Log collision rule conversion method, device, system and electronic device

Abstract

The present application relates to a log collision rule conversion method, device, system and electronic device, wherein the log collision rule conversion method includes: obtaining a log sample, a first log collision rule and a target rule type, extracting the first rule information in the first log collision rule; regularizing the characteristic value of the first rule information to obtain a regular statement of the first rule information, splicing the first rule information with the log sample to obtain a spliced ​​statement; performing rule conversion processing on the spliced ​​statement according to the target rule type to obtain a second log collision rule; performing a log content collision test on the second log collision rule and the log sample to obtain a collision test result; outputting the collision test result and the second log collision rule to a terminal device. Through the present application, the problems of low utilization rate of collision rules, large redundancy and low rule conversion efficiency are solved, and efficient conversion of log collision rules is achieved.

Description

Technical Field

[0001] The present application relates to the field of log collision rules, and in particular to a log collision rule conversion method, device, system and electronic device. Background Art

[0002] On the terminals where websites for various industries such as finance, government, medical, education, military, and people's livelihood are deployed, the assets will inevitably increase with the increase of business. Therefore, in order to strengthen the security of the terminals where the assets are located, various types of terminal response devices will be installed, and various terminal threat collision rules and various types of rule formats will be generated. In order to achieve unified management of terminal collision rule format definitions, it is necessary to quickly convert various terminal collision rules to each other in order to promote rule integration and simplify operations and unified rule maintenance.

[0003] In the related art, it is often necessary to write corresponding collision rules for different terminal response devices, and the old and new rules coexist in the computer system.

[0004] There is no effective solution to the problems of low utilization rate, large redundancy and low rule conversion efficiency of terminal collision rules in related technologies. Summary of the invention

[0005] In this embodiment, a log collision rule conversion method, device, system and electronic device are provided to solve the problems of low terminal collision rule utilization, large redundancy and low rule conversion efficiency in the related art.

[0006] In a first aspect, a log collision rule conversion method is provided in this embodiment, including:

[0007] Obtain a log sample, a first log collision rule and a target rule type, and extract first rule information in the first log collision rule; wherein the target rule type is different from the initial rule type, and the initial rule type refers to the type of the first log collision rule;

[0008] Regularizing the feature values ​​of the first rule information to obtain a regular statement of the first rule information, and concatenating the regular statements of the first rule information using the log sample to obtain a concatenated statement;

[0009] The concatenated statement is subjected to rule conversion processing according to the target rule type to obtain a second log collision rule; wherein the type of the second log collision rule refers to the target rule type; the second log collision rule is subjected to a log content collision test with the log sample to obtain a collision test result;

[0010] Output the collision test result and the second log collision rule to the terminal device.

[0011] In some of the embodiments, the first rule information includes a first rule field and / or a first rule module;

[0012] The first rule information regular statement includes a first rule field regular statement and / or a first rule module regular statement; wherein, the first rule field regular statement is obtained by regularizing the feature value of the first rule field, and the first rule module regular statement is obtained by regularizing the feature value of the first rule module.

[0013] In some embodiments, the step of regularizing the feature value of the first rule information to obtain a regular statement of the first rule information, and concatenating the regular statements of the first rule information using the log sample to obtain a concatenated statement includes:

[0014] Extracting second rule information from the first log collision rule;

[0015] Regularizing the feature value of the first rule information to obtain a first rule information regular statement, and regularizing the feature value of the second rule information to obtain a second rule information regular statement;

[0016] Using the log sample, the first rule information regular statement and the second rule information regular statement are concatenated to obtain the concatenated statement.

[0017] In some embodiments, the second rule information includes a second rule field and / or a second rule module; wherein the second rule field is a field in the first log collision rule other than the first rule field, and the second rule module is a module in the first log collision rule other than the first rule module;

[0018] The second rule information regular statement includes a second rule field regular statement and / or a second rule module regular statement; wherein, the second rule field regular statement is obtained by regularizing the feature value of the second rule field, and the second rule module regular statement is obtained by regularizing the feature value of the second rule module.

[0019] In some embodiments, the step of splicing the first rule information regular statements using the log sample to obtain a spliced ​​statement includes:

[0020] Performing standardized format processing on the fields in the log sample to obtain the standardized fields of the log sample, and obtaining the sorting result of the standardized fields of the log sample in the log sample;

[0021] According to the sorting result, the regular statements of the first rule information are concatenated to obtain the concatenated statement.

[0022] In some embodiments, performing a log content collision test on the second log collision rule and the log sample to obtain a collision test result includes:

[0023] Performing standardized format processing on the fields in the log sample to obtain log sample standardized fields, and dividing the log sample standardized fields to obtain log sample field names and log sample field values;

[0024] According to the second log collision rule, the field name and field characteristic value specified in the second log collision rule are searched in the log sample standardized field; if the log sample field name and the log sample field value corresponding to the specified field name and field characteristic value are found in the log sample standardized field, the collision test result indicates that the collision test is successful; if the specified field name and field characteristic value are missing in the log sample standardized field, the collision test result indicates that the collision test failed.

