168.1.20 is modified to 192.168.1.10 -192.168.1.14 and 192.168.1.16 - 192.168.1.20, thus excluding the IP address 192.168.1.15 of the marketing department's equipment, so that the connection of the core business equipment is not affected by the network connection control command, ensuring the normal promotion of the important projects of the marketing department.

[0148] Step S1525, merging the re-divided blocked address segment into the original network connection control instruction to generate a final control instruction that passes compatibility verification.

[0149] Specifically, the re-divided blocked address segments (192.168.1.10 - 192.168.1.14 and 192.168.1.16 - 192.168.1.20) are merged into the original network connection control instructions, replacing the original IP address segment blocking list. At the same time, the port disabled list remains unchanged, and the final control instruction that passes the compatibility verification is generated. This final control instruction can effectively control network security (blocking suspicious IP address segments and disabling dangerous ports) without affecting the normal network connection of the enterprise's core business equipment.

[0150] In a possible implementation manner, the specific steps of the event slicing processing include: Step S410, taking the time point when the attacker first breaks through the network boundary as the starting slicing point.

[0151] In this embodiment, taking a network attack on the data of the enterprise's R&D department as an example, the attacker exploited an operating system vulnerability that was not updated in time on a test server of the R&D department (assuming it is a specific vulnerability number CVE-2023-5678) and successfully invaded at 3 am on October 15, 2023. This time point is the starting slicing point.

[0152] Step S420, the time point when the attacker obtains key data or triggers the protection mechanism is used as the termination point of the slice.

[0153] In this embodiment, the termination point is the time when the attacker obtains key data (such as the source code file of a core project being carried out by the R&D department) or triggers the protection mechanism. Assume that the attacker successfully obtains the source code file at 8:00 a.m. on October 15, 2023 and begins to transfer it out of the enterprise network. At this time, the enterprise's internal intrusion detection system detects abnormal traffic and triggers the protection mechanism. This 8:00 a.m. is the termination point.

[0154] Step S430, dividing the slices into sub-slices between the start slice point and the end slice point according to fixed time intervals or key operation events.

[0155] For example, between the starting slicing point (3:00 a.m. on October 15, 2023) and the ending slicing point (8:00 a.m. on October 15, 2023), sub-slicing is performed according to fixed time intervals or key operation events.

[0156] If the partition is based on a fixed time interval, let's assume that the sub-slice partition is performed every 30 minutes. In this time period, from 3 am to 8 am, a total of 10 sub-slices are partitioned. At the same time, if there is a critical operation event during this process, the sub-slice partition will also be performed separately. For example, at 4:30 am, the attacker successfully upgraded the privileges on the invaded server. This is a critical operation event, so the sub-slice partition will also be performed at this time point.

[0157] Step S440, extract the following features for each sub-slice: the vulnerability number used, the protocol type adopted for lateral movement, and the hash value of the injected malicious payload.

[0158] For example, in one of the sub-slices (from 4 a.m. to 4:30 a.m.), the vulnerability used by the attacker is CVE-2023-5678 (which may be the same vulnerability as the initial intrusion, or it may be a new vulnerability further discovered by using this initial vulnerability), the protocol type used for lateral movement is SMB protocol (the attacker uses the SMB protocol shared on the enterprise internal network to move from the invaded test server to other R&D devices), and the hash value of the injected malicious payload is 123456789abcdef (assuming that this hash value is obtained by hashing the malicious program injected into the target device).

[0159] Step S450, performing temporal correlation analysis on the sub-slice features and the full life cycle features of the full life cycle data to establish a causal relationship chain of the attack stage case.

[0160] For example, step S450 includes: Step S451, extract the vulnerability number, protocol type and malicious payload hash value in the sub-slice features, and obtain the timestamp interval of the starting slice point and the ending slice point corresponding to each sub-slice.

[0161] For example, for the previously mentioned sub-slice from 4:00 a.m. to 4:30 a.m., the vulnerability number is CVE-2023-5678, the protocol type is SMB protocol, the malicious payload hash value is 123456789abcdef, the timestamp of the starting slice point is 2023-10-15 04:00:00, and the timestamp of the ending slice point is 2023-10-15 04:30:00.

