Network security risk identification method and device, storage medium and electronic equipment

Abstract

The invention discloses a network security risk identification method and device, a storage medium and electronic equipment. Relates to the field of network security detection, and the method comprises the steps: obtaining endogenous threat intelligence data of a to-be-detected network device, the endogenous threat intelligence data comprising risk scores corresponding to a plurality of attack source IPs; multiple pieces of external threat intelligence data are obtained, the multiple pieces of external threat intelligence data are in one-to-one correspondence with the multiple data sources, and the external threat intelligence data comprise original malicious probabilities corresponding to multiple attack source IPs obtained under the corresponding data sources; the original malicious probability represents the probability that the corresponding attack source IP obtained under the corresponding data source is a malicious attack IP; and determining a network security identification result of the to-be-tested network device based on the endogenous threat intelligence data and the plurality of external threat intelligence data. According to the invention, the technical problem of low network security risk identification accuracy in related technologies is solved.

Description

Technical Field

[0001] This invention relates to the field of network security detection, and more specifically, to a method, apparatus, storage medium, and electronic device for identifying network security risks. Background Technology

[0002] With the rapid development of network technology and the continuous expansion of application scenarios, network security risks are becoming increasingly complex and volatile. Rule-based and signature-based protection measures are no longer sufficient to comprehensively and effectively address current network threats. Against this backdrop, threat intelligence, as an emerging security concept and tool, has gained widespread application and attention. Threat intelligence provides a deep understanding of the methods, motivations, and goals of network attackers, helping organizations predict and defend against future network attacks.

[0003] However, threat intelligence data currently comes from diverse sources, including commercial intelligence, open-source intelligence, and internal monitoring intelligence. These different sources vary in coverage, accuracy, and real-time performance, leading to low accuracy in identifying cybersecurity risks. For example, commercial intelligence typically has high accuracy, but its coverage may be limited; while open-source intelligence has broad coverage, its accuracy and real-time performance are often poor. Furthermore, the lack of effective multi-source intelligence fusion mechanisms makes it difficult to coordinate intelligence data from different sources, resulting in biases and omissions in the identification results and reducing the overall effectiveness of cybersecurity risk identification.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, storage medium, and electronic device for identifying cybersecurity risks, in order to at least solve the technical problem of low accuracy in identifying cybersecurity risks in related technologies.

[0006] According to one aspect of the present invention, a network security risk identification method is provided, comprising: acquiring endogenous threat intelligence data of a network device under test, wherein the endogenous threat intelligence data includes risk scores corresponding to multiple attack source IPs; acquiring multiple external threat intelligence data, wherein the multiple external threat intelligence data correspond one-to-one with multiple data sources, and the external threat intelligence data includes the original malicious probability corresponding to each of the multiple attack source IPs obtained from the corresponding data source, the original malicious probability representing the probability that the corresponding attack source IP obtained from the corresponding data source is a malicious attack IP; and determining the network security identification result of the network device under test based on the endogenous threat intelligence data and the multiple external threat intelligence data.

[0007] According to another aspect of the present invention, a network security risk identification device is also provided, comprising: an intrinsic threat intelligence data acquisition module, configured to acquire intrinsic threat intelligence data of a network device under test, wherein the intrinsic threat intelligence data includes risk scores corresponding to multiple attack source IPs; a multi-source threat intelligence data acquisition module, configured to acquire multiple external threat intelligence data, wherein the multiple external threat intelligence data correspond one-to-one with multiple data sources, and the external threat intelligence data includes the original malicious probability corresponding to each of the multiple attack source IPs acquired under the corresponding data source, the original malicious probability representing the probability that the corresponding attack source IP acquired under the corresponding data source is a malicious attack IP; and a network security identification module, configured to determine the network security identification result of the network device under test based on the intrinsic threat intelligence data and the multiple external threat intelligence data.

[0008] According to another aspect of the present invention, a non-volatile storage medium is also provided, which stores multiple instructions adapted for a network security risk identification method to be loaded by a processor and executed at any one of them.

[0009] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the network security risk identification method described above.

[0010] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the network security risk identification method described above.

