A method and device for identifying lost equipment and evaluating the lost degree of equipment

Abstract

The present invention discloses a method and device for compromising device identification and device compromise assessment, which periodically obtains traffic logs for traffic baseline analysis and anomaly analysis to determine suspicious devices, and simultaneously obtains security logs in real time for correlation analysis to perform a first round of verification on the suspicious devices, and then uses an external threat intelligence library for a second round of verification, and finally combines the attack link of the device determined by anomaly analysis identification and threat intelligence verification to determine whether the suspicious device is a compromising device. This is conducive to further improving the accuracy of identification and quickly detecting and identifying compromising devices; at the same time, specific evaluation factors for the certainty index and threat index are proposed, which is conducive to more intuitive evaluation of the degree of harm of the device.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular, relates to a method for identifying a compromised device, and a method and device for evaluating the compromise degree of the device. Background Art

[0002] The malicious damage or significant losses caused by advanced network attacks aimed at stealing information assets often occur after the target host is compromised, and the compromised host goes through a period of minutes, hours, days or even longer from being hacked to being controlled to launching malicious access behaviors. This type of attack is usually composed of several attack stages, and the possibility of host compromise and the threat after compromise are different at different attack stages. For example, in the "invasion" stage, the target host is often attacked by phishing, vulnerability exploitation, brute force cracking, etc.; once the attack successfully enters the "control" stage, the target host will establish a connection with the remote C&C server and continue to be controlled by the attacker; after the target host is controlled, the "initiate malicious behavior" stage will begin. The controlled host is often used as a springboard for attack to launch a series of threat activities such as scanning attacks, denial of service (DoS / DDoS) attacks, malicious website access, vulnerability intrusion, spyware implantation, data theft, etc. on new targets on the intranet or extranet.

[0003] Compromised host detection attempts to promptly detect and warn hosts during or after they are hacked, so that administrators can quickly take response measures such as isolation, killing, and recovery to minimize the impact of the attack. The accuracy of compromised host identification (detection) affects whether the targeted operations on the host are correct, thereby affecting network operations and business operations.

[0004] The patent with announcement number "CN105915532" determines the host's compromise possibility score and the host's threat score to the organization's assets based on "the host's identity information and the host's scenario score in each scenario. In this way, by analyzing the organization's network traffic, the organization's intranet hosts are scored in multiple preset scenarios, and finally the compromised hosts are found." In this technical solution, as the system deployment scenario changes, the corresponding identification and scoring rules also need to change. A new set of identification rules needs to be formulated for each new scenario, and adaptability needs to be improved.

[0005] The patent application with publication number "CN109660539" proposed the shortcomings of improving scenario analysis. "Based on the generated security events, the device is identified according to the connection direction of the security events, and the attack chain stage and attack direction corresponding to the device are determined to be a suspected compromised device. Then, the suspected compromised device is evaluated for compromise based on the attack chain information, behavioral baseline information, whitelist configuration, etc. of the suspected compromised device. If the compromise score of the suspected compromised device is greater than the compromise threshold, it is determined to be a compromised device." It aims to improve the recognition accuracy and scenario adaptability. This solution is to analyze the security events formed by logs from various sources to obtain suspicious devices, and then evaluate the compromise based on the information of the compromised device to determine whether it is a compromised device. It is mainly through the convergence analysis of multiple information horizontally, lacking vertical step-by-step determination, that is, the source information is not analyzed separately and verified with each other, and the recognition accuracy needs to be further improved; and no specific quantification of the compromise evaluation is proposed. Summary of the invention

[0006] In view of the above, a method and apparatus for compromising device identification and device compromise degree assessment is proposed to address the aspects of the above scheme that need to be improved: namely, the limitations of scene recognition and information aggregation analysis, the lack of mutual verification of different information sources, and the lack of specific quantification of compromise degree assessment.

[0007] In a first aspect, a method for identifying a compromised device includes:

[0008] Periodically obtain the device's traffic log and match it with the normal traffic baseline. If there is abnormal traffic data, list the device as the first suspicious device;

[0009] Perform an anomaly analysis on the first suspicious device, mark the attack link where the device is located, and list the device as a second suspicious device;

[0010] Acquire the security log of the device in real time, perform correlation analysis and save the alarm data; periodically acquire the alarm data, match the information with the second suspicious device, and if the match is successful, list the device as a third suspicious device;

[0011] Matching the third suspicious device with the threat intelligence library, and if the match is successful, listing the device as a fourth suspicious device;

[0012] Determine the attack link of the fourth suspicious device, and if it reaches a specific stage, identify the device as a compromised device.

