Data attack prevention method and device based on full-process audit of data flow

Abstract

The present invention provides a data attack prevention method and device based on the audit of the entire process of data flow, wherein the method includes: determining the associated endpoints of the entire process of data flow, and collecting logs for each associated endpoint; the types of collected logs include at least: operating system logs and application system logs; performing association analysis on the security events contained in the collected logs; if the result of the association analysis is to determine that there is an abnormal behavior, then determining the true identity of the abnormal operation account corresponding to the abnormal behavior; determining the associated account related to the true identity of the abnormal operation account, and adjusting the authority scope of the associated account; sending the adjustment result to the corresponding associated endpoint, so that the associated endpoint provides services based on the authority scope of the adjusted associated account. This solution can prevent the user with the real identity from using other associated accounts to carry out data attacks, thereby improving the data attack prevention effect.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a data attack prevention method and device based on full-process auditing of data flow. Background Art

[0002] With the long-term information construction, internal network applications are becoming increasingly complex, the network is widely distributed, the number of terminal devices is increasing, the number of business application systems is increasing, and the number of endpoints through which data flows is increasing. In order to prevent attackers from attacking endpoint data, corresponding defense measures are deployed on the endpoints to reduce the probability of data being attacked by assigning different permission ranges to different users. However, the current prevention and control measures on the endpoints are all based on a single audit of the endpoint itself, and the data attack prevention effect is poor. Summary of the invention

[0003] In view of the problem that single audit of endpoints leads to poor data attack prevention effect, the embodiments of the present invention provide a data attack prevention method and device based on full-process audit of data flow, which can improve the data attack prevention effect.

[0004] In a first aspect, an embodiment of the present invention provides a data attack prevention method based on full-process auditing of data flow, including:

[0005] Determine the associated endpoints of the entire data flow process and collect logs for each associated endpoint; the collected log types include at least: operating system logs and application system logs;

[0006] Conduct correlation analysis on security events contained in collected logs;

[0007] If the result of the association analysis is that abnormal behavior exists, the true identity of the abnormal operation account corresponding to the abnormal behavior is determined;

[0008] Determine the associated accounts related to the true identity of the abnormal operation account and adjust the authority scope of the associated accounts;

[0009] The adjustment result is sent to the corresponding association endpoint, so that the association endpoint provides services based on the permission scope of the adjusted association account.

[0010] Preferably, the correlation analysis of the security events contained in the collected logs includes:

[0011] Determine the true identity of the operating account corresponding to each security incident;

[0012] Group security events contained in collected logs according to different real identities;

[0013] Perform anomaly analysis on security events in each group.

[0014] Preferably, determining the real identity of the operating account corresponding to each security event includes:

[0015] For each security event, determine the target associated endpoint for requesting to initiate the security event;

[0016] Determine whether the security event is initiated by the target application system in the target associated endpoint, if so, determine the login account of the target application system as the operation account requesting to initiate the security event, otherwise, determine the login account of the target associated endpoint as the operation account requesting to initiate the security event;

[0017] Based on the pre-established correspondence between the account and the real identity, the real identity corresponding to the operating account requesting to initiate the security incident is determined.

[0018] Preferably, the performing abnormal analysis on the security events in each group includes:

[0019] For each group, the following are performed: obtaining the normal behavior characteristics of the real identity corresponding to the group; performing anomaly detection on the security events in the group according to the pre-set detection rules and the normal behavior characteristics to determine whether there is abnormal behavior.

[0020] Preferably, before performing abnormal detection on the security events in the group, the method further includes: sorting the security events in the group according to the order of timestamps;

[0021] The abnormality detection of the security events in the group includes: detecting whether there are continuous security events in the group that meet the timing characteristics of preset abnormal behavior, and if so, determining that abnormal behavior exists.

[0022] Preferably, before determining the associated account related to the real identity of the abnormal operation account, the method further includes: determining the real identity and assets currently managed, and for each real identity, allocating the account corresponding to each asset and the scope of authority of the account to obtain the corresponding relationship between the account and the real identity;

[0023] Determining the associated accounts related to the real identity of the abnormal operation account includes:

[0024] According to the correspondence between the account and the real identity, all accounts corresponding to the real identity of the abnormal operation account are determined, and all accounts are determined as associated accounts.