[0011] In this embodiment of the invention, by acquiring endogenous threat intelligence data of the network device under test, wherein the endogenous threat intelligence data includes risk scores corresponding to multiple attack source IPs; and acquiring multiple external threat intelligence data, wherein the multiple external threat intelligence data correspond one-to-one with multiple data sources, and the external threat intelligence data includes the original malicious probability corresponding to each of the multiple attack source IPs obtained from the corresponding data source, the original malicious probability representing the probability that the corresponding attack source IP obtained from the corresponding data source is a malicious attack IP; and based on the endogenous threat intelligence data and the multiple external threat intelligence data, determining the network security identification result of the network device under test, the purpose of comprehensively analyzing the endogenous threat intelligence data and the multi-source external threat intelligence data to accurately identify network security risks is achieved, thereby realizing a more accurate and comprehensive network security risk identification, effectively improving the technical effect of network threat detection accuracy, and thus solving the technical problem of low accuracy in network security risk identification in related technologies. Attached Figure Description

[0012] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0013] Figure 1 This is a flowchart of a network security risk identification method according to an embodiment of the present invention;

[0014] Figure 2 This is a flowchart of an optional network security risk identification method according to an embodiment of the present invention;

[0015] Figure 3 This is a schematic diagram of a network security risk identification device according to an embodiment of the present invention. Detailed Implementation

[0016] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0017] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0018] First, to facilitate understanding of the embodiments of the present invention, some terms or nouns involved in the present invention will be explained below:

[0019] Threat intelligence refers to various information about cybersecurity threats, including knowledge about the source, target, means, and impact of threats.

[0020] According to an embodiment of the present invention, a method embodiment for identifying network security risks is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0021] Figure 1 This is a flowchart of a network security risk identification method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0022] Step S102: Obtain the intrinsic threat intelligence data of the network device under test, wherein the intrinsic threat intelligence data includes the risk scores corresponding to each of the multiple attack source IPs;

[0023] Optionally, endogenous threat intelligence data refers to threat intelligence collected and generated by the security monitoring system or tools within the network device under test. This can be network security threat information related to the device itself, obtained through methods such as network attack monitoring or proactive capture by internet honeypots. This intelligence directly reflects the actual attack behaviors and characteristics occurring on the network devices within an organization or enterprise. Endogenous threat intelligence data includes the identification of multiple attack source IPs, each with a corresponding risk score. This score can be calculated based on various factors, such as the frequency, type, intensity of the attack, and the importance of the attacked target. For example, an IP address might be assigned a high risk score due to multiple unauthorized attempts to access a server with a high level of protection. Endogenous threat intelligence data can be generated by, but is not limited to, monitoring and recording abnormal behaviors in network traffic through security monitoring devices (i.e., security tools such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Firewalls (FW), and traffic analysis systems) deployed on critical network nodes. These abnormal behaviors can then be quantitatively assessed and converted into risk scores using data mining and analysis techniques, thus forming endogenous threat intelligence data.

[0024] In one optional embodiment, acquiring the inherent threat intelligence data of the network device under test includes: obtaining the risk score of any one of multiple attack source IPs through the following methods: acquiring attack information of any one attack source IP detected by multiple types of security tools, wherein the attack information includes multiple attacks, the number of attacks corresponding to each of the multiple attacks, and the attack weight corresponding to each of the multiple attacks; obtaining the risk score of any one attack source IP based on the attack information of any one attack source IP detected by multiple types of security tools; obtaining the risk scores corresponding to each of the multiple attack source IPs using the same method as obtaining the risk score of any one attack source IP; and obtaining the inherent threat intelligence data based on the risk scores corresponding to each of the multiple attack source IPs.

[0025] Optionally, detailed information on all attack activities detected by various security tools (such as IDS, IPS, firewalls, traffic analysis systems, etc.) against any specific attack source IP is collected and analyzed. This information includes not only different types of attacks (such as Distributed Denial of Service (DDoS) attacks, Structured Query Language (SQL) injection, malware propagation, etc.), but also the frequency (i.e., number of attacks) of each type of attack and the attack weights assigned based on the severity of the attack type and the reliability of the detection tools. Next, based on the number of attacks and the attack weights for each attack type, an overall risk score is derived for that attack source IP. This calculation process fully considers the potential impact of different attack types on network security and the accuracy and reliability of security tools, ensuring the objectivity and scientific validity of the risk score. Subsequently, the above quantitative analysis process is applied to all monitored attack source IPs, generating a set containing the risk score for each IP. By summarizing and integrating these risk scores, a comprehensive endogenous threat intelligence dataset reflecting the threat situation faced by the network device under test is formed, providing a solid foundation for subsequent integration with external threat intelligence. The generation of endogenous threat intelligence data not only reveals the actual threat level within a network but also provides crucial data support for the customization and optimization of cybersecurity strategies. The advantage of this approach lies in its ability to dynamically adjust weights based on the diversity of attacks and the different characteristics of monitoring tools, thereby improving the accuracy and practicality of risk assessments.

[0026] In one optional embodiment, the risk score of any attack source IP is obtained based on the attack information detected by each of the multiple security tools. This includes: determining the weighted score corresponding to each of the multiple security tools based on the attack information detected by each of the multiple security tools, wherein the weighted score is obtained by weighting the number of attacks detected by each security tool and the attack weights of each attack; and obtaining the risk score of any attack source IP based on the weighted score corresponding to each of the multiple security tools.

