Control method and device for boundary access control strategy for abnormal behavior discovery

Abstract

The present invention discloses a control method and device for boundary access control policies for abnormal behavior discovery. The method comprises obtaining access control request data; processing the access control request data using a pre-determined model for partitioning and sorting access control policies, determining a partition access control policy corresponding to the access control request data, and recording the access control request data according to the corresponding partition access control policy. The process of determining the pre-determined model for partitioning and sorting access control policies includes: obtaining boundary access control policies; partitioning and sorting boundary access control policies according to access security levels, and determining a partition access policy corresponding to each partition. Advantages: This method solves the problems of multiple, coarse, and chaotic policies. Different types of logs can also be recorded based on individual policy matches, greatly improving operation and maintenance and audit efficiency. It also lays a good foundation for the early detection and prevention of abnormal behavior.

Description

Technical Field

[0001] The present invention relates to a control method and device for a boundary access control strategy oriented to abnormal behavior discovery, belonging to the technical field of boundary access control. Background Art

[0002] With the increasing informatization of enterprises, network security has become a crucial prerequisite for ensuring the secure and reliable operation of information systems. Perimeter access control software and hardware devices can manage inbound and outbound traffic according to policies, thereby ensuring network security. Currently, access control policies can be defined based on specific security requirements to meet the protection needs of different zones.

[0003] Boundary access control technology is relatively mature and widely used. However, devices from different manufacturers and with different interfaces, along with the thousands of policies accumulated over the years and the large amount of logs generated, pose a huge challenge to operations, maintenance, and auditing. During the initial deployment phase, in order to get services online as quickly as possible and avoid business failures, it is easy to overlook the precise planning of mutual access principles, and most people adopt loose configuration policies to ensure business needs. In the later stages of application, as security requirements are gradually implemented, the access control policies of boundary devices have been refined to the port level. However, new attack methods include behaviors such as implanting Trojans and initiating reverse connections from the server. Although these behaviors can be intercepted by protective devices, there are no separate logs to record such behaviors. These warning signals are often drowned out by the massive amount of useless logs, which has a huge impact on the reliability and availability of the equipment. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to overcome the defects of the existing technology and provide a control method and device for boundary access control policies for abnormal behavior detection, so that expired policies can be easily cleared, duplicate policies can be easily discovered, loose policies can be easily refined, and high-risk policies can be easily managed, thereby greatly improving operation and maintenance efficiency.

[0005] To solve the above technical problems, the present invention provides a control method for a boundary access control policy oriented to abnormal behavior discovery, which obtains access control request data;

[0006] Using a predetermined model for partitioning and sorting access control policies, the access control request data is processed, a partitioned access control policy corresponding to the access control request data is determined, and the access control request data is recorded according to the corresponding partitioned access control policy;

[0007] The process of determining the model for pre-partitioning and sorting access control policies includes:

[0008] Get the boundary access control policy;

[0009] The boundary access control strategy is divided and sorted according to the access security level, and the partition access strategy corresponding to each partition is determined.

[0010] Furthermore, the partitioned access control strategy includes:

[0011] Special access policies are used to allow access to high-risk access requests that have special or temporary needs or can be opened after evaluation;

[0012] High-risk service blocking policy, used to block ports that exploit known vulnerabilities and non-routine service ports where common worm viruses spread;

[0013] General access policy is used to allow cross-border access requests for all general services;

[0014] The full IP blocking policy for servers in Area A accessing servers in Area B is used to pre-mark all IP addresses of servers in Area A and block non-business-type active requests from servers in Area A to the IP addresses of servers in Area B. Servers in Areas A and B represent servers on both sides of the access control device.

[0015] The policy of blocking all IP addresses of servers in zone A from accessing servers in zone B is used to pre-mark all IP addresses of servers in zone B and block all non-recorded requests from server IP addresses in zone A to access servers in zone B.

[0016] The policy of blocking all IP addresses in zone B from accessing zone A is used to pre-mark all zone B server IP addresses and block non-business type active requests from zone B servers to zone A server IP addresses.