[0162] Step S452, extracting the timestamp starting point of the attack initial stage feature, the timestamp sequence of the lateral movement path feature, and the timestamp end point of the data leakage node feature from the full life cycle features of the full life cycle data to generate a full life cycle timeline.

[0163] In detail, the timestamp starting point of the attack initial stage characteristics (i.e., 3 a.m., October 15, 2023), the timestamp sequence of the lateral movement path characteristics (for example, records of various time points when the attacker moves between different devices, such as a series of time points starting from 4 a.m. when the attacker uses the SMB protocol to move to other devices) and the timestamp end point of the data leakage node characteristics (8 a.m., October 15, 2023) are extracted from the full life cycle characteristics to generate a full life cycle timeline.

[0164] Step S453, mapping the timestamp interval of the sub-slice to the full life cycle timeline, identifying the time overlap area and interval area between adjacent sub-slices, and generating an event sequence pattern.

[0165] For example, there may be an overlap between the end slicing point of a sub-slice (such as 4:30) and the start slicing point of the next sub-slice (such as 4:30), which indicates that the attacker's operation is continuous; if there is an interval area (such as no attacker activity is detected within 10 minutes after the end of a sub-slice, and then there is activity at the beginning of the next sub-slice), this is also part of the event sequence pattern.

[0166] Step S454, matching the vulnerability exploitation path in the lateral movement path feature according to the continuity of the vulnerability numbers in the event sequence pattern, and generating a vulnerability exploitation path matching result.

[0167] For example, if in a series of sub-slices, the vulnerability numbers show continuity from the initial intrusion vulnerability to the gradual exploitation of other related vulnerabilities for privilege escalation or lateral movement, then the corresponding vulnerability exploitation path can be found in the lateral movement path feature. For example, after the attacker exploits the CVE-2023-5678 vulnerability to invade, he gradually expands the scope of control in the enterprise network through a series of related vulnerabilities. The order in which these vulnerabilities are exploited in the lateral movement path feature matches the continuity of the vulnerability numbers in the sub-slices.

[0168] Step S455: Based on the conversion frequency of the protocol type in the time overlap region, the protocol switching node in the lateral movement path feature is associated to generate a protocol switching association mark.

[0169] For example, in the time overlapping area, if it is found that the protocol type is frequently converted from the SMB protocol to other protocols (such as the HTTP protocol used to communicate with external servers), then the corresponding protocol switching node is found in the lateral movement path characteristics (such as the node where the attacker switches from the internal network share to the node that interacts with the external server), and a protocol switching association mark is established.

[0170] Step S456, mapping the malicious payload hash value to the payload injection record in the data leakage node feature through the number of repeated occurrences in the interval area, to generate a payload propagation path.

[0171] For example, if the malicious payload hash value appears repeatedly in the interval area, this may indicate that the attacker spreads the malicious payload between different devices. The corresponding payload injection records are found in the data leakage node features (such as which devices the attacker injected the malicious payload into in order to obtain data), thereby constructing the payload propagation path.

[0172] Step S457, superimposing the vulnerability exploitation path matching result, the protocol switching association mark and the load propagation path in the order of timestamps to generate an initial causal relationship chain.

[0173] For example, in chronological order, first the vulnerability exploitation path matching results show how the attacker gradually exploits the vulnerability to invade and expand permissions, then the protocol switching association mark shows the attacker's protocol conversion in different network operations, and finally the payload propagation path shows the propagation of the malicious payload and the data acquisition process.

[0174] Step S458, detecting whether there is a logical breakpoint in the initial causal relationship chain. If there is a logical breakpoint, supplement the missing vulnerability number or protocol type according to the attack tool usage record in the full life cycle feature to generate a corrected causal relationship chain.