[0013] Secondly, a method for evaluating the degree of device compromise includes evaluating the certainty and threat of the device; evaluating the degree of compromise of the device through a certainty index, and evaluating the degree of threat of the device through a threat index.

[0014] In a third aspect, a device for identifying a compromised device and assessing the compromised degree of the device includes:

[0015] Log acquisition module, used to obtain log data of the device;

[0016] The data analysis module is used to analyze the log data and mark the attack link of the device;

[0017] Threat intelligence library module, used to receive intelligence information on threat activities reported by security devices and software;

[0018] The compromised device determination module determines the attack link of the suspicious device based on the results of the data analysis module and the threat intelligence library module, and identifies whether the suspicious device is a compromised device;

[0019] The compromise assessment module is used to quantitatively assess the compromise possibility and threat of the device.

[0020] By adopting the above technical scheme, in an embodiment of the present invention, traffic logs are periodically obtained to perform traffic baseline analysis and anomaly analysis to determine suspicious devices, and security logs are simultaneously obtained in real time to perform correlation analysis to perform a first round of verification on the suspicious devices, and then a second round of verification is performed using an external threat intelligence library. Finally, the attack link of the device determined by anomaly analysis identification and threat intelligence verification is combined to determine whether the suspicious device is a compromised device. Overall, this is an identification process that uses periodic and real-time information and external intelligence to perform multiple vertical verifications, which is beneficial to further improve identification accuracy and quickly detect and identify compromised devices. At the same time, specific evaluation factors for the certainty index and threat index are proposed, which is beneficial to more intuitively evaluate the degree of harm of the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a flowchart of a method for identifying a compromised device according to an embodiment of the present invention;

[0022] Figure 2 This is a flow chart of a method for evaluating equipment failure degree according to an embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram of the structure of a device for identifying a compromised device and assessing the degree of compromise of the device, according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and embodiments. In order to facilitate understanding of the embodiments of the present invention, firstly, the related technical terms involved are briefly introduced.

[0025] Advanced cyber attacks aimed at stealing information assets are usually targeted attacks using unknown threats and consist of multiple stages. For example, one of the methods for dividing the attack stages (links) is:

[0026] ① Investigation and tracking: Attackers learn about the personnel information, IT architecture and defense measures of the target organization through social networks and social engineering. This process is the "site-scouting" stage before the attack. Common behavioral characteristics include port scanning, network scanning, system scanning, vulnerability scanning, SSH scanning, etc. Common scanning tools for system vulnerabilities include NESSUS, SSS, ISS, X-scan, Retha, etc. Scanning tools for service ports include Nmap, Super Scan, Amap, etc. Scanning tools for WEB page services include SQL scanner, PHP scanner, upload vulnerability scanner, etc.; and WEB site scanning tools such as Appscan, Acunetix Web Vulnerability Scanner, Jsky, etc.; Scanning tools for databases include shadow Database scanner, NGSSQuirreL, SQL weak password scanner, etc.

[0027] Attackers collect information such as the target network topology, IP distribution, network connection device information, and server distribution through Google Hacking, WHOIS, DNS queries, and network topology scanners (such as Solarwinds).

[0028] ② Payload delivery: Based on the results of target detection and tracking, purchase or write malicious code targeting existing vulnerabilities of the target, and conduct evasion tests to ensure that the attack can successfully bypass the existing protection system of the target organization; launch spear phishing attacks through phishing emails, phishing web pages, USB storage, etc., to lure the target to click and download the malicious code prepared in advance;

[0029] Common methods include: DOS possible Memcached DDoS amplification query (set), VOIP REGISTER message Flood UDP, VOIP INVITE message flood UDP, GPL VOIP SIP INVITE message flood, DOS possible Sentinal LM amplification attack (request) inbound, DOS DNS amplification attack inbound, DOS possible NTP DDoS inbound frequent unauthenticated MON_LIST request IMPL 0x03, etc.

