Security event mining method, device, storage medium and electronic device

Abstract

The present disclosure relates to a security event mining method, device, storage medium and electronic device to provide a new network security analysis method. The security event mining method includes: obtaining security log information corresponding to at least two security functions, the security functions are used to defend against security attack actions; determining multiple associated log sets according to the network addresses in the security log information; screening the multiple associated log sets according to the danger levels of the security attack actions corresponding to the security log information in the multiple associated log sets and / or the similarities between the security attack actions to obtain a target log set; generating a security event according to the security attack actions corresponding to the security log information in the target log set.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular, to a security event mining method, device, storage medium and electronic device. Background Art

[0002] Security attack events, referred to as security events, are generally caused by a combination of multiple attack actions. For example, the most threatening APT (Advanced Persistent Threat, targeted threat attack) among various security attack methods usually includes multiple attack actions such as detection, intrusion, and control. The combination of these attack actions represents a complete security attack event. Security functions such as antivirus and spam detection can detect and defend against attack actions in security attack events.

[0003] Relevant technologies can analyze security functions and obtain security analysis results, which can be used to track and trace security attack incidents, facilitate the adjustment of security defense directions and key defense targets in subsequent defense processes, and improve attack defense capabilities in specific security scenarios. Summary of the invention

[0004] The purpose of the present invention is to provide a security event mining method, device, storage medium and electronic device to provide a new network security analysis method.

[0005] In order to achieve the above objectives, in a first aspect, the present disclosure provides a security event mining method, the method comprising:

[0006] Obtain security log information corresponding to at least two security functions, where the security functions are used to defend against security attack actions;

[0007] Determine a plurality of associated log sets according to the network addresses in the security log information;

[0008] According to the danger level of the security attack actions corresponding to the security log information in the multiple associated log sets and / or the similarity between the security attack actions, the multiple associated log sets are screened to obtain a target log set, wherein the danger level is determined according to the log type of the security log information corresponding to the security attack action and a preset corresponding relationship between the log type and the danger level;

[0009] A security event is generated according to the security attack action corresponding to the security log information in the target log set.

[0010] Optionally, obtaining security log information corresponding to at least two security functions includes:

[0011] Obtain security log information corresponding to at least two of the following security functions: anti-virus function, spam blocking function, malicious uniform resource locator system URL filtering function, intrusion prevention function, and sandbox detection function.

[0012] Optionally, determining a plurality of associated log sets according to the network address in the security log information includes:

[0013] Security log information with the same source IP address and / or the same destination IP address is added to the same log set to obtain multiple associated log sets.

[0014] Optionally, determining a plurality of associated log sets according to the network address in the security log information includes:

[0015] Adding security log information with the same source IP address and / or the same destination IP address to the same log set to obtain multiple potentially related log sets;

[0016] The security log information in the multiple potential associated log sets is screened according to the time correlation between the security log information to obtain multiple associated log sets.

[0017] Optionally, screening the security log information in the plurality of potentially associated log sets according to the time correlation between the security log information includes:

[0018] For each security log information included in the potential associated log set, if the occurrence time of the security attack action corresponding to the security log information satisfies the security attack timing rule, and the occurrence time difference of the security attack action corresponding to the security log information does not exceed the preset time difference, then the security log information is determined to belong to the same associated log set.

[0019] Optionally, screening the multiple associated log sets according to the danger levels of the security attack actions corresponding to the security log information in the multiple associated log sets and the similarities between the security attack actions includes:

[0020] For each of the associated log sets, the following processing is performed: according to the danger level of the security attack action corresponding to each security log information in the associated log set, and the preset corresponding relationship between the danger level and the danger value, the danger value corresponding to each of the security log information is determined; the danger value corresponding to each of the security log information is averaged to obtain the target danger value corresponding to the associated log set; according to the similarity between the target danger value and the security attack action corresponding to the security log information in the associated log set, the security event probability value corresponding to the associated log set is calculated;

[0021] The multiple associated log sets are screened according to the security event probability value corresponding to each of the associated log sets.

[0022] Optionally, calculating the security event probability value corresponding to the associated log set according to the similarity between the target risk value and the security attack action corresponding to the security log information in the associated log set includes:

[0023] Determine the log category to which the security log information in the associated log set belongs to obtain a target classification set, and determine the target log category whose number of appearances in the target classification set is less than a preset number, and determine the similarity between the security attack actions corresponding to the security log information in the associated log set according to the number of the target log categories;

[0024] The sum of the target risk value and the similarity is determined as the security event probability value corresponding to the associated log set.

[0025] Optionally, determining the similarity between the security attack actions corresponding to the associated log set according to the number of the target log categories includes:

[0026] According to the following formula, the similarity between the security attack actions corresponding to the security log information in the associated log set is determined according to the number of the target log categories:

[0027]

[0028] Among them, S similarity represents the similarity between the security attack actions corresponding to the security log information in the associated log set, β represents the preset weight value, n represents the number of log categories included in the target classification set, and n single Indicates the number of the target log category.