[0175] For example, identify the jump interval of vulnerability numbers of adjacent sub-slices in the initial causal chain that exceeds the preset vulnerability association threshold (assuming that the preset threshold is the maximum interval of adjacent vulnerability numbers in common attack chains is 2. If it is found that the vulnerability numbers of adjacent sub-slices jump beyond this threshold, such as jumping directly from CVE-2023-5678 to a vulnerability that has no connection with the previous one and has a large number difference), the protocol type conversion is not recorded in the lateral movement path feature (such as the initial causal chain shows that the protocol is converted from SMB to a custom protocol that has not appeared in the lateral movement path feature), or the node position where the malicious payload hash value does not appear continuously in the payload propagation path (if there is a missing in the middle of the malicious payload hash value that should appear continuously in the payload propagation path). If there is a logical breakpoint, supplement the missing vulnerability number or protocol type according to the attack tool usage record in the full life cycle feature. For example, if a vulnerability number jump is found and the attack tool usage record shows that the attacker used a specific vulnerability exploit tool, supplement the possible vulnerability number according to the characteristics of this tool, thereby generating a corrected causal chain.

[0176] Step S459, based on the time sequence of the vulnerability exploitation path matching results and the protocol switching association marks in the modified causal relationship chain, verify the consistency of the load propagation path. If there is a time sequence conflict, readjust the mapping relationship of the protocol switching association marks, and perform integrity comparison on the verified modified causal relationship chain with the characteristics of the initial stage of the attack, the characteristics of the lateral movement path and the characteristics of the data leakage node. Delete duplicate associated nodes and merge the operation tracks of the same attack tool to generate the final causal relationship chain.

[0177] Among them, the detection process of the logical breakpoint includes: identifying the node position where the vulnerability number jump interval of adjacent sub-slices in the initial causal chain exceeds the preset vulnerability association threshold, the protocol type conversion is not recorded in the lateral movement path characteristics, or the malicious payload hash value does not appear continuously in the payload propagation path.

[0178] If in the corrected causal chain, the vulnerability exploitation path matching result shows that the attacker first exploits the vulnerability on a certain device to obtain certain permissions, and then the protocol switching association mark indicates that the attacker switches the protocol to communicate with the outside, according to this time sequence, the payload propagation path should be to spread the malicious payload from the device that obtains the permission. If there is a time sequence conflict (such as the payload propagation path shows that the malicious payload first appears on the device that does not obtain the permission), then the mapping relationship of the protocol switching association mark is readjusted to make the entire corrected causal chain reasonable in time sequence.

[0179] Furthermore, if there are vulnerability exploitation nodes in the corrected causal chain that are repeated with the characteristics of the initial stage of the attack, only one will be retained; if there are multiple operation tracks of the same attack tool (such as using the same hacker script) in the lateral movement path characteristics, they will be merged into a continuous operation track, and finally a complete, concise and logically coherent final causal chain will be obtained. This final causal chain can accurately describe the development process of the entire network attack incident, and provide important basis for subsequent security analysis, protection strategy formulation, etc.

[0180] Figure 2 The hardware structure of the remote office protection system 100 provided in the embodiment of the present application is shown as follows: Figure 2 As shown, the remote office protection system 100 may include a processor 110 , a machine-readable storage medium 120 , a bus 130 , and a communication unit 140 .

[0181] In one possible design, the remote office protection system 100 can be a single server or a server group. The server group can be centralized or distributed (for example, the remote office protection system 100 can be a distributed system). In some embodiments, the remote office protection system 100 can be local or remote. For example, the remote office protection system 100 can access information and / or data stored in a machine-readable storage medium 120 via a network. For another example, the remote office protection system 100 can be directly connected to the machine-readable storage medium 120 to access the stored information and / or data. In some embodiments, the remote office protection system 100 can be implemented on a server. By way of example only, the server may include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an internal cloud, a multi-layer cloud, or the like, or any combination thereof.

[0182] The machine-readable storage medium 120 may store data and / or instructions. In some embodiments, the machine-readable storage medium 120 may store data obtained from an external terminal. In some embodiments, the machine-readable storage medium 120 may store data and / or instructions that the remote office protection system 100 uses to execute or use to complete the exemplary methods described in this application.

