Safety operation and maintenance auditing system

Abstract

The invention provides a security operation and maintenance auditing system, which collects original log data generated by a plurality of system components through a log auditing unit, carries out structured processing based on the original log data to obtain a plurality of event triples, and constructs an event graph database based on the event triples. Traversing the event graph database based on a preset rule base at a preset time point to generate an attack behavior chain; a vulnerability scanning unit determines a current risk level of a target asset based on the target asset involved in the attack behavior chain and a log behavior density, an event type, a historical risk level and an abnormal operation frequency corresponding to the target asset in a preset time period, and configures a scanning task scheduling parameter based on the current risk level of the target asset, executing a vulnerability scanning task for the target asset based on the scanning task scheduling parameter; the operation and maintenance auditing unit generates the operation and maintenance request based on the attack behavior chain and / or the execution result of the vulnerability scanning task of each asset, so that the system security is effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of security auditing, and in particular to a security operation and maintenance auditing system. Background Art

[0002] Enterprise operations encompass not only the specific responsibilities and work procedures of various functional departments within an enterprise (such as administration, HR, finance, IT, and sales), but also the company's response mechanisms and institutional safeguards in the face of changes in the external environment. From a micro perspective, enterprise operations can be broken down into a series of standardized operational processes, such as sales order processing, product inbound and outbound management, financial settlement, and customer service feedback. Each step must be executed by the relevant positions according to established systems, authority levels, and operational procedures. From a macro perspective, enterprise operations reflect the company's overall operational efficiency, resource allocation capabilities, and organizational management capabilities. These processes ultimately converge into a dynamic and collaborative system that supports the company in achieving its strategic goals.

[0003] With the rapid development of information technology, business operations are increasingly reliant on information systems. From HR attendance to ERP management, from customer relationship management (CRM) to data analysis and decision-making platforms, nearly every critical business process is closely connected to information systems. Therefore, the availability, stability, and security of information systems directly impact the continuity and reliability of business operations. However, traditional operations and maintenance auditing methods remain largely rudimentary, relying on manual record-keeping, post-analysis, and static configurations. These methods often suffer from issues such as delayed response, crude permission review, and lagging risk monitoring. This model is no longer able to meet the demands of modern enterprises for real-time, efficient, and intelligent security management. Its limitations are particularly pronounced in the face of increasingly complex cyber threats and system compliance pressures. Therefore, building a secure operations and maintenance audit system with proactive monitoring and intelligent identification has become a pressing need for modern enterprises to ensure the security of their information systems and enhance their resilience to operational risks. Summary of the Invention

[0004] The present invention provides a security operation and maintenance audit system to solve the defects of the security operation and maintenance mode in the prior art.

[0005] The present invention provides a security operation and maintenance audit system, comprising: A log audit unit is configured to collect raw log data generated by multiple system components, perform structured processing on the raw log data to obtain multiple event triples, construct an event graph database based on the event triples, and traverse the event graph database based on a preset rule base at a preset time point to generate an attack behavior chain; a vulnerability scanning unit, configured to determine a current risk level of the target asset based on the target asset involved in the attack behavior chain, and the log behavior density, event type, historical risk level, and abnormal operation frequency corresponding to the target asset within a preset time period, and configure scanning task scheduling parameters based on the current risk level of the target asset, so as to execute a vulnerability scanning task for the target asset based on the scanning task scheduling parameters; The operation and maintenance audit unit is used to generate an operation and maintenance request based on the execution results of the attack behavior chain and / or the vulnerability scanning tasks of each asset, and configure operation and maintenance parameters for the operation and maintenance personnel based on the operation and maintenance request.

[0006] According to a security operation and maintenance audit system provided by the present invention, the event graph database is constructed based on the event triples, and the event graph database is traversed based on a preset rule base at a preset time point to generate an attack behavior chain, including: Obtain candidate event triplets whose occurrence times fall within the preset sliding time window and their corresponding event IDs; An event graph database is constructed based on the event subject, event action, and event target in each candidate event triple in the order of occurrence time of the event ID corresponding to the candidate event triple; wherein the nodes in the event graph database correspond to the event subject or event target in the candidate event triple, and the edges in the event graph database correspond to the event actions in the candidate event triple; Based on the preset rule base, the event graph database is traversed to obtain a path that matches any behavior chain template in the preset rule base and in which the occurrence time corresponding to each node satisfies the time constraint corresponding to any behavior chain template, as the attack behavior chain.

