A risk asset blocking method, disposal system and storage medium

Abstract

This invention aims to propose a method for blocking risky assets, as well as a risky asset disposal system and storage medium applying this method. Within the network, a core node and various levels of sub-nodes are set up according to a preset hierarchical relationship. Each level node is linked to a firewall at the network egress. Each level node collects network data of assets within its network, analyzes the data to determine whether the asset poses a security risk, and if a risky asset triggers a preset blocking policy of that node and is no longer on the whitelist, the preset blocking action is executed. The risky asset and blocking policy are then reported to the core node. The core node distributes the blocked asset information to each sub-node for appropriate handling. This automatically achieves hierarchical linkage within the network, quickly and effectively blocking further threats from risky assets, thus contributing to network security.

Description

Technical Field

[0001] This invention belongs to the field of cybersecurity risk prevention and control technology for assets, and in particular relates to a method for blocking risky assets and an asset disposal system and storage medium using this method. Background Technology

[0002] With technological advancements, cyberattack methods are rapidly evolving towards high integration, automation, and diversification. This places higher demands on asset management in organizations with stringent security and confidentiality requirements. Particularly as business grows, IT environments become increasingly complex, IT infrastructure expands, and business changes become more frequent. To protect business systems and network data from attacks and prevent the spread of attack incidents, it is necessary to utilize various technical means to monitor local networks and user host environments in real time. Enhancing the detection of server asset exposure surfaces and rapidly addressing and responding to compromised assets plays a crucial role in effectively preventing the spread of threats. Summary of the Invention

[0003] In view of the above background, the present invention aims to propose a method for sealing off risky assets, as well as a risky asset disposal system and storage medium using the method, the specific contents of which are as follows.

[0004] Firstly, a method for blocking risky assets is proposed, comprising: based on data analysis results of a first network, if a first asset triggers a first blocking policy of a first node corresponding to the first network and the first asset is not in the whitelist of the first node, then the blocking action specified by the first blocking policy is executed on the first asset; the first node reports the first asset and the first blocking policy it triggered level by level up to the highest level core node; the core node issues blocking instructions level by level to a second node that belongs to the preset blocking range of the first blocking policy; if the second node determines that the first asset is not in the whitelist of the second node, then the blocking action on the first asset is executed on the corresponding second network.

[0005] Preferably, in the above method, a cascading relationship consisting of at least one level of nodes and their firewalls is first created according to a preset hierarchical relationship. Each level of node coordinates with the firewall of its own network to block the first asset IP. The hierarchical relationship includes organizational structure hierarchy, geographical location or network segment. Each level of node can only interact with data through upper and lower level nodes, and each level of node can only coordinate with the firewall of its own network. The highest level node in the cascading relationship is the core node. The core node configures blocking policies for each level of node and distributes them level by level through agreed interfaces. The blocking policy includes blocking conditions, blocking scope, blocking duration and blocking action.

[0006] Preferably, in the above method, the ban condition is triggered when the first asset triggers at least one of the following conditions: Key requirements, including source IP or destination IP; Threat types include pre-defined threat intelligence matching determined after analyzing the data traffic of assets; Threat level, including when an asset triggers a preset threat type, the asset threat level is determined as high, medium or low based on the threat type and attack phase; The scope of impact is determined by sorting the threat alerts triggered by assets according to their occurrence time to obtain the time sequence of the alerts, thereby obtaining the propagation path of the attack. After deduplicating all IPs involved in the propagation path and excluding IPs not belonging to this organization, the IPs affected by the attack are determined. The number of alarms, specifically those involving the IP address of the asset, has reached a preset threshold.

[0007] Furthermore, the aforementioned blocking scope includes network-wide blocking and designated blocking. Network-wide blocking applies to all subordinate nodes of the core node, while designated blocking applies to nodes specified by the blocking policy. The aforementioned blocking duration is positively correlated with the asset's threat level, scope of impact, and number of alerts; The aforementioned blocking actions include prohibiting an asset from accessing other assets, prohibiting an asset from being accessed by other assets, or prohibiting specific data transfers of an asset.

[0008] Preferably, the above-mentioned blocking policy distribution includes: forming a data set based on the mapping relationship between nodes and blocking policies; the core node distributing the data set to nodes at each level; and each node retrieving its own blocking policy from the received data set until the lowest level node or the data set is empty.