[0183] During the specific implementation process, one or more processors 110 execute computer executable instructions stored in the machine-readable storage medium 120, so that the processor 110 can execute the remote office network security protection method based on big data as described in the above method embodiment. The processor 110, the machine-readable storage medium 120 and the communication unit 140 are connected through the bus 130, and the processor 110 can be used to control the sending and receiving actions of the communication unit 140.

[0184] The specific implementation process of the processor 110 can refer to the various method embodiments executed by the above-mentioned remote office protection system 100. The implementation principles and technical effects are similar, and this embodiment will not be repeated here.

[0185] In addition, an embodiment of the present application also provides a readable storage medium, in which computer executable instructions are preset. When the processor executes the computer executable instructions, the above-mentioned remote office network security protection method based on big data is implemented.

[0186] It should be noted that in order to simplify the description disclosed in the present application and thereby facilitate the understanding of one or more embodiments of the invention, in the foregoing description of the embodiments of the present application, various features are sometimes grouped into one embodiment, drawing or description thereof.

Claims

1. A remote office network security protection method based on big data, characterized in that: The method comprises: Acquire network activity data generated by multiple terminal devices in a remote office scenario, wherein the network activity data includes traffic data, device status data, and user behavior data; Performing a multi-dimensional security feature analysis on the network activity data to generate a dynamic security feature set corresponding to the network activity data, wherein the dynamic security feature set includes traffic features, device fingerprint features, and behavior pattern features; Based on the dynamic security feature set, the network activity data is subjected to abnormal behavior identification through a multi-layer anomaly detection model, and an anomaly detection result including anomaly type and anomaly confidence is output; According to the anomaly detection result, a target protection strategy corresponding to the anomaly type is matched from a preset protection strategy library, and a dynamic weight adjustment is performed on the target protection strategy based on the anomaly confidence level to generate a real-time protection strategy instruction; The real-time protection strategy instructions are executed to synchronously regulate the network connection, device permissions and user access paths in the remote office scenario, and the regulated network status data is fed back to the multi-layer anomaly detection model to optimize the anomaly identification logic.

2. The remote office network security protection method based on big data according to claim 1 is characterized in that: The performing multi-dimensional security feature analysis on the network activity data to generate a dynamic security feature set corresponding to the network activity data includes: Extracting the protocol type distribution characteristics, data packet transmission frequency characteristics and target address clustering characteristics from the traffic data to form the traffic characteristics; Parsing device hardware identification features, operating system vulnerability features, and process resource occupancy features from the device status data to form the device fingerprint features; Identifying login time series features, file operation trajectory features, and permission change history features from the user behavior data to form the behavior pattern features; Aligning the traffic features, device fingerprint features, and behavior pattern features according to a time window, performing cross-dimensional correlation analysis on the aligned features, and generating the dynamic security feature set; Among them, the cross-dimensional correlation analysis includes: identifying abnormal data transmission paths based on the target address clustering features in the traffic features and the file operation trajectory features in the behavior pattern features; detecting potential threats of mismatch between resource consumption and traffic based on the process resource occupancy features in the device fingerprint features and the data packet transmission frequency features in the traffic features.

