A security event prediction method and apparatus

Abstract

The application provides a security event prediction method and device, the method comprising: extracting an intrusion behavior sequence, a horizontal penetration behavior sequence and an attack path from a security event log of an asset in an access network; processing the intrusion behavior sequence, the horizontal penetration behavior sequence and the attack path by using a pre-trained behavior prediction model, predicting a next intrusion behavior of the asset, a next horizontal penetration behavior and a next attack behavior of the attack path; and estimating a next security event according to the predicted next intrusion behavior, next horizontal penetration behavior and next attack behavior of the attack path. Thus, the accuracy and rationality of the security event prediction result are improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and device for predicting security events. Background Art

[0002] With the development of network technology, the types and number of network attacks are constantly increasing. Network security devices such as firewalls, intrusion prevention systems (IPS), endpoint detection and response (EDR), and network traffic analysis (NTA) are deployed throughout the network in a defense-in-depth manner to monitor and identify security incidents. The alarm logs of network security devices contain the attacker's experience and attack patterns. By analyzing the alarm logs of security events, it is possible to effectively predict future security incidents in the network. By collecting a large number of security event alarm logs, it is possible to model the attacker's attack patterns and methods, thereby accurately and in real time predicting security incidents in cyberspace.

[0003] Existing technologies for predicting network security events focus on hosts, collecting a large number of host security events and using them to build models for prediction. However, a network attack event involves both an initiator and a target, as well as an attack path. Existing technologies fail to consider this factor, resulting in a coarse-grained modeling process and thus affecting the accuracy and rationality of security event prediction results.

[0004] Therefore, how to accurately predict security incidents is one of the technical issues worth considering. Summary of the Invention

[0005] In view of this, the present application provides a security event prediction method and device for accurately predicting security events.

[0006] Specifically, this application is implemented through the following technical solutions:

[0007] According to a first aspect of the present application, a security event prediction method is provided, comprising:

[0008] Extracting an intrusion behavior sequence, a lateral penetration behavior sequence, and an attack path from a security event log of an asset in the access network, wherein the intrusion behavior sequence is a chronological sequence of security events with the same destination IP address in the security event log, the lateral penetration behavior sequence is a chronological sequence of security events with the same source IP address in the security event log, and the attack path is a sequence of security events with the source IP address pointing to the destination IP address;

[0009] Processing the intrusion behavior sequence, the lateral penetration behavior sequence, and the attack path using a pre-trained behavior prediction model to predict the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior of the asset along the attack path;

[0010] The next security event is estimated based on the predicted next intrusion behavior, the next lateral penetration behavior, and the next attack behavior of the attack path.

[0011] Optionally, the above-mentioned behavior prediction model includes an intrusion behavior prediction model, a lateral penetration behavior prediction model and an attack path prediction model; then

[0012] Processing the intrusion behavior sequence, the lateral penetration behavior sequence, and the attack path using a pre-trained behavior prediction model to predict the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior in the attack path, including:

[0013] Inputting the intrusion behavior sequence into the intrusion behavior prediction model, and outputting the next intrusion behavior of the asset;

[0014] Inputting the lateral penetration behavior into the lateral penetration behavior prediction model and outputting the next lateral penetration behavior of the asset;

[0015] The attack path is input into the attack path prediction model, and the next attack behavior of the attack path is output.

[0016] Optionally, the next attack behavior is characterized by an attack type and an occurrence probability; the next lateral penetration behavior is characterized by an attack type and an occurrence probability; the next intrusion behavior is characterized by an attack type and an occurrence probability;

[0017] Based on the predicted next intrusion behavior, next lateral penetration behavior, and next attack behavior along the attack path, the next security event is predicted, including:

[0018] Screening out at least one target attack behavior of the same attack type, each target attack behavior including one of the lateral penetration behavior and the next attack behavior, and the next intrusion behavior;

[0019] The product of the occurrence probabilities of the behaviors included in each target attack behavior is determined as the occurrence probability of the security incident corresponding to the target attack behavior;

[0020] The next security event is estimated based on the probability of occurrence of the security event corresponding to each target attack behavior.