[0017] The policy of blocking all IP addresses of servers in zone B from accessing servers in zone A is used to pre-mark all IP addresses of servers in zone A and block all non-recorded requests from IP addresses of servers in zone B to access servers in zone A;

[0018] Full blocking policy is used to prohibit all requests to meet security management requirements;

[0019] The ineffective policy is used to observe the temporary policy after use and delete the temporary policy after a certain period of time. The temporary policy is an access need generated within a certain period of time due to sudden demand. After the need is met, the policy is no longer necessary.

[0020] Furthermore, the process of recording the access control request data according to the corresponding partition access control policy includes:

[0021] Log levels are divided into three levels: high, medium, and low according to the security level of the content involved. High-level content includes: triggering of abnormal behavior and interception of malicious attacks; medium-level content includes: access auditing for special needs; low-level content includes: remaining access requests intercepted by access control devices;

[0022] If the corresponding partition control strategy is:

[0023] Special access policies are recorded in logs. The log content includes: medium security level, number of special policy hits, special policy hit time period, special policy link duration, etc. The analysis results are used to determine whether the special demand policies in this partition are used properly.

[0024] High-risk service blocking policy records logs, including information such as high security level, source IP address that hits the blocked policy, destination IP address that hits the blocked policy, and destination port address that hits the blocked policy. Based on the analysis results, hosts that launch malicious attacks from outside or hosts with abnormal behavior inside can be found, and corresponding IP addresses can be banned or repaired by tracing the source.

[0025] For business routine access policies, no logs are recorded;

[0026] If the server in zone A accesses the server in zone B, all IP addresses are blocked, logs are recorded, and the security level is high. The blocking reason is determined based on the recorded results.

[0027] If the server in zone B accesses the server in zone A, all IP addresses are blocked, logs are recorded, and the security level is high. The blocking reason is determined based on the recorded results.

[0028] If all IP addresses of servers in zone B are blocked from accessing servers in zone A, logs are recorded, which has a low security level. The logged results are used to determine whether the request is legitimate or an attack.

[0029] If all IP addresses of servers in zone A are blocked from accessing servers in zone B, logs are recorded, which has a low security level. The logged results are used to determine whether the request is legitimate or an attack.

[0030] If the policy is full blocking, no logs will be recorded;

[0031] If the policy is not in effect, no log is recorded.

[0032] Furthermore, the access control policies within each partition are sorted in a one-to-one and then one-to-many order. The specific process includes:

[0033] Get the access control source zone group within the partition. The source zone group refers to the zone to which the source IP belongs. It clearly identifies which IPs and corresponding zones have access requirements.

[0034] Based on the business characteristics of the enterprises within the partition, the access control source area groups are sorted by region, unit or subordinate relationship, and the sorting results are mapped to the access control policy sequence of different partitions;

[0035] Each access control source zone group includes all access control policies involving the source IPs under the zone group. The access control policies in each zone group are sorted in the form of access control policies for one source IP to one destination IP, and then access control policies for one source IP to multiple destination IPs.

[0036] Furthermore, the creation of access control policies includes:

[0037] The access control policy is created with one or several ports of the business address as target objects.

[0038] A computer-readable storage medium storing one or more programs, the one or more programs comprising instructions that, when executed by a computing device, cause the computing device to perform any of the methods described.

[0039] A computing device comprising:

[0040] One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for executing any of the methods described.

[0041] The beneficial effects achieved by the present invention are:

[0042] The present invention designs the configuration method of access control policy and log recording in combination with various attack methods and network actions of abnormal behavior, solving the problems of multiple, rough and chaotic policies. It can also record different types of logs according to individual policy matching, greatly improving operation and maintenance and audit efficiency, and laying a good foundation for early detection and early prevention of abnormal behavior. DETAILED DESCRIPTION

[0043] The present invention will be further described below with reference to the following examples. The following examples are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention.

[0044] A control method for boundary access control strategy for abnormal behavior discovery,

[0045] Get access control request data;

[0046] Using a model that pre-partitions and sorts access control policies, the access control request data is processed to determine the partition corresponding to the access control request data, and the access control request data is recorded according to the corresponding partition control policy;

[0047] The process of determining the model for pre-partitioning and sorting access control policies includes:

[0048] Get the boundary access control policy;

[0049] The boundary access control strategy is divided and sorted according to the access security level, and the partition access strategy corresponding to each partition is determined.

