A data processing method, apparatus, device, and machine-readable storage medium

Abstract

The present disclosure provides a data processing method, apparatus, device, and machine-readable storage medium, the method comprising: receiving security alarm logs; grouping security alarm logs associated with the same attack source IP into a group, calculating the attack characteristics associated with the attack source IP associated with each security alarm log in the group according to preset rules based on the security alarm logs in the same group; performing clustering calculations based on the attack characteristics associated with each attack source IP, and obtaining an attacker profile based on the calculation results. Through the technical solution of the present disclosure, the security alarms reported by the security device are analyzed based on the attack events of each attack source, and the attack behavior characteristics of the attack source on a single target are extracted. The attack behavior of the attack source on multiple attack targets is then calculated and analyzed, and the attack behavior characteristics of the attack source are extracted. On this basis, each attack source is classified using clustering calculations, and finally an attacker profile is obtained, which is efficient and accurate.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technologies, and in particular to a data processing method, apparatus, device, and machine-readable storage medium. Background Art

[0002] Cybersecurity is gaining increasing attention today, with perimeter defense equipment becoming standard equipment in enterprise information technology deployments. Faced with increasing cybersecurity attacks, identifying the characteristics of attackers' attack behaviors is a key area of focus within the cybersecurity industry. This research holds considerable value in areas such as predicting external attacks and identifying attackers' attack methods.

[0003] K-means is a commonly used clustering algorithm based on Euclidean distance, which believes that the closer the distance between two targets, the greater the similarity.

[0004] The LCS (Long Common Sequence) algorithm is used to find the longest common subsequence between two strings.

[0005] DBSCAN (Density-Based Spatial Clustering of Applications with Noise) is a density-based clustering algorithm. Unlike partitioning and hierarchical clustering methods, it defines a cluster as the largest set of density-connected points. It can partition sufficiently dense regions into clusters and can discover clusters of arbitrary shapes in noisy spatial databases.

[0006] The current method of processing security alert logs to obtain attacker portraits is too rough in data processing, the basis for dividing attacker communities is insufficient, and the clustering effect is poor. Summary of the Invention

[0007] In view of this, the present disclosure provides a data processing method, device, electronic device, and machine-readable storage medium to improve the above-mentioned problem of poor effect in obtaining attacker portraits.

[0008] The specific technical solutions are as follows:

[0009] The present disclosure provides a data processing method, which is applied to a security management platform. The method includes: receiving security alarm logs; grouping security alarm logs associated with the same attack source IP address into a group, and calculating attack features associated with the attack source IP address associated with the security alarm logs in the same group using preset rules; performing clustering calculations based on the attack features associated with each attack source IP address, and obtaining an attacker profile based on the calculation results.

[0010] As a technical solution, the receiving of the security alarm log includes: receiving the security alarm log, normalizing the security alarm log, and obtaining the normalized security alarm log data as the security alarm log for the next step.

[0011] As a technical solution, the security alarm logs associated with the same attack source IP are grouped together, and the attack features associated with the attack source IP associated with the security alarm logs in the same group are calculated according to preset rules. The method includes: obtaining an attack source IP, extracting all security alarm logs associated with the attack source IP, classifying the security alarm logs associated with the attack source IP according to the attack target IP, calculating the attack sequence set associated with the same attack target IP and the same attack source IP according to a set method, and calculating the maximum common subsequence of each attack sequence set as the attack feature associated with the attack source IP.

[0012] As a technical solution, clustering calculation is performed based on the attack characteristics associated with each attack source IP, and the attacker portrait is obtained based on the calculation results, including: according to the attack characteristics associated with each attack source IP, each attack source IP is divided into several groups using a specified algorithm, and the attack characteristics associated with each attack source IP in the same group are used as the portrait of the attacker associated with the group.

[0013] The present disclosure also provides a data processing device, which is applied to a security management platform. The device includes: a log module, which is used to receive security alarm logs; a feature module, which is used to group security alarm logs associated with the same attack source IP, and calculate the attack features associated with the attack source IP associated with the security alarm logs in the same group according to preset rules; a portrait module, which is used to perform clustering calculations based on the attack features associated with each attack source IP, and obtain an attacker portrait based on the calculation results.

[0014] As a technical solution, the receiving of the security alarm log includes: receiving the security alarm log, normalizing the security alarm log, and obtaining the normalized security alarm log data as the security alarm log for the next step.