[0029] Optionally, screening the multiple associated log sets according to the security event probability value corresponding to each associated log set includes:

[0030] Sorting the multiple associated log sets according to the security event probability values ​​to obtain a sorted log set;

[0031] Selecting a log set from the sorted log set according to a preset number threshold to obtain a first log set, and selecting a log set according to a preset ratio threshold and the number of the associated log sets to obtain a second log set;

[0032] Among the first log set and the second log set, the log set including a smaller amount of security log information is determined as the target log set.

[0033] In a second aspect, the present disclosure further provides a security event mining device, the device comprising:

[0034] An acquisition module, used to acquire security log information corresponding to at least two security functions, where the security functions are used to defend against security attack actions;

[0035] A determination module, used to determine a plurality of associated log sets according to the network address in the security log information;

[0036] A screening module, configured to screen the plurality of associated log sets according to the danger level of the security attack actions corresponding to the security log information in the plurality of associated log sets and / or the similarity between the security attack actions, so as to obtain a target log set, wherein the danger level is determined according to the log type of the security log information corresponding to the security attack action and a preset corresponding relationship between the log type and the danger level;

[0037] The generating module is used to generate a security event according to the security attack action corresponding to the security log information in the target log set.

[0038] In a third aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0039] In a fourth aspect, the present disclosure provides an electronic device, including:

[0040] a memory having a computer program stored thereon;

[0041] A processor is used to execute the computer program in the memory to implement the steps of any one of the methods in the first aspect.

[0042] Through the above technical scheme, security log information corresponding to at least two security functions can be obtained to conduct information mining of security incidents. Compared with the information mining of security attack actions from a single data dimension in related technologies, it is possible to realize the linkage analysis between security functions, better restore the security incidents composed of multiple attack actions, and realize the analysis and tracing from points (i.e. attack actions) and surfaces (i.e. security incidents), thereby realizing the optimization and improvement from a single security defense action to a three-dimensional defense system.

[0043] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present disclosure but do not constitute a limitation of the present disclosure. In the accompanying drawings:

[0045] Figure 1 is a flow chart of a security event mining method according to an exemplary embodiment of the present disclosure;

[0046] Figure 2 is a process diagram of a security event mining method according to an exemplary embodiment of the present disclosure;

[0047] Figure 3 is a block diagram of a security event mining device according to an exemplary embodiment of the present disclosure;

[0048] Figure 4 It is a block diagram of an electronic device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0049] The specific implementation of the present disclosure is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the present disclosure, and is not used to limit the present disclosure.

[0050] Security attack events, referred to as security events, are generally caused by a combination of multiple attack actions. For example, the most threatening APT (Advanced Persistent Threat, targeted threat attack) among various security attack methods usually includes multiple attack actions such as detection, intrusion, and control. The combination of these attack actions represents a complete security attack event. However, security functions such as antivirus and spam detection in related technologies can only detect and defend against one or several attack actions in network attack events, and it is difficult to detect and defend against security attack events as a whole through a single security function.

[0051] The linkage between security functions can integrate multiple detection functions. Through the linkage analysis between functions, a comprehensive security analysis result can be obtained to help security product users and security vendors track and trace security incidents. And by analyzing the attack action sequence and attack time sequence in network attack events, in-depth analysis of the security situation and attack event types in the current network can be achieved. This kind of linkage analysis security event mining system can be used as an analysis basis for network security situation, helping security personnel adjust security defense direction and key defense targets, and improving attack defense capabilities in specific security scenarios.

[0052] However, the inventors have discovered that the data mining systems in related technologies are generally based on information mining in the same data dimension, such as conducting information mining based solely on the anti-virus security function, or conducting information mining based solely on the spam detection security function, etc., without realizing the linkage analysis between security functions, and are unable to better restore security events composed of multiple attack actions.

[0053] In view of this, the present disclosure provides a security event mining method, device, storage medium and electronic device to provide a new network security analysis method, which fully utilizes the characteristics of network attack events in action and timing to achieve linkage analysis between multiple security functions, and summarizes the analysis results and further quantifies them, thereby achieving analysis and tracing from points (i.e., attack actions) and surfaces (i.e., security events), and further achieving optimization and improvement from a single security defense action to a three-dimensional defense system.

[0054] Figure 1 FIG. 1 is a flowchart of a security event mining method according to an exemplary embodiment of the present disclosure. Figure 1 , the security event mining method may include the following steps:

[0055] Step 101, obtaining security log information corresponding to at least two security functions, where the security functions are used to defend against security attack actions.

[0056] Step 102: Determine multiple associated log sets based on the network addresses in the security log information.

[0057] Step 103, based on the danger level of the security attack actions corresponding to the security log information in the multiple associated log sets and / or the similarity between the security attack actions, the multiple associated log sets are screened to obtain a target log set. The danger level is determined based on the log type of the security log information corresponding to the security attack action and the preset corresponding relationship between the log type and the danger level.

[0058] Step 104: Generate a security event according to the security attack action corresponding to the security log information in the target log set.

[0059] For example, the security event mining method provided by the embodiment of the present disclosure can be used to mine information on the security functions of any security application, such as the security functions of the gateway defense application installed on the router, or the security functions of the security protection application installed on the personal terminal (such as mobile phones, computers and other electronic devices), etc. The embodiment of the present disclosure does not limit this. For the sake of convenience, the following description takes the information mining of the security function of the gateway defense application as an example.