[0021] Optionally, the intrusion behavior prediction model is obtained by training based on an intrusion behavior sequence training set, wherein the intrusion behavior sequence training set is composed of intrusion behavior sequences respectively extracted from security event logs of various security events that have occurred in the network;

[0022] The lateral penetration behavior prediction model is trained based on a lateral penetration behavior sequence training set, wherein the lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences extracted from security event logs of various security events that have occurred in the network;

[0023] The attack path prediction model is obtained by training based on an attack path training set, and the attack path training set is composed of attack paths respectively extracted from security event logs of various security events that have occurred in the network.

[0024] Optionally, the above-mentioned behavior prediction model is obtained by training based on an intrusion behavior sequence training set, a lateral penetration behavior sequence training set and an attack path training set, wherein the intrusion behavior sequence training set is composed of intrusion behavior sequences extracted from the security event logs of various security events that have occurred in the network, the lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences extracted from the security event logs of various security events that have occurred in the network, and the attack path training set is composed of attack paths extracted from the security event logs of various security events that have occurred in the network.

[0025] According to a second aspect of the present application, a security event prediction device is provided, comprising:

[0026] An extraction module is configured to extract an intrusion behavior sequence, a lateral penetration behavior sequence, and an attack path from a security event log of an asset in an access network, wherein the intrusion behavior sequence is a chronological sequence of security events in the security event log having the same destination IP address, the lateral penetration behavior sequence is a chronological sequence of security events in the security event log having the same source IP address, and the attack path is a sequence of security events whose source IP address points to the destination IP address;

[0027] a behavior prediction module, configured to process the intrusion behavior sequence, the lateral penetration behavior sequence, and the attack path using a pre-trained behavior prediction model, and predict the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior of the asset along the attack path;

[0028] The event prediction module is used to predict the next security event based on the predicted next intrusion behavior, the next lateral penetration behavior and the next attack behavior of the attack path.

[0029] Optionally, the above-mentioned behavior prediction model includes an intrusion behavior prediction model, a lateral penetration behavior prediction model and an attack path prediction model; then

[0030] The behavior prediction module is specifically used to input the intrusion behavior sequence into the intrusion behavior prediction model and output the next intrusion behavior of the asset; input the lateral penetration behavior into the lateral penetration behavior prediction model and output the next lateral penetration behavior of the asset; input the attack path into the attack path prediction model and output the next attack behavior of the attack path.

[0031] Optionally, the next attack behavior is characterized by an attack type and an occurrence probability; the next lateral penetration behavior is characterized by an attack type and an occurrence probability; the next intrusion behavior is characterized by an attack type and an occurrence probability;

[0032] The event prediction module is specifically used to screen out at least one target attack behavior with the same attack type, each target attack behavior including the lateral penetration behavior and one of the next attack behavior, as well as the next intrusion behavior; multiplying the occurrence probabilities of the behaviors included in each target attack behavior to determine the occurrence probability of the security event corresponding to the target attack behavior; and estimating the next security event based on the occurrence probabilities of the security events corresponding to each target attack behavior.

[0033] Optionally, the intrusion behavior prediction model is obtained by training based on an intrusion behavior sequence training set, wherein the intrusion behavior sequence training set is composed of intrusion behavior sequences respectively extracted from security event logs of various security events that have occurred in the network;

[0034] The lateral penetration behavior prediction model is trained based on a lateral penetration behavior sequence training set, wherein the lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences extracted from security event logs of various security events that have occurred in the network;

[0035] The above-mentioned attack path prediction model is obtained by training based on an attack path training set, and the attack path training set is composed of attack paths respectively extracted from the security event logs of various security events that have occurred in the network.

[0036] Optionally, the above-mentioned behavior prediction model is obtained by training based on an intrusion behavior sequence training set, a lateral penetration behavior sequence training set and an attack path training set, wherein the intrusion behavior sequence training set is composed of intrusion behavior sequences extracted from the security event logs of various security events that have occurred in the network, the lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences extracted from the security event logs of various security events that have occurred in the network, and the attack path training set is composed of attack paths extracted from the security event logs of various security events that have occurred in the network.