[0025] In some embodiments, the outputting the collision test result and the second log collision rule to a terminal device includes:

[0026] If the collision test result indicates that the collision test is successful, outputting the collision test result and the second log collision rule to the terminal device;

[0027] If the collision test result indicates that the collision test fails, the collision test result and a collision test failure log corresponding to the collision test result are output to the terminal device.

[0028] In a second aspect, a log collision rule conversion device is provided in this embodiment, including: an acquisition module, a processing module and a sending module;

[0029] The acquisition module is used to acquire a log sample, a type and content of a first log collision rule, and a target rule type, and extract first rule information in the first log collision rule;

[0030] The processing module is used to regularize the feature value of the first rule information to obtain a first rule information regular statement, and use the log sample to splice the first rule information regular statement to obtain a spliced ​​statement; perform rule conversion processing on the spliced ​​statement according to the target rule type to obtain a second log collision rule; wherein the type of the second log collision rule refers to the target rule type; perform a log content collision test on the second log collision rule and the log sample to obtain a collision test result;

[0031] The sending module is used to output the collision test result and the second log collision rule to the terminal device.

[0032] In a third aspect, a log collision rule conversion system is provided in this embodiment, including: a terminal device, a transmission device and a server device; wherein the terminal device is connected to the server device via the transmission device;

[0033] The server device is used to execute the log collision rule conversion method described in the first aspect above;

[0034] The transmission device is used to send the collision test result and the second log collision rule to the terminal device;

[0035] The terminal device is used to obtain the collision test result and the second log collision rule for display.

[0036] In a fourth aspect, an electronic device is provided in this embodiment, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the log collision rule conversion method described in the first aspect when executing the computer program.

[0037] Compared with the related art, the log collision rule conversion method, device, system and electronic device provided in this embodiment extract the first rule information in the first log collision rule by acquiring a log sample, a first log collision rule and a target rule type; regularize the characteristic value of the first rule information to obtain a regular statement of the first rule information, and use the log sample to splice the first rule information regular statement to obtain a spliced ​​statement; then perform rule conversion processing on the spliced ​​statement according to the target rule type to obtain a second log collision rule, and perform a log content collision test on the second log collision rule and the log sample to obtain a collision test result; finally, output the collision test result and the second log collision rule to the terminal device, which solves the problems of low utilization rate, large redundancy and low rule conversion efficiency of collision rules, and realizes efficient conversion of log collision rules.

[0038] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0040] Figure 1An application scenario diagram of a log collision rule conversion method in an embodiment;

[0041] Figure 2 A flow chart of a log collision rule conversion method in one embodiment;

[0042] Figure 3 A schematic diagram of a flow chart of a log collision rule conversion method in another embodiment;

[0043] Figure 4 is a structural block diagram of a log collision rule conversion device in an embodiment;

[0044] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0046] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with general skills in the technical field to which this application belongs. The words "one", "a", "the", "these" and the like in this application do not indicate a quantitative limitation, and they may be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone. Generally, the character " / " indicates that the objects associated with each other are in an "or" relationship. The terms "first", "second", "third", etc. in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0047] The log collision rule conversion method provided in this application can be applied to Figure 1In the application environment shown. Among them, the terminal device 102 communicates with the server 104 through the network. First, the server 104 obtains the log sample, the first log collision rule and the target rule type, and extracts the first rule information in the first log collision rule; secondly, the server 104 regularizes the characteristic value of the first rule information to obtain the regular statement of the first rule information, and uses the log sample to splice the regular statement of the first rule information to obtain the spliced ​​statement; at the same time, the server 104 performs rule conversion processing on the spliced ​​statement according to the target rule type to obtain the second log collision rule; finally, the terminal device 102 receives the collision test result and the second log collision rule and displays them. Among them, the terminal device 102 can be but is not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices, and the server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0048] In this embodiment, a log collision rule conversion method is provided. Figure 2 : is a flow chart of the log collision rule conversion method of this embodiment, such as Figure 2 As shown, the process includes the following steps:

[0049] Step S202, obtaining a log sample, a first log collision rule and a target rule type, and extracting the first rule information in the first log collision rule; wherein the target rule type is different from the initial rule type, and the initial rule type refers to the type of the first log collision rule. Preferably, the log samples are different log sample types generated by different asset types, such as security logs, maintenance logs and operation logs; the type of the first log collision rule is a log collision rule type corresponding to the log sample type, for example, when the log sample type is a security log, the first log collision rule can be a sigma rule; the sigma rule is a rule writing tool for threat detection, which is mainly used in the threat hunting process and can collide and detect threats found in the fields of network traffic and terminal logs.