[0015] As a technical solution, the security alarm logs associated with the same attack source IP are grouped together, and the attack features associated with the attack source IP associated with the security alarm logs in the same group are calculated according to preset rules. The method includes: obtaining an attack source IP, extracting all security alarm logs associated with the attack source IP, classifying the security alarm logs associated with the attack source IP according to the attack target IP, calculating the attack sequence set associated with the same attack target IP and the same attack source IP according to a set method, and calculating the maximum common subsequence of each attack sequence set as the attack feature associated with the attack source IP.

[0016] As a technical solution, clustering calculation is performed based on the attack characteristics associated with each attack source IP, and the attacker portrait is obtained based on the calculation results, including: according to the attack characteristics associated with each attack source IP, each attack source IP is divided into several groups using a specified algorithm, and the attack characteristics associated with each attack source IP in the same group are used as the portrait of the attacker associated with the group.

[0017] The present disclosure also provides an electronic device, including a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor executes the machine-executable instructions to implement the aforementioned data processing method.

[0018] The present disclosure also provides a machine-readable storage medium, which stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to implement the aforementioned data processing method.

[0019] The above technical solution provided by the present disclosure brings at least the following beneficial effects:

[0020] The security alarms reported by security devices are analyzed based on the attack events of each attack source, and the attack behavior characteristics of the attack source on a single target are refined. Then, the attack behavior of the attack source on multiple attack targets is calculated and analyzed to refine the attack behavior characteristics of the attack source. On this basis, each attack source is classified using clustering calculations to finally obtain the attacker portrait with high efficiency and accurate portrait. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments of the present disclosure or the description of the prior art. Obviously, the drawings described below are only some of the embodiments recorded in the present disclosure. For ordinary technicians in this field, other drawings can also be obtained based on these drawings of the embodiments of the present disclosure.

[0022] Figure 1 is a flow chart of a data processing method in one embodiment of the present disclosure;

[0023] Figure 2 is a structural diagram of a data processing device in one embodiment of the present disclosure;

[0024] Figure 3 It is a hardware structure diagram of an electronic device in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] The terms used in the embodiments of the present disclosure are intended only to describe specific embodiments and are not intended to limit the present disclosure. The singular forms "a," "an," "the," and "the" used in the present disclosure and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to any or all possible combinations of one or more of the associated listed items.

[0026] It should be understood that although the terms first, second, third, etc. may be used to describe various information in the embodiments of the present disclosure, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" used may be interpreted as "at the time of" or "when" or "in response to determining".

[0027] The present disclosure provides a data processing method, device, electronic device, and machine-readable storage medium to improve the above-mentioned problem of poor effect in obtaining attacker portraits.

[0028] Specifically, the technical solution is described below.

[0029] In one embodiment, the present disclosure provides a data processing method applied to a security management platform, the method comprising: receiving security alarm logs; grouping security alarm logs associated with the same attack source IP into a group, and calculating attack features associated with the attack source IP associated with the security alarm logs in the same group according to preset rules; performing clustering calculations based on the attack features associated with each attack source IP, and obtaining an attacker portrait based on the calculation results.

[0030] Specifically, if Figure 1 , including the following steps:

[0031] Step S11, receiving a security alarm log;

[0032] Step S12: grouping the security alarm logs associated with the same attack source IP into a group, and calculating the attack features associated with the attack source IP associated with the security alarm logs in the same group using a preset rule.

[0033] Step S13: Perform clustering calculation based on the attack features associated with each attack source IP address, and obtain an attacker profile based on the calculation results.

[0034] The security alarms reported by security devices are analyzed based on the attack events of each attack source, and the attack behavior characteristics of the attack source on a single target are refined. Then, the attack behavior of the attack source on multiple attack targets is calculated and analyzed to refine the attack behavior characteristics of the attack source. On this basis, each attack source is classified using clustering calculations to finally obtain the attacker portrait with high efficiency and accurate portrait.

[0035] In one embodiment, the receiving of the security alarm log includes: receiving the security alarm log, normalizing the security alarm log, and obtaining the normalized security alarm log data as the security alarm log for the next step.

[0036] Because security devices from different manufacturers, models, and versions may report security alarm logs that differ in format and content, they are normalized so that the security management platform can better understand the attack behaviors expressed by attack events.