[0025] Preferably, the adjusting the authority scope of the associated account includes:

[0026] Conduct a credit evaluation on the real identity of the abnormal account based on the abnormal behavior;

[0027] Determine the scope of authority that needs to be adjusted for each associated account based on the credit rating.

[0028] In a second aspect, an embodiment of the present invention further provides a data attack prevention device based on full-process auditing of data flow, including:

[0029] The log collection unit is used to determine the associated endpoints of the entire data flow process and collect logs for each associated endpoint; the collected log types include at least: operating system logs and application system logs;

[0030] A correlation analysis unit, used to perform correlation analysis on security events contained in the collected logs;

[0031] A real identity determination unit, configured to determine the real identity of the abnormal operation account corresponding to the abnormal behavior if the association analysis result determines that there is abnormal behavior;

[0032] The authority scope adjustment unit is used to determine the associated account related to the real identity of the abnormal operation account, adjust the authority scope of the associated account, and send the adjustment result to the corresponding associated endpoint so that the associated endpoint provides services based on the authority scope of the adjusted associated account.

[0033] In a third aspect, an embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0034] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method described in any embodiment of this specification.

[0035] The embodiment of the present invention provides a data attack prevention method and device based on the audit of the entire process of data flow. By performing correlation analysis on the logs of the associated endpoints of the entire data flow process, the audit content is richer than that of a single audit of the endpoint, and involves the entire data flow process. Therefore, it is possible to identify abnormal behaviors that cannot be identified by a single endpoint. After the abnormal behavior is identified, by confirming the true identity of the abnormal operation account, the authority scope of the associated account related to the true identity is adjusted, thereby preventing the user of the true identity from using other associated accounts to carry out data attacks, thereby improving the data attack prevention effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 This is a flow chart of a data attack prevention method based on full-process auditing of data flow provided by an embodiment of the present invention;

[0038] Figure 2 is a hardware architecture diagram of a computing device provided by an embodiment of the present invention;

[0039] Figure 3 This is a structural diagram of a data attack prevention device based on full-process auditing of data flow provided by an embodiment of the present invention;

[0040] Figure 4 This is a structural diagram of another data attack prevention device based on full-process auditing of data flow provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0042] As mentioned above, corresponding defense measures are currently deployed on endpoints to reduce the probability of data being attacked by assigning different permission ranges to different users. It can be seen that the current prevention and control measures on endpoints are all based on a single audit of the endpoint itself, and it is impossible to identify risks in the entire data flow process. Therefore, the data attack prevention effect is poor. Considering that multiple application systems can be installed on a single endpoint, such as financial systems, procurement systems, OA approval systems, etc., after users log in to the endpoint using the endpoint login account, they can log in to different application systems through the login account of the application system to implement different businesses. When using the application system to implement business, the operating endpoint of the application system is not the access endpoint, and when implementing business, the endpoints through which data flows may be multiple. It can be seen that the business-related information that can be obtained on a single endpoint is not comprehensive. Therefore, relying only on a single endpoint for prevention and control is ineffective. Based on the above analysis, it is possible to consider using the data on the endpoints of the entire data flow process for unified analysis and auditing to enrich the information used for abnormal analysis.

[0043] In addition, the account that logs into the endpoint and the real user corresponding to the account that logs into the application system on the endpoint may not be the same user. Therefore, when conducting a unified analysis and audit to obtain abnormal behavior, you can consider locating the real identity of the abnormal behavior, so as to adjust the authority scope of its associated account to prevent the real identity from using other associated accounts to carry out data attacks.

[0044] The specific implementation of the above concept is described below.

[0045] Please refer to Figure 1 The embodiment of the present invention provides a data attack prevention method based on full-process audit of data flow, the method comprising:

[0046] Step 100, determining the associated endpoints of the entire data flow process, and collecting logs for each associated endpoint; the collected log types include: operating system logs and application system logs;

[0047] Step 102, performing correlation analysis on the security events contained in the collected logs;

[0048] Step 104: if the result of the association analysis is that abnormal behavior is determined, then the real identity of the abnormal operation account corresponding to the abnormal behavior is determined;

[0049] Step 106, determining the associated accounts related to the real identity of the abnormal operation account, and adjusting the authority scope of the associated accounts;

[0050] Step 108: Send the adjustment result to the corresponding associated endpoint, so that the associated endpoint provides services based on the authority scope of the associated account after the adjustment.