[0050] Step S204, regularize the characteristic value of the first rule information to obtain the regular statement of the first rule information, and use the log sample to splice the regular statement of the first rule information to obtain a spliced ​​statement. The characteristic value of the first rule information refers to the value of the first rule field and / or the first rule module corresponding to the first rule information; regularizing the characteristic value of the first rule information refers to writing the first rule information into a regular expression statement to form the first rule information expressed by a regular expression, performing regular expression judgment on the log sample, and completing log collision detection; the spliced ​​statement refers to sorting and splicing the regular statement of the first rule information corresponding to the standardized field of the log sample according to the sorting order of the standardized field of the log sample according to the sorting order of the standardized field of the log sample to obtain a spliced ​​statement.

[0051] Step S206, performing rule conversion processing on the concatenated statement according to the target rule type to obtain a second log collision rule; wherein the type of the second log collision rule refers to the target rule type; performing a log content collision test on the second log collision rule and the log sample to obtain a collision test result.

[0052] Furthermore, the rule conversion process may be to adjust the concatenated statement to a rule statement of the type that conforms to the second log collision rule; after the second log collision rule is obtained through the rule conversion process, the second log collision rule may be subjected to a collision test with the content in the above log sample to obtain a collision test result. The collision test refers to the behavior that can extract specific features from the log sample; the collision rule refers to a rule that contains the specific feature to quickly extract the specific feature from the log sample; the collision test result refers to the result obtained by extracting the specific feature from the log sample using the converted second log collision rule.

[0053] Step S208: output the collision test result and the second log collision rule to the terminal device.

[0054] Among them, the type of the second log collision rule is the same as the type of the first log collision rule, but the rule syntax is different. For example, when the above log sample is a security log, the second collision rule type can be a yara rule; the yara rule is a tool designed to help malware researchers identify and classify malware samples. It is mainly used in the threat hunting process and can detect threats found in the fields of collision detection terminals.

[0055] Through the above steps, compared with the situation in the related art where corresponding collision rules need to be written for different terminal response devices, and the old class rules and the new class rules coexist in the computer system, the present embodiment provides a log collision rule conversion method, device, system and electronic device, which obtains a log sample, a first log collision rule and a target rule type, extracts the first rule information in the first log collision rule, regularizes the characteristic value of the first rule information to obtain a first rule information regular statement, splices the first rule information regular statement using the log sample to obtain a spliced ​​statement, and then performs rule conversion processing on the spliced ​​statement according to the target rule type to obtain a second log collision rule, so that efficient conversion of log collision rules between different types can be achieved, so that collision detection can be performed on different types of log samples generated by different assets, and there is no need to manually write collision detection rules for log samples, thereby improving the efficiency of rule conversion, and at the same time, it can also simplify the unified maintenance of terminal collision detection rules, achieve efficient conversion of log collision rules, and solve the problems of low utilization rate, large redundancy and low rule conversion efficiency of terminal collision rules.

[0056] In some of the embodiments, a log collision rule conversion method is provided, which, in addition to all the above steps, further comprises: the first rule information comprises a first rule field and / or a first rule module;

[0057] The first rule information regular statement includes a first rule field regular statement and / or a first rule module regular statement; wherein, the first rule field regular statement is obtained by regularizing the feature value of the first rule field, and the first rule module regular statement is obtained by regularizing the feature value of the first rule module.

[0058] Further, the first rule information includes the first rule field and / or the first rule module, which means that the first rule information may include only the first rule field, may include only the first rule module, or may include both the first rule field and the first rule module.

[0059] It should be noted that the first rule information refers to the potential common necessary rule statements that adapt to different types of terminal collision rules. In addition to the above-mentioned first rule field and / or first rule module, it can also include rule semantics, rule syntax, rule name, rule sub-items, rule sub-conditions and rule content items.

[0060] Through the above steps, the characteristic values ​​of the first rule field and / or the first rule module in the first rule information are regularized to obtain the first rule field regular statement and / or the first rule module regular statement that conforms to the collision rule format, thereby realizing efficient conversion of the log collision rule; at the same time, the first rule information includes potential common necessary rule statements that adapt to collision rules of different types of terminals, making the log collision rule conversion method more widely used.

[0061] In some embodiments, a log collision rule conversion method is provided. In addition to regularizing the feature value of the first rule information to obtain a regular statement of the first rule information, and splicing the regular statements of the first rule information using the log sample to obtain a spliced ​​statement, the method also includes:

[0062] Extracting second rule information from the first log collision rule content;

[0063] Regularizing the characteristic value of the first rule information to obtain a regular statement of the first rule information, and regularizing the characteristic value of the second rule information to obtain a regular statement of the second rule information;

[0064] Using the log sample, the first rule information regular statement and the second rule information regular statement are concatenated to obtain the concatenated statement.

[0065] It should be noted that the second rule information refers to potential common optional rule statements that adapt to different types of terminal collision rules; the difference between the second rule information and the first rule information is that the first rule information refers to the essential rule information in log collision, which can be the rule name (title) and rule syntax (detection); the second rule information refers to the optional rule information in log collision, which can be the rule description (description).