3. The remote office network security protection method based on big data according to claim 1 is characterized in that: The multi-layer anomaly detection model includes a primary detection layer, an intermediate aggregation layer, and a high-level decision layer; Based on the dynamic security feature set, the network activity data is subjected to abnormal behavior identification through a multi-layer anomaly detection model, and an anomaly detection result including anomaly type and anomaly confidence is output, including: Inputting the dynamic security feature set into the primary detection layer, performing independent anomaly scoring on the traffic features, device fingerprint features, and behavior pattern features, respectively, to obtain a primary anomaly score set; Inputting the primary anomaly score set into the intermediate aggregation layer, performing combined weight calculation on multiple primary anomaly scores according to a preset threat scenario template, and generating an intermediate anomaly aggregation index; Input the intermediate anomaly aggregation index into the high-level decision layer, combine the pattern matching results in the historical anomaly case library and the real-time network environment parameters, calculate the anomaly confidence and determine the anomaly type; The threat scenario template defines the following combination logic: when the traffic feature anomaly score is higher than the first set score and the behavior pattern feature anomaly score is lower than the second set score, it is marked as a disguise attack scenario; when the device fingerprint feature anomaly score continues to increase and is negatively correlated with the traffic feature anomaly score, it is marked as a device hijacking scenario; The step of matching a target protection strategy corresponding to the abnormality type from a preset protection strategy library includes: According to the threat level corresponding to the abnormality type, a candidate strategy set that meets the minimum response level is selected from the protection strategy library; Prioritizing the strategies in the candidate strategy set based on the anomaly confidence, and selecting the strategy with the highest priority as the basic protection strategy; According to the bandwidth load rate, device online status and user role authority in the real-time network environment parameters, the execution parameters of the basic protection strategy are dynamically adapted to generate the target protection strategy; Among them, the dynamic adaptation includes: when the bandwidth load rate is greater than the preset critical value, reducing the traffic monitoring frequency and increasing the device fingerprint verification strength; when it is detected that a user with set permissions is online, retaining the key data access channel while restricting external device access.

4. The remote office network security protection method based on big data according to claim 3 is characterized in that: The executing the real-time protection strategy instruction includes: Decomposing the real-time protection strategy instruction into a network connection control instruction, a device permission reset instruction, and a user access interception instruction; Verify the compatibility of the network connection control instruction with the current network topology structure, and if there is a conflict between the network connection control instruction and the current network topology structure, reallocate the IP address pool according to the device fingerprint feature; According to the device permission reset instruction, the file read and write permissions and the peripheral interface enablement status of the target device are modified in batches, and a permission difference log before and after the modification is recorded; Based on the user access interception instruction, a virtual access path is injected into the user behavior data to induce the attacker to trigger the protection mechanism, and an encrypted copy of the real access path is backed up; The permission difference log and the encrypted copy are used as the regulated network status data and input into the multi-layer anomaly detection model to update the combination weight calculation rules in the threat scenario template.

5. The remote office network security protection method based on big data according to claim 2 is characterized in that: The extracting the protocol type distribution feature from the traffic data includes: Capturing the nested relationship between the transport layer protocol and the application layer protocol in the traffic data, and identifying unconventional protocol combination patterns; Count the proportion of packets of different protocols under the same source address and generate a protocol distribution vector; Compare the protocol distribution vector with a known malicious protocol library for similarity, and if the similarity is greater than a dynamically set score, mark the corresponding protocol as a risky protocol; The dynamically set score is automatically adjusted according to the proportion of normal business traffic in the current network environment: when the proportion of normal business traffic decreases, the dynamically set score is reduced to expand the risk protocol identification scope.

6. The remote office network security protection method based on big data according to claim 3 is characterized in that: The construction process of the historical abnormal case library includes: Collect the full life cycle data of historical network attack events, extract the characteristics of the initial stage of the attack, the characteristics of the lateral movement path, and the characteristics of the data leakage node; Performing event slicing processing on the full life cycle data to generate multiple independent attack stage cases; Label each attack stage case with a corresponding protection strategy effectiveness label, wherein the protection strategy effectiveness label includes strategy response speed, resource consumption ratio, and false interception rate; Clustering the annotated attack stage cases according to the attack type to form a retrieval index structure of the historical abnormal case library; The retrieval index structure adopts a multi-dimensional hash map, and the dimensions of the multi-dimensional hash map include attack tool hash, vulnerability exploit hash and data encryption method hash.

7. The remote office network security protection method based on big data according to claim 3 is characterized in that: The step of determining the minimum response level includes: Define a mapping table between threat levels and response levels, where the device hijacking scenario corresponds to the first-level response and the camouflage attack scenario corresponds to the second-level response; Monitor the resource usage baseline of the available strategies in the current protection strategy library, and if the resource demand of the available strategies is greater than the upper limit of the system idle resources, raise the minimum response level to the next level; When multiple anomaly types are detected concurrently, the response level corresponding to the anomaly type with the highest threat level is selected as the global minimum response level; The resource occupancy baseline includes CPU occupancy, memory consumption and network delay growth coefficient, which are calculated and updated in real time through a sliding window algorithm.