[0027] Optionally, firstly, for each type of security tool, the attack information detected regarding any given attack source IP includes various types of attacks and their corresponding attack counts and weights. Based on this data, a weighted score is calculated for each type of security tool. This is achieved by multiplying the occurrence count of each attack type by its corresponding attack weight, and then summing all the products. This process essentially quantifies the attack information detected by the security tools. Through weighted calculations, it considers the significant differences in the network threat posed by different attack types, as well as the reliability of the monitoring tools themselves in identifying specific types of attacks. After obtaining the weighted score for each type of security tool for a given attack source IP, the weighted scores of all security tools are combined to finally calculate the overall risk score for that attack source IP. This risk score reflects the potential threat level and urgency posed by the IP address from the perspective of the enterprise or organization where the network device under test is located. In determining the IP risk score, this embodiment considers not only the frequency of attacks (attack counts) but also the nature of the attacks (reflected through attack weights), and the efficiency and accuracy of the monitoring tools in identifying these attacks. By combining the number of attacks with attack weights, a more comprehensive and objective assessment of network risks can be ensured. Furthermore, by weighting monitoring data from different security tools, information from multiple monitoring points can be effectively integrated, reducing the limitations of single-tool monitoring results and improving the reliability and effectiveness of risk assessment.

[0028] In one optional embodiment, the risk score of any attack source IP is obtained based on the weighted scores corresponding to each of the multiple types of security tools, including: determining the correlation scores among the multiple types of security tools, wherein the correlation scores are used to indicate the correlation between attack information detected by different security tools; and summing the weighted scores and correlation scores corresponding to each of the multiple types of security tools to obtain the risk score of any attack source IP.

[0029] Optionally, firstly, it's necessary to assess the correlation between different security tools, that is, the interrelationships between attack information they detect regarding the same attack source IP. The correlation score can be calculated based on various factors. For example, if two or more security tools detect the same type of attack almost simultaneously, or if the attacks they detect form a reasonable attack chain (e.g., scanning first, then attempting intrusion), then their correlation is considered high; otherwise, it's low. Introducing the correlation score considers the consistency and complementarity of monitoring results from different tools, helping to more comprehensively understand the complexity of attack behavior. After determining the weighted scores of multiple security tools and their correlation scores, a more comprehensive and objective attack source IP risk score can be obtained by summing the weighted scores and the correlation scores. This summation not only considers the quantitative assessment of attack information detected by a single security tool but also comprehensively considers the mutual verification and support between the monitoring results of different tools, enabling the final risk score to more accurately reflect the threat status faced by the network. This embodiment introduces a correlation score, providing a more refined risk assessment method. It effectively integrates and utilizes monitoring data from different security tools, improving the accuracy and comprehensiveness of identifying attack source IP threats. The advantage of this method lies in its consideration of not only direct evidence of attack behavior (attack frequency and attack weight) but also the coordination between different monitoring tools. This enables multi-dimensional analysis of network risks and is of great significance for enhancing network security defense capabilities.

[0030] Optionally, external network attack behavior can be detected and discovered based on the enterprise's own various network security monitoring and detection equipment and systems, including intrusion detection systems, intrusion prevention systems, web application firewalls, full traffic security inspection, host protection, internet honeypots, and other security tools (e.g., A, B, C, D, E, etc.). Different security tools can be assigned different weights based on their detection capabilities. Furthermore, by setting correlation analysis rules, different threat risk scores can be generated for different attack source IP addresses, thus producing endogenous threat intelligence. Since the threat intelligence data is extracted and produced based on the enterprise's own attack behavior, it has strong targeting and accuracy. Taking security tools of types A, B, and C as examples, the calculation method for the endogenous threat intelligence IP risk score is as follows: IP Risk Score = ,in, This represents the number of times the i-th type of attack was detected by the Class A security tool. This represents the weight of the i-th attack detected by the Class A security tool; This indicates the number of times the j-th type of attack was detected by the Class B security tool. This represents the weight of the j-th attack detected by the Class B security tool; This indicates the number of times the k-th type of attack was detected by the Class C security tool. This represents the weight of the kth attack detected by the Class C security tool; This represents the score of the association analysis rules formed by tools of types A, B, and C. For example, tool A detects that external IP address N is attacking server M, and tools of types B and C detect that server M attacked server O within 10 minutes. Ultimately, a risk score is obtained for each attack source IP address, forming intrinsic threat intelligence.

[0031] Step S104: Obtain multiple external threat intelligence data, wherein each external threat intelligence data corresponds to a multiple data source. The external threat intelligence data includes the original malicious probability of each of the multiple attack source IPs obtained from the corresponding data source. The original malicious probability represents the probability that the corresponding attack source IP obtained from the corresponding data source is a malicious attack IP.