[0037] According to the third aspect of the present application, an electronic device is provided, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores a computer program that can be executed by the processor, and the processor is prompted by the computer program to execute the method provided in the first aspect of the embodiment of the present application.

[0038] According to the fourth aspect of the present application, a machine-readable storage medium is provided, which stores a computer program. When called and executed by a processor, the computer program prompts the processor to execute the method provided in the first aspect of the embodiment of the present application.

[0039] Beneficial effects of the embodiments of the present application:

[0040] Extract intrusion behavior sequences, lateral penetration behavior sequences, and attack paths with time-series relationships from security event logs, and then use the pre-trained behavior prediction model to process the extracted data to predict the next possible intrusion behavior, the next possible lateral penetration behavior, and the next attack behavior of the attack path. Based on this, the next possible security event is predicted, instead of the existing prediction of security events from the perspective of the host. The method provided by this application improves the rationality and accuracy of the predicted next security event. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a flow chart of a security event prediction method provided by an embodiment of the present application;

[0042] Figure 2 This is a schematic diagram of the structure of a security event prediction device provided in an embodiment of the present application;

[0043] Figure 3 This is a hardware structure diagram of an electronic device for implementing a security event prediction method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] Exemplary embodiments are described in detail herein, with examples illustrated in the accompanying drawings. When the following description refers to the drawings, identical numerals in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with certain aspects of the present application.

[0045] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms "a," "the," and "the" used in this application are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and includes any or all possible combinations of one or more of the corresponding listed items.

[0046] It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0047] Before introducing the security incident prediction method provided by this application, the technical terms involved in this application are explained:

[0048] This application categorizes common attackers into three types: intrusion, lateral penetration, and attack paths.

[0049] Intrusion means that an attacker targets an asset (such as an IP address) and takes a series of attack actions in the hope of conquering the asset.

[0050] Lateral penetration occurs when an attacker, after compromising an asset, uses that asset as a springboard to probe and attack other assets in the network.

[0051] An attack path refers to the process by which attackers often use one or more jump hosts to compromise target assets. This path is comprised of the attack vector from the initiator to the jump host, and then from the jump host to the target asset, along with the attack behaviors used at each step.

[0052] The security event prediction method provided in this application is described in detail below.

[0053] See also Figure 1 , Figure 1This is a flowchart of a security event prediction method provided by the present application, which is applied to a network device. When the network device implements the above method, the steps may include:

[0054] S101. Extract intrusion behavior sequences, lateral penetration behavior sequences, and attack paths from security event logs of assets in the access network.

[0055] Among them, the above-mentioned intrusion behavior sequence is a sequence of security events with the same destination IP address in the above-mentioned security event log in chronological order, the above-mentioned lateral penetration behavior sequence is a sequence of security events with the same source IP address in the above-mentioned security event log in chronological order, and the above-mentioned attack path is a sequence of security events with the above-mentioned source IP address pointing to the above-mentioned destination IP address.

[0056] Specifically, the network device extracts the intrusion behavior sequence, lateral penetration behavior sequence, and attack path from the currently recorded security event log. It should be noted that the above attack path is a sequence of security events that point from the source IP address to the destination IP address (i.e., the source IP address and the destination IP address are connected at the end).

[0057] It should be noted that the above-mentioned network devices can be, but are not limited to, devices for maintaining the security of the connected network, including but not limited to IPS, EDR, NTA and firewall devices. Network devices can be real physical devices or software modules based on physical resources, all of which are within the scope of protection of this application. Network devices will generate security event logs during the protection process, and then extract the above-mentioned various security events that threaten network security based on the security event logs, and then obtain intrusion behavior sequences, lateral penetration behavior sequences and attack paths.

[0058] S102: Use a pre-trained behavior prediction model to process the intrusion behavior sequence, lateral penetration behavior sequence, and attack path to predict the next intrusion behavior of the asset, the next lateral penetration behavior, and the next attack behavior of the attack path.

[0059] In this step, the application pre-trains the initial model using training samples to obtain a behavior prediction model. The behavior prediction model then uses the intrusion behavior sequence, lateral penetration behavior sequence, and attack path as inputs to predict the next possible behavior of the asset, namely the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior along the attack path.