[0030] ③ Penetration and Exploitation: Malicious code is successfully implanted into the target's devices and systems, and exploits vulnerabilities in the target devices and systems to obtain higher execution permissions; common methods include: brute force cracking, spear phishing attacks, watering hole attacks, USB flash drive transfers, access to malicious links, and malicious emails.

[0031] ④Installation and implantation: Using the successfully acquired execution permissions, the target device is controlled to download malware with richer functions, install and start the software.

[0032] ⑤ Communication control: After the malware is launched, it will actively establish a connection with the command and control (C&C) server deployed by the attacker at a remote end, and receive control signals sent by the C&C server; common ones include: DNS covert channel detection (legal DNS request baseline, frequency and regularity, information entropy, semantic recognition), abnormal authority escalation, service monitoring, etc.

[0033] ⑥ Penetration and sabotage: The attacker controls the target device through the C&C server to initiate further malicious actions, such as scanning for vulnerabilities in other devices on the intranet, invading new targets, mining valuable data, or transmitting stolen data;

[0034] Common penetration methods include: TROJAN Windows executable file base64 encoding, INFO suspicious Mozilla user agent - possibly forged (Mozilla / 4.0), MALWARE suspicious user agent, ETPOLICYWin32 / Sogou user agent (SOGOU_UPDATER), MALWARE-CNC Win.Trojan.ZeroAccess outbound connection, etc.

[0035] When the device's behavior characteristics meet the above "communication control" or "penetration and destruction" stage, the device can be defined as a "compromised device", which is a greater threat; while the devices that meet the first three stages are relatively less threatening and are suspicious devices; and the devices that meet the fourth stage are mostly between suspicious and compromised. It should be noted here that the aforementioned attacking or attacked devices include servers, routers, switches, PCs and other terminal devices that can access the network.

[0036] The main content of the compromised device detection of the present invention is to learn the normal behavior baseline and profile of the network based on statistical association analysis, machine learning, behavior baseline analysis and other technologies, collect, monitor and analyze the behavior data of users and machines, and quickly mine abnormal behaviors that deviate from the normal behavior baseline through big data technology, so as to locate suspicious or compromised devices; on the other hand, the threat logs reported by security devices such as next-generation firewalls and the attack and defense information from various other protection software are aggregated into threat intelligence, and the threat information such as known malicious IPs, malicious URLs, malicious DNS resolutions and malicious behavior characteristics extracted from massive threat intelligence are used to compare data with suspicious behaviors that have occurred in the network, so as to quickly detect compromised devices and confirm their stage.

[0037] like Figure 1 The embodiment of the present invention provides a method for identifying a compromised device, including:

[0038] S101, periodically obtain the traffic log of the device and match it with the normal traffic baseline. If there is abnormal traffic data, list the device as a first suspicious device.

[0039] Common device logs include:

[0040] Application access logs: source IP, source port, destination IP, destination port, protocol, login status (login result), geographical location of login IP, number of logins, operation type, operation result, time, user name, user permissions, application type, application name (ID);

[0041] URL access log: URL address, access times;

[0042] File transfer log: file name, file identifier, transfer path, file type, file content;

[0043] Traffic log: sent bytes, received bytes, number of sent packets, number of received packets, start time, end time;

[0044] Host behavior log: login status (login result), geographical location of login IP, number of logins, operation type, operation result, time, user name, user permissions, application type, application name (ID).

[0045] Traditional network traffic tuples (IP, port, protocol) and operation logs and environmental information can characterize the attacker's behavior and motivation. Therefore, by analyzing log information, especially aggregating log data reported by various applications and devices for big data machine learning, specific behavior data can be extracted and corresponding features can be obtained.

[0046] Therefore, in an embodiment of the present invention, certain conditions are preset to perform machine learning on the traffic log of a device. For example, a certain device (working PC) and time period (8 hours working time) are preset, and machine learning and analysis are performed on the traffic log that meets the conditions for a sufficient period of time, so as to obtain a normal traffic baseline for the device within the time period; when it is detected that the traffic of the device (including but not limited to the total traffic volume, peak value, stability, special or super-authorized access type, etc.) exceeds the normal traffic baseline and reaches a specific threshold, it is determined that abnormal traffic has occurred in the device, and the device is listed as the first suspicious device.

[0047] S102, performing an abnormality analysis on the first suspicious device, marking the attack link where the device is located, and listing the device as a second suspicious device.