[0032] Optionally, external threat intelligence data refers to threat information from external intelligence sources, including but not limited to commercial threat intelligence providers, open-source threat intelligence databases, and industry-shared intelligence platforms. Each data source provides threat assessment information for the same set of attack source IPs (consistent with the IPs in the endogenous intelligence), expressed as raw probability of malicious activity. Probability of malicious activity refers to the likelihood that an IP address is considered a malicious attack based on the assessment system of a specific data source. For example, data from a commercial intelligence provider might indicate that the probability of malicious behavior from a particular IP address is 85%. Threat data updates from different intelligence sources can be received periodically or in real-time through methods such as subscriptions, purchases, and sharing agreements. This data needs to undergo preprocessing, such as data cleaning and format conversion, for subsequent analysis and fusion operations.

[0033] Optionally, external threat intelligence data from multiple sources can be collected through purchasing, open-source acquisition, or exchange, and then integrated. After accessing the multi-source intelligence data, to address the issue of inconsistent formats, types, and standards, multi-source intelligence data preprocessing is performed. This involves standardizing heterogeneous threat intelligence data from multiple sources in formats such as single-line, XML, and JSON, including normalization and standardization of formats and styles. For example, the format of the integrated intelligence fields can be determined to be JSON, which is simple to parse, has good universality, and adding or removing fields will not affect the original data processing flow. Further information extraction and integration are then performed, extracting and integrating information from heterogeneous intelligence data sources. This includes enriching data context, extraction, deduplication, despoofing, aging, and encapsulation. Intelligence with different content is integrated, including basic information such as IP addresses and city names, vulnerability intelligence, malware intelligence, abnormal organization intelligence, malicious IPs, malicious Uniform Resource Locators (URLs), and botnet intelligence, and these are then normalized.

[0034] Step S106: Based on the intrinsic threat intelligence data and multiple external threat intelligence data, determine the network security identification result of the network device under test.

[0035] This step aims to provide a comprehensive assessment of the cybersecurity risks faced by the network device under test by combining the analysis of internal and external threat intelligence data. Based on the risk scores of internal threat intelligence data and the raw malicious probability of external threat intelligence data, specific algorithms or models can be used to comprehensively evaluate each attack source IP and calculate the final malicious probability or risk level. For example, a weight adjustment mechanism can be established to dynamically adjust the weights of different intelligence sources based on the consistency and quality of internal and external intelligence, thereby obtaining more accurate identification results. By fusing internal and external intelligence, it is ensured that the assessment process considers both direct evidence from internal monitoring data and a broad perspective from external intelligence, ultimately outputting threat identification results for each attack source to guide the formulation and implementation of security strategies.

[0036] In one optional embodiment, the network security identification result of the network device under test is determined based on endogenous threat intelligence data and multiple external threat intelligence data, including: determining the target malicious probability corresponding to each of the multiple attack source IPs based on multiple external threat intelligence data; and obtaining the network security identification result based on the endogenous threat intelligence data and the target malicious probability corresponding to each of the multiple attack source IPs.

[0037] Optionally, firstly, the threat intelligence data obtained externally is analyzed to calculate a target malicious probability for each attack source IP. This probability value reflects the likelihood that the IP address is identified as engaging in malicious activity by external intelligence. After determining the target malicious probability for each attack source IP, this probability data is deeply integrated with endogenous threat intelligence data. Endogenous threat intelligence, originating from the enterprise's own network monitoring, provides direct and specific risk information about the attack source IP, including risk scores. Combining endogenous threat intelligence data with target malicious probabilities aims to generate more accurate network security identification results through the complementarity of internal and external intelligence. Through calculation and comparison, the endogenous threat intelligence risk score and target malicious probability of each attack source IP are fused. This fusion process can, but is not limited to, using a weighted average method to ensure that the weight of endogenous threat intelligence is reasonably reflected, while also not ignoring the contribution of external intelligence. Ultimately, based on this comprehensive analysis, the obtained network security identification results will more comprehensively reflect the threats faced by the network, providing stronger data support for subsequent defense strategy formulation.

[0038] This embodiment achieves dual verification of threat identification by combining internal and external intelligence. It not only considers the breadth and timeliness of external threat intelligence but also fully utilizes real-time monitoring data from the enterprise's internal network, improving the accuracy and reliability of threat assessment. This method is particularly suitable for identifying security risks in complex network environments, helping security teams more effectively identify and prioritize high-threat attack source IPs, thereby optimizing network security defense strategies and improving overall security levels.