[0060] Optionally, the training samples for the behavior prediction model include an intrusion behavior sequence training set, a lateral penetration behavior sequence training set, and an attack path training set. Furthermore, the intrusion behavior sequence training set is composed of intrusion behavior sequences extracted from security event logs of various security events that have occurred in the network; the lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences extracted from security event logs of various security events that have occurred in the network; and the attack path training set is composed of attack paths extracted from security event logs of various security events that have occurred in the network.

[0061] Specifically, during the training data collection phase, security event logs recorded over a period of time on multiple network devices can be collected. The more training samples collected, the more accurate the behavior prediction model obtained through training, thereby increasing the accuracy of the prediction results. The access network can be an enterprise network, and accordingly, the multiple network devices can be multiple devices connected to at least one enterprise network.

[0062] On this basis, if the initial model is a single model, the aforementioned intrusion behavior sequence training set, lateral penetration behavior sequence training set, and attack path training set are input into the initial model. The model parameters in the initial model are then adjusted until the training termination condition is met. The training termination condition may include, but is not limited to, the number of adjustments reaching the iteration threshold, or the error of the adjusted model falling within the allowable error range.

[0063] The above-mentioned behavior prediction models include intrusion behavior prediction model, lateral penetration behavior prediction model and attack path prediction model.

[0064] Specifically, the initial model is trained using the intrusion behavior sequence training set to obtain the intrusion behavior prediction model; similarly, the initial model is trained using the lateral penetration behavior sequence training set to obtain the lateral penetration behavior prediction model; the initial model is trained using the attack path training set to obtain the attack path prediction model.

[0065] It should be noted that the initial model described above is designed to capture temporal relationships. Specifically, in the training set of intrusion behavior sequences, each sequence reflects a series of attack behaviors used by an attacker to conduct a targeted attack on a target asset. Attackers often follow certain rules during their intrusion attacks, such as prioritizing system vulnerabilities over web vulnerabilities, which in turn prioritize web vulnerabilities over brute force attacks. Furthermore, the subsequent attack behaviors employed by the attacker often depend on the results of the previous ones. Therefore, the attacker's intrusion behaviors exhibit temporal relationships, making them suitable for modeling using an initial model that captures these temporal relationships.

[0066] In the lateral movement training set, each lateral movement sequence reflects a series of probing and attack behaviors performed by an attacker after compromising an asset. Attackers also follow certain rules during lateral movement, such as obtaining access credentials before remote access. Similarly, the attacker's subsequent attack behaviors depend on the results of the previous ones. Therefore, the attacker's lateral movement behaviors also have a temporal relationship, and can be modeled using an initial model that can record temporal relationships.

[0067] In the attack path training set, each sequence reflects the attack chain from the attacker to the target asset. In the attack chain, the success of the previous attack is a prerequisite for the subsequent attack. Therefore, the attack behaviors in the attack path also have a temporal relationship and can be modeled using an initial model that can record temporal relationships.

[0068] Since the training set used to train the model is a training set with a temporal relationship, the behavior prediction model obtained through training also has a temporal relationship. The next behavior predicted by the behavior prediction model has a temporal relationship with the input behavior, and the prediction result is more accurate.

[0069] On this basis, step S102 can be executed according to the following process: input the above-mentioned intrusion behavior sequence into the above-mentioned intrusion behavior prediction model, and output the next intrusion behavior of the above-mentioned asset; input the above-mentioned lateral penetration behavior into the above-mentioned lateral penetration behavior prediction model, and output the next lateral penetration behavior of the above-mentioned asset; input the above-mentioned attack path into the above-mentioned attack path prediction model, and output the next attack behavior of the above-mentioned attack path.

[0070] Optionally, the above initial model can be, but is not limited to, a Markov model, a conditional random field model, a recurrent neural network model, etc.

[0071] It should be noted that when using the behavior prediction model to predict the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior in the attack path, the behavior prediction model will also output the probability of the next intrusion behavior, the probability of the next lateral penetration behavior, and the probability of the next attack behavior in the attack path.