[0048] The abnormal analysis refers to matching the abnormal traffic data of the first suspicious device with the abnormal analysis model.

[0049] In the embodiment of the present invention, the abnormal analysis includes obtaining a model for dividing abnormal data types and features by machine learning of abnormal data. The model has traffic characteristics of different attack links, so the abnormal data is matched with each attack link in the model library to preliminarily mark the attack link in which the device is located. In this embodiment, the abnormal analysis model includes the traffic characteristics of the aforementioned six attack links (i.e., reconnaissance and tracking, payload delivery, penetration and utilization, installation, communication control and penetration and destruction, etc.), so if the abnormal data successfully matches the abnormal analysis model, the device can be marked as one of the six links.

[0050] At the same time, since traffic logs are obtained periodically for analysis and network attacks are in dynamic change, the matching results of the anomaly analysis model in each cycle may be different links. If the attack spans a long time, it is also possible that the matching results in several cycles are in the same attack link.

[0051] The anomaly analysis process in this step, on the one hand, marks the attack link where the suspicious device is located through the model, and on the other hand, verifies the anomaly of the first suspicious device. That is, if the first suspicious device with abnormal traffic data is successfully matched in the anomaly analysis model matching, the possibility of the first suspicious device being compromised is increased, so the device is listed as the second suspicious device.

[0052] S103, obtaining the security log of the device in real time, performing correlation analysis and saving the alarm data; periodically obtaining the alarm data, matching the information with the second suspicious device, and if the match is successful, listing the device as a third suspicious device.

[0053] Correlation analysis is a rule that users define according to the actual environment to identify the correlation between various security events (log information, alarm information, etc.) in terms of occurrence sequence, post-event impact, etc., and then make preventive responses based on known scenarios. For example, some of the following correlation analysis rules: using part of a single log as an alarm message, such as login, startup, and shutdown in the log can all be used as alarm messages; based on the frequency of occurrence of special events within a unit of time, such as 3 incorrect user passwords in a log within 1 minute can be used as a brute force crack; correlation analysis between multiple device logs, such as many logs with the same target IP address but different source IP addresses can be used as a DDOS attack.

[0054] If the event information matches the correlation analysis rule successfully, an alarm will be generated. The alarm data is stored in the database. By periodically obtaining the log information in the alarm data for analysis, information such as the attack source and attack path can be obtained.

[0055] In an embodiment of the present invention, as a preferred association analysis rule, a rule for performing machine learning analysis on the security log to determine the attack link of the device can be included. If the security log of the device successfully matches the rule, the corresponding alarm data will include the attack link information of the device.

[0056] The analysis process in this step is different from the periodic acquisition of traffic logs for anomaly analysis. It obtains security logs in real time for correlation analysis to obtain alarm data, and then periodically obtains alarm data and matches the anomaly analysis results for information consistency, thus realizing a second verification of the anomaly data.

[0057] S104: Match the third suspicious device with the threat intelligence library. If the match is successful, list the device as a fourth suspicious device.

[0058] The threat intelligence library includes threat log data reported by firewalls, IPS, vulnerability scanners, etc. within the network, as well as intelligence information on massive known threats obtained from the outside.

[0059] In an embodiment of the present invention, threat intelligence may include attack link information of threat activities, that is, characteristic information of various known threat activities in their respective attack links. By matching the data of the third suspicious device with the threat intelligence library, if the match is successful, the possibility of the device being attacked can be further confirmed.

[0060] S105, determining the attack link of the fourth suspicious device, and if it reaches a specific stage, identifying the device as a compromised device.

[0061] Compare the attack link of the third suspicious device with the attack link of the threat intelligence library, and take the highest attack link as the attack link of the fourth suspicious device.

[0062] For example, a suspicious device obtained through anomaly analysis is in the third stage (penetration and exploitation), identified as the fourth stage (installation and implantation) in the alarm data of correlation analysis, and identified as the fifth stage (communication control) in the threat intelligence library. The attack stage of the fourth suspicious device is determined to be the fifth stage (communication control). According to the terminology introduction, the device in the communication control stage has been controlled by the attacker and poses a greater threat. Therefore, the device is identified as a compromised device.

[0063] It should be understood that the above-mentioned attack link includes the attack link where the device acts as an attacker and the attacked link where the device acts as a victim.