[0060] For example, security log information corresponding to at least two security functions may be obtained for information mining. For example, security log information of at least two security functions of a gateway defense application may be obtained from the gateway defense application to perform information mining based on the security log information and ultimately generate a security event.

[0061] In a possible manner, security log information corresponding to at least two of the following security functions may be obtained: anti-virus function, spam interception function, malicious uniform resource locator system URL filtering function, intrusion prevention function, and sandbox detection function.

[0062] Among them, the antivirus function is used to kill viruses to protect data security. The spam interception function is used to identify which emails among the received emails are completely meaningless spam emails to the recipient, and intercept and delete them. The URL filtering function is used to control the URLs accessed by users, allowing or prohibiting users from accessing certain web resources to achieve the purpose of regulating Internet behavior. The intrusion prevention function is used to timely interrupt, adjust or isolate some abnormal or harmful network transmission behaviors. The sandbox detection function is used to run a program in a sandbox and observe the program behavior to determine whether the program is a malicious program.

[0063] It should be understood that the gateway defense application program illustrated above can simultaneously have anti-virus function, spam interception function, malicious uniform resource locator system URL filtering function, intrusion prevention function, and sandbox detection function, so security log information corresponding to at least two of these security functions can be obtained for subsequent information mining. The security functions of the security protection application program installed on the personal terminal illustrated above do not include intrusion prevention function and sandbox detection function, so security log information corresponding to at least two of the security functions of anti-virus function, spam interception function, and malicious uniform resource locator system URL filtering function can be obtained for subsequent information mining.

[0064] It should also be understood that in order to achieve more comprehensive data mining and thus more accurately trace the analysis from attack actions to security incidents, it is preferred to obtain security log information corresponding to all security functions of security applications for subsequent data mining.

[0065] After obtaining the security log information, multiple associated log sets can be determined based on the network address in the security log information to dig out the association between the security log information corresponding to different security functions. In a possible manner, the security log information with the same source IP address and / or the same destination IP address can be added to the same log set to obtain multiple associated log sets.

[0066] For example, each security log information may correspond to a source IP (Internet Protocol) address and a destination IP address. If the source IP address and / or the destination IP address corresponding to multiple security log information are the same, it means that the security attack actions corresponding to the multiple security log information are derived from the same security event, so that the multiple security log information can be classified into the same associated log set, and each associated log set can include at least one security log information.

[0067] For example, the obtained security log information can be associated and filtered in sequence using the following formula:

[0068]

[0069] Alternatively, you can use the following formula to perform correlation filtering on the obtained security log information:

[0070]

[0071] Among them, R_IP represents the association identifier between security log information, LOG A (S IP ) indicates the source IP address of security log information A, LOG B (S IP ) indicates the source IP address of security log information B, LOG A (D IP ) indicates the destination IP address of security log information A, LOG B (D IP ) indicates the destination IP address of security log information B, and else indicates other situations.

[0072] Taking formula (1) as an example, a log set with empty content is created in advance, and any security log information in the obtained security log information is used as security log information A, and another security log information different from security log information A is used as security log information B. When the source IP addresses of security log information A and security log information B are the same, or when the destination IP addresses of security log information A and security log information B are the same, the value of the association identifier R_IP between the security log information is 1, then the security log information A and security log information B can be added to the created log set, and then other security log information can be judged according to formula (1). In other cases, when the source IP address and the destination IP address of security log information A and security log information B are not the same, the value of the association identifier R_IP between the security log information is 0, and the log set addition operation is not performed on security log information A and security log information B, but other security log information can be judged according to formula (1). In this way, the obtained security log information can be preliminarily screened to determine the associated security log information, so as to obtain multiple associated log sets for subsequent security event mining.

[0073] Generally speaking, the time span between multiple security attack actions in a security incident may not be large, and the security attack actions may follow certain attack timing rules. Therefore, in order to obtain a more accurate set of associated logs, the security log information with the same source IP address and / or the same destination IP address can be added to the same log set to obtain multiple potential associated log sets, and then the security log information in the multiple potential associated log sets is screened according to the time correlation between the security log information to obtain multiple associated log sets.

[0074] The method of adding security log information with the same source IP address and / or the same destination IP address to the same log set to obtain multiple potentially associated log sets is similar to the method described above and will not be repeated here.

[0075] In a possible manner, based on the time correlation between the security log information, the security log information in multiple potential associated log sets is screened to obtain multiple associated log sets, which can be: for each potential associated log set included in the security log information, if the occurrence time of the security attack action corresponding to the security log information satisfies the security attack timing rule, and the occurrence time difference of the security attack action corresponding to the security log information does not exceed the preset time difference, then the security log information is determined to belong to the same associated log set.