[0050] By logically partitioning access control policies and clarifying the policy creation logic and resource object management methods, we can easily remove expired policies, identify duplicate policies, refine loose policies, and manage high-risk policies, significantly improving operational efficiency. Partitioning access control policy logs reduces the amount of useless logs and significantly improves the efficiency of log security audits. This plays an indispensable role in preventing and detecting abnormal behavior.

[0051] Access control partitioning method:

[0052] Access control zoning divides policies into logical or physical zones and arranges them in a specific order. This enables standardized management, greatly increasing the efficiency of operations and management personnel in adding, deleting, modifying, and querying access control policies. It also lays a solid foundation for subsequent log audits. Access control zones can be divided into nine zones, which can be adjusted based on actual conditions. Zone security levels are assigned based on actual conditions. The detailed zoning is shown below.

[0053] Log levels are divided into three levels: high, medium, and low according to the security level of the content involved. High-level content includes the triggering of abnormal behavior, interception of malicious attacks, etc. Effective attention can avoid security risks; medium-level content includes access audits for special needs. Effective audits can discover abnormal behaviors of internal personnel using reasonable access; low-level content includes remaining access requests intercepted by access control devices. Business or risk baselines can be established in combination with machine learning technology to conduct in-depth analysis of their matching content.

[0054] 1. Special access policies: Log records. The log content should include information such as the medium security level, the number of times the special policy was hit, the time period during which the special policy was hit, and the length of time the special policy maintained a connection. Based on the analysis results, determine whether the special demand policies within this partition are being used legitimately (such as remote control, transmission, login, and other non-routine operations).

[0055] 2. High-risk service blocking strategy: Log records. The log content should include information such as the high security level, the source IP address that hits the blocking strategy, the destination IP address that hits the blocking strategy, and the destination port that hits the blocking strategy. Based on the analysis results, hosts launching malicious attacks from outside or hosts exhibiting abnormal internal behavior can be identified, and corresponding IP addresses can be blocked or remediated through traceability. For the blocking strategy area, policies are implemented to block ports for known vulnerability exploits, ports for common worm virus propagation, and non-routine service ports for services such as remote control, remote login, and remote transmission (such as TCP_23, TCP_135, TCP_139, TCP_445, TCP_3306, and TCP_3389).

[0056] 3. General access policy: This is the release policy area, which contains the control policies for all general services that allow cross-border access.

[0057] 4. Blocking policy for servers in area A to access all IP addresses in area B: This is a blocking policy that marks all IP addresses of servers in area A and blocks non-business type active requests from servers in area A to IP addresses in area B.

[0058] 5. Blocking policy for all IPs in zone A to access servers in zone B: This is a blocking policy that marks all IPs of servers in zone B and blocks all non-registered requests from IPs in zone A to access servers in zone B.

[0059] 6. Blocking policy for servers in zone B to access all IP addresses in zone A: This is a blocking policy that marks all IP addresses of servers in zone B and blocks non-business type active requests from servers in zone B to IP addresses in zone A.

[0060] 7. Blocking policy for all IPs in zone B to access servers in zone A: This is a blocking policy that marks all IPs of servers in zone A and blocks all non-registered requests from IPs in zone B to access servers in zone A.

[0061] 8. Full blocking strategy: A full prohibition strategy to meet security management requirements.

[0062] 9. Ineffective policy: A policy that expires after the temporary policy is used. The policy in this area will be deleted after a certain period of observation (three months).

[0063] Logging methods:

[0064] Access control logs are logs recorded after the access control policy is hit. A reasonable logging strategy can filter out a large number of useless logs. At the same time, different risk level fields can be set for different areas based on actual conditions. By matching areas of different levels, high, medium and low levels of log risk are defined, laying a solid foundation for subsequent in-depth log analysis and the discovery of abnormal behavior.

[0065] 1. Special access policy: records logs, field intermediate, login, control, transmission and other ports. It is necessary to analyze the number of times the policy is hit, the time period, the duration and other information to determine whether the policy in this area is used properly.