[0007] According to a security operation and maintenance audit system provided by the present invention, the length of the sliding time window is dynamically adjusted based on the number of logs in the current unit time; the more logs in the current unit time, the longer the sliding time window.

[0008] According to a security operation and maintenance audit system provided by the present invention, configuring scanning task scheduling parameters based on the current risk level of the target asset includes: Obtain the business level corresponding to each target asset and construct an asset profile table including the risk level and business level of each target asset; Based on the matching of the asset portrait table with the scanning strategy template, the scanning task scheduling parameters corresponding to each target asset are determined.

[0009] According to a security operation and maintenance audit system provided by the present invention, the asset portrait table includes static attributes and dynamic behavior indicators of each target asset; The static attributes include the asset type, business affiliation, risk level, business level, operating role and security domain label of the corresponding target asset; the dynamic behavior indicators include the number of high-risk events, scanning detection records and access frequency of the corresponding target asset within a preset time period.

[0010] According to a security operation and maintenance audit system provided by the present invention, the number of high-risk events is determined based on the number of attack behavior chains including corresponding target assets and the execution results of vulnerability scanning tasks for the corresponding target assets.

[0011] According to a security operation and maintenance audit system provided by the present invention, determining the current risk level of the target asset based on the target asset involved in the attack behavior chain and the log behavior density, event type, historical risk level, and abnormal operation frequency corresponding to the target asset within a preset time period includes: Identify users who access the target asset within a preset time period, and collect authentication information of the users, access operation data for the target asset, and access operation data for other assets; The current risk level of the target asset is determined based on the log behavior density, event type, historical risk level and abnormal operation frequency corresponding to the target asset within a preset time period, as well as the user's authentication information, access operation data for the target asset and access operation data for other assets.

[0012] According to a security operation and maintenance audit system provided by the present invention, the current risk level of a target asset is determined based on the log behavior density, event type, historical risk level, and abnormal operation frequency corresponding to the target asset within a preset time period, as well as the user's authentication information, access operation data for the target asset, and access operation data for other assets, including: Determining the abnormality of the corresponding user based on the authentication information of the user who accessed the target asset within a preset time period, the access operation data for the target asset, and the access operation data for other assets; The current risk level of the target asset is determined based on the log behavior density, event type, historical risk level and abnormal operation frequency corresponding to the target asset within a preset time period, as well as the abnormality of users accessing the target asset within the preset time period.

[0013] According to a security operation and maintenance audit system provided by the present invention, determining the abnormality of a corresponding user based on authentication information of a user accessing the target asset within a preset time period, access operation data for the target asset, and access operation data for other assets includes: Determining a first degree of difference between access operation data of any user for a target asset and access operation data for other assets, and a second degree of difference between access operation data of any user and other users for the same asset; The abnormality degree of any one user is determined based on the first difference degree and the second difference degree.

[0014] According to a security operation and maintenance audit system provided by the present invention, configuring operation and maintenance parameters for an operation and maintenance personnel based on the operation and maintenance request includes: Automatically update the login password of the asset targeted by the operation and maintenance request; Automatically generate batch login files based on the number of operation and maintenance personnel and the modified login passwords.