[0009] In addition, the mapping relationship between nodes and blocking policies includes the mapping relationship between node IP and blocking policy ID.

[0010] The above method also includes linking blocking strategies based on preset abnormal behavior scenarios: matching asset data with preset behavioral characteristics to determine the abnormal behavior type of the asset, determining the abnormal behavior scenario to which the abnormal behavior belongs based on the abnormal behavior type, and executing the blocking action on the asset based on the corresponding blocking strategy linked to the abnormal behavior scenario.

[0011] Secondly, this invention also proposes a risk asset disposal system to implement the risk asset blocking method described above. This system includes a cascading relationship consisting of at least one level of nodes and their firewalls. Each level of node includes: The asset data acquisition module is used to collect network data of assets within the local network and report it to the asset risk assessment module. The asset risk assessment module analyzes the network data of assets to determine the level of risk. The risk asset disposal module, based on the asset risk assessment results, works in conjunction with the firewall to execute preset disposal methods on the assets.

[0012] The risk asset disposal module's process for disposing of risk assets includes: Based on the data analysis results of the first network, if the first asset triggers the first blocking policy of the first node corresponding to the first network and the first asset is not in the whitelist of the first node, then the blocking action specified by the first blocking policy will be executed on the first asset. The first node will report the first asset and the first blocking policy it triggered level by level up, until it reaches the highest level of the core node; The core node sends blocking instructions to the second node that is within the preset blocking range of the first blocking policy, level by level; if the second node determines that the first asset does not belong to the whitelist of the second node, then it performs the blocking action on the first asset in the corresponding second network.

[0013] Thirdly, the present invention also proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the risk asset blocking method described above.

[0014] The present invention, employing the above technical solution, has at least the following beneficial effects: Within the network, a core node and various levels of sub-nodes are set up according to a preset hierarchical relationship, with each level node linked to a firewall at the network egress. Each level node collects asset network data within its own network, analyzes the data to determine whether the asset poses a security risk, and if a risky asset triggers a preset blocking policy of that node and is no longer on the whitelist, the preset blocking action is executed, and the risky asset and blocking policy are reported to the core node. The core node then distributes the blocked asset information to each sub-node for appropriate handling. This automatically achieves hierarchical linkage within the network, quickly and effectively blocking further threats from risky assets, thus contributing to network security. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the workflow of an embodiment of the risk asset blocking method of the present invention; Figure 2 This is a schematic diagram of the network structure of an embodiment of the risk asset disposal system of the present invention; Figure 3 The module composition and data flow diagram of a node in an embodiment of the risk asset disposal system of the present invention; Detailed Implementation

[0016] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the application. Furthermore, it should be noted that, for ease of description, only the parts relevant to the application are shown in the accompanying drawings.

[0017] like Figure 1 As shown, an embodiment of a method for blocking risky assets includes: based on data analysis results of a first network, if a first asset triggers a first blocking policy of a first node corresponding to the first network and the first asset is not in the whitelist of the first node, then the blocking action specified by the first blocking policy is executed on the first asset; the first node reports the first asset and the first blocking policy it triggered level by level up to the highest-level core node; the core node issues blocking instructions level by level to a second node that belongs to the preset blocking range of the first blocking policy; if the second node determines that the first asset is not in the whitelist of the second node, then the blocking action on the first asset is executed on the corresponding second network.

[0018] As a preferred implementation, the core node and nodes at all levels in this embodiment can be a network security situation awareness platform, which is responsible for collecting and analyzing data within the network. The platform collects and aggregates traffic logs, security events, security vulnerabilities, and attack logs from security devices such as probes, vulnerability scanners, database auditing, EDR, firewalls, and website security monitoring.

[0019] When the entire organization is connected to only one situational awareness platform and firewall, the data is collected by installing probe software in various subordinate departments or local area networks. The probes then report the data to the situational awareness platform for final analysis and decision-making.

[0020] As a preferred implementation, before the above-mentioned network data collection and analysis, a cascading relationship consisting of at least one level of nodes and their firewalls is created according to a preset hierarchical relationship. Each level of node links with the firewall of its own network to block the first asset IP. For example, the hierarchical relationship can be an organizational structure level, geographical location, or network segment.

[0021] In a preferred implementation, nodes at this level can only interact with each other through nodes at higher and lower levels, and nodes at this level can only link the firewall of their own network. The highest level node in the cascading relationship is the core node. The core node configures blocking policies for each level of nodes and distributes them level by level through agreed interfaces. The blocking policies include blocking conditions, blocking scope, blocking duration, and blocking actions.