[0072] It should be noted that the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior in the attack path are essentially attack behaviors, but the attack forms are different. Moreover, since each behavior is classified, the attack type of each behavior will be identified when the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior in the attack path are identified.

[0073] Based on this, the next attack behavior can be characterized by attack type and probability. Similarly, the next lateral movement behavior can be characterized by attack type and probability, and the next intrusion behavior can also be characterized by attack type and probability. Furthermore, the next attack behavior also includes the source IP address, while the next lateral movement behavior also includes the source IP address, and the next intrusion behavior includes the destination IP address. In other words, the next attack behavior is characterized by (source IP address, attack type, probability), and is an attack behavior initiated by this asset. Similarly, the next lateral movement behavior is characterized by (source IP address, attack type, probability), and is also an attack behavior initiated by this asset; while the next intrusion behavior is characterized by (attack type, probability, destination IP address), indicating an attack behavior launched by other assets against this asset.

[0074] S103: Estimate the next security event based on the predicted next intrusion behavior, next lateral penetration behavior, and next attack behavior of the attack path.

[0075] Specifically, step S103 may be performed according to the following process: screening out at least one target attack behavior of the same attack type, each target attack behavior including the lateral penetration behavior and one of the next attack behaviors, as well as the next intrusion behavior; multiplying the product of the occurrence probabilities of the behaviors included in each target attack behavior as the occurrence probability of the security incident corresponding to the target attack behavior; and estimating the next security incident based on the occurrence probability of the security incident corresponding to each target attack behavior.

[0076] Specifically, when there is more than one attack path extracted from the security log, in addition, when using the behavior prediction model to predict each behavior, more than one predicted behavior may be output. That is, when using the intrusion behavior prediction model and the intrusion behavior sequence to predict the next intrusion behavior, multiple next intrusion behaviors and the probability of occurrence of each next intrusion behavior may be output; similarly, there may also be multiple next lateral penetration behaviors predicted by the lateral penetration behavior prediction model, and accordingly, the probability of each next lateral penetration behavior will also be output; and, there may also be multiple next attack behaviors predicted by the attack path prediction model, and accordingly, the probability of occurrence of each next attack behavior will also be output.

[0077] On this basis, since the characterization elements of each behavior include the attack type, target attack behaviors with the same attack type can be screened out. These target attack behaviors include one of the next attack behavior and the next lateral penetration behavior, as well as the next intrusion behavior. Since there may be multiple next intrusion behaviors, next lateral penetration behaviors, and next attack behaviors, at least one target attack behavior can be screened out. Accordingly, a security event corresponding to the target attack behavior will be generated. Based on the occurrence probabilities of the behaviors included in the target attack behavior, the occurrence probability of the security event corresponding to the target attack behavior can be determined, namely, the product of the occurrence probabilities of the behaviors included in the target attack behavior. In this way, the occurrence probabilities of multiple security events can be determined, and the security event that meets the probability threshold can be used as the next possible security event. The occurrence probabilities of the security events corresponding to each target attack behavior can also be sorted and displayed to operations and maintenance personnel for reference and preventive measures.

[0078] For example, the predicted next attack behavior is represented by (source IP address 1, attack type 1, occurrence probability 1), the next intrusion behavior is represented by (attack type 2, occurrence probability 2, target IP address 1), and the next lateral penetration behavior is represented by (source IP address 2, attack type 3, occurrence probability 3). If attack type 1 = attack type 2 ≠ attack type 3, it can be confirmed that the target attack behavior includes the next attack behavior and the next intrusion behavior. The security event corresponding to the target attack behavior is represented by (source IP address 1, attack type 1, target IP address 1), and the probability of occurrence of the security event is probability of occurrence 1*probability of occurrence 2.

[0079] It should be noted that since the last node in the attack path cannot be the same as the source IP of the lateral penetration behavior, the next attack behavior and the next lateral penetration behavior in the attack path generally cannot exist at the same time.