[0015] The present invention provides a security operation and maintenance audit system, which collects original log data generated by multiple system components through a log audit unit, performs structured processing based on the original log data to obtain multiple event triples, and constructs an event graph database based on the event triples. At a preset time point, the event graph database is traversed based on a preset rule base to generate an attack behavior chain; a vulnerability scanning unit determines the current risk level of the target asset based on the target asset involved in the attack behavior chain, and the log behavior density, event type, historical risk level and abnormal operation frequency corresponding to the target asset within a preset time period, and configures scanning task scheduling parameters based on the current risk level of the target asset to execute vulnerability scanning tasks for the target asset based on the scanning task scheduling parameters; an operation and maintenance audit unit generates an operation and maintenance request based on the execution results of the vulnerability scanning tasks of the attack behavior chain and / or each asset, and configures operation and maintenance parameters for operation and maintenance personnel based on the operation and maintenance request. The system can automatically analyze the attack behavior chain, dynamically perceive the asset risk status, and execute customized scanning strategies for key assets, effectively improving the system's security operation and maintenance capabilities and risk identification capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 It is a structural diagram of the security operation and maintenance audit system provided by the present invention; Figure 2 Schematic diagram of the attack behavior chain generation method provided by the present invention; Figure 3 It is a flow chart of the method for determining the current risk level of a target asset provided by the present invention; Figure 4 It is a flow chart of the scanning task scheduling parameter configuration method provided by the present invention. DETAILED DESCRIPTION

[0018] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0019] Figure 1 This is a schematic diagram of the structure of the security operation and maintenance audit system provided by the present invention. Figure 1 As shown, the system includes: The log audit unit 110 is configured to collect raw log data generated by multiple system components, perform structured processing on the raw log data to obtain multiple event triples, construct an event graph database based on the event triples, and traverse the event graph database based on a preset rule base at a preset time point to generate an attack behavior chain; The vulnerability scanning unit 120 is configured to determine a current risk level of the target asset based on the target asset involved in the attack behavior chain, and the log behavior density, event type, historical risk level, and abnormal operation frequency of the target asset within a preset time period, and configure scanning task scheduling parameters based on the current risk level of the target asset to execute a vulnerability scanning task for the target asset based on the scanning task scheduling parameters; The operation and maintenance audit unit 130 is used to generate an operation and maintenance request based on the execution results of the attack behavior chain and / or the vulnerability scanning tasks of each asset, and configure operation and maintenance parameters for the operation and maintenance personnel based on the operation and maintenance request.

[0020] Specifically, the security operation and maintenance audit system includes three key modules: log audit unit, vulnerability scanning unit and operation and maintenance audit unit.

[0021] First, the core task of the log audit unit is to centrally collect and structure raw log data generated by multiple system components. Log sources include, but are not limited to, edge network devices (such as firewalls, WAFs, IDS / IPS), host devices (such as Linux / Windows servers), database systems (such as MySQL, Oracle, and SQL Server), middleware components (such as Nginx, Tomcat, and Kafka), and application operation logs. The system collects raw log data by configuring multiple collection agents and applying predefined log parsing rules to structure raw log data in various formats, generating multiple event triples. Each event triple contains an event subject, an event action, and an event target, such as [User A logs in to server B], [IP accesses application Y], or [Process P modifies configuration file Z]. The system also adds a timestamp to each event triple to indicate when the corresponding event occurred.

[0022] Based on event triples, an event graph database can be constructed. This event graph database is a directed graph arranged in time series. The nodes of the graph are the event subjects or event targets, including users, hosts, IP addresses, ports, processes, application systems, URLs, data objects, etc. The edges are event actions, representing the operational relationships between nodes (such as connection, access, call, read, and execution).

[0023] In some embodiments, as Figure 2 As shown, the attack behavior chain can be generated as follows: Step 210: Acquire candidate event triples whose occurrence times fall within a preset sliding time window and their corresponding event IDs; Step 220: constructing an event graph database based on the event subject, event action, and event target in each candidate event triple in the order of occurrence time of the event ID corresponding to the candidate event triple; wherein the nodes of the event graph database correspond to the event subject or event target in the candidate event triple, and the edges in the event graph database correspond to the event action in the candidate event triple; Step 230: traverse the event graph database based on the preset rule base to obtain a path that matches any behavior chain template in the preset rule base and in which the occurrence time corresponding to each node satisfies the time constraint corresponding to any behavior chain template, as the attack behavior chain.