[0051] In an embodiment of the present invention, by performing correlation analysis on the logs of associated endpoints of the entire data flow process, the audit content is richer than a single audit of an endpoint and involves the entire data flow process. Therefore, it is possible to identify abnormal behaviors that cannot be identified by a single endpoint. After the abnormal behavior is identified, the authority scope of the associated accounts related to the real identity is adjusted by confirming the real identity of the account performing the abnormal operation, thereby preventing the user of the real identity from using other associated accounts to carry out data attacks, thereby improving the data attack prevention effect.

[0052] Described below Figure 1 How the various steps are performed.

[0053] First, for step 100, the associated endpoints of the entire data flow process are determined, and log collection is performed for each associated endpoint; the collected log types include: operating system logs and application system logs.

[0054] In the embodiment of the present invention, it is necessary to identify which endpoints the entire data flow process flows through, and determine these endpoints as associated endpoints.

[0055] In order to identify the associated endpoints, it is necessary to first manage the assets in a unified manner. These assets can include endpoints such as terminal devices, network devices, and security devices. Terminal devices can include clients, routers, switches, etc. Network devices can be application servers that provide services for application systems, such as mail, web, FTP, etc. Security devices can include firewalls, web application firewalls, bastion hosts, etc.

[0056] In one approach, all centrally managed assets are identified as associated endpoints of the entire data flow process.

[0057] In another way, for specific data, for example, using the request data initiated by the financial system, the endpoints through which the request data flows are determined, and the access endpoint is determined as the endpoint where the financial system operates as the associated endpoint of the entire data flow process.

[0058] When collecting logs for associated endpoints, since the endpoint logs generally record the operation logs related to the endpoints, and in this embodiment, it is necessary to analyze whether the operations based on the application system are abnormal, the types of logs collected include at least operating system logs and application system logs. Among them, the application system logs include not only the logs of the business application system, but also the alarm logs of the defense application system deployed on the endpoint. The operating system log records the information of hardware, software and system problems in the system, and can also monitor the events that occur in the system. It can be seen that the traces of the user's operations on each associated endpoint can be analyzed using the operating system log and the application system log.

[0059] Then, with respect to step 102, correlation analysis is performed on the security events contained in the collected logs.

[0060] Since the collected logs are collected from all associated endpoints through which the data flows, the associated endpoints are horizontally connected through logs so that all operation records involved in the data flow process are acquired together. Therefore, the logs used for association analysis at this time are more comprehensive and rich. By utilizing the security events in these comprehensive and rich logs, the association analysis results can be closer to authenticity and can better analyze existing abnormal behaviors compared to single analysis audits of endpoints.

[0061] In one embodiment of the present invention, in step 102, correlation analysis can be performed on the security events contained in the collected logs in at least one of the following ways, specifically including the following steps S1 to S3:

[0062] S1. Determine the real identity of the operating account corresponding to each security event.

[0063] Each security event corresponds to an operating account. For example, if a user downloads a file through a business system, the operating account corresponding to the security event is the account that logs into the business system. Assuming that a user logs into account A001 on application system M installed on the access endpoint and initiates a request, there may be multiple endpoints for the data flow. For example, the associated endpoints of the entire data flow process are as follows: access endpoint → running endpoint M1 of application system M → running endpoint A1 of application system A → running endpoint A2 of application system A → running endpoint B1 of application system B → running endpoint B2 of application system B → running endpoint M of application system → access endpoint. The login accounts of different associated endpoints may be different, and the data flow is initiated based on the login account A001 of application system M installed on the access endpoint. Therefore, the corresponding operating account of the security events about the data flow recorded in the logs collected on the above-mentioned associated endpoints is A001.

[0064] Specifically, in one embodiment of the present invention, the true identity of the operating account corresponding to each security event can be determined in the following manner: for each security event, determine the target associated endpoint that requests to initiate the security event; determine whether the security event is initiated by the target application system in the target associated endpoint, and if so, determine the login account of the target application system as the operating account that requests to initiate the security event; otherwise, determine the login account of the target associated endpoint as the operating account that requests to initiate the security event; and determine the true identity corresponding to the operating account that requests to initiate the security event based on a pre-established correspondence between the account and the true identity.

[0065] Since each security event that occurs is recorded in the operating system log and the application system log, each security event can be traced back to the target associated endpoint that requested to initiate the security event, that is, the access endpoint in the above-mentioned full-process associated endpoint. After determining the target associated endpoint, the log collected from the target associated endpoint can be used to determine whether the security event was initiated by the application system in the target associated endpoint. According to the above-mentioned full data flow process, it can be known that it was initiated by the application system M on the access endpoint, so the account A001 that logs in to the application system M is determined as the operating account.