[0022] As a preferred implementation, the ban condition is triggered when the first asset triggers at least one of the following conditions: Key requirements, including source IP or destination IP; Threat types include pre-defined threat intelligence matching determined after analyzing the data traffic of assets; Threat level, including when an asset triggers a preset threat type, the asset threat level is determined as high, medium or low based on the threat type and attack phase; The scope of impact is determined by sorting the threat alerts triggered by assets according to their occurrence time to obtain the time sequence of the alerts, thereby obtaining the propagation path of the attack. After deduplicating all IPs involved in the propagation path and excluding IPs not belonging to this organization, the IPs affected by the attack are determined. The number of alarms, specifically those involving the IP address of the asset, has reached a preset threshold.

[0023] As a preferred implementation method, threat type determination can be made by analyzing data traffic through security devices and matching it with shared threat intelligence. Not all threat types can trigger IP blocking. The configuration can be adjusted according to the specific network conditions. For example, if an organization only has an internal network environment, it should focus on threat types such as abnormal account logins, abnormal file outgoing, and Trojans.

[0024] As a preferred implementation method, threat level assessment can be defined as high, medium, and low threats, determined by combining the threat type and the stage of the attack. For example, one method for dividing the attack stages (links) of an advanced cyberattack is: ① Reconnaissance and Tracking: Attackers use social networks, social engineering, and other methods to learn about the target organization's personnel information, IT architecture, and defense measures. This process is the "reconnaissance" phase before the attack. ② Payload Delivery: Based on the reconnaissance and tracking results, attackers purchase or write malicious code that targets existing vulnerabilities in the target organization and conduct evasion tests to ensure the attack can successfully bypass the target organization's existing protection system. Spear-phishing attacks are launched through phishing emails, phishing websites, USB storage, etc., to lure the target to click and download the pre-prepared malicious code. ③ Exploitation: The malicious code is successfully implanted into the target's device and system, and exploits vulnerabilities in the target device and system to gain higher execution privileges. Common methods include brute-force attacks, spear-phishing attacks, watering hole attacks, USB flash drive attacks, accessing malicious links, and malicious emails. ④ Installation and Implantation: Using the successfully obtained execution privileges, attackers control the target device to download more feature-rich malware, install it, and launch the software. ⑤ Communication Control: After the malware is launched, it will actively establish a connection with the attacker's remotely deployed command and control (C&C) server and receive control signals sent by the C&C server; common examples include: DNS covert channel detection (legitimate DNS request baseline, frequency and patterns, information entropy, semantic recognition), abnormal privilege escalation, service monitoring, etc. ⑥ Penetration and Destruction: The attacker uses the C&C server to control the target device to launch further malicious activities, such as scanning for vulnerabilities in other devices on the internal network, intruding into new targets, mining valuable data, or disseminating stolen data.

[0025] If a device's behavior characteristics match the aforementioned "communication control" or "penetration and sabotage" stages, the device can be defined as a "sabotaged device," at which point the device poses a significant threat. Devices that match the first three stages are relatively less threatening and are considered suspicious devices, which can be marked as low threat. Devices that match the fourth stage of installation are mostly between suspicious and sabotaged and can be marked as medium threat. Devices that match the fifth and sixth stages are marked as high risk.

[0026] Furthermore, the aforementioned blocking scope includes both network-wide blocking and targeted blocking. Network-wide blocking applies to all subordinate nodes of the core node, while targeted blocking applies to nodes specified in the blocking policy. The determination of the blocking scope is primarily related to the impact range and magnitude of the alert. The impact range is measured by the number of organizational departments corresponding to the IPs involved in the alert, and the number of IPs within those organizations. The magnitude of the impact is measured by the threat type, threat level, and number of alerts. For example, if a related alert involves IPs from multiple organizational structures or multiple network segments, a network-wide blocking is applied to the IPs; otherwise, only the organization or network segment is targeted for blocking. For example, if the threat type is spyware, the IPs are blocked network-wide. Similarly, if the attack threat level involved in the alert is high, the IPs are blocked network-wide; otherwise, only the organization or network segment is targeted for blocking.

[0027] The duration of a block is positively correlated with the threat level, scope of impact, and number of alerts. For example, some threat types with greater impact have longer block times, higher threat levels have longer block times, higher-level assets involved have longer block times, and more alerts result in longer block times. In practice, these can be pre-defined manually.