[0066] Through the above steps, on the basis of extracting the first rule information in the first log collision rule content, the second rule information is extracted, which can expand or narrow the scope of rule information extraction in the first rule content for different types of logs generated by different assets, generate collision rules for different types of logs in a customized manner, or generally generate unified collision rules for logs with universal potential common rule statements, thereby realizing efficient conversion of log collision rules and improving the management efficiency of log collision rules.

[0067] In some embodiments, a log collision rule conversion method is provided. In addition to all the above steps, the method further includes:

[0068] The second rule information includes a second rule field and / or a second rule module; wherein the second rule field is a field in the first log collision rule except the first rule field, and the second rule module is a module in the first log collision rule except the first rule module;

[0069] The second rule information regular statement includes a second rule field regular statement and / or a second rule module regular statement; wherein, the second rule field regular statement is obtained by regularizing the feature value of the second rule field, and the second rule module regular statement is obtained by regularizing the feature value of the second rule module.

[0070] Further, the second rule information includes the second rule field and / or the second rule module, which means that the second rule information may only include the second rule field, may only include the second rule module, or may include both the second rule field and the second rule module.

[0071] It should be noted that, in addition to the above-mentioned second rule field and / or second rule module, the second rule information may also include rule semantics, rule syntax, rule name, rule sub-items, rule sub-conditions and rule content items; when the second rule information includes rule semantics, rule syntax, rule name, rule sub-items, rule sub-conditions and rule content items, it includes rule information in the first log collision rule except for the rule semantics, rule syntax, rule name, rule sub-items, rule sub-conditions and rule content items included in the first rule information.

[0072] Through the above steps, the characteristic values ​​of the second rule field and / or the second rule module in the second rule information are regularized to obtain the second rule field regular statement and / or the second rule module regular statement that conforms to the collision rule format, thereby realizing efficient conversion of the log collision rule; at the same time, the second rule information includes potential common optional rule statements that are adapted to collision rules of different types of terminals, making the log collision rule conversion method more widely used.

[0073] In some embodiments, a log collision rule conversion method is provided. In addition to using a log sample to splice a first rule information regular statement to obtain a spliced ​​statement, the method also includes:

[0074] Performing standardized format processing on the fields in the log sample to obtain the standardized fields of the log sample, and obtaining the sorting result of the standardized fields of the log sample in the log sample;

[0075] According to the sorting result, the regular statements of the first rule information are concatenated to obtain the concatenated statement.

[0076] It should be noted that the standardized format processing refers to distinguishing the various fields in the log sample according to the log standardized format to obtain the standardized fields of the log sample. For example, the log in json format can be distinguished according to the json format, and the field names and field values ​​are separated into lines, with one line storing one field name and its corresponding value, that is, one line corresponds to one log sample standardized field; according to the sorting result, the first rule information regular statement is spliced ​​to obtain the spliced ​​statement, which means that after obtaining the sorting result of the log sample standardized field in the log sample, according to the sorting order of the log sample standardized field, the first rule information regular statement corresponding to the log sample standardized field is sorted according to the sorting order of the log sample standardized field, and spliced ​​to obtain the spliced ​​statement.

[0077] Through the above steps, the same type of log samples have the same format, that is, the same order of log statements. The first rule information regular statement is spliced ​​in the order of the standardized fields of the log samples to obtain the spliced ​​statements arranged in the order of the log samples. When log collision is performed on the same type of log samples in the future, the log collision is performed in accordance with the format order of the log samples, thereby achieving efficient conversion of log collision rules and improving the efficiency of specific feature extraction of log collision.

[0078] In some embodiments, a log collision rule conversion method is provided. In addition to performing a log content collision test on the second log collision rule and the log sample to obtain a collision test result, the method further includes:

[0079] Performing standardized format processing on the fields in the log sample to obtain the log sample standardized fields, and dividing the log sample standardized fields to obtain the log sample field names and log sample field values;

[0080] According to the second log collision rule, the field name and field characteristic value specified in the second log collision rule are searched in the log sample standardized field; if the log sample field name and the log sample field value corresponding to the specified field name and field characteristic value are found in the log sample standardized field, the collision test result indicates that the collision test is successful; if the specified field name and field characteristic value are missing in the log sample standardized field, the collision test result indicates that the collision test failed.

[0081] Among them, the collision test refers to the behavior that can extract specific features from the log sample; the collision rule refers to the rule that contains the specific feature to quickly extract the specific feature from the log sample; the collision test result refers to the result obtained by extracting the specific feature from the log sample using the converted second log collision rule; the division of the log sample standardized field to obtain the log sample field name and the log sample field value means that after the fields in the log sample are processed in a standardized format to obtain the log sample standardized field, the field name and field value in the log sample standardized field are distinguished, and the field name is defined, so that the second log collision rule is collision tested according to the divided field name and field feature value in the collision test.