[0064] It can be seen that the above-mentioned embodiment of the method for identifying a compromised host uses a variety of information to perform multiple vertical verification and identification, which is conducive to further improving the accuracy of identifying compromised devices.

[0065] like Figure 2 As shown, an embodiment of the present invention provides a method for evaluating the degree of device compromise, which performs compromise evaluation on a suspicious device or a compromised device. The evaluation method includes evaluating the certainty and threat of the device; the certainty is the degree of possible compromise of the evaluated device, and the threat is the degree of threat of the evaluated device.

[0066] The main steps of the above assessment method include:

[0067] S201, specifies the attack aspects that are factors to be evaluated;

[0068] Specifically in the embodiments of the present invention, it includes specifying attack links as deterministic evaluation factors and specifying attack links as threat evaluation factors; among them, the four links of reconnaissance and tracking, payload delivery, penetration and utilization, installation and implantation of anomaly analysis and the attack links of the threat intelligence library are used as factors for evaluating certainty; the six links of reconnaissance and tracking, payload delivery, penetration and utilization, installation and implantation, communication control, and penetration and destruction of anomaly analysis and the attack links of the threat intelligence library are used as factors for evaluating threat.

[0069] S202, obtaining all attack links experienced by the device, that is, recording the attack link information obtained from the anomaly analysis of each cycle.

[0070] S203, acquiring the attack link identified by the threat intelligence library, that is, the corresponding attack link information in the threat intelligence library.

[0071] S204, determining the attack stage the device is in. In this embodiment, the attack stage the device is in is determined according to the method described in S105 above.

[0072] S205, determining the evaluation index based on the evaluation factors. In the embodiment of the present invention, the certainty index of the suspicious device and the threat index of the compromised device are obtained based on whether the attack link of the anomaly analysis is consistent with the attack link of the threat intelligence library, and the completeness, continuity and depth of the attack link identified by the anomaly analysis.

[0073] The following examples illustrate the evaluation process of the certainty index and the threat index. In the embodiment of the present invention, the certainty index is preferably a percentage system, and the higher the value, the greater the possibility of being compromised. Similarly, the threat index is preferably a percentage system, and the higher the value, the greater the degree of harm caused by the device to other systems.

[0074] (1) Evaluation of the certainty index:

[0075] The attack stages experienced by the device recorded in the anomaly analysis are: the first stage of reconnaissance and tracking is x1, the second stage of payload delivery is x2, the third stage of penetration and utilization is x3, and the fourth stage of installation and implantation is x4;

[0076] The threat intelligence database records the attack stages experienced by the device: the first stage is reconnaissance and tracking, which is m1; the second stage is payload delivery, which is m2; the third stage is penetration and exploitation, which is m3; and the fourth stage is installation and implantation, which is m4;

[0077] Because m4 and x4 have mutually reinforcing concepts, and x4 is for x1, x2, and x3, and x1, x2, and x3 will strengthen x4.

[0078] If it is determined according to S105 that the attack link in which the suspicious device is located is the fourth link of installation and implantation, the certainty index evaluation can be performed according to the scores shown in the following table.

[0079] Evaluation factors Certainty Index (Score) x1+x2+x3+x4+m4 98 x2+x3+x4+m4 96 x1+x3+x4+m4 95 x3+x4+m4 94 x1+x2+x4+m4 93 x2+x4+m4 92 x1+x4+m4 90 x4+m4 88 x1+x2+x3+x4 86 x2+x3+x4 84 x1+x3+x4 82 x1+x2+x4 80 x3+x4 79 x2+x4 77 x1+x4 75 m4 73 x4 71

[0080] It can be seen that the priority factor for scoring is the consistency of the attack links of anomaly analysis and threat intelligence, that is, whether both are the fourth link, such as x4+m4 has a higher score than x1+x2+x3+x4; the second is the completeness of the attack links identified by anomaly analysis, that is, whether all links have been experienced, such as x1+x2+x3+x4 has a higher score than x2+x3+x4; the third is the continuity of the attack links identified by anomaly analysis, such as x2+x3+x4+m4 has a higher score than x1+x3+x4+m4; the last is the depth of the attack links identified by anomaly analysis, such as x2+x4+m4 has a higher score than x1+x4+m4.