[0024] Here, candidate event triplets whose occurrence times fall within a preset sliding time window and their corresponding event IDs are obtained. These candidate event triplets are temporally proximal and may have semantic connections. An event graph database is then constructed based on the event subject, event action, and event target within each candidate event triple, in chronological order of the event IDs corresponding to the candidate event triplets. The length of the sliding time window is dynamically adjusted based on the number of logs in the current unit time. The greater the number of logs in the current unit time, the longer the sliding time window. After the event graph database is constructed, a predefined rule base can be used to traverse it. This rule base consists of multiple behavior chain templates, each of which describes the sequence of operations and temporal characteristics of a typical attack behavior. For example, an attack chain template might represent "external IP login → privilege escalation command execution → access to sensitive files → data outbound," and requires that the time interval between each two adjacent nodes does not exceed 5 minutes. During the traversal process, the system selects a node in the event graph database as a starting point and sequentially searches along the edges in the graph for paths that may match a specific behavior chain template. Whenever the node type, edge type, and behavioral action sequence on a path are consistent with a behavior chain template, and the timestamp differences between all nodes meet the time interval constraints specified by the behavior chain template, the path will be identified as an attack behavior chain.

[0025] After receiving the attack behavior chain detected by the log audit unit, the vulnerability scanning unit automatically extracts the target assets involved in the attack behavior chain. These target assets may be hosts with malicious logins, frequently scanned servers, illegally accessed databases, or service nodes that trigger abnormal behavior. Next, the system creates a profile for each target asset, encompassing the following dimensions: the corresponding log behavior density (i.e., log frequency) within a preset time period, event type (such as authentication failure, access denial, command execution, port change, etc.), historical risk level, and frequency of abnormal operations. Based on the profile of any target asset, the current risk level of that asset can be determined.

[0026] In some embodiments, as Figure 3 As shown, the current risk level of any target asset can be determined based on the following method: Step 310: Determine users who access the target asset within a preset time period, and collect authentication information of the users, access operation data for the target asset, and access operation data for other assets; Step 320, based on the log behavior density, event type, historical risk level and abnormal operation frequency corresponding to the target asset within a preset time period, as well as the user's authentication information, access operation data for the target asset and access operation data for other assets, determines the current risk level of the target asset.

[0027] To determine the current risk level of any target asset, the key is to not only focus on the target asset's own operational trajectory, but also comprehensively analyze the behavior of all users interacting with it and the underlying access patterns. Specifically, users who have accessed the target asset within a preset time period can be identified. For each user who interacts with the target asset, the system further collects authentication information and access operation data. Authentication information includes the user's authentication method (such as password authentication or two-factor authentication), as well as the source IP address and login time. Access operation data includes the user's operational behavior on the target asset during the same time period, as well as access operation data on other assets. This cross-asset behavioral correlation becomes a crucial factor in determining the target asset's risk level. Access operation data for any asset includes command type, operation frequency, requested data range, resource modification actions, and more. Once comprehensive user behavior is collected, this information can be integrated and analyzed with the target asset's own behavioral data. The current risk level of a target asset can be determined based on the target asset's corresponding log behavior density, event type, historical risk level, and abnormal operation frequency within a preset time period, as well as the authentication information of users accessing the target asset, access operation data for the target asset, and access operation data for other assets. This comprehensive assessment mechanism not only determines the risk status of an asset based on its own activities, but also conducts in-depth analysis of global behavioral data such as user behavior, operation paths, and cross-asset access patterns to determine the asset's current risk level, providing a decision-making basis for precise and dynamic security operations and maintenance.

[0028] In some embodiments, when conducting a comprehensive analysis of global behavioral data such as user behavior, operation paths, and cross-asset access patterns, the abnormality of the corresponding user can be determined based on the authentication information of the user who accessed the target asset within a preset time period, the access operation data for the target asset, and the access operation data for other assets. Among them, based on the authentication information, if it is determined that the user has multiple login failures in a short period of time, frequently switches login sources across geographical regions, or uses unauthorized authentication methods, it can be considered that the user's access behavior is suspicious. In addition, based on the user's access operation data for the target asset and the access operation data for other assets, the user's abnormal access behavior can be identified. After integrating these data, the system generates an independent "abnormality degree" for each user. The higher the user's abnormality degree, the more likely their behavior is to be associated with risky operations.