[0076] For example, the security attack timing rule can be used to characterize the occurrence timing of security attack actions under normal circumstances, and can be obtained by analyzing the occurrence timing between security attack actions in a large number of sample security events that have occurred. Figure 2 , the security attack timing rule may include three timing stages, the first timing stage occurs earliest, the second timing stage occurs later, and the third timing stage occurs latest. The first timing stage may include spam logs and malicious URL logs, which means that, if possible, the first attack action that occurs in a security event may be a spam attack or a malicious URL attack. The second stage may include antivirus logs, malicious URL logs, intrusion prevention logs, and sandbox detection logs, which means that, if possible, the attack action that occurs later in a security event may be any one of a virus attack, a malicious URL attack, an intrusion attack, and a malicious program attack. The third stage may include antivirus logs, malicious URL logs, intrusion detection logs, and sandbox detection logs, which means that, if possible, the attack action that occurs latest in a security event may also be any one of a virus attack, a malicious URL attack, an intrusion attack, and a malicious program attack.

[0077] It should be understood that in specific implementation, the type of security log information obtained can be referenced. Figure 2 For example, the acquired security log information includes the security log information corresponding to the URL filtering function, the anti-virus function and the intrusion prevention function. In this case, the occurrence sequence of the security attack actions corresponding to the security log information is: malicious URL attack, virus attack, intrusion attack. Figure 2 It can be seen that the occurrence sequence of this type of security attack action exists, so it can be determined that the occurrence time of the security attack action corresponding to the security log information meets the security attack timing rule. If the occurrence time difference between the three attack actions does not exceed the preset time difference, it can be determined that the three attack actions are derived from the same security event, so that the corresponding security log information can be determined to belong to the same associated log set.

[0078] By way of example, a log set with empty content can be created in advance, and then the security log information with the same source IP address and / or the same destination IP address can be added to the log set to obtain multiple potential associated log sets. Then, another log set with empty content can be created, and then the security log information that satisfies the time correlation can be added to the associated log set to obtain a final associated log set. Alternatively, the security log information that does not satisfy the time correlation in the potential associated log set can be deleted, so that the potential associated log set after the deletion operation is used as the final associated log set, which is not limited in the disclosed embodiments.

[0079] Through the above method, the potentially related logs can be further screened according to the time correlation between the security log information, so as to obtain a more accurate set of related logs, and then dig out security events that are more in line with the actual situation, which is convenient for the analysis and tracing of security events.

[0080] After obtaining a plurality of associated log sets, the plurality of associated log sets can be screened according to the danger level of the security attack actions corresponding to the security log information in the plurality of associated log sets and / or the similarity between the security attack actions to obtain the target log set. That is, the plurality of associated log sets can be screened in any of the following ways: screening the plurality of associated log sets according to the danger level of the security attack actions corresponding to the security log information in the plurality of associated log sets, screening the plurality of associated log sets according to the similarity between the security attack actions corresponding to the security log information in the plurality of associated log sets, and screening the plurality of associated log sets according to the danger level of the security attack actions corresponding to the security log information in the plurality of associated log sets and the similarity between the security attack actions.

[0081] For example, the specific process of determining the danger level of a security attack action is similar to that in the related art, and a brief example is given here. For example, the danger level of the security log information can be determined according to the log type of the security log information corresponding to the security attack action, and the preset correspondence between the log type and the danger level. Among them, the preset correspondence can be set according to the actual situation, and the embodiment of the present disclosure does not limit this. For example, the danger level is divided into three levels: high, medium, and low, and the log type includes a spam log type, an intrusion detection log type, and an antivirus log type. The preset correspondence can be: the spam log type corresponds to a low danger level, the intrusion detection log type corresponds to a medium danger level, and the antivirus log type corresponds to a high risk level. In this case, after determining the log type of the security log information, the danger level of the security log information can be determined. For example, if the obtained security log information is an antivirus log, it can be determined that the danger level of the security log information is a high danger level. Of course, if possible, the log type can include more than three types, so the same danger level in the preset correspondence can correspond to at least one log type.

[0082] It should be understood that the higher the danger level of the security attack action, the greater the impact of the security attack action on the normal operation of the network or application, and vice versa. The smaller the impact of the security attack action on the normal operation of the network or application. In the embodiment of the present disclosure, the security attack action corresponding to the security log information in the target log set has a higher danger level, so information mining based on the target log set can mine security events that have a greater impact on the normal operation of the network or application. Based on the security event, more effective security defense can be carried out in the future to reduce the impact of security attacks on the operation of the network or application.

[0083] In a possible manner, screening multiple associated log sets according to the danger level of the security attack action corresponding to the security log information in the multiple associated log sets and the similarity between the security attack actions can be: for each associated log set, the following processing is performed: according to the danger level of the security attack action corresponding to each security log information in the associated log set and the preset correspondence between the danger level and the danger value, the danger value corresponding to each security log information is determined, and the danger value corresponding to each security log information is averaged to obtain a target danger value corresponding to the associated log set, and according to the target danger value and the similarity between the security attack action corresponding to the security log information in the associated log set, the security event probability value corresponding to the associated log set is calculated. Then, according to the security event probability value corresponding to each associated log set, the multiple associated log sets can be screened to obtain a target log set.