[0066] Considering that different businesses within an enterprise correspond to different application systems, a user has corresponding accounts on different application systems, and the account for logging into the endpoint and the account for logging into the application system on the endpoint may not correspond to the same real identity. Therefore, in order to associate the accounts, the associated accounts need to be managed uniformly.

[0067] Specifically, in one embodiment of the present invention, the associated accounts can be managed in a unified manner as follows: determine the real identity and assets currently being managed, and for each real identity, assign the account corresponding to each asset and the scope of authority of the account to obtain the corresponding relationship between the account and the real identity. The assets may include endpoints, application systems, databases, etc.

[0068] Therefore, the real identity of the operating account can be accurately determined based on the correspondence between the account and the real identity.

[0069] S2. Group the security events contained in the collected logs according to different real identities.

[0070] S3. Perform anomaly analysis on the security events in each group.

[0071] Since the security events in a group are all executed by the same real identity, when performing anomaly analysis on the security events in each group, it can be associated with the normal behavior characteristics of the real identity. Specifically, in one embodiment of the present invention, the security events in each group can be analyzed for anomalies in the following way: obtaining the normal behavior characteristics of the real identity corresponding to the group; performing anomaly detection on the security events in the group according to the pre-set detection rules and the normal behavior characteristics to determine whether there is abnormal behavior.

[0072] The normal behavior characteristics of the real identity can be obtained by analyzing the behavior characteristics of the real identity in the historical log records. In order to improve the accuracy of the normal behavior characteristics, manual review and confirmation can be performed after the normal behavior characteristics are obtained.

[0073] Among them, detection rules can be set in advance, and the detection rules can at least include one or more of the following forms of detection: detection based on a single security event, alarm detection based on the number of multiple security events, alarm detection based on the number of multi-value events, and alarm detection based on time series, etc.

[0074] Detection based on a single security event, for example, whether a login was performed during non-working hours / non-working locations, whether there was a login bypassing the bastion host, whether there was an unauthorized login, whether there was a login using an IP in a non-secure area, etc.

[0075] Alarm detection based on the number of multiple security events, such as whether there is password guessing behavior. The model for this detection may include the following parts: time dimension, threshold dimension and condition dimension. Specifically, the detection may be: whether a security event that meets the conditions required by the condition dimension is executed within the time period required by the time dimension, and the number of the security events reaches the number required by the threshold dimension. If so, an alarm is issued.

[0076] Alarm detection based on the number of multi-value events, for example, whether there is port scanning behavior. The model for this detection may include the following parts: time dimension, threshold dimension, different dimensions and conditional dimension. Specifically, the detection may be: whether a security event that meets the conditions required by the conditional dimension is executed within the time period required by the time dimension, and the number of the security events reaches the number required by the threshold dimension, and the content of the security events that meet the conditions is different. If so, an alarm is issued.

[0077] Based on the timing alarm detection, for example, a non-working event logs into the FTP server, uploads a script, and then downloads a sensitive file. This behavior is determined as an abnormal behavior in the timing characteristics. When performing abnormal detection on the security events in the group, it can include: detecting whether there are continuous security events in the group that meet the timing characteristics of the preset abnormal behavior. If so, it is determined that abnormal behavior exists. Since security events have timing characteristics, before performing abnormal detection on the security events in the group, it can also include: sorting the security events in the group in the order of timestamps. This is more conducive to the detection of timing characteristics.

[0078] In the case of time-series alarm detection, since the security events used are collected from the associated endpoints, when using time-series feature analysis, the security event information in the time sequence will be longer and more able to determine whether there is abnormal behavior. For example, after sorting by timestamp, the traces of the entire operation process in the entire data flow can be obtained, operation C1→operation C2→operation C3→operation C4→operation C5, where operations C1 and C5 are obtained on associated endpoint 1, operation C2 is obtained on associated endpoint 2, and operations C3 and C4 are obtained on associated endpoint 3. Therefore, if only time-series feature analysis is performed on a single endpoint, for example, on associated endpoint 1, only operation C1→operation C5 can be obtained, and the time-series feature with abnormal behavior is operation C1→operation C2→operation C3→operation C4→operation C5, and operation C1→operation C5 is not an abnormal behavior. It can be seen that compared with single endpoint analysis, abnormal behavior can be analyzed more accurately.