[0029] A first degree of difference between any user's access operation data for a target asset and their access operation data for other assets, as well as a second degree of difference between the user's access operation data for the same asset and that of other users, can be determined. This allows identification of user operation patterns that pose potential security risks by quantifying the differences in user behavior between the target asset and other assets, as well as the deviations in user behavior from other users on the same asset. To quantify the first and second degrees of difference, a vectorization method can be used to encode any user's access operation data for any asset into a feature vector.

[0030] Subsequently, the distance between the feature vector of any user's access operation data for the target asset and the feature vector of the access operation data for another asset can be calculated as the first difference; and the second difference between the feature vector of any user's access operation data for the same asset and that of other users can be calculated. If the user's behavior on the target asset deviates significantly from their regular operations on other assets, for example, the user usually only reads files but suddenly performs batch deletion operations on the target asset, then the first difference will increase significantly, suggesting that the user's access to the target asset may have abnormal intentions. In addition, if the user's access pattern on the target asset is significantly different from that of the vast majority of users, for example, other users only perform read operations, but the user frequently performs write and execute script instructions, then it means that the user's behavior is highly abnormal, and the second difference will also be high.

[0031] Once the first and second differences are calculated, they can be used as input factors to calculate the user's final abnormality using a weighted model. Nonlinear methods, such as SVM classifiers or neural network models, can also be used to train models based on historically labeled samples for high-risk users, further improving recognition accuracy.

[0032] After calculating the user anomaly level, the target asset's log behavior density within the current time window can be analyzed to determine whether the number of generated logs is significantly higher than the historical baseline. (An increase in log density may indicate concentrated asset access or a high number of security incidents.) Event types in the target asset's logs can be analyzed, such as whether there are high-risk operations such as abnormal logins, privilege escalation, sensitive data access, configuration modifications, and file transfers. The target asset's historical risk level can also be retrieved. This historical information serves as static risk information. Furthermore, the frequency of abnormal operations on the asset can be assessed, including significant changes in command execution sequences, unusual network connectivity expansion, access concentration during non-working hours, and the presence of a large number of abnormal alerts in the logs. These dynamic behavioral characteristics reflect the target asset's current potential threat level. This static risk information, along with the dynamic behavioral characteristics and the anomaly level of each user, are then fed into a risk scoring model. The model can employ methods such as rule-based weighting and logistic regression to output the target asset's risk level.

[0033] Based on the risk level, the vulnerability scanning unit configures a set of personalized scanning task scheduling parameters for each target asset, including but not limited to: scanning plug-in combination (such as web application vulnerability plug-in, system configuration plug-in, database security plug-in), task priority (high-risk priority scheduling), execution strategy (concurrent / serial / limited), task window (execution during off-peak hours), and retry strategy for task failures. Based on the target asset's task scheduling parameters, the vulnerability scanning task for that target asset is added to the scheduling queue and executed through the distributed scanning engine.

[0034] In some embodiments, as Figure 4 As shown, you can configure the scan task scheduling parameters for the target asset in the following ways: Step 410: Obtain the business level corresponding to each target asset and construct an asset profile table including the risk level and business level of each target asset; Step 420 : Based on the matching of the asset portrait table and the scanning strategy template, the scanning task scheduling parameters corresponding to each target asset are determined.

[0035] After completing a preliminary risk assessment of target assets involved in the attack chain, business-level information is further integrated to create an asset profile for each target asset, encompassing both security posture and business importance. This profile guides subsequent vulnerability scanning task scheduling. Each target asset's business level reflects its importance in terms of business continuity, service dependencies, or data sensitivity. For example, a database server storing customer transaction data might be labeled "core," while a script node used for batch processing might simply be labeled "normal." Simultaneously, the risk levels of each target asset, previously output, are collected. Once information from both dimensions is collected, they are combined to construct an asset profile. This profile uses business level and risk level as the two axes, with each asset mapped to a specific matrix cell. Next, a predefined library of scanning policy templates is loaded. Each scanning policy template in this library corresponds to a region in the asset profile and contains specific scanning scheduling policies for all assets within that region. Scanning policy templates can include configuration parameters such as whether scanning is permitted during peak business hours, which plugin combinations to use, scanning frequency and retry periods, and concurrent task limits.