[0084] For example, the danger value can be used to quantify the danger level of the security log information, so as to facilitate the subsequent screening of the security log information to obtain the target log set. Among them, the preset correspondence between the danger level and the danger value can be set according to the actual situation, and the embodiments of the present disclosure are not limited to this. For example, in the above example, the danger level includes three levels: high, medium, and low. The preset correspondence between the danger level and the danger value can be: the danger value corresponding to the high danger level is 0.5, the danger value corresponding to the medium danger level is 0.3, and the danger value corresponding to the low danger level is 0.1.

[0085] According to the above method, the risk value corresponding to each security log information can be obtained, and then the risk value corresponding to each security log information can be averaged according to the following formula to obtain the target risk value corresponding to the associated log set:

[0086]

[0087] Among them, S danger represents the target risk value corresponding to the associated log set, L irepresents the risk value of the security attack action corresponding to the ith security log information in the associated log set, and m represents the total number of security log information included in the associated log set.

[0088] Alternatively, a weight value may be added to the calculation of the target risk value, that is, the risk value corresponding to each security log information may be averaged according to the following formula to obtain the target risk value corresponding to the associated log set:

[0089]

[0090] Among them, α represents a preset weight value, which is greater than 0 and less than 1. The specific value can be set according to actual conditions, and the embodiment of the present disclosure is not limited to this. For example, α can be set to 0.6, and so on.

[0091] Taking formula (3) as an example, through the preset correspondence between log type and danger level in the above example, it is determined that the associated log set includes spam logs with low danger level, intrusion detection logs with medium danger level and antivirus logs with high danger level. In addition, the preset correspondence between danger level and risk value is: the risk value corresponding to high danger level is 0.5, the risk value corresponding to medium danger level is 0.3, the risk value corresponding to low danger level is 0.1, and α is 0.6. In this case, the target risk value of the associated log set can be obtained as: S danger =0.6×((0.1+0.3+0.5) / 3), that is, the target risk value of the associated log set is 0.18.

[0092] After obtaining the target danger value, the security event probability value corresponding to the associated log set can be calculated based on the similarity between the target danger value and the security attack action corresponding to the security log information in the associated log set. Among them, the target danger value can quantify the impact of the security attack action on the operation of the network or application, thereby screening out the associated log set that has a greater impact on the operation of the network or application. The greater the similarity between the security attack actions corresponding to the security log information, the more likely it is that the security attack action corresponding to the security log information comes from the same security event. Therefore, the embodiment of the present disclosure calculates the security event probability value corresponding to the associated log set based on the similarity between the target danger value and the security attack action corresponding to the security log information in the associated log set, so that multiple associated log sets can be screened according to the security event probability value to obtain the target log set, thereby generating more effective security events, which is convenient for subsequent security defense.

[0093] In a possible manner, according to the similarity between the target danger value and the security attack action corresponding to the security log information in the associated log set, the security event probability value corresponding to the associated log set is calculated, which can be: determining the log category to which the security log information in the associated log set belongs to obtain a target classification set, and determining the target log category whose number of appearances in the target classification set is less than a preset number, and according to the number of the target log category, determining the similarity between the security attack actions corresponding to the security log information in the associated log set, and then determining the sum of the target danger value and the similarity as the security event probability value corresponding to the associated log set. Among them, the preset number can be set according to actual conditions, and the embodiment of the present disclosure does not limit this. For example, the preset number can be set to 2.

[0094] For example, the specific process of determining the log category to which the security log information in the associated log set belongs is similar to that in the related art, and a brief example is given here. For example, the corresponding relationship between the log type and the log category of at least one security log information can be preset, and then the log category to which the security log information belongs can be determined based on the log type of the security log information and the corresponding relationship. For example, the corresponding relationship between the log type and the log category of the security log information can be preset as follows: the spam log type and the sandbox detection log type correspond to log category 1, the intrusion detection log type and the malicious URL filtering log type correspond to log category 2, and the antivirus log type corresponds to log category 3. In this case, if the associated log set includes 5 security log information, namely, spam log, antivirus log, intrusion detection log, malicious URL filtering log, and sandbox detection log, the target classification set can be determined to be {1, 3, 2, 2, 1}.

[0095] After obtaining the target classification set, the target log categories whose occurrence times in the target classification set are less than the preset times can be determined. For example, in the example where the target classification set is {1, 3, 2, 2, 1}, the preset times are 2, and the target log category can be determined to be 3. Then, according to the number of target log categories, the similarity between the security attack actions corresponding to the security log information in the associated log set can be determined.

[0096] In a possible manner, the similarity between the security attack actions corresponding to the security log information in the associated log set can be determined according to the number of target log categories according to the following formula:

[0097]

[0098] Among them, S similarity represents the similarity between the security attack actions corresponding to the security log information in the associated log set, n represents the number of log categories included in the target classification set, and n singleIndicates the number of target log categories.

[0099] Alternatively, in a possible manner, a weight value may be added to the calculation of the similarity, that is, the similarity between the security attack actions corresponding to the security log information in the associated log set may be determined according to the number of target log categories according to the following formula:

[0100]

[0101] Among them, β represents a preset weight value, which is greater than 0 and less than 1. The specific value can be set according to actual conditions, and the embodiment of the present disclosure is not limited to this. For example, β can be set to 0.4, and so on.