[0037]

[0038] Table 1

[0039] The normalized output data can be shown in Table 1. For example, attack types may include: denial of service, scanning and reconnaissance, malicious files, vulnerability exploitation, privilege acquisition, trace cleanup, data leakage, malicious communication, vulnerability risk, risky access, abnormal login, abnormal operation, system damage, and other. Taking scanning and reconnaissance as an example, it can also be divided into various attack subtypes, such as host scanning, port scanning, network topology scanning, application scanning, operating system scanning, database scanning, sensitive information leakage, and other scanning. Specific categories can be set arbitrarily based on the usage scenario and requirements.

[0040] Severity levels can be categorized into three levels: high, medium, and low, or further subdivided as needed. Actions can include blocking, releasing, or other actions. Special hit directions can include request and response directions.

[0041] By comparing the attack source IP, attack target IP and related ports with the preset blacklist, you can directly determine whether the data is attack data that matches the existing attacker profile.

[0042] In one embodiment, the security alarm logs associated with the same attack source IP are grouped together, and the attack features associated with the attack source IP associated with the security alarm logs in the same group are calculated according to preset rules, including: obtaining an attack source IP, extracting all security alarm logs associated with the attack source IP, classifying the security alarm logs associated with the attack source IP according to the attack target IP, calculating the attack sequence set associated with the same attack target IP and the same attack source IP according to a set method, and calculating the maximum common subsequence of each attack sequence set as the attack feature associated with the attack source IP.

[0043] Calculate the attack sequences from the same attack source IP against each target IP, sorting them by attack events to obtain the attack sequence set, F(i) = (<attack category 1, attack subcategory 1, attack name 1>, <attack category 2, attack subcategory 2, attack name 2>, <attack category 3, attack subcategory 3, attack name 3>, ...), where i represents one of the attack targets and i represents the set of all attack targets. Use the LCS algorithm to calculate the longest common subsequence of each attack sequence set as the attack signature associated with the attack source IP.

[0044] In one embodiment, clustering calculation is performed based on the attack characteristics associated with each attack source IP, and the attacker portrait is obtained based on the calculation results, including: dividing each attack source IP into several communities based on the attack characteristics associated with each attack source IP using a specified algorithm, and using the attack characteristics associated with each attack source IP in the same community as the portrait of the attacker associated with the community.

[0045] The DBSCAN algorithm is used to cluster the attack features associated with each attack source IP address, dividing the attack source IP addresses into multiple clusters, such as C1, C2, and C3. Attack source IP addresses in the same cluster are considered to be associated with the same attacker. All attack features associated with the cluster are used as the attack features of the attacker, thereby deriving an attacker profile associated with the attacker. Correspondingly, an attacker profile for each attacker is obtained.

[0046] In one embodiment, the present disclosure also provides a data processing device, such as Figure 2 , applied to a security management platform, the device includes: a log module 21, used to receive security alarm logs; a feature module 22, used to group security alarm logs associated with the same attack source IP, and calculate the attack features associated with the attack source IP associated with the security alarm logs in the same group according to preset rules; a portrait module 23, used to perform clustering calculations based on the attack features associated with each attack source IP, and obtain an attacker portrait based on the calculation results.

[0047] In one embodiment, the receiving of the security alarm log includes: receiving the security alarm log, normalizing the security alarm log, and obtaining the normalized security alarm log data as the security alarm log for the next step.

[0048] In one embodiment, the security alarm logs associated with the same attack source IP are grouped together, and the attack features associated with the attack source IP associated with the security alarm logs in the same group are calculated according to preset rules, including: obtaining an attack source IP, extracting all security alarm logs associated with the attack source IP, classifying the security alarm logs associated with the attack source IP according to the attack target IP, calculating the attack sequence set associated with the same attack target IP and the same attack source IP according to a set method, and calculating the maximum common subsequence of each attack sequence set as the attack feature associated with the attack source IP.

[0049] In one embodiment, clustering calculation is performed based on the attack characteristics associated with each attack source IP, and the attacker portrait is obtained based on the calculation results, including: dividing each attack source IP into several communities based on the attack characteristics associated with each attack source IP using a specified algorithm, and using the attack characteristics associated with each attack source IP in the same community as the portrait of the attacker associated with the community.