[0028] Blocking actions include prohibiting an asset from accessing other assets, prohibiting an asset from being accessed by other assets, or prohibiting specific data transfers of an asset.

[0029] The duration of a ban and the action can also be combined. For example, the platform can define a ban index: duration / action level, so that the combination of duration and level can be selected while ensuring the stability of the ban index.

[0030] As a preferred implementation, the blocking policy distribution includes: forming a data set based on the mapping relationship between nodes and blocking policies; the core node distributing the data set to nodes at each level; and each node retrieving its own blocking policy from the received data set until the lowest level node or the data set is empty.

[0031] In addition, the mapping relationship between nodes and blocking policies includes the mapping relationship between node IP and blocking policy ID.

[0032] As a preferred implementation, the method may further include linking a blocking strategy based on a preset abnormal behavior scenario: matching asset data with preset behavioral characteristics to determine the abnormal behavior type of the asset, determining the abnormal behavior scenario to which the abnormal behavior belongs based on the abnormal behavior type, and executing a blocking action on the asset based on the corresponding blocking strategy linked to the abnormal behavior scenario.

[0033] For example, a "sent file anomaly" scenario is defined, which is divided into anomaly of the destination address of the sent file and anomaly of the target area of ​​the sent file. This scenario is triggered when an asset in the network sends a file to an uncommon address or an uncommon area. Whether this scenario is triggered can be determined based on the asset's sent file protocol audit, internal and external behavior, and whether the behavior is download or upload. Once this scenario is triggered, the preset blocking policy is invoked to block the IP of the destination address or target area across the entire network or a specified subnet.

[0034] As described above, the embodiment of the risk asset blocking method of the present invention sets up a core node and various levels of sub-nodes within the network according to a preset hierarchical relationship. Each level node is linked to a firewall at the network egress. Each level node collects asset network data in its own network, analyzes the data to determine whether the asset poses a security risk, and if the risk asset triggers the preset blocking policy of this node and is no longer on the whitelist, the preset blocking action is executed, and the risk asset and blocking policy are reported to the core node. The core node then distributes the blocked asset information to each sub-node for corresponding processing. This can automatically realize hierarchical linkage within the network, quickly and effectively blocking further threats from risk assets, which is beneficial to ensuring network security.

[0035] like Figure 2 As shown, an embodiment of a risk asset disposal system implements the risk asset blocking method described above. The system includes a cascading relationship consisting of at least one level node and its firewall. Each level node includes: The asset data acquisition module is used to collect network data of assets within the local network and report it to the asset risk assessment module. The asset risk assessment module analyzes the network data of assets to determine the level of risk. The risk asset disposal module, based on the asset risk assessment results, works in conjunction with the firewall to execute preset disposal methods on the assets.

[0036] The risk asset disposal module's process for disposing of risk assets includes: Based on the data analysis results of the first network, if the first asset triggers the first blocking policy of the first node corresponding to the first network and the first asset is not in the whitelist of the first node, then the blocking action specified by the first blocking policy will be executed on the first asset. The first node will report the first asset and the first blocking policy it triggered level by level up, until it reaches the highest level of the core node; The core node sends blocking instructions to the second node that is within the preset blocking range of the first blocking policy, level by level; if the second node determines that the first asset does not belong to the whitelist of the second node, then it performs the blocking action on the first asset in the corresponding second network.

[0037] As described above, the risk asset disposal system embodiment of the present invention sets up a core node and various levels of sub-nodes within the network according to a preset hierarchical relationship. Each level node is linked to a firewall at the network egress. Each level node collects asset network data in its own network, analyzes the data to determine whether the asset poses a security risk, and if the risk asset triggers a preset blocking policy of the node and is no longer on the whitelist, the preset blocking action is executed, and the risk asset and blocking policy are reported to the core node. The core node then distributes the blocked asset information to each sub-node for corresponding handling. This system can automatically achieve hierarchical linkage within the network, quickly and effectively blocking further threats from risk assets, which is beneficial to ensuring network security.

[0038] Thirdly, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc.

[0039] The description of the disclosed embodiments above enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles disclosed herein.