[0102] After obtaining the target risk value and the similarity, the sum of the target risk value and the similarity can be determined as the security event probability value corresponding to the associated log set, as shown in formula (7).

[0103] S=S danger +S similarity (7)

[0104] Where S represents the security event probability value corresponding to the associated log set.

[0105] The larger the security event probability value is, the more likely the security attack action corresponding to the security log information included in the associated log set is to constitute a security event. Therefore, the target log set for generating a security event can be determined according to the security event probability value.

[0106] It should be understood that when the plurality of associated log sets are screened according to the danger level of the security attack actions corresponding to the security log information in the plurality of associated log sets, the security event probability value is S danger When the multiple associated log sets are screened according to the similarity between the security attack actions corresponding to the security log information in the multiple associated log sets, the security event probability value is S similarity .

[0107] In a possible manner, multiple associated log sets may be sorted according to the security event probability value to obtain a sorted log set. Then, a log set is selected from the sorted log set according to a preset number threshold to obtain a first log set, and a log set is selected according to a preset ratio threshold and the number of associated log sets to obtain a second log set. Finally, in the first log set and the second log set, the log set including a smaller number of security log information is determined as the target log set.

[0108] It should be understood that, generally, the amount of security log information of security functions is huge. In order to reduce the amount of data analysis, the embodiments of the present disclosure provide a method for filtering associated log sets according to security event probability values ​​to obtain security events generated by a target log set.

[0109] For example, sorting multiple associated log sets according to security event probability values ​​may be sorting multiple associated log sets from small to large according to security event probability values, or may be sorting multiple associated log sets from large to small according to security event probability values, and the embodiments of the present disclosure are not limited to this.

[0110] For example, a preset quantity threshold can be used to characterize the total number of security log information expected to be obtained for generating security events, and can be reasonably set according to the total number of security log information obtained, which is not limited in the embodiments of the present disclosure. A preset ratio threshold can be used to characterize the ratio of security log information expected to be obtained for generating security events to all security log information in the associated log set. Selecting a log set according to the preset ratio threshold and the number of associated log sets means selecting a fixed ratio of log sets in the sorted log set. The preset ratio threshold can be set according to actual conditions, which is not limited in the embodiments of the present disclosure.

[0111] For example, multiple related log sets may be screened according to the following formula based on the security event probability value corresponding to each related log set:

[0112] C events =Min(TOP th1 ,TOP th2 ) (8)

[0113] Among them, C events Indicates the filtered target log set, TOP th1 Indicates the first log set obtained according to the preset number threshold th1, TOP th2 represents a second log set obtained according to a preset ratio threshold th2, and Min represents a log set including a smaller amount of security log information selected from the first log set and the second log set.

[0114] It should be understood that, in specific implementation, the associated log set may be screened based on a preset quantity threshold to obtain a target log set. Alternatively, the associated log set may be screened based on a preset ratio threshold to obtain a target log set, which is not limited in the embodiments of the present disclosure.

[0115] Reference Figure 2Taking the gateway defense application as an example, according to the security event mining method provided by the embodiment of the present disclosure, the security log information corresponding to all security functions of the gateway defense function can be obtained first. Then, the combination screening between different types of security log information can be completed by analyzing the IP addresses between the security log information, and a potential associated log set can be obtained, thereby realizing the first step of analyzing the security log information. In this process, the real associated log set can be screened by analyzing the time sequence and time interval threshold analysis (i.e., time sequence analysis) of the potential associated log set. Then, the real associated log set can be quantitatively analyzed, that is, quantitative analysis can be performed according to the danger level of the security attack action corresponding to the security log information, and quantitative analysis can be performed according to the similarity between the security attack actions corresponding to the security log information to obtain the security event probability value, so that the real associated log set can be screened according to the security event probability value to obtain the target log set. Finally, the final mining of the security event can be completed according to the target log set. It can be understood that the security event obtained by mining is the information extraction and analysis of scattered security logs, which can be used as an effective tool for security personnel to analyze network threats and grasp network security situation.

[0116] Based on the same inventive concept, the embodiment of the present disclosure also provides a security event mining device, which can be part or all of the electronic device through software, hardware or a combination of both. Figure 3 , the security event mining device may include:

[0117] An acquisition module 301 is used to acquire security log information corresponding to at least two security functions, where the security functions are used to defend against security attack actions;

[0118] A determination module 302, configured to determine a plurality of associated log sets according to the network address in the security log information;

[0119] A screening module 303 is used to screen the multiple associated log sets according to the danger level of the security attack actions corresponding to the security log information in the multiple associated log sets and / or the similarity between the security attack actions to obtain a target log set, wherein the danger level is determined according to the log type of the security log information corresponding to the security attack action and a preset corresponding relationship between the log type and the danger level;

[0120] The generating module 304 is used to generate a security event according to the security attack action corresponding to the security log information in the target log set.

[0121] Optionally, the acquisition module 301 is used to:

[0122] Obtain security log information corresponding to at least two of the following security functions: anti-virus function, spam blocking function, malicious uniform resource locator system URL filtering function, intrusion prevention function, and sandbox detection function.