[0082] Through the above steps, the second log collision rule is subjected to a collision test using log samples. The test produces two results, success and failure, which can verify the correctness of the second log collision rule and obtain the correct second log collision rule, thereby achieving efficient conversion of the log collision rule and ensuring the correctness of the conversion rule.

[0083] In some embodiments, a log collision rule conversion method is provided. In addition to all the above steps, the method further includes:

[0084] If the collision test result indicates that the collision test is successful, outputting the collision test result and the second log collision rule to the terminal device;

[0085] If the collision test result indicates that the collision test fails, the collision test result and the collision test failure log corresponding to the collision test result are output to the terminal device.

[0086] Through the above steps, the result of success or failure of the collision test is output to the terminal device, and the terminal device can display the collision test result, which is convenient for saving the second log collision rule of the successful collision test, or for finding the cause of failure according to the collision test result indicating failure, adjusting the parameter setting of the log collision rule conversion, and re-executing the log collision rule conversion, thereby realizing efficient conversion of the log collision rule.

[0087] This embodiment also provides a log collision rule conversion method. Figure 3 is a flow chart of another log collision rule conversion method of this embodiment, such as Figure 3 As shown, the process includes the following steps:

[0088] Step S302, collect terminal log content, standardize fields according to corresponding formats, and divide field names, field definitions, and corresponding field values. Specifically, the code example of the terminal log content collected above is as follows:

[0089] {"commandLine":"reg save hklm\\sam sam.hiv","company":"MicrosoftCorporation","currentDirectory":"C:\\Users\\administrator\\","eventNum":"1","fileHash":"MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D","fileVersion":"10.0.19041.1(WinBuild.160101.0800)","hostName":"win10-pc4-jh.molecule-labs.com","image":"C:\\Windows\\System32\\reg.exe","imageLoaded":"","integrityLevel":"High","logonGuid":"{d22097d2-62c1-6107-db93-150000000000}","logonId":"0x1593db","parentCommandLine":"\"C:\\WINDOWS\\system32\\cmd.exe\" ","parentImage":"C:\\Windows\\System32\\cmd.exe","parentProcessGuid":"{d22097d2-76aa-610a-3f1a-000000001000}","parentProcessId":"7652","processGuid":"{d22097d2-76e4-610a-411a-000000001000}","processId":"9692","product":"Microsoft® Windows®Operating System","srcChannel":"Microsoft-Windows-Sysmon / Operational","srcUserId":"S-1-5-18","srcUserName":"MOLECULE-LABS\\Administrator","terminalSessionId":"2","utcTime":"2021-08-04 11:15:48.035","eId":1,"pid":9692,"recordNum":5332302,"created":1628075748}.

[0090] The above standardized fields example would look like this:

[0091] {

[0092] "commandLine": "reg save hklm\\sam sam.hiv",

[0093] "company": "Microsoft Corporation",

[0094] "currentDirectory": "C:\\Users\\administrator\\",

[0095] "eventID": "1",

[0096] "fileHash": "MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D",

[0097] "fileVersion": "10.0.19041.1 (WinBuild.160101.0800)",

[0098] "hostName": "win10-pc4-jh.molecule-labs.com",

[0099] "image": "C:\\Windows\\System32\\reg.exe",

[0100] "imageLoaded": "",

[0101] "integrityLevel": "High",

[0102] "logonGuid": "{d22097d2-62c1-6107-db93-150000000000}",

[0103] "logonId": "0x1593db",

[0104] "parentCommandLine": "\"C:\\WINDOWS\\system32\\cmd.exe\" ",

[0105] "parentImage": "C:\\Windows\\System32\\cmd.exe",

[0106] "parentProcessGuid": "{d22097d2-76aa-610a-3f1a-000000001000}",

[0107] "parentProcessId": "7652",

[0108] "processGuid": "{d22097d2-76e4-610a-411a-000000001000}",

[0109] "processId": "9692",

[0110] "product": "Microsoft® Windows® Operating System",

[0111] "srcChannel": "Microsoft-Windows-Sysmon / Operational",

[0112] "srcUserId": "S-1-5-18",

[0113] "srcUserName": "MOLECULE-LABS\\Administrator",

[0114] "terminalSessionId": "2",

[0115] "utcTime": "2021-08-04 11:15:48.035",

[0116] "eId": 1,

[0117] "pid": 9692,

[0118] "recordNum": 5332302,

[0119] "created": 1628075748

[0120] }

[0121] The above field division result example is shown in Table 1:

[0122] Table 1 Example table of standardized field division results

[0123]

[0124] Step S304, confirm the collision rule types before and after the conversion, confirm the collision rule content before the conversion, extract its necessary fields or modules and other optional fields or modules, including but not limited to potentially available fields. Specifically, the above collision rule content example before the conversion is as follows:

[0125] Title: Export sam and system files locally and extract hash offline (administrator)

[0126] description: Windows 7 simulation test results

[0127] references: https: / / github.com / gentilkiwi / mimikatz / wiki / module-~-lsadump