[0080] By implementing the security event prediction method provided by this application, a time-series intrusion behavior sequence, a lateral penetration behavior sequence, and an attack path are extracted from the security event log, and then the extracted data is processed using a pre-trained behavior prediction model to predict the next possible intrusion behavior, the next lateral penetration behavior, and the next attack behavior of the attack path. Based on this, the next possible security event is predicted, rather than the existing prediction of security events from the perspective of the host. The method provided by this application improves the rationality and accuracy of the predicted next security event. In addition, this application uses each behavior sequence and behavior prediction model to predict the next behavior, rather than directly predicting a security event. The behavior prediction model has a theoretical basis and can better describe the attacker's attack behavior pattern. Therefore, the security event predicted based on each behavior is more accurate.

[0081] Based on the same inventive concept, the present application also provides a security event prediction device corresponding to the above security event prediction method. The implementation of the security event prediction device can refer to the above description of the security event prediction method, and will not be discussed here one by one.

[0082] See also Figure 2 , Figure 2 An exemplary embodiment of the present application provides a security event prediction device, comprising:

[0083] Extraction module 201 is configured to extract an intrusion behavior sequence, a lateral penetration behavior sequence, and an attack path from a security event log of an asset in an access network, wherein the intrusion behavior sequence is a chronological sequence of security events in the security event log having the same destination IP address, the lateral penetration behavior sequence is a chronological sequence of security events in the security event log having the same source IP address, and the attack path is a sequence of security events whose source IP address points to the destination IP address;

[0084] A behavior prediction module 202 is configured to process the intrusion behavior sequence, the lateral penetration behavior sequence, and the attack path using a pre-trained behavior prediction model to predict the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior of the asset along the attack path.

[0085] The event prediction module 203 is used to predict the next security event based on the predicted next intrusion behavior, the next lateral penetration behavior and the next attack behavior of the attack path.

[0086] Optionally, the above-mentioned behavior prediction model includes an intrusion behavior prediction model, a lateral penetration behavior prediction model and an attack path prediction model; then

[0087] The above-mentioned behavior prediction module 202 is specifically used to input the intrusion behavior sequence into the intrusion behavior prediction model and output the next intrusion behavior of the asset; input the lateral penetration behavior into the lateral penetration behavior prediction model and output the next lateral penetration behavior of the asset; input the attack path into the attack path prediction model and output the next attack behavior of the attack path.

[0088] Optionally, the next attack behavior is characterized by an attack type and an occurrence probability; the next lateral penetration behavior is characterized by an attack type and an occurrence probability; the next intrusion behavior is characterized by an attack type and an occurrence probability;

[0089] The above-mentioned event prediction module 203 is specifically used to screen out at least one target attack behavior with the same attack type, each target attack behavior including the lateral penetration behavior and one of the next attack behavior, as well as the next intrusion behavior; multiplying the occurrence probabilities of the behaviors included in each target attack behavior as the occurrence probability of the security event corresponding to the target attack behavior; and estimating the next security event based on the occurrence probabilities of the security events corresponding to each target attack behavior.

[0090] Optionally, in a possible embodiment, the intrusion behavior prediction model is obtained by training based on an intrusion behavior sequence training set, wherein the intrusion behavior sequence training set is composed of intrusion behavior sequences respectively extracted from security event logs of various security events that have occurred in the network;

[0091] The lateral penetration behavior prediction model is trained based on a lateral penetration behavior sequence training set, wherein the lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences extracted from security event logs of various security events that have occurred in the network;

[0092] The above-mentioned attack path prediction model is obtained by training based on an attack path training set, and the attack path training set is composed of attack paths respectively extracted from the security event logs of various security events that have occurred in the network.

[0093] Optionally, in another possible embodiment, the above-mentioned behavior prediction model is obtained by training based on an intrusion behavior sequence training set, a lateral penetration behavior sequence training set and an attack path training set, wherein the intrusion behavior sequence training set is composed of intrusion behavior sequences respectively extracted from the security event logs of various security events that have occurred in the network, the lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences respectively extracted from the security event logs of various security events that have occurred in the network, and the attack path training set is composed of attack paths respectively extracted from the security event logs of various security events that have occurred in the network.