[0123] Optionally, the determining module 302 is used to:

[0124] Security log information with the same source IP address and / or the same destination IP address is added to the same log set to obtain multiple associated log sets.

[0125] Optionally, the determining module 302 is used to:

[0126] Adding security log information with the same source IP address and / or the same destination IP address to the same log set to obtain multiple potentially related log sets;

[0127] The security log information in the multiple potential associated log sets is screened according to the time correlation between the security log information to obtain multiple associated log sets.

[0128] Optionally, the determining module 302 is used to:

[0129] For each security log information included in the potential associated log set, if the occurrence time of the security attack action corresponding to the security log information satisfies the security attack timing rule, and the occurrence time difference of the security attack action corresponding to the security log information does not exceed the preset time difference, then the security log information is determined to belong to the same associated log set.

[0130] Optionally, the screening module 303 is used to:

[0131] For each of the associated log sets, the following processing is performed: according to the danger level of the security attack action corresponding to each security log information in the associated log set, and the preset corresponding relationship between the danger level and the danger value, the danger value corresponding to each of the security log information is determined; the danger value corresponding to each of the security log information is averaged to obtain the target danger value corresponding to the associated log set; according to the similarity between the target danger value and the security attack action corresponding to the security log information in the associated log set, the security event probability value corresponding to the associated log set is calculated;

[0132] The multiple associated log sets are screened according to the security event probability value corresponding to each of the associated log sets.

[0133] Optionally, the screening module 303 is used to:

[0134] Determine the log category to which the security log information in the associated log set belongs to obtain a target classification set, and determine the target log category whose number of appearances in the target classification set is less than a preset number, and determine the similarity between the security attack actions corresponding to the security log information in the associated log set according to the number of the target log categories;

[0135] The sum of the target risk value and the similarity is determined as the security event probability value corresponding to the associated log set.

[0136] Optionally, the screening module 303 is used to:

[0137] According to the following formula, the similarity between the security attack actions corresponding to the security log information in the associated log set is determined according to the number of the target log categories:

[0138]

[0139] Among them, S similarity represents the similarity between the security attack actions corresponding to the security log information in the associated log set, β represents the preset weight value, n represents the number of log categories included in the target classification set, and n single Indicates the number of the target log category.

[0140] Optionally, the screening module 303 is used to:

[0141] Sorting the multiple associated log sets according to the security event probability values ​​to obtain a sorted log set;

[0142] Selecting a log set from the sorted log set according to a preset number threshold to obtain a first log set, and selecting a log set according to a preset ratio threshold and the number of the associated log sets to obtain a second log set;

[0143] Among the first log set and the second log set, the log set including a smaller amount of security log information is determined as the target log set.

[0144] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0145] Based on the same inventive concept, the present disclosure also provides an electronic device, including:

[0146] a memory having a computer program stored thereon;

[0147] A processor is used to execute the computer program in the memory to implement the steps of any of the above-mentioned security event mining methods.

[0148] In a possible manner, the block diagram of the electronic device may be as follows Figure 4 See Figure 4 The electronic device 400 may include: a processor 401 and a memory 402. The electronic device 400 may also include one or more of a multimedia component 403, an input / output (I / O) interface 404, and a communication component 405.

[0149] The processor 401 is used to control the overall operation of the electronic device 400 to complete all or part of the steps in the above-mentioned security event mining method. The memory 402 is used to store various types of data to support the operation of the electronic device 400, and these data may include, for example, instructions for any application or method used to operate on the electronic device 400, and application-related data, such as contact data, sent and received messages, pictures, audio, video, etc. The memory 402 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, disk or optical disk.

[0150] The multimedia component 403 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone, which is used to receive external audio signals. The received audio signal may be further stored in the memory 402 or sent through the communication component 405. The audio component also includes at least one speaker for outputting audio signals. The I / O interface 404 provides an interface between the processor 401 and other interface modules, and the above-mentioned other interface modules may be keyboards, mice, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component 405 is used for wired or wireless communication between the electronic device 400 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, 4G, NB-IOT, eMTC, or other 5G, etc., or a combination of one or more of them, is not limited here. Therefore, the corresponding communication component 405 may include: Wi-Fi module, Bluetooth module, NFC module, etc.

[0151] In an exemplary embodiment, the electronic device 400 can be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned security event mining method.

[0152] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the steps of the above-mentioned security event mining method are implemented. For example, the computer-readable storage medium can be the above-mentioned memory 402 including program instructions, and the above-mentioned program instructions can be executed by the processor 401 of the electronic device 400 to complete the above-mentioned security event mining method.

[0153] In another exemplary embodiment, a computer program product is also provided. The computer program product includes a computer program that can be executed by a programmable device. The computer program has a code portion for executing the above-mentioned security event mining method when executed by the programmable device.

[0154] The preferred embodiments of the present disclosure are described in detail above in conjunction with the accompanying drawings; however, the present disclosure is not limited to the specific details in the above embodiments. Within the technical concept of the present disclosure, a variety of simple modifications can be made to the technical solution of the present disclosure, and these simple modifications all fall within the protection scope of the present disclosure.