[0039] In one optional embodiment, determining the target malicious probability corresponding to each of the multiple attack source IPs based on multiple external threat intelligence data includes: obtaining the target malicious probability of any attack source IP based on the original malicious probability of any attack source IP in each of the multiple external threat intelligence data from the multiple data sources in the following manner; obtaining the weight value of any attack source IP in each of the multiple data sources; performing a weighted average calculation based on the original malicious probability of any attack source IP in each of the multiple data sources and the weight value of any attack source IP in each of the multiple data sources to obtain the target malicious probability of any attack source IP; and obtaining the target malicious probability corresponding to each of the multiple attack source IPs based on the multiple external threat intelligence data in the same manner as obtaining the target malicious probability of any attack source IP.

[0040] Optionally, threat information about the same attack source IP can be obtained from different external intelligence sources. Each source, based on its own data and analysis, provides a probability assessment of the potential malicious behavior of that IP address, i.e., the raw malicious probability. These intelligence sources may include, but are not limited to, commercial threat intelligence services, open-source intelligence databases, and industry sharing platforms. The malicious probability from each source reflects the assessment of IP threat from different perspectives. A weight value is determined for each data source, reflecting the source's credibility, data quality, coverage, and relevance to the actual threat scenario of the enterprise or organization to which the network device under test belongs. An intelligence source that provides accurate and timely threat intelligence in its historical records may have a higher weight value; conversely, if the source's data updates slowly or is inaccurate, its weight value will be lower. After collecting the raw malicious probabilities and corresponding weight values ​​from all data sources, a weighted average is calculated. The calculation process involves multiplying the raw malicious probability of each source by its weight value, summing all products, and finally dividing by the sum of the weight values ​​to obtain a weighted average target malicious probability. This approach comprehensively considers threat assessments from all intelligence sources, while weighting adjustments ensure that more reliable sources have a greater impact on the results. The above process is repeated for all detected attack source IPs, calculating a target malicious probability for each IP address, forming a malicious probability set containing all attack source IPs. This set constitutes a key component of the external threat intelligence data and will be used for subsequent fusion with endogenous threat intelligence data to generate the final network security identification result. This embodiment enables a more accurate assessment of the maliciousness of each attack source IP when integrating data from multiple external threat intelligence sources, thus providing a more reliable basis for risk identification in internal and external intelligence fusion and significantly contributing to improving network security early warning and defense effectiveness.

[0041] In one optional embodiment, obtaining the weight value of any attack source IP in each of the multiple data sources includes: determining the malicious similarity of any attack source IP in each of the multiple external threat intelligence data, wherein the malicious similarity represents the similarity between the malicious information of any attack source IP in the corresponding threat intelligence data and the malicious information in the endogenous threat intelligence data; and determining the weight value of any attack source IP in each of the multiple data sources based on the malicious similarity of any attack source IP in each of the multiple external threat intelligence data.

[0042] Optionally, firstly, calculate the malicious similarity of the attack source IP across each external threat intelligence data source. Malicious similarity reflects the degree of agreement between malicious information about the IP in external intelligence data (such as attack type, frequency, and target) and malicious information about the IP in internal threat intelligence data. Various quantification techniques can be used to calculate malicious similarity, such as comparing key information like attack type and frequency recorded in internal and external threat intelligence to assess their similarity. High malicious similarity indicates good consistency between external and internal intelligence, and vice versa. Based on malicious similarity, determine the weight value of each data source, i.e., its contribution to the calculation of the malicious probability of the attack source IP's final target in subsequent intelligence fusion. Intelligence sources with high malicious similarity have higher weight values ​​because they provide threat information that better matches the enterprise's internal network conditions; similarly, intelligence sources with low malicious similarity have lower weight values ​​to reduce their negative impact on the final result. Dynamic adjustment of weight values ​​allows the intelligence fusion process to adapt more flexibly to changes in the internal and external threat environment.

[0043] This embodiment provides an intelligent multi-source threat intelligence fusion strategy. It automatically adjusts the influence of intelligence sources based on the matching results of internal and external intelligence data, thereby generating more accurate and targeted cybersecurity identification results. The advantage of this method lies in its ability to fully utilize endogenous threat intelligence as a benchmark, optimize the use of external intelligence data, and improve the overall efficiency and accuracy of threat assessment. In the face of a dynamic cyber threat environment, this method can help enterprises or organizations identify and respond to potential security threats more quickly and accurately.

[0044] Optionally, when the values ​​of relevant field attributes differ or contradictory among different intelligence sources, different weights are assigned based on the reputation value of each intelligence source, and a final unique and accurate intelligence result is obtained through a comprehensive weighted average. For example, A, B, and C are three different intelligence sources. A believes that a certain IP has a 90% probability of being "malicious," B believes it has an 80% probability, and C believes it has a 70% probability. During multi-source intelligence fusion, for this IP address, the corresponding IP malice probability (i.e., target malice probability) is obtained as follows: IP malice probability = (weight of A) / (weight of B) / (weight of C ... 90%+B weight 80%+C weight 70%) / 3.