[0066] 2. High-risk service blocking strategy: Record logs, advanced fields. High-risk port blocking strategies are mostly regular service ports used for worm virus propagation or vulnerability exploitation, and are non-business ports. Matched strategies need to be analyzed to discover infected or compromised hosts or hosts with improper behavior. IP addresses can then be blocked or traced.

[0067] 3. Business general access policy: No logs are recorded.

[0068] 4. Block all IP addresses in Zone B from servers in Zone A: Log data in the Advanced field. You can use the logs to identify blocked requests initiated by the server. In principle, servers rarely initiate connections. They typically spread the infection to other hosts or send reverse connection control requests only after they've been infected with a Trojan or other virus.

[0069] 5. Block all IP addresses in Zone A from accessing servers in Zone B: Log data with the Advanced field enabled. This allows you to identify blocked active outbound requests from servers by matching logs. In principle, servers rarely initiate connections. Servers typically only spread the infection to other hosts or send reverse connection control requests when infected with a Trojan or other virus.

[0070] 6. Blocking all IP addresses in Zone B from accessing Zone A servers: This policy records logs at a low level, allowing for the identification of blocked requests for illegal server access. This policy can be manually or through machine learning, based on multiple factors such as the access port, source IP address, access time, and access frequency, to determine whether the request is legitimate or an attack.

[0071] 7. Blocking all IP addresses in Zone A from accessing Zone B servers: This policy records logs at a low level, allowing for the identification of blocked requests for illegal server access. This policy can be manually or through machine learning to determine whether a request is legitimate or an attack based on multiple factors, including the access port, source IP address, access time, and access frequency.

[0072] 8. Full blocking strategy: no logs are recorded.

[0073] 9. Ineffective policy: No log is recorded.

[0074] Access control policy sorting and creation methods:

[0075] Policies within each zone should be sorted one-to-one, then one-to-many. Policy creation should target one or more ports of a business address (e.g., 1.1.1.1:80). This serves two purposes: first, to facilitate additions, deletions, and modifications during operations and maintenance, such as preventing duplicate policies from being added or omissions from being made. Second, to facilitate emergency response, such as when a unit is completely compromised, allowing for unified control of release policies. Policies should be sorted according to a specific rule (e.g., Beijing, Tianjin, Tibet) based on the source address accessing the same target.

[0076] For invalid and deleted policies, the resources they occupy (IP address resources, custom port resources) are deleted together.

[0077] The policies within each partition should be sorted in a one-to-one and then one-to-many manner. Further explanation: Access control policies generally limit who in a certain area is allowed / not allowed to access who in another area. The objects involved in access control policies include: source IP, destination IP, destination port, policy validity period, whether to record logs, partition to which they belong, and other information. In order to effectively optimize emergency response efficiency and reduce the workload of operation and maintenance, response policies must be reasonably merged and sorted.

[0078] Sorting by the regional group to which the source IP belongs (hereinafter referred to as the source regional group) can maximize merging efficiency. First, the access control source regional groups should be sorted. Enterprises should sort the access control source regional groups involved based on their own business characteristics by region, unit, or subordinate relationship, and map the sorting results to the access control policy order of different partitions.

[0079] Each source zone group should contain all access control policies involving the source IPs within the zone. The access control policies within each group should be sorted in the order of "one-to-one" first and then "one-to-many" (that is, the access control policy for one source IP to one destination IP first, and then the access control policy for one source IP to multiple destination IPs).

[0080] The present invention also provides a computer-readable storage medium storing one or more programs, wherein the one or more programs include instructions, which, when executed by a computing device, enable the computing device to perform any of the methods described above.

[0081] The corresponding present invention also provides a computing device, comprising one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for executing any of the methods described.

[0082] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A control method for a boundary access control policy for abnormal behavior discovery, characterized in that: Get access control request data; Using a predetermined model for partitioning and sorting access control policies, the access control request data is processed, a partitioned access control policy corresponding to the access control request data is determined, and the access control request data is recorded according to the corresponding partitioned access control policy; The process of determining the model for pre-partitioning and sorting access control policies includes: Get the boundary access control policy; Divide and sort the boundary access control policies according to the access security level, and determine the partition access policy corresponding to each partition; Access control policies within each partition are sorted one-to-one and then one-to-many. The specific process includes: Get the access control source zone group within the partition. The source zone group refers to the zone to which the source IP belongs. It clearly identifies which IPs and corresponding zones have access requirements. Based on the business characteristics of the enterprises within the partition, the access control source area groups are sorted by region, unit or subordinate relationship, and the sorting results are mapped to the access control policy sequence of different partitions; Each access control source zone group includes all access control policies involving the source IPs under the zone group. The access control policies in each zone group are sorted in the form of access control policies for one source IP to one destination IP, and then access control policies for one source IP to multiple destination IPs.