[0094] In the security event prediction device provided by the present application, a time-series intrusion behavior sequence, a lateral penetration behavior sequence, and an attack path are extracted from the security event log, and then the extracted data is processed using a pre-trained behavior prediction model to predict the next possible intrusion behavior, the next lateral penetration behavior, and the next attack behavior of the attack path. Based on this, the next possible security event is predicted, rather than the existing prediction of security events from the perspective of the host. The method provided by the present application improves the rationality and accuracy of the predicted next security event. In addition, the present application uses each behavior sequence and behavior prediction model to predict the next behavior, rather than directly predicting a security event. The behavior prediction model has a theoretical basis and can better describe the attacker's attack behavior pattern. Therefore, the security event predicted based on each behavior is more accurate.

[0095] Based on the same inventive concept, the embodiment of the present application provides an electronic device, such as Figure 3 As shown, the electronic device includes a processor 301 and a machine-readable storage medium 302. The machine-readable storage medium 302 stores a computer program executable by the processor 301. The computer program prompts the processor 301 to execute the security event prediction method provided by any embodiment of the present application. In addition, the electronic device also includes a communication interface 303 and a communication bus 304. The processor 301, the communication interface 303, and the machine-readable storage medium 302 communicate with each other via the communication bus 304.

[0096] The communication bus mentioned in the electronic device mentioned above may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0097] The communication interface is used for communication between the above electronic device and other devices.

[0098] The memory may include random access memory (RAM), DDR SRAM (Double Data Rate Synchronous Dynamic Random Access Memory), or non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory may be at least one storage device located remotely from the processor.

[0099] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0100] In addition, an embodiment of the present application provides a machine-readable storage medium, which stores a computer program. When called and executed by a processor, the computer program prompts the processor to execute the security event prediction method provided by the embodiment of the present application.

[0101] As for the electronic device and machine-readable storage medium embodiments, since the method contents involved are basically similar to the aforementioned method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0102] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0103] The implementation process of the functions and effects of each unit / module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0104] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely schematic, wherein the units / modules described as separate components may or may not be physically separated, and the components displayed as units / modules may or may not be physical units / modules, that is, they may be located in one place, or they may be distributed over multiple network units / modules. Some or all of the units / modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0105] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A security incident prediction method, characterized in that: include: Extracting an intrusion behavior sequence, a lateral penetration behavior sequence, and an attack path from a security event log of an asset in the access network, wherein the intrusion behavior sequence is a chronological sequence of security events with the same destination IP address in the security event log, the lateral penetration behavior sequence is a chronological sequence of security events with the same source IP address in the security event log, and the attack path is a sequence of security events with the source IP address pointing to the destination IP address; Processing the intrusion behavior sequence, the lateral penetration behavior sequence, and the attack path using a pre-trained behavior prediction model to predict the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior of the asset along the attack path; Estimate the next security incident based on the predicted next intrusion behavior, next lateral penetration behavior, and next attack behavior along the attack path; The next attack behavior is characterized by an attack type and an occurrence probability; The next lateral penetration behavior is characterized by attack type and occurrence probability; The next intrusion behavior is characterized by an attack type and an occurrence probability; Based on the predicted next intrusion behavior, next lateral penetration behavior, and next attack behavior along the attack path, the next security event is predicted, including: Screening out at least one target attack behavior of the same attack type, each target attack behavior including one of the lateral penetration behavior and the next attack behavior, and the next intrusion behavior; The product of the occurrence probabilities of the behaviors included in each target attack behavior is determined as the occurrence probability of the security incident corresponding to the target attack behavior; The next security event is estimated based on the probability of occurrence of the security event corresponding to each target attack behavior.

2. The method according to claim 1, characterized in that The behavior prediction model includes an intrusion behavior prediction model, a lateral penetration behavior prediction model and an attack path prediction model; Processing the intrusion behavior sequence, the lateral penetration behavior sequence, and the attack path using a pre-trained behavior prediction model to predict the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior in the attack path, including: Inputting the intrusion behavior sequence into the intrusion behavior prediction model, and outputting the next intrusion behavior of the asset; Inputting the lateral penetration behavior into the lateral penetration behavior prediction model and outputting the next lateral penetration behavior of the asset; The attack path is input into the attack path prediction model, and the next attack behavior of the attack path is output.