[0155] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present disclosure will not further describe various possible combinations.

[0156] In addition, various embodiments of the present disclosure may be arbitrarily combined, and as long as they do not violate the concept of the present disclosure, they should also be regarded as the contents disclosed by the present disclosure.

Claims

1. A security event mining method, characterized in that: The method comprises: Obtain security log information corresponding to at least two security functions, where the security functions are used to defend against security attack actions; Determine a plurality of associated log sets according to the network addresses in the security log information; For each of the associated log sets, the following processing is performed: according to the danger level of the security attack action corresponding to each security log information in the associated log set, and the preset corresponding relationship between the danger level and the danger value, the danger value corresponding to each of the security log information is determined; the danger value corresponding to each of the security log information is averaged to obtain the target danger value corresponding to the associated log set; according to the similarity between the target danger value and the security attack action corresponding to the security log information in the associated log set, the security event probability value corresponding to the associated log set is calculated; According to the security event probability value corresponding to each of the associated log sets, the multiple associated log sets are screened to obtain a target log set, wherein the danger level is determined according to the log type of the security log information corresponding to the security attack action and a preset corresponding relationship between the log type and the danger level; A security event is generated according to the security attack action corresponding to the security log information in the target log set.

2. The method according to claim 1, characterized in that The obtaining of security log information corresponding to at least two security functions includes: Obtain security log information corresponding to at least two of the following security functions: anti-virus function, spam blocking function, malicious uniform resource locator system URL filtering function, intrusion prevention function, and sandbox detection function.

3. The method according to claim 1, characterized in that The step of determining a plurality of associated log sets according to the network address in the security log information includes: Security log information with the same source IP address and / or the same destination IP address is added to the same log set to obtain multiple associated log sets.

4. The method according to claim 1, characterized in that: The step of determining a plurality of associated log sets according to the network address in the security log information includes: Adding security log information with the same source IP address and / or the same destination IP address to the same log set to obtain multiple potentially related log sets; The security log information in the multiple potential associated log sets is screened according to the time correlation between the security log information to obtain multiple associated log sets.

5. The method according to claim 4, characterized in that The screening of the security log information in the plurality of potentially associated log sets according to the time correlation between the security log information includes: For each security log information included in the potential associated log set, if the occurrence time of the security attack action corresponding to the security log information satisfies the security attack timing rule, and the occurrence time difference of the security attack action corresponding to the security log information does not exceed the preset time difference, then the security log information is determined to belong to the same associated log set.

6. The method according to claim 1, characterized in that The calculating, according to the similarity between the target risk value and the security attack action corresponding to the security log information in the associated log set, the security event probability value corresponding to the associated log set comprises: Determine the log category to which the security log information in the associated log set belongs to obtain a target classification set, and determine the target log category whose number of appearances in the target classification set is less than a preset number, and determine the similarity between the security attack actions corresponding to the security log information in the associated log set according to the number of the target log categories; The sum of the target risk value and the similarity is determined as the security event probability value corresponding to the associated log set.

7. The method according to claim 6, characterized in that The determining, according to the number of the target log categories, the similarity between the security attack actions corresponding to the associated log sets includes: According to the following formula, the similarity between the security attack actions corresponding to the security log information in the associated log set is determined according to the number of the target log categories: in, represents the similarity between the security attack actions corresponding to the security log information in the associated log set, Indicates the preset weight value, Indicates the number of log categories included in the target classification set, Indicates the number of the target log category.

8. The method according to claim 1, characterized in that The screening of the plurality of associated log sets according to the security event probability value corresponding to each of the associated log sets includes: Sorting the multiple associated log sets according to the security event probability values ​​to obtain a sorted log set; Selecting a log set from the sorted log set according to a preset number threshold to obtain a first log set, and selecting a log set according to a preset ratio threshold and the number of the associated log sets to obtain a second log set; Among the first log set and the second log set, the log set including a smaller amount of security log information is determined as the target log set.

9. A security event mining device, characterized in that: The device comprises: An acquisition module, used to acquire security log information corresponding to at least two security functions, where the security functions are used to defend against security attack actions; A determination module, used to determine a plurality of associated log sets according to the network address in the security log information; The screening module is used to perform the following processing for each of the associated log sets: determine the danger value corresponding to each of the security log information according to the danger level of the security attack action corresponding to each of the security log information in the associated log set, and the preset corresponding relationship between the danger level and the danger value; calculate the average value of the danger value corresponding to each of the security log information to obtain the target danger value corresponding to the associated log set; calculate the security event probability value corresponding to the associated log set according to the similarity between the target danger value and the security attack action corresponding to the security log information in the associated log set; screen the multiple associated log sets according to the security event probability value corresponding to each of the associated log sets to obtain the target log set, wherein the danger level is determined according to the log type of the security log information corresponding to the security attack action, and the preset corresponding relationship between the log type and the danger level; The generating module is used to generate a security event according to the security attack action corresponding to the security log information in the target log set.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 8 are implemented.

11. An electronic device, characterized in that: include: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 1 to 8.

Images