2. The control method of the boundary access control policy for abnormal behavior discovery according to claim 1 is characterized in that: The partitioned access control strategy includes: Special access policies are used to allow access to high-risk access requests that have special or temporary needs or can be opened after evaluation; High-risk service blocking policy, used to block ports that exploit known vulnerabilities and non-routine service ports where common worm viruses spread; General access policy is used to allow cross-border access requests for all general services; The full IP blocking policy for servers in Area A accessing servers in Area B is used to pre-mark all IP addresses of servers in Area A and block non-business-type active requests from servers in Area A to the IP addresses of servers in Area B. Servers in Areas A and B represent servers on both sides of the access control device. The policy of blocking all IP addresses of servers in zone A from accessing servers in zone B is used to pre-mark all IP addresses of servers in zone B and block all non-recorded requests from server IP addresses in zone A to access servers in zone B. The policy of blocking all IP addresses in zone B from accessing zone A is used to pre-mark all zone B server IP addresses and block non-business type active requests from zone B servers to zone A server IP addresses. The policy of blocking all IP addresses of servers in zone B from accessing servers in zone A is used to pre-mark all IP addresses of servers in zone A and block all non-recorded requests from IP addresses of servers in zone B to access servers in zone A; Full blocking policy is used to prohibit all requests to meet security management requirements; The ineffective policy is used to observe the temporary policy after use and delete the temporary policy after a certain period of time. The temporary policy is an access need generated within a certain period of time due to sudden demand. After the need is met, the policy is no longer necessary.

3. The control method of the boundary access control policy for abnormal behavior discovery according to claim 2 is characterized in that: The process of recording the access control request data according to the corresponding partition access control policy includes: Log levels are divided into three levels: high, medium, and low according to the security level of the content involved. High-level content includes: triggering of abnormal behavior and interception of malicious attacks; medium-level content includes: access auditing for special needs; low-level content includes: remaining access requests intercepted by access control devices; If the corresponding partition control strategy is: Special access policies are recorded in logs. The log content includes: medium security level, number of special policy hits, special policy hit time period, special policy link duration, etc. The analysis results are used to determine whether the special demand policies in this partition are used properly. High-risk service blocking policy records logs, including information such as high security level, source IP address that hits the blocked policy, destination IP address that hits the blocked policy, and destination port address that hits the blocked policy. Based on the analysis results, hosts that launch malicious attacks from outside or hosts with abnormal behavior inside can be found, and corresponding IP addresses can be banned or repaired by tracing the source. For business routine access policies, no logs are recorded; If the server in zone A accesses the server in zone B, all IP addresses are blocked, logs are recorded, and the security level is high. The blocking reason is determined based on the recorded results. If the server in zone B accesses the server in zone A, all IP addresses are blocked, logs are recorded, and the security level is high. The blocking reason is determined based on the recorded results. If all IP addresses of servers in zone B are blocked from accessing servers in zone A, logs are recorded, which has a low security level. The logged results are used to determine whether the request is legitimate or an attack. If all IP addresses of servers in zone A are blocked from accessing servers in zone B, logs are recorded, which has a low security level. The logged results are used to determine whether the request is legitimate or an attack. If the policy is full blocking, no logs will be recorded; If the policy is not in effect, no log is recorded.

4. The control method of the boundary access control policy for abnormal behavior discovery according to claim 1 is characterized in that: Creating an access control policy involves: The access control policy is created with one or several ports of the business address as target objects.

5. A computer-readable storage medium storing one or more programs, characterized in that: The one or more programs include instructions that, when executed by a computing device, cause the computing device to perform any one of the methods according to claims 1 to 4.

6. A computing device, characterized in that include, One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising instructions for executing any one of the methods according to claims 1 to 4.