[0036] In other embodiments, the asset portrait table may include static attributes and dynamic behavior indicators for each target asset, that is, one dimension corresponds to static attributes and the other dimension corresponds to dynamic behavior indicators. The static attributes include the asset type, business affiliation, risk level, business level, operating role, and security domain label of the corresponding target asset; the dynamic behavior indicators include the number of high-risk events for the corresponding target asset within a preset time period (the number of high-risk events is determined based on the number of attack behavior chains involving the corresponding target asset and the execution results of vulnerability scanning tasks for the corresponding target asset), scan detection records, and access frequency. In this case, a target asset may correspond to one cell in the one-dimensional table corresponding to the static attributes and one cell in the one-dimensional table corresponding to the dynamic behavior indicators, and each scan policy template corresponds to a certain combination of cells in the one-dimensional table corresponding to the static attributes and the one-dimensional table corresponding to the dynamic behavior indicators.

[0037] Based on the target asset's position in the profile table, the system automatically extracts the corresponding scheduling parameters from the policy template library, builds a scan task queue, and invokes the vulnerability scan scheduling engine to send the task to the execution node. This approach ensures that each asset type receives the most appropriate security testing intensity without compromising business continuity, effectively balancing asset security priorities with business continuity requirements, significantly improving the accuracy of scan task execution and operational reliability.

[0038] Finally, the operations audit unit extracts key events from the attack behavior chain and vulnerability scanning task execution results and automatically generates operations requests. These requests are categorized into multiple levels based on system policies, such as "observation events" (subsequent monitoring recommended), "warning events" (remediation recommended), and "disposition events" (immediate response required). For disposition events, refined operations task templates can be pre-built to specify parameters such as the required steps for operations personnel, required permissions, tools or commands to be used, accessible target range, and operation time window. Furthermore, operations parameters can be configured for operations personnel based on the operations request. For example, the login password for the asset targeted by the operation request can be automatically updated, and batch login files can be automatically generated based on the number of operations personnel and the modified login passwords, thereby improving system security and operations efficiency.

[0039] The system provided by the embodiment of the present invention collects original log data generated by multiple system components through a log audit unit, performs structured processing based on the original log data to obtain multiple event triples, and constructs an event graph database based on the event triples. At a preset time point, the event graph database is traversed based on a preset rule base to generate an attack behavior chain; the vulnerability scanning unit determines the current risk level of the target asset based on the target asset involved in the attack behavior chain, and the log behavior density, event type, historical risk level and abnormal operation frequency corresponding to the target asset within a preset time period, and configures scanning task scheduling parameters based on the current risk level of the target asset to execute vulnerability scanning tasks for the target asset based on the scanning task scheduling parameters; the operation and maintenance audit unit generates an operation and maintenance request based on the execution results of the attack behavior chain and / or the vulnerability scanning tasks of each asset, and configures operation and maintenance parameters for the operation and maintenance personnel based on the operation and maintenance request. It can automatically analyze the attack behavior chain, dynamically perceive the asset risk status, and execute customized scanning strategies for key assets, effectively improving the system's security operation and maintenance capabilities and risk identification capabilities.

[0040] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0041] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0042] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A security operation and maintenance audit system, characterized in that: include: A log audit unit is configured to collect raw log data generated by multiple system components, perform structured processing on the raw log data to obtain multiple event triples, construct an event graph database based on the event triples, and traverse the event graph database based on a preset rule base at a preset time point to generate an attack behavior chain; a vulnerability scanning unit, configured to determine a current risk level of the target asset based on the target asset involved in the attack behavior chain, and the log behavior density, event type, historical risk level, and abnormal operation frequency corresponding to the target asset within a preset time period, and configure scanning task scheduling parameters based on the current risk level of the target asset, so as to execute a vulnerability scanning task for the target asset based on the scanning task scheduling parameters; The operation and maintenance audit unit is used to generate an operation and maintenance request based on the execution results of the attack behavior chain and / or the vulnerability scanning tasks of each asset, and configure operation and maintenance parameters for the operation and maintenance personnel based on the operation and maintenance request.