[0079] It should be noted that, in addition to the correlation analysis method in steps S1 to S3 above, it is also possible not to perform grouping, but to directly detect and analyze all security events in all logs one by one to determine whether there is abnormal behavior.

[0080] In this embodiment, security events are grouped according to the real identity. Security events in the same group are all operated by the same real identity. Therefore, all security events operated by the real identity can be comprehensively analyzed. Compared with analyzing security events one by one, it is possible to analyze the user's more realistic behavioral characteristics, and the accuracy of detecting behavioral anomalies will be higher.

[0081] Finally, step 104 "If the result of the association analysis is to determine the existence of abnormal behavior, determine the true identity of the abnormal operation account corresponding to the abnormal behavior", step 106 "determine the associated account related to the true identity of the abnormal operation account, and adjust the authority scope of the associated account" and step 108 "send the adjustment result to the corresponding associated endpoint so that the associated endpoint provides services based on the authority scope of the adjusted associated account" are explained at the same time.

[0082] In one embodiment of the present invention, if the above step 102 performs the association analysis after grouping according to different real identities, then the group corresponding to the abnormal behavior can be directly determined in this step 104, and then the real identity can be directly determined; otherwise, this step 104 can also determine the real identity corresponding to the operating account based on the pre-established correspondence between the account and the real identity.

[0083] In order to facilitate office work, the scope of authority of asset accounts generally assigned to users is too loose, which greatly increases the possibility of security or privacy issues. Due to the temptation of interests, it is very likely that users will perform abnormal operations such as adding, deleting, checking and modifying sensitive data within the enterprise. Therefore, when abnormal behavior is discovered, it is necessary not only to adjust the scope of authority of the account where the abnormal behavior occurred, but also to adjust the scope of authority of other accounts of the real identity, so as to promptly prevent the real identity from using other accounts to further perform abnormal operations and ensure data security.

[0084] In order to determine the associated accounts related to the real identity, according to the above step 102, the real identity and assets currently managed can be determined, and for each real identity, the accounts corresponding to each asset and the scope of authority of the account are allocated to it, and the correspondence between the account and the real identity is obtained. According to the correspondence between the account and the real identity, all accounts corresponding to the real identity of the abnormal operation account are determined, and all accounts are determined as associated accounts.

[0085] For example, the real identity "Zhang San" corresponds to the account Z001 of application system A, the account Z002 of application system B, and the account Z003 of application system C. Among them, the abnormal operation account is Z001, and the above Z001~Z003 are all determined as associated accounts.

[0086] Since each account has a corresponding scope of authority, when adjusting the scope of authority of associated accounts, the authority corresponding to sensitive data can be closed, or it can be adjusted in the following way: a credit evaluation is conducted on the true identity of the abnormal operating account based on the existing abnormal behavior; and the scope of authority that needs to be adjusted for each associated account is determined based on the credit evaluation level.

[0087] Among them, the real identity can be credit evaluated according to the sensitivity of abnormal behavior. In addition, the corresponding level can be configured for sensitive data. After the credit evaluation level is determined, the permissions of sensitive data with a higher level than the credit evaluation level are closed for the associated account, so as to obtain the adjusted permission range of each associated account, and send the adjusted permission range to the corresponding associated endpoint, so that the associated endpoint serves the associated account according to the adjusted permission range, thereby reducing the possibility of sensitive data being attacked.

[0088] It should be noted that the credit evaluation method can be implemented using any credit evaluation model in the prior art, and the scope of authority can also be adjusted to different ranges according to different situations, and there is no specific limitation on this.

[0089] like Figure 2 , Figure 3 As shown, the embodiment of the present invention provides a data attack prevention device based on the full process audit of data flow. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown, it is a hardware architecture diagram of a computing device where a data anti-attack device based on full-process audit of data flow provided by an embodiment of the present invention is located. Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the computing device in which the device is located in the embodiment may also generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the computing device in which it is located reads the corresponding computer program in the non-volatile memory into the memory and runs it. This embodiment provides a data attack prevention device based on the full process audit of data flow, including:

[0090] The log collection unit 301 is used to determine the associated endpoints of the entire data flow process and collect logs for each associated endpoint; the collected log types include at least: operating system logs and application system logs;

[0091] A correlation analysis unit 302, configured to perform correlation analysis on security events contained in the collected logs;

[0092] A real identity determination unit 303 is used to determine the real identity of the abnormal operation account corresponding to the abnormal behavior if the association analysis result determines that there is an abnormal behavior;

[0093] The authority range adjustment unit 304 is used to determine the associated account related to the real identity of the abnormal operation account, adjust the authority range of the associated account, and send the adjustment result to the corresponding associated endpoint so that the associated endpoint provides services based on the authority range of the adjusted associated account.