[0045] As an optional implementation, a threat intelligence data quality assessment model can be established to address the problem of large differences in the quality of multi-source intelligence data and the difficulty in assessing it. Specifically, this involves setting the reputation value of intelligence sources in multi-source intelligence aggregation. Based on a fundamental strategy of decreasing reputation values ​​for commercially purchased intelligence, open-source collected intelligence, and exchanged intelligence, different basic weights are assigned to different intelligence sources according to factors such as the timeliness of intelligence data updates, authoritative basic information authorization lists, influence ranking, and intelligence data consistency. Then, endogenous threat intelligence data and multi-source intelligence data are collide-matched to verify external multi-source intelligence data. The more intelligence sources that match, the more accurate the intelligence source is considered, and the reputation value of that intelligence source is automatically adjusted, increasing its computational weight. For example, A, B, and C are threat intelligence data from three different sources, and X is endogenous threat intelligence. Generally, the amount of external intelligence data (A, B, C) is much larger than that of endogenous threat intelligence X, while endogenous threat intelligence X is more accurate. X can be used to verify the accuracy of A, B, and C, thereby dynamically adjusting the weights of A, B, and C.

[0046] Suppose there are 10,000 IP addresses in the intrinsic threat intelligence X, each IP address has its own intrinsic risk score. Input the 10,000 addresses in X into intelligence from three sources, A, B, and C, respectively, query the corresponding malicious identifiers and probabilities, and calculate the similarity of IP malice. For example, if the similarity between X and A is 90%, the similarity between X and B is 70%, and the similarity between X and C is 50%, then after normalizing the similarity, the weight of A is 0.43, the weight of B is 0.33, and the weight of C is 0.24.

[0047] Because both endogenous threat intelligence and external multi-source intelligence are constantly being updated, and the similarity and weight of each intelligence source are also continuously and dynamically adjusted, the entire solution yields multi-source threat intelligence that is richer in content, more accurate, and more applicable.

[0048] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation method. Figure 2 This is a flowchart of an optional network security risk identification method according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes:

[0049] First, based on the enterprise's own various network security monitoring and detection equipment and systems, including intrusion detection systems, intrusion prevention systems, web application firewalls, full-traffic security inspection, host protection, and internet honeypots (e.g., A, B, C, D, E, etc.), external network attack behaviors are detected and discovered. Different security tools can be assigned different weights based on their detection capabilities. Furthermore, by setting correlation analysis rules, different threat risk scores can be generated for different attack source IP addresses, thus producing endogenous threat intelligence. Since the threat intelligence data is extracted and produced based on the enterprise's own attack behaviors, it has strong targeting and accuracy. Taking security tools of types A, B, and C as examples, the calculation method for the endogenous threat intelligence IP risk score is the same as in the aforementioned embodiments, and will not be repeated here.

[0050] Then, threat intelligence data from multiple external sources is collected through purchasing, open-source acquisition, and exchange, and multi-source intelligence is integrated:

[0051] First, after integrating multi-source intelligence data, to address the issue of inconsistent formats, types, and standards, multi-source intelligence data preprocessing is performed. This involves standardizing heterogeneous threat intelligence data from multiple sources, including single-line formats, XML formats, and JSON formats, by normalizing and standardizing formats and styles. For example, the format of the merged intelligence fields can be determined to be JSON, which is simple to parse, has good universality, and adding or removing fields will not affect the original data processing flow.

[0052] Second, information extraction and integration are carried out. Information is extracted and integrated from heterogeneous intelligence data sources, including data context enrichment, extraction, deduplication, despoofing, aging, and encapsulation. Intelligence with different content is integrated, including basic information intelligence such as IP and city name, vulnerability intelligence, malicious software intelligence, abnormal organization intelligence, malicious IP, malicious URL, botnet intelligence, etc., and normalized.

[0053] Third, when aggregating the integrated data, a union approach is used to supplement and enrich the data for different field attributes obtained from different intelligence sources. When the values ​​of related field attributes differ or contradictory across intelligence sources, different weights are assigned based on the reputation value of each intelligence source, and a final, unique, and accurate intelligence result is obtained through a comprehensive weighted average. For example, if A, B, and C are three different intelligence sources, and A believes a certain IP address is "malicious" with a 90% probability, B with an 80% probability, and C with a 70% probability, then during multi-source intelligence fusion, the corresponding IP malicious probability (i.e., target malicious probability) is obtained for that IP address as follows: IP malicious probability = (weight of A) / (weight of B) / (weight of C ... 90%+B weight 80%+C weight 70%) / 3.