2. A security operation and maintenance audit system according to claim 1, characterized in that: The step of constructing an event graph database based on the event triples, traversing the event graph database based on a preset rule base at a preset time point, and generating an attack behavior chain includes: Obtain candidate event triplets whose occurrence times fall within the preset sliding time window and their corresponding event IDs; An event graph database is constructed based on the event subject, event action, and event target in each candidate event triple in the order of occurrence time of the event ID corresponding to the candidate event triple; wherein the nodes in the event graph database correspond to the event subject or event target in the candidate event triple, and the edges in the event graph database correspond to the event actions in the candidate event triple; Based on the preset rule base, the event graph database is traversed to obtain a path that matches any behavior chain template in the preset rule base and in which the occurrence time corresponding to each node satisfies the time constraint corresponding to any behavior chain template, as the attack behavior chain.

3. A security operation and maintenance audit system according to claim 2, characterized in that: The length of the sliding time window is dynamically adjusted based on the number of logs in the current unit time; the more logs there are in the current unit time, the longer the sliding time window is.

4. A security operation and maintenance audit system according to claim 1, characterized in that: The configuring of the scanning task scheduling parameters based on the current risk level of the target asset includes: Obtain the business level corresponding to each target asset and construct an asset profile table including the risk level and business level of each target asset; Based on the matching of the asset portrait table with the scanning strategy template, the scanning task scheduling parameters corresponding to each target asset are determined.

5. A security operation and maintenance audit system according to claim 4, characterized in that: The asset portrait table includes the static attributes and dynamic behavior indicators of each target asset; The static attributes include the asset type, business affiliation, risk level, business level, operating role and security domain label of the corresponding target asset; the dynamic behavior indicators include the number of high-risk events, scanning detection records and access frequency of the corresponding target asset within a preset time period.

6. A security operation and maintenance audit system according to claim 5, characterized in that: The number of high-risk events is determined based on the number of attack behavior chains involving corresponding target assets and the execution results of vulnerability scanning tasks for the corresponding target assets.

7. A security operation and maintenance audit system according to claim 1, characterized in that: Determining the current risk level of the target asset based on the target asset involved in the attack behavior chain, and the log behavior density, event type, historical risk level, and abnormal operation frequency corresponding to the target asset within a preset time period, includes: Identify users who access the target asset within a preset time period, and collect authentication information of the users, access operation data for the target asset, and access operation data for other assets; The current risk level of the target asset is determined based on the log behavior density, event type, historical risk level and abnormal operation frequency corresponding to the target asset within a preset time period, as well as the user's authentication information, access operation data for the target asset and access operation data for other assets.

8. A security operation and maintenance audit system according to claim 7, characterized in that: Determining the current risk level of the target asset based on the log behavior density, event type, historical risk level, and abnormal operation frequency corresponding to the target asset within a preset time period, as well as the user's authentication information, access operation data for the target asset, and access operation data for other assets, includes: Determining the abnormality of the corresponding user based on the authentication information of the user who accessed the target asset within a preset time period, the access operation data for the target asset, and the access operation data for other assets; The current risk level of the target asset is determined based on the log behavior density, event type, historical risk level and abnormal operation frequency corresponding to the target asset within a preset time period, as well as the abnormality of users accessing the target asset within the preset time period.

9. A security operation and maintenance audit system according to claim 8, characterized in that: The determining of the abnormality of the corresponding user based on the authentication information of the user who accessed the target asset within the preset time period, the access operation data for the target asset, and the access operation data for other assets includes: Determining a first degree of difference between access operation data of any user for a target asset and access operation data for other assets, and a second degree of difference between access operation data of any user and other users for the same asset; The abnormality degree of any one user is determined based on the first difference degree and the second difference degree.

10. A security operation and maintenance audit system according to claim 1, characterized in that: Configuring operation and maintenance parameters for the operation and maintenance personnel based on the operation and maintenance request includes: Automatically update the login password of the asset targeted by the operation and maintenance request; Automatically generate batch login files based on the number of operation and maintenance personnel and the modified login passwords.

Images