3. The method according to claim 2, characterized in that The intrusion behavior prediction model is obtained by training based on an intrusion behavior sequence training set, wherein the intrusion behavior sequence training set is composed of intrusion behavior sequences respectively extracted from security event logs of various security events that have occurred in the network; The lateral penetration behavior prediction model is trained based on a lateral penetration behavior sequence training set, wherein the lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences extracted from security event logs of various security events that have occurred in the network; The attack path prediction model is obtained by training based on an attack path training set, and the attack path training set is composed of attack paths respectively extracted from security event logs of various security events that have occurred in the network.

4. The method according to claim 1, wherein The behavior prediction model is obtained through training based on an intrusion behavior sequence training set, a lateral penetration behavior sequence training set, and an attack path training set. The intrusion behavior sequence training set is composed of intrusion behavior sequences extracted from the security event logs of various security events that have occurred in the network. The lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences extracted from the security event logs of various security events that have occurred in the network. The attack path training set is composed of attack paths extracted from the security event logs of various security events that have occurred in the network.

5. A security event prediction device, characterized in that: include: An extraction module is configured to extract an intrusion behavior sequence, a lateral penetration behavior sequence, and an attack path from a security event log of an asset in an access network, wherein the intrusion behavior sequence is a chronological sequence of security events in the security event log having the same destination IP address, the lateral penetration behavior sequence is a chronological sequence of security events in the security event log having the same source IP address, and the attack path is a sequence of security events whose source IP address points to the destination IP address; a behavior prediction module, configured to process the intrusion behavior sequence, the lateral penetration behavior sequence, and the attack path using a pre-trained behavior prediction model, and predict the next intrusion behavior, the next lateral penetration behavior, and the next attack behavior of the asset along the attack path; An event prediction module, configured to predict the next security event based on the predicted next intrusion behavior, the next lateral penetration behavior, and the next attack behavior of the attack path; The next attack behavior is characterized by an attack type and an occurrence probability; the next lateral penetration behavior is characterized by an attack type and an occurrence probability; The next intrusion behavior is characterized by an attack type and an occurrence probability; The event prediction module is specifically configured to screen out at least one target attack behavior of the same attack type, each target attack behavior including one of the lateral penetration behavior and the next attack behavior, as well as the next intrusion behavior; The product of the occurrence probabilities of the behaviors included in each target attack behavior is determined as the occurrence probability of the security incident corresponding to the target attack behavior; The next security event is estimated based on the probability of occurrence of the security event corresponding to each target attack behavior.

6. The device according to claim 5, characterized in that The behavior prediction model includes an intrusion behavior prediction model, a lateral penetration behavior prediction model and an attack path prediction model; The behavior prediction module is specifically configured to input the intrusion behavior sequence into the intrusion behavior prediction model and output the next intrusion behavior of the asset; The lateral penetration behavior is input into the lateral penetration behavior prediction model, and the next lateral penetration behavior of the asset is output; the attack path is input into the attack path prediction model, and the next attack behavior of the attack path is output.

7. The device according to claim 6, characterized in that The intrusion behavior prediction model is obtained by training based on an intrusion behavior sequence training set, wherein the intrusion behavior sequence training set is composed of intrusion behavior sequences respectively extracted from security event logs of various security events that have occurred in the network; The lateral penetration behavior prediction model is trained based on a lateral penetration behavior sequence training set, wherein the lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences extracted from security event logs of various security events that have occurred in the network; The attack path prediction model is obtained by training based on an attack path training set, and the attack path training set is composed of attack paths respectively extracted from security event logs of various security events that have occurred in the network.

8. The device according to claim 5, characterized in that The behavior prediction model is obtained through training based on an intrusion behavior sequence training set, a lateral penetration behavior sequence training set, and an attack path training set. The intrusion behavior sequence training set is composed of intrusion behavior sequences extracted from the security event logs of various security events that have occurred in the network. The lateral penetration behavior sequence training set is composed of lateral penetration behavior sequences extracted from the security event logs of various security events that have occurred in the network. The attack path training set is composed of attack paths extracted from the security event logs of various security events that have occurred in the network.

Images