Claims

1. A method for locking up risky assets, characterized in that, include: Based on the data analysis results of the first network, if the first asset triggers the first blocking policy of the first node corresponding to the first network and the first asset is not in the whitelist of the first node, then the blocking action specified by the first blocking policy will be executed on the first asset. The first node will report the first asset and the first blocking policy it triggered level by level up until it reaches the highest level of the core node; The core node sends blocking instructions to the second nodes that fall within the preset blocking range of the first blocking strategy, level by level. If the second node determines that the first asset does not belong to the second node's whitelist, then it will block the first asset on the corresponding second network.

2. The method for locking up risky assets according to claim 1, characterized in that, Based on a preset hierarchical relationship, a cascading relationship consisting of at least one level of nodes and their firewalls is created. Each level of node links with the firewall of its own network to block the first asset IP. The hierarchical relationship includes organizational structure hierarchy, geographical location or network segment. Each level of node can only interact with data through the nodes above and below it, and each level of node can only link with the firewall of its own network. The highest-level node in the cascading relationship is the core node. The core node configures blocking policies for each level of node and distributes them level by level through an agreed interface. The blocking policy includes blocking conditions, blocking scope, blocking duration, and blocking action.

3. The method for locking up risky assets according to claim 2, characterized in that, The ban condition is triggered when the first asset triggers at least one of the following conditions: Key requirements, including source IP or destination IP; Threat types include pre-defined threat intelligence matching determined after analyzing the data traffic of assets; Threat level, including when an asset triggers a preset threat type, the asset threat level is determined as high, medium or low based on the threat type and attack phase; The scope of impact is determined by sorting the threat alerts triggered by assets according to their occurrence time to obtain the time sequence of the alerts, thereby obtaining the propagation path of the attack. After deduplicating all IPs involved in the propagation path and excluding IPs not belonging to this organization, the IPs affected by the attack are determined. The number of alarms, specifically those involving the IP address of the asset, has reached a preset threshold.

4. The method for locking up risky assets according to claim 2, characterized in that, The scope of the blocking includes network-wide blocking and designated blocking. Network-wide blocking applies to all subordinate nodes of the core node, while designated blocking applies to nodes specified by the blocking policy. The duration of the blocking is positively correlated with the threat level of the asset, the scope of its impact, and the number of alerts. The blocking actions include prohibiting an asset from accessing other assets, prohibiting an asset from being accessed by other assets, or prohibiting specific data transmissions of an asset.

5. The method for blocking risky assets according to any one of claims 2-4, characterized in that, The distribution of the blocking policy includes: forming a data set based on the mapping relationship between nodes and blocking policies; the core node distributes the data set to nodes at each level; each node at each level retrieves its own blocking policy from the received data set until the lowest level node or the data set is empty.

6. The method for locking up risky assets according to claim 5, characterized in that, The mapping relationship between nodes and blocking policies includes the mapping relationship between node IPs and blocking policy IDs.

7. The method for locking up risky assets according to claim 1, characterized in that, It also includes linking blocking strategies based on preset abnormal behavior scenarios: matching asset data with preset behavioral characteristics to determine the abnormal behavior type of the asset, determining the abnormal behavior scenario to which the abnormal behavior type belongs based on the abnormal behavior type, and executing the blocking action on the asset based on the corresponding blocking strategy linked to the abnormal behavior scenario.

8. A risk asset disposal system, implementing the risk asset blocking method as described in any one of claims 1-7, the system comprising a cascaded relationship of at least one primary node and its firewall, characterized in that, Each level of node includes: The asset data acquisition module is used to collect network data of assets within the local network and report it to the asset risk assessment module. The asset risk assessment module analyzes the network data of assets to determine the level of risk. The risk asset disposal module, based on the asset risk assessment results, works in conjunction with the firewall to execute preset disposal methods on the assets.

9. The risk asset disposal system according to claim 8, characterized in that, The risk asset disposal module's process for disposing of risk assets includes: Based on the data analysis results of the first network, if the first asset triggers the first blocking policy of the first node corresponding to the first network and the first asset is not in the whitelist of the first node, then the blocking action specified by the first blocking policy will be executed on the first asset. The first node will report the first asset and the first blocking policy it triggered level by level up until it reaches the highest level of the core node; The core node sends blocking instructions to the second nodes that are within the preset blocking range of the first blocking policy, level by level; if the second node determines that the first asset does not belong to the whitelist of the second node, then it performs the blocking action on the first asset in the corresponding second network.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, implements the method for blocking risky assets as described in any one of claims 1-7.

Images