[0128] tags: ATT&CK T1003-002

[0129] status: experimental

[0130] author: 12306Bro

[0131] logsource:

[0132] product: windows

[0133] service:sysmon

[0134] detection:

[0135] selection1:

[0136] EventID: 1

[0137] Image: 'C:\Windows\System32\reg.exe'

[0138] CommandLine: 'reg save hklm\sam *.hiv'

[0139] selection2:

[0140] EventID: 1

[0141] Image: 'C:\Windows\System32\reg.exe'

[0142] CommandLine: 'reg save hklm\system *.hiv'

[0143] timeframe: last 2m

[0144] condition: any of them

[0145] level: high

[0146] The required fields or modules and other optional fields or modules extracted above include: required first rule information, specifically rule name title and rule syntax detection, and optional second rule information, specifically rule description description; in this embodiment, the extracted rule name title is "local export of sam, system files offline for hash extraction (administrator)"; the extracted rule syntax detection includes rule syntax detection condition "any of them" and rule syntax detection syntax content items selection1, selection2 in item identification names "selection1" and "selection2"; at the same time, in the rule syntax extraction, the syntax content items are extracted in the order of the syntax content item identification names selection1, selection2, including extracting the field names "EventID", "Image" and "CommandLine", and the corresponding values ​​of "EventID", "Image" and "CommandLine"; the extracted rule description description is "Windows 7 simulation test results".

[0147] Step S306, sorting out the extracted fields or module results, and regularizing the extracted field or module feature values. Specifically, the sorted field and module result examples are shown below:

[0148] |Rule name title: ---> Locally export sam and system files and perform hash extraction offline (administrator)

[0149] |Rule description description: ---> Windows 7 simulation test results

[0150] |Rule syntax detection condition: ---> any of them

[0151] | Extraction rule syntax detection syntax content items: ---> selection1, selection2

[0152] |-selection1

[0153] |-EventID:--->1

[0154] |-Image:--->C:\Windows\System32\reg.exe

[0155] |-CommandLine:--->reg save hklm\sam *.hiv

[0156] |-selection2

[0157] |-EventID:--->1

[0158] |-Image:--->C:\Windows\System32\reg.exe

[0159] |-CommandLine:--->reg save hklm\system *.hiv

[0160] Examples of the above fields and module regularization results are shown below:

[0161] |Rule name title: ---> Locally export sam and system files and perform hash extraction offline (administrator)

[0162] |Rule description description: ---> Windows 7 simulation test results

[0163] |Rule syntax detection condition: ---> any of them

[0164] | Extraction rule syntax detection syntax content items: ---> selection1, selection2

[0165] |-selection1

[0166] |-EventID:--->1 --->\"eventNum\":\"1\"

[0167] |-Image:--->C:\Windows\System32\reg.exe --->\"image\":\"C:\\\\Windows\\\\System32\\\\reg.exe

[0168] |-CommandLine:--->reg save hklm\sam *.hiv --->\"commandLine\":\".{0,20}reg\s*save\s*sam\\\\sam\s*.*.hiv

[0169] |-selection2

[0170] |-EventID:--->1 --->\"eventNum\":\"1\"

[0171] |-Image:--->C:\Windows\System32\reg.exe --->\"image\":\"C:\\\\Windows\\\\System32\\\\reg.exe

[0172] |-CommandLine:--->reg save hklm\system *.hiv --->\"commandLine\":\".{0,20}reg\s*save\s*hklm\\\\sam\s*.*.hiv

[0173] Step S308: Based on the feature value regularization results of the fields or modules, combined with the collected terminal logs, the feature value regularization results of the fields or modules are spliced ​​in the order of the log contents in the collected terminal logs to obtain the rule content conditional statement. Specifically, the above field and module splicing results are shown as follows:

[0174] $selection1 = / \"commandLine\":\".{0,20}reg\s*save\s*hklm\\\\sam\s*.*.hiv.{0,250},\"eventNum\":\"1\".{0,250},\"image\":\"C:\\\\Windows\\\\System32\\\\reg.exe / nocase

[0175] $selection2 = / \"commandLine\":\".{0,20}reg\s*save\s*hklm\\\\system\s*.*.hiv.{0,250},\"eventNum\":\"1\".{0,250},\"image\":\"C:\\\\Windows\\\\System32\\\\reg.exe / nocase

[0176] Step S310, the regular processing results of the extracted fields or modules, field or module feature values, and the spliced ​​rule content conditional statements are spliced ​​into a new collision rule according to the converted rule type format. Specifically, an example of the new collision rule result is as follows:

[0177] rule test001

[0178] {

[0179] meta:

[0180] title = "Locally export sam and system files and perform hash extraction offline (administrator)"

[0181] description = "Windows 7 simulation test results"

[0182] strings:

[0183] $selection1 = / \"commandLine\":\".{0,20}reg\s*save\s*hklm\\\\sam\s*.*.hiv.{0,250},\"eventNum\":\"1\".{0,250},\"image\":\"C:\\\\Windows\\\\System32\\\\reg.exe / nocase

[0184] $selection2 = / \"commandLine\":\".{0,20}reg\s*save\s*hklm\\\\system\s*.*.hiv.{0,250},\"eventNum\":\"1\".{0,250},\"image\":\"C:\\\\Windows\\\\System32\\\\reg.exe / nocase

[0185] condition:

[0186] any of them

[0187] }

[0188] Step S312: perform a collision test on the new collision rule after splicing with the collected terminal log content to obtain a collision result.