[0054] Finally, addressing the issue of significant quality differences and difficulty in assessing multi-source intelligence data, specifically the setting of intelligence source reputation values ​​in multi-source intelligence aggregation, a threat intelligence data quality assessment model was established. This model is based on a fundamental strategy where the reputation values ​​of commercially purchased intelligence, open-source collected intelligence, and exchanged intelligence decrease sequentially. Different basic weights are assigned to different intelligence sources based on factors such as the timeliness of intelligence data updates, authoritative basic information authorization lists, influence ranking, and intelligence data consistency. Then, endogenous threat intelligence data and multi-source intelligence data are collide-matched to verify external multi-source intelligence data. The more intelligence sources that match, the more accurate the intelligence source is considered, and the reputation value of that intelligence source is automatically adjusted, increasing its computational weight.

[0055] Because both endogenous threat intelligence and external multi-source intelligence are constantly being updated, and the similarity and weight of each intelligence source are also continuously and dynamically adjusted, the entire solution yields multi-source threat intelligence that is richer in content, more accurate, and more applicable.

[0056] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties. For example, if there is an interface between this system and the relevant user or organization, before obtaining the relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving the consent information from the aforementioned user or organization.

[0057] This embodiment also provides a network security risk identification device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the terms "module" and "device" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0058] According to embodiments of the present invention, an apparatus embodiment for implementing the above-described network security risk identification method is also provided. Figure 3 This is a schematic diagram of the structure of a network security risk identification device according to an embodiment of the present invention, such as... Figure 3 As shown, the aforementioned network security risk identification device includes: an endogenous threat intelligence data acquisition module 300, a multi-source threat intelligence data acquisition module 302, and a network security identification module 304, wherein:

[0059] The intrinsic threat intelligence data acquisition module 300 is used to acquire intrinsic threat intelligence data of the network device under test. The intrinsic threat intelligence data includes the risk scores corresponding to multiple attack source IPs.

[0060] The multi-source threat intelligence data acquisition module 302 is connected to the endogenous threat intelligence data acquisition module 300 and is used to acquire multiple external threat intelligence data. The multiple external threat intelligence data correspond one-to-one with multiple data sources. The external threat intelligence data includes the original malicious probability of each of the multiple attack source IPs obtained from the corresponding data source. The original malicious probability represents the probability that the corresponding attack source IP obtained from the corresponding data source is a malicious attack IP.

[0061] The network security identification module 304 is connected to the multi-source threat intelligence data acquisition module 302 and is used to determine the network security identification result of the network device under test based on endogenous threat intelligence data and multiple external threat intelligence data.

[0062] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0063] It should be noted that the aforementioned intrinsic threat intelligence data acquisition module 300, multi-source threat intelligence data acquisition module 302, and network security identification module 304 correspond to steps S102 to S106 in the embodiments. The instances and application scenarios implemented by the above modules and their corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should be noted that the above modules, as part of the device, can run on a computer terminal.

[0064] It should be noted that the optional or preferred implementation methods of this embodiment can be found in the relevant descriptions in the embodiments, and will not be repeated here.

[0065] The aforementioned network security risk identification device may also include a processor and a memory. The aforementioned endogenous threat intelligence data acquisition module 300, multi-source threat intelligence data acquisition module 302, network security identification module 304, etc., are all stored in the memory as program modules, and the processor executes the aforementioned program modules stored in the memory to realize the corresponding functions.

[0066] The processor contains a core that retrieves the corresponding program modules from memory. One or more cores may be configured. Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory includes at least one memory chip.

[0067] According to an embodiment of this application, an embodiment of a non-volatile storage medium is also provided. Optionally, in this embodiment, the non-volatile storage medium includes a stored program, wherein, when the program runs, it controls the device where the non-volatile storage medium is located to execute any of the aforementioned network security risk identification methods.

[0068] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals, and the non-volatile storage medium includes stored programs.

[0069] Optionally, a program that controls the device containing the non-volatile storage medium to execute any of the above-mentioned network security risk identification method steps during program execution.

[0070] According to an embodiment of this application, an embodiment of a processor is also provided. Optionally, in this embodiment, the processor is used to run a program, wherein the program executes any of the aforementioned network security risk identification methods during runtime.

[0071] According to an embodiment of this application, an embodiment of a computer program product is also provided, which, when executed on a data processing device, is adapted to execute a program that initializes the network security risk identification method steps described above.

[0072] This invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of any of the above-described network security risk identification methods.

[0073] The order of the above embodiments of the present invention is merely for description and does not represent the superiority or inferiority of the embodiments.

[0074] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0075] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of modules described above can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between modules, and may be electrical or other forms.