[0094] In one embodiment of the present invention, the association analysis unit 302 is specifically used to determine the real identity of the operating account corresponding to each security event; group the security events contained in the collected logs according to different real identities; and perform anomaly analysis on the security events in each group.

[0095] In one embodiment of the present invention, the association analysis unit 302, when determining the real identity of the operating account corresponding to each security event, is specifically used to determine, for each security event, a target associated endpoint that requests to initiate the security event; determine whether the security event is initiated by a target application system in the target associated endpoint, and if so, determine the login account of the target application system as the operating account that requests to initiate the security event; otherwise, determine the login account of the target associated endpoint as the operating account that requests to initiate the security event; and determine the real identity corresponding to the operating account that requests to initiate the security event based on a pre-established correspondence between the account and the real identity.

[0096] In one embodiment of the present invention, when performing anomaly analysis on security events in each group, the association analysis unit 302 is specifically used to execute, for each group, the following: obtaining normal behavior characteristics of the real identity corresponding to the group; performing anomaly detection on the security events in the group according to pre-set detection rules and the normal behavior characteristics to determine whether there is abnormal behavior.

[0097] In one embodiment of the present invention, the association analysis unit 302 is further configured to sort the security events in the group according to the order of timestamps before performing abnormality detection on the security events in the group;

[0098] When performing abnormality detection on the security events in the group, the correlation analysis unit 302 is specifically used to detect whether there are continuous security events in the group that meet the timing characteristics of preset abnormal behavior. If so, it is determined that abnormal behavior exists.

[0099] In one embodiment of the present invention, please refer to Figure 4The device may further include: an identity account association unit 305, which is used to determine the real identity and assets currently managed, and for each real identity, allocate the account corresponding to each asset and the scope of authority of the account to obtain the corresponding relationship between the account and the real identity;

[0100] When determining the associated accounts related to the real identity of the abnormal operation account, the authority scope adjustment unit 304 is specifically used to determine all accounts corresponding to the real identity of the abnormal operation account according to the corresponding relationship between the accounts and the real identities, and determine all accounts as associated accounts.

[0101] In one embodiment of the present invention, when adjusting the authority scope of an associated account, the authority scope adjustment unit 304 is specifically used to perform a credit evaluation on the real identity of the abnormal operation account based on the existing abnormal behavior; and determine the authority scope that needs to be adjusted for each associated account based on the credit evaluation level.

[0102] It is understandable that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a data attack prevention device based on the audit of the entire data flow process. In other embodiments of the present invention, a data attack prevention device based on the audit of the entire data flow process may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0103] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0104] An embodiment of the present invention also provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a data attack prevention method based on full-process auditing of data flow in any embodiment of the present invention is implemented.

[0105] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a data attack prevention method based on full-process auditing of data flow in any embodiment of the present invention.

[0106] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0107] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0108] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0109] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0110] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0111] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0112] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0113] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data attack prevention method based on full-process audit of data flow, characterized in that: include: Determine the associated endpoints of the entire data flow process and collect logs for each associated endpoint; The types of logs collected include at least: operating system logs and application system logs; Conduct correlation analysis on security events contained in collected logs; If the result of the association analysis is that abnormal behavior exists, the true identity of the abnormal operation account corresponding to the abnormal behavior is determined; Determine the associated accounts related to the true identity of the abnormal operation account and adjust the authority scope of the associated accounts; Send the adjustment result to the corresponding association endpoint so that the association endpoint can provide services based on the permission scope of the adjusted association account; The correlation analysis of the security events contained in the collected logs includes: for each security event, determining the target correlation endpoint that requests to initiate the security event; determining whether the security event is initiated by the target application system in the target correlation endpoint, and if so, determining the login account of the target application system as the operation account that requests to initiate the security event, otherwise, determining the login account of the target correlation endpoint as the operation account that requests to initiate the security event; determining the real identity corresponding to the operation account that requests to initiate the security event based on a pre-established correspondence between the account and the real identity; grouping the security events contained in the collected logs according to different real identities; and performing anomaly analysis on the security events in each group.