[0081] (2) Assessment of threat index:

[0082] The attack stages experienced by the device recorded in the anomaly analysis are: the first stage is reconnaissance and tracking, which is x1; the second stage is payload delivery, which is x2; the third stage is penetration and utilization, which is x3; the fourth stage is installation and implantation, which is x4; the fifth stage is communication control, which is X5; and the sixth stage is penetration and destruction, which is X6;

[0083] The threat intelligence database records the attack stages experienced by the device: the first stage is reconnaissance and tracking, which is m1; the second stage is payload delivery, which is m2; the third stage is penetration and utilization, which is m3; the fourth stage is installation and implantation, which is m4; the fifth stage is communication control, which is m5; and the sixth stage is penetration and destruction, which is m6;

[0084] If it is determined according to S105 that the attack link where the compromised device is located is the sixth link of penetration and destruction, the threat index can be evaluated by referring to the scores shown in the following table (because there are many combinations involved, only some are listed as examples).

[0085] Evaluation factors Threat Index (Score) x1+x2+x3+x4+x5+x6+m6 98 x2+x3+x4+x5+x6+m6 96 x1+x3+x4+x5+x6+m6 95 x1+x2+x4+x5+x6+m6 94 x1+x2+x3+x5+x6+m6 93 x1+x2+x3+x4+x6+m6 92 x3+x4+x5+x6+m6 90

[0086] The priority factor for scoring is the consistency of the attack links of anomaly analysis and threat intelligence, that is, whether both are the sixth link, such as x1+x2+x3+x4+x5+x6+m6 has a higher score than x1+x2+x3+x4+x5+x6; the second is the completeness of the attack links identified by anomaly analysis, that is, whether all links have been experienced, such as x1+x2+x3+x4+x5+x6 has a higher score than x1+x2+x3+x4+x5; the third is the continuity of the attack links identified by anomaly analysis, such as x2+x3+x4+x5+x6+m6 has a higher score than x1+x3+x4+ x5+x6+m6; the last is the depth comparison of the attack links identified by anomaly analysis, such as x3+x4+x5+x6+m6 has a higher score than x2+x4+x5+x6+m6.

[0087] In the above-described embodiment of the present invention, a specific quantitative scoring is performed on the degree of device compromise, which is conducive to intuitively determining the possibility and harmfulness of device compromise.

[0088] like Figure 3 As shown, a device 30 for identifying a compromised device and assessing the degree of compromise of a device is used to implement the specific process of identifying a compromised device and assessing the degree of compromise of a device.

[0089] The log acquisition module 301 is used to periodically acquire traffic logs and acquire security logs in real time.

[0090] The data analysis module 302 is used to analyze the log data and mark the attack link of the device, including:

[0091] Baseline analysis unit, which uses machine learning traffic logs to obtain a normal traffic baseline. When the traffic does not meet the normal traffic baseline, the device is identified as a suspicious device;

[0092] The abnormal analysis unit analyzes abnormal traffic data and marks the attack link of the device according to the traffic characteristics of the model;

[0093] The correlation analysis unit analyzes the security log data according to the correlation analysis rules to obtain the alarm data, and periodically obtains the alarm data to verify the accuracy of the abnormal analysis results.

[0094] The threat intelligence library module 303 is used to receive intelligence information on threat activities reported by security devices and software, verify the results of the data analysis module, and combine the attack link identification results of the anomaly analysis unit to ultimately determine the attack link in which the device is located.

[0095] The compromised device determination module 304 determines the attack link of the suspicious device based on the results of the data analysis module and the threat intelligence library module, and identifies whether the suspicious device is a compromised device; when the attack link of the suspicious device reaches a specific stage, such as the communication control or penetration and destruction stage, the device poses a greater threat and the device is identified as a compromised device.

[0096] The vulnerability assessment module 305 is used to quantitatively assess the vulnerability threat of the device.

[0097] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.