[0076] The modules described above as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0077] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0078] If the aforementioned integrated modules are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable non-volatile storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a non-volatile storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned non-volatile storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0079] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A network security risk identification method, characterized by, include: Acquire intrinsic threat intelligence data of the network device under test, wherein the intrinsic threat intelligence data includes risk scores corresponding to multiple attack source IPs; Multiple external threat intelligence data are acquired, wherein each external threat intelligence data corresponds one-to-one with multiple data sources, and the external threat intelligence data includes the original malicious probability corresponding to each of the multiple attack source IPs obtained from the corresponding data source. The original malicious probability represents the probability that the corresponding attack source IP obtained from the corresponding data source is a malicious attack IP. Based on the intrinsic threat intelligence data and the multiple external threat intelligence data, the network security identification result of the network device under test is determined.

2. The method of claim 1, wherein, The acquisition of intrinsic threat intelligence data of the network device under test includes: The risk score of any one of the multiple attack source IPs is obtained in the following manner: The attack information of any attack source IP detected by multiple security tools is obtained, wherein the attack information includes multiple attacks, the number of attacks corresponding to each of the multiple attacks, and the attack weight corresponding to each of the multiple attacks; Based on the attack information detected by each of the various security tools, a risk score is obtained for each attack source IP. The risk scores corresponding to each of the multiple attack source IPs are obtained by using the method of obtaining the risk score of any one of the attack source IPs; The intrinsic threat intelligence data is obtained based on the risk scores corresponding to the multiple attack source IPs.

3. The method according to claim 2, characterized in that, The process of obtaining a risk score for any attack source IP based on attack information detected by each of the multiple security tools includes: Based on the attack information of any attack source IP detected by each of the multiple security tools, a weighted score corresponding to each of the multiple security tools is determined. The weighted score is obtained by weighting the number of attacks detected by each of the multiple attacks by the corresponding security tool and the attack weights of each of the multiple attacks. Based on the weighted scores corresponding to each of the various security tools, the risk score of any attack source IP is obtained.

4. The method according to claim 3, characterized in that, The risk score for any attack source IP is obtained based on the weighted scores corresponding to each of the multiple security tools, including: Determine the correlation score among the multiple types of security tools, wherein the correlation score is used to indicate the correlation between attack information detected by different security tools; The risk score of any attack source IP is obtained by summing the weighted scores of the various security tools and the correlation scores.

5. The method according to claim 1, characterized in that, The determination of the network security identification result of the network device under test based on the endogenous threat intelligence data and the multiple external threat intelligence data includes: Based on the aforementioned external threat intelligence data, the probability of target malice corresponding to each of the aforementioned attack source IPs is determined; Based on the intrinsic threat intelligence data and the target malicious probability corresponding to each of the multiple attack source IPs, the network security identification result is obtained.

6. The method according to claim 5, characterized in that, The determination of the target malicious probability corresponding to each of the multiple attack source IPs based on the multiple external threat intelligence data includes: Based on the original malicious probability of any attack source IP in the multiple external threat intelligence data from each of the multiple data sources, the target malicious probability of any attack source IP is obtained in the following way; Obtain the weight value of each attack source IP from each of the multiple data sources; Based on the original malicious probability of any attack source IP corresponding to each of the multiple data sources, and the weight value of any attack source IP corresponding to each of the multiple data sources, a weighted average calculation is performed to obtain the target malicious probability of any attack source IP. Based on the multiple external threat intelligence data, the target malicious probability corresponding to each of the multiple attack source IPs is obtained in the same way as the target malicious probability of obtaining any one of the attack source IPs.

7. The method according to claim 6, characterized in that, The step of obtaining the weight value of any attack source IP corresponding to each of the multiple data sources includes: Determine the malicious similarity of any attack source IP in each of the multiple external threat intelligence data, wherein the malicious similarity represents the similarity between the malicious information of any attack source IP in the corresponding threat intelligence data and the malicious information in the endogenous threat intelligence data; Based on the malicious similarity of any attack source IP to each of the multiple external threat intelligence data, the weight value of any attack source IP corresponding to each of the multiple data sources is determined.

8. A network security risk identification device, characterized in that, include: An intrinsic threat intelligence data acquisition module is used to acquire intrinsic threat intelligence data of the network device under test, wherein the intrinsic threat intelligence data includes risk scores corresponding to multiple attack source IPs. A multi-source threat intelligence data acquisition module is used to acquire multiple external threat intelligence data, wherein the multiple external threat intelligence data correspond one-to-one with multiple data sources, and the external threat intelligence data includes the original malicious probability corresponding to each of the multiple attack source IPs obtained from the corresponding data source, wherein the original malicious probability represents the probability that the corresponding attack source IP obtained from the corresponding data source is a malicious attack IP. The network security identification module is used to determine the network security identification result of the network device under test based on the endogenous threat intelligence data and the multiple external threat intelligence data.

9. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores multiple instructions, which are adapted to be loaded by a processor and executed by the network security risk identification method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the network security risk identification method according to any one of claims 1 to 7.

Images