8. The remote office network security protection method based on big data according to claim 4 is characterized in that: The verifying the compatibility of the network connection control instruction with the current network topology structure includes: Parsing the IP address segment blocking list and the port prohibition list in the network connection control instruction; Comparing the blocking list with the current active connection list, if there are overlapping address segments between the blocking list and the current active connection list, generating an address conflict report; According to the overlapping address segments in the address conflict report, query the corresponding device fingerprint features to determine the department to which the device belongs and the business importance level; Re-dividing the blocked address segments based on the business importance level so that the connection of the core business equipment is not affected by the network connection control instruction; The re-divided blocked address segment is merged into the original network connection control instruction to generate a final control instruction that passes the compatibility verification.

9. The remote office network security protection method based on big data according to claim 6 is characterized in that: The specific steps of the event slicing process include: The starting slicing point is the time when the attacker first breaks through the network boundary; The point at which the attacker obtains key data or triggers the protection mechanism is used as the termination point of the slice; Between the starting slicing point and the ending slicing point, sub-slices are divided according to fixed time intervals or key operation events; The following features are extracted for each sub-slice: the vulnerability number used, the protocol type adopted for lateral movement, and the hash value of the injected malicious payload; Performing temporal correlation analysis on the sub-slice features and the full life cycle features of the full life cycle data to establish a causal relationship chain of the attack stage case; The time series correlation analysis of the sub-slice features and the full life cycle features of the full life cycle data to establish a causal relationship chain of the attack stage case includes: Extract the vulnerability number, protocol type and malicious payload hash value in the sub-slice feature, and obtain the timestamp interval of the starting slice point and the ending slice point corresponding to each sub-slice; Extracting the timestamp starting point of the attack initial stage feature, the timestamp sequence of the lateral movement path feature, and the timestamp end point of the data leakage node feature from the full life cycle features to generate a full life cycle timeline; Mapping the timestamp interval of the sub-slice to the full life cycle timeline, identifying the time overlap region and interval region between adjacent sub-slices, and generating an event sequence pattern; According to the continuity of the vulnerability numbers in the event sequence pattern, matching the vulnerability exploitation path in the lateral movement path feature to generate a vulnerability exploitation path matching result; Based on the conversion frequency of the protocol type in the time overlap region, associating the protocol switching nodes in the lateral movement path feature to generate a protocol switching association mark; By mapping the malicious payload hash value to the payload injection record in the data leakage node feature through the number of repeated occurrences in the interval area, a payload propagation path is generated; Superimposing the vulnerability exploit path matching results, protocol switching association marks, and payload propagation paths in timestamp order to generate an initial causal relationship chain; Detect whether there is a logical breakpoint in the initial causal relationship chain. If there is a logical breakpoint, supplement the missing vulnerability number or protocol type according to the attack tool usage record in the full life cycle feature to generate a corrected causal relationship chain; Verify the consistency of the load propagation path according to the time sequence of the vulnerability exploitation path matching result and the protocol switching association mark in the modified causal relationship chain, and readjust the mapping relationship of the protocol switching association mark if there is a time sequence conflict; The verified corrected causal chain is compared with the characteristics of the initial stage of the attack, the characteristics of the lateral movement path, and the characteristics of the data leakage node for integrity, and duplicate associated nodes are deleted and the operation tracks of the same attack tool are merged to generate the final causal chain; Among them, the detection process of the logical breakpoint includes: identifying the node position where the vulnerability number jump interval of adjacent sub-slices in the initial causal chain exceeds the preset vulnerability association threshold, the protocol type conversion is not recorded in the lateral movement path characteristics, or the malicious payload hash value does not appear continuously in the payload propagation path.

10. A remote office protection system, characterized in that: The remote office protection system includes a processor and a memory, the memory is connected to the processor, the memory is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the memory to implement the remote office network security protection method based on big data as described in any one of claims 1 to 9.

Images