2. The method according to claim 1, characterized in that The abnormal analysis of the security events in each group includes: For each group, the following are performed: obtaining the normal behavior characteristics of the real identity corresponding to the group; performing anomaly detection on the security events in the group according to the pre-set detection rules and the normal behavior characteristics to determine whether there is abnormal behavior.

3. The method according to claim 2, characterized in that Before performing abnormal detection on the security events in the group, the method further includes: sorting the security events in the group according to the order of timestamps; The abnormality detection of the security events in the group includes: detecting whether there are continuous security events in the group that meet the timing characteristics of preset abnormal behavior, and if so, determining that abnormal behavior exists.

4. The method according to any one of claims 1 to 3, characterized in that: Before determining the associated accounts related to the real identity of the abnormal operation account, the method further includes: determining the real identity and assets currently managed, and for each real identity, allocating the accounts corresponding to each asset and the scope of authority of the account to obtain the corresponding relationship between the account and the real identity; Determining the associated accounts related to the real identity of the abnormal operation account includes: According to the correspondence between the account and the real identity, all accounts corresponding to the real identity of the abnormal operation account are determined, and all accounts are determined as associated accounts.

5. The method according to claim 4, characterized in that The adjustment of the authority scope of the associated account includes: Conduct credit evaluation on the real identity of the abnormal operation account based on the abnormal behavior; Determine the scope of authority that needs to be adjusted for each associated account based on the credit rating.

6. A data attack prevention device based on full-process audit of data flow, characterized in that: include: The log collection unit is used to determine the associated endpoints of the entire data flow process and collect logs for each associated endpoint; The types of logs collected include at least: operating system logs and application system logs; A correlation analysis unit, used to perform correlation analysis on security events contained in the collected logs; A real identity determination unit, configured to determine the real identity of the abnormal operation account corresponding to the abnormal behavior if the association analysis result determines that there is abnormal behavior; The authority range adjustment unit is used to determine the associated account related to the real identity of the abnormal operation account, adjust the authority range of the associated account, and send the adjustment result to the corresponding associated endpoint so that the associated endpoint provides services based on the authority range of the adjusted associated account; The association analysis unit is specifically used to determine, for each security event, a target association endpoint that requests to initiate the security event; determine whether the security event is initiated by a target application system in the target association endpoint, and if so, determine the login account of the target application system as the operating account that requests to initiate the security event; otherwise, determine the login account of the target association endpoint as the operating account that requests to initiate the security event; determine the real identity corresponding to the operating account that requests to initiate the security event based on a pre-established correspondence between the account and the real identity; group the security events contained in the collected logs according to different real identities; and perform anomaly analysis on the security events in each group.

7. The device according to claim 6, characterized in that The association analysis unit, when performing abnormal analysis on the security events in each group, is specifically used to execute, for each group, the following steps: obtaining normal behavior characteristics of the real identity corresponding to the group; According to the pre-set detection rules and the normal behavior characteristics, anomaly detection is performed on the security events in the group to determine whether there is abnormal behavior.

8. The device according to claim 7, characterized in that The correlation analysis unit is further configured to sort the security events in the group according to the order of timestamps before performing abnormality detection on the security events in the group; When performing anomaly detection on security events in the group, the correlation analysis unit is specifically used to detect whether there are continuous security events in the group that meet the timing characteristics of preset abnormal behavior. If so, it is determined that abnormal behavior exists.

9. The device according to any one of claims 6 to 8, characterized in that: Also includes: The identity account association unit is used to determine the real identity and assets currently managed, and for each real identity, assign the account corresponding to each asset and the scope of authority of the account to obtain the corresponding relationship between the account and the real identity; The authority scope adjustment unit, when determining the associated accounts related to the real identity of the abnormal operation account, is specifically used to determine all accounts corresponding to the real identity of the abnormal operation account according to the corresponding relationship between the accounts and the real identities, and determine all accounts as associated accounts.

10. The device according to claim 9, characterized in that The authority range adjustment unit is specifically used to perform a credit evaluation on the real identity of the abnormal operation account according to the existing abnormal behavior when adjusting the authority range of the associated account; Determine the scope of authority that needs to be adjusted for each associated account based on the credit rating.

11. A computing device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

12. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 5.

Images