[0050] The device implementation is the same as or similar to the corresponding method implementation, and will not be repeated here.

[0051] In one embodiment, the present disclosure provides an electronic device, including a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor executes the machine-executable instructions to implement the aforementioned data processing method. From a hardware perspective, the hardware architecture diagram can be found in Figure 3 shown.

[0052] In one embodiment, the present disclosure provides a machine-readable storage medium storing machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to implement the aforementioned data processing method.

[0053] Here, the machine-readable storage medium can be any electronic, magnetic, optical or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage media, or a combination thereof.

[0054] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email transceiver, game console, tablet computer, wearable device, or any combination of these devices.

[0055] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing the present disclosure, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0056] Those skilled in the art will appreciate that embodiments of the present disclosure may be provided as methods, systems, or computer program products. Thus, the present disclosure may take the form of a fully hardware implementation, a fully software implementation, or an implementation combining software and hardware. Furthermore, embodiments of the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0057] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0058] Furthermore, these computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0059] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0060] Those skilled in the art will appreciate that embodiments of the present disclosure may be provided as methods, systems, or computer program products. Thus, the present disclosure may take the form of a fully hardware implementation, a fully software implementation, or an implementation combining software and hardware. Furthermore, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (which may include, but are not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0061] The foregoing is merely an embodiment of the present disclosure and is not intended to limit the present disclosure. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure are intended to be included within the scope of the claims of the present disclosure.

Claims

1. A data processing method, characterized in that: Applied to a security management platform, the method includes: Receive security alert logs; The security alarm logs associated with the same attack source IP are grouped together, and the attack features associated with the attack source IP associated with the security alarm logs in the same group are calculated using preset rules. Specifically, an attack source IP is obtained, all security alarm logs associated with the attack source IP are extracted, the security alarm logs associated with the attack source IP are classified according to the attack target IP, the attack sequence sets associated with the same attack target IP and the same attack source IP are calculated according to the set method, and the maximum common subsequence of each attack sequence set is calculated as the attack feature associated with the attack source IP; Perform clustering calculations based on the attack characteristics associated with each attack source IP address, and obtain an attacker profile based on the calculation results.

2. The method according to claim 1, characterized in that The receiving of the security alarm log includes: Receive the security alarm log, perform normalization processing on the security alarm log, and obtain the normalized security alarm log data as the security alarm log for the next step.

3. The method according to claim 1, characterized in that The method of performing cluster calculation based on the attack characteristics associated with each attack source IP address and obtaining an attacker profile based on the calculation results includes: Based on the attack characteristics associated with each attack source IP, a specified algorithm is used to divide the attack source IP into several clusters. The attack characteristics associated with each attack source IP in the same cluster are used as the profile of the attacker associated with the cluster.

4. A data processing device, characterized in that: Applied to a security management platform, the device includes: Log module, used to receive security alert logs; A feature module is used to group security alarm logs associated with the same attack source IP, and calculate attack features associated with the attack source IP associated with the security alarm logs in the same group according to preset rules. Specifically, an attack source IP is obtained, all security alarm logs associated with the attack source IP are extracted, the security alarm logs associated with the attack source IP are classified according to the attack target IP, and the attack sequence sets associated with the same attack target IP and the same attack source IP are calculated according to a set method. The maximum common subsequence of each attack sequence set is calculated as the attack feature associated with the attack source IP; The portrait module is used to perform clustering calculations based on the attack features associated with each attack source IP address and obtain the attacker portrait based on the calculation results.

5. The device according to claim 4, characterized in that The receiving of the security alarm log includes: Receive the security alarm log, perform normalization processing on the security alarm log, and obtain the normalized security alarm log data as the security alarm log for the next step.

6. The device according to claim 4, characterized in that The method of performing cluster calculation based on the attack characteristics associated with each attack source IP address and obtaining an attacker profile based on the calculation results includes: Based on the attack characteristics associated with each attack source IP, a specified algorithm is used to divide the attack source IP into several clusters. The attack characteristics associated with each attack source IP in the same cluster are used as the profile of the attacker associated with the cluster.

7. An electronic device, characterized in that: include: A processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor executes the machine-executable instructions to implement the method according to any one of claims 1 to 3.

8. A machine-readable storage medium, characterized in that The machine-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to implement the method according to any one of claims 1 to 3.

Images