[0189] Step S314, according to the collision result, if the collision is successful, the new collision rule result is output to the display and the new collision rule result file is recorded; if the collision fails, the failure log is saved and output to the display for subsequent search for the cause of the failure.

[0190] Through the above steps, compared with the situation in the related art where corresponding collision rules need to be written for different terminal response devices, and the old class rules and the new class rules coexist in the computer system, the present embodiment provides a log collision rule conversion method, device, system and electronic device, which obtains a log sample, a first log collision rule and a target rule type, extracts the first rule information in the first log collision rule, regularizes the characteristic value of the first rule information to obtain a first rule information regular statement, splices the first rule information regular statement using the log sample to obtain a spliced ​​statement, and then performs rule conversion processing on the spliced ​​statement according to the target rule type to obtain a second log collision rule, so that efficient conversion of log collision rules between different types can be achieved, so that collision detection can be performed on different types of log samples generated by different assets, and there is no need to manually write collision detection rules for log samples, thereby improving the efficiency of rule conversion, and at the same time, it can also simplify the unified maintenance of terminal collision detection rules, achieve efficient conversion of log collision rules, and solve the problems of low utilization rate, large redundancy and low rule conversion efficiency of terminal collision rules.

[0191] It should be understood that although Figure 2-3 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2-3 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0192] In this embodiment, a log collision rule conversion device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. The terms "module", "unit", "subunit", etc. used below can implement a combination of software and / or hardware of predetermined functions. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0193] Figure 4 is a structural block diagram of the log collision rule conversion device of this embodiment, such as Figure 4 As shown, the device includes: an acquisition module, a processing module and a sending module;

[0194] The acquisition module is used to acquire a log sample, a type and content of a first log collision rule, and a target rule type, and extract first rule information in the first log collision rule;

[0195] The processing module is used to regularize the characteristic value of the first rule information to obtain a regular statement of the first rule information, and use the log sample to splice the regular statement of the first rule information to obtain a spliced ​​statement; perform rule conversion processing on the spliced ​​statement according to the target rule type to obtain a second log collision rule; wherein the type of the second log collision rule refers to the target rule type; and perform a log content collision test on the second log collision rule and the log sample to obtain a collision test result;

[0196] The sending module is used to output the collision test result and the second log collision rule to the terminal device.

[0197] This embodiment also provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any of the above-mentioned log collision rule conversion method embodiments.

[0198] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0199] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0200] S1, obtaining a log sample, a first log collision rule and a target rule type, and extracting first rule information in the first log collision rule; wherein the target rule type is different from the initial rule type, and the initial rule type refers to the type of the first log collision rule.

[0201] S2, regularizing the feature value of the first rule information to obtain a regular statement of the first rule information, and concatenating the regular statements of the first rule information using the log sample to obtain a concatenated statement.

[0202] S3, performing rule conversion processing on the concatenated statement according to the target rule type to obtain a second log collision rule; wherein the type of the second log collision rule refers to the target rule type; performing a log content collision test on the second log collision rule and the log sample to obtain a collision test result.

[0203] S4, outputting the collision test result and the second log collision rule to the terminal device.

[0204] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and will not be repeated in this embodiment.

[0205] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a log collision rule conversion method is implemented.

[0206] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0207] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0208] It should be understood that the specific embodiments described herein are only used to explain the application, rather than to limit it. Based on the embodiments provided in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of this application.

[0209] Obviously, the drawings are only some examples or embodiments of the present application. For ordinary technicians in the field, the present application can also be applied to other similar situations based on these drawings without creative work. In addition, it is understandable that although the work done in this development process may be complicated and lengthy, for ordinary technicians in the field, certain changes in design, manufacturing or production based on the technical content disclosed in this application are only conventional technical means and should not be regarded as insufficient content disclosed in this application.

[0210] The term "embodiment" in this application refers to a specific feature, structure or characteristic described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various locations in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. It is clearly or implicitly understood by those of ordinary skill in the art that the embodiments described in this application can be combined with other embodiments without conflict.