[0098] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for identifying a compromised device, characterized in that: include: Periodically obtain the device's traffic log and match it with the normal traffic baseline. If there is abnormal traffic data, list the device as the first suspicious device; Performing an anomaly analysis on the first suspicious device, marking the attack link where the device is located, and listing the device as a second suspicious device; the anomaly analysis includes obtaining a model for classifying the types and characteristics of abnormal data by machine learning on the abnormal data, and the model has traffic characteristics of different attack links; Acquire the security log of the device in real time, perform correlation analysis and save the alarm data; periodically acquire the alarm data, match the information with the second suspicious device, and if the match is successful, list the device as a third suspicious device; The third suspicious device is matched with the threat intelligence library. If the match is successful, the device is listed as the fourth suspicious device; the threat intelligence library has threat intelligence reported by network security devices and software, and the threat intelligence has attack link information of threat activities. The attack link of the device is obtained by matching and identifying; Compare the attack links marked by anomaly analysis with the attack links identified by the threat intelligence library, and take the highest attack link as the attack link of the fourth suspicious device. If it reaches the last two stages of reconnaissance and tracking, payload delivery, penetration and utilization, installation and implantation, communication control and penetration and destruction, the device will be identified as a compromised device.

2. The identification method according to claim 1, characterized in that: The attack link includes the attack link where the device acts as an attacker and the attacked link where the device acts as a victim.

3. The identification method according to claim 1, characterized in that: The identification of the first suspicious device specifically includes: Perform machine learning on the device's traffic logs according to preset conditions to obtain the device's normal traffic baseline; When it is detected that the traffic of a device exceeds the normal traffic baseline and reaches a specific threshold, it is determined that abnormal traffic has occurred in the device and the device is listed as a first suspicious device.

4. The identification method according to claim 1, characterized in that: The marking device's attack link includes: the abnormal analysis model has traffic characteristics of different attack links; the abnormal traffic data of the first suspicious device is matched with the traffic characteristics of the different attack links, and if the match is successful, the corresponding attack link is marked for the device.

5. A method for evaluating the degree of device failure, for evaluating the degree of failure of a suspicious device or a failed device according to any one of claims 1 to 4, characterized in that: The evaluation method includes evaluating the certainty index and threat index of the device, wherein the certainty index is the suspicious degree of the device being compromised, and the threat index is the degree of threat posed by the device to the outside world; The specific process includes: The attack links that serve as deterministic assessment factors and threat assessment factors are specified separately; Obtain all attack links experienced by the device identified by anomaly analysis, and obtain the attack links identified by the threat intelligence library; Compare the highest attack link identified by anomaly analysis with the attack link identified by the threat intelligence library, and take the higher attack link as the attack link the device is in; Scores are assigned to the following evaluation sub-items: the attack link the device is in, the consistency between the highest attack link of the anomaly analysis and the attack link identified by the threat intelligence library, and the completeness, continuity, and depth of the attack link identified by the anomaly analysis; Calculate the sum of the scores of the above assessment sub-items to obtain the certainty index and threat index respectively.

6. A device for identifying a compromised device and assessing the degree of compromise of a device, for assessing the degree of compromise of a suspicious device or a compromised device as claimed in any one of claims 1 to 4, characterized in that: include: Log acquisition module, used to obtain log data of the device; The data analysis module is used to analyze the log data and mark the attack link of the device; Threat intelligence library module, used to receive intelligence information on threat activities reported by security devices and software; The compromised device determination module determines the attack link of the suspicious device and whether the suspicious device is a compromised device based on the results of the data analysis module and the threat intelligence library module; The vulnerability assessment module is used to quantitatively assess the possibility of device vulnerability and threat: score the following assessment sub-items: the attack link the device is in, the consistency between the highest attack link of anomaly analysis and the attack link identified by the threat intelligence library, the completeness, continuity and depth of the attack link identified by anomaly analysis; calculate the sum of the scores of the assessment sub-items to obtain the certainty index and threat index.

7. The device according to claim 6, characterized in that The log acquisition module: periodically acquires traffic logs and acquires security logs in real time; The data analysis module includes: The baseline analysis unit uses machine learning traffic logs to obtain a normal traffic baseline. When the traffic does not meet the normal traffic baseline, the device is identified as a suspicious device. The abnormal analysis unit analyzes abnormal traffic data and marks the attack link of the device according to the traffic characteristics of the model. The correlation analysis unit analyzes the security log data according to the correlation analysis rules to obtain the alarm data, and periodically obtains the alarm data to verify the accuracy of the abnormal analysis results; The threat intelligence module verifies the results of the data analysis module and combines the attack link identification results of the anomaly analysis unit to ultimately determine the attack link in which the device is located; The compromised device determination module identifies the device as a compromised device when the attack link of the suspicious device reaches the latter two stages of reconnaissance and tracking, payload delivery, penetration and utilization, installation and implantation, communication control and penetration and destruction.

Images