[0211] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A log collision rule conversion method, characterized in that: include: Obtain a log sample, a first log collision rule and a target rule type, and extract first rule information in the first log collision rule; wherein the target rule type is different from the initial rule type, and the initial rule type refers to the type of the first log collision rule; Regularizing the feature values ​​of the first rule information to obtain a regular statement of the first rule information, and concatenating the regular statements of the first rule information using the log sample to obtain a concatenated statement; The concatenated statement is subjected to rule conversion processing according to the target rule type to obtain a second log collision rule; wherein the type of the second log collision rule refers to the target rule type; The second log collision rule and the log sample are subjected to a log content collision test to obtain a collision test result; the method includes: performing standardized format processing on the fields in the log sample to obtain a log sample standardized field, and dividing the log sample standardized field to obtain a log sample field name and a log sample field value; according to the second log collision rule, searching the log sample standardized field for the field name and the field characteristic value specified in the second log collision rule; if the log sample field name and the log sample field value corresponding to the specified field name and field characteristic value are found in the log sample standardized field, the collision test result indicates that the collision test is successful; if the specified field name and field characteristic value are found to be missing in the log sample standardized field, the collision test result indicates that the collision test is failed; Output the collision test result and the second log collision rule to the terminal device.

2. The log collision rule conversion method according to claim 1, characterized in that: The first rule information includes a first rule field and / or a first rule module; The first rule information regular statement includes a first rule field regular statement and / or a first rule module regular statement; wherein, the first rule field regular statement is obtained by regularizing the feature value of the first rule field, and the first rule module regular statement is obtained by regularizing the feature value of the first rule module.

3. The log collision rule conversion method according to claim 1, characterized in that: Regularizing the feature value of the first rule information to obtain a regular statement of the first rule information, and splicing the regular statements of the first rule information using the log sample to obtain a spliced ​​statement includes: Extracting second rule information from the first log collision rule; Regularizing the feature value of the first rule information to obtain a first rule information regular statement, and regularizing the feature value of the second rule information to obtain a second rule information regular statement; Using the log sample, the first rule information regular statement and the second rule information regular statement are concatenated to obtain the concatenated statement.

4. The log collision rule conversion method according to claim 3 is characterized in that: The second rule information includes a second rule field and / or a second rule module; wherein the second rule field is a field in the first log collision rule other than the first rule field, and the second rule module is a module in the first log collision rule other than the first rule module; The second rule information regular statement includes a second rule field regular statement and / or a second rule module regular statement; wherein, the second rule field regular statement is obtained by regularizing the feature value of the second rule field, and the second rule module regular statement is obtained by regularizing the feature value of the second rule module.

5. The log collision rule conversion method according to claim 1, characterized in that: The step of using the log sample to splice the first rule information regular statement to obtain a spliced ​​statement includes: Performing standardized format processing on the fields in the log sample to obtain the standardized fields of the log sample, and obtaining the sorting result of the standardized fields of the log sample in the log sample; According to the sorting result, the regular statements of the first rule information are concatenated to obtain the concatenated statement.

6. The log collision rule conversion method according to any one of claims 1 to 5, characterized in that: The outputting the collision test result and the second log collision rule to the terminal device includes: If the collision test result indicates that the collision test is successful, outputting the collision test result and the second log collision rule to the terminal device; If the collision test result indicates that the collision test fails, the collision test result and a collision test failure log corresponding to the collision test result are output to the terminal device.

7. A log collision rule conversion device, characterized in that: include: Acquisition module, processing module and sending module; The acquisition module is used to acquire a log sample, a type and content of a first log collision rule, and a target rule type, and extract the first rule information in the first log collision rule; wherein the target rule type is different from the initial rule type, and the initial rule type refers to the type of the first log collision rule; The processing module is used to regularize the feature value of the first rule information to obtain a first rule information regular statement, and use the log sample to splice the first rule information regular statement to obtain a spliced ​​statement; according to the target rule type, the spliced ​​statement performs rule conversion processing to obtain a second log collision rule; wherein the type of the second log collision rule refers to the target rule type; The second log collision rule and the log sample are subjected to a log content collision test to obtain a collision test result; the method includes: performing standardized format processing on the fields in the log sample to obtain a log sample standardized field, and dividing the log sample standardized field to obtain a log sample field name and a log sample field value; according to the second log collision rule, searching the log sample standardized field for the field name and the field characteristic value specified in the second log collision rule; if the log sample field name and the log sample field value corresponding to the specified field name and field characteristic value are found in the log sample standardized field, the collision test result indicates that the collision test is successful; if the specified field name and field characteristic value are found to be missing in the log sample standardized field, the collision test result indicates that the collision test is failed; The sending module is used to output the collision test result and the second log collision rule to the terminal device.

8. A log collision rule conversion system, characterized in that: include: Terminal equipment, transmission equipment and server equipment; wherein the terminal equipment is connected to the server equipment via the transmission equipment; The server device is used to execute the log collision rule conversion method described in any one of claims 1 to 6; The transmission device is used to send the collision test result and the second log collision rule to the terminal device; The terminal device is used to obtain the collision test result and the second log collision rule for display.

9. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to execute the log collision rule conversion method according to any one of claims 1 to 6.

Images