A security analysis method, device, equipment and readable storage medium

Abstract

The present application discloses a security analysis method, device, equipment and readable storage medium. Based on the target log information in the alarm log whose hazard level is higher than the hazard level threshold and the alarm confidence is higher than the confidence threshold, the present application determines the attacked state of the device, and then uses the analysis strategy corresponding to the attacked state to analyze the alarm log, and can analyze the alarm log in a targeted manner according to different analysis strategies. For example: when the device is in an attacked state, the alarm log generated at the current moment is analyzed in focus; when the device is in a controlled state, the alarm information at the current moment, before the current moment, and after the current moment are analyzed in focus, so as to accurately analyze the current attack event based on the alarm log, and can also improve the analysis efficiency and accuracy. Correspondingly, a security analysis device, equipment and readable storage medium provided by the present application also have the above-mentioned technical effects.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a security analysis method, device, equipment and readable storage medium. Background Art

[0002] Currently, the alarm logs can be analyzed using association analysis rules. For example, if an association rule such as ABC is formulated, when events A, B, and C occur in sequence within a period of time, it is considered to be an accurate attack event, A, B, and C are accurate alarms, and the hacker's attack process is ABC.

[0003] However, the association analysis rules require a large number of association rules to be built into the device in advance, so security analysts need to analyze the attack events that have already occurred to determine the association rules. However, the attack methods are complex and changeable, so the association rules determined based on historical attack events may not be applicable to new attack events, and will also introduce a large number of false positives due to the presence of low-confidence logs in the logs to be associated.

[0004] Therefore, how to more accurately analyze attack events based on alarm logs is a problem that technical personnel in this field need to solve. Summary of the invention

[0005] In view of this, the purpose of this application is to provide a security analysis method, device, equipment and readable storage medium to more accurately analyze attack events based on alarm logs. The specific scheme is as follows:

[0006] In a first aspect, the present application provides a security analysis method, comprising:

[0007] Get the alarm log in the target device;

[0008] Determine in the alarm log target log information whose harm degree is higher than the harm degree threshold and whose alarm certainty is higher than the certainty threshold, and determine the attacked state of the target device based on the target log information;

[0009] The alarm log is analyzed using an analysis strategy corresponding to the attacked state.

[0010] Preferably, the target log information of determining in the alarm log that the degree of harm is higher than the threshold of the degree of harm and the degree of alarm certainty is higher than the threshold of the degree of alarm certainty includes:

[0011] The harm degree and alarm confidence of each piece of log information in the alarm log are determined, so as to select the target log information from each piece of log information according to the harm degree threshold and the confidence threshold.

[0012] Preferably, it also includes:

[0013] According to the hazard level threshold and the confidence threshold, select the log information to be evaluated whose alarm confidence is lower than the confidence threshold from each log information;

[0014] If it is determined that the log information to be evaluated is a false alarm, the log information to be evaluated is deleted from the alarm log.

[0015] Preferably, if the alarm frequency of the log information to be evaluated is higher than the frequency threshold, and / or the prevalence of the log information to be evaluated is higher than the prevalence threshold, it is determined that the log information to be evaluated is a false alarm; otherwise, it is determined that the log information to be evaluated is not a false alarm.

[0016] Preferably, if it is determined that the log information to be evaluated is not a false alarm, the log information to be evaluated is retained.

[0017] Preferably, determining the attacked state of the target device based on the target log information includes:

[0018] The attacked state is determined based on the access direction, attack attribute and attack result of the target log information.

[0019] Preferably, analyzing the alarm log by using an analysis strategy corresponding to the attacked state includes:

[0020] If the attacked state is an attacking state, the log information in the alarm log whose harm degree is higher than the harm degree threshold is displayed according to the timeline;

[0021] and / or

[0022] If the attacked state is a successful attack state, the log information in the alarm log whose harm degree is higher than the harm degree threshold is displayed according to the timeline, and the attack time point and the corresponding attack IP address are marked in the timeline, and the log information newly generated after the current time and whose harm degree is higher than the harm degree threshold is processed by the security management and control strategy, and the log information newly generated after the current time and whose harm degree is lower than the harm degree threshold is monitored;

[0023] and / or

[0024] If the attacked state is a controlled state, the alarm log will be displayed according to the timeline, and the attack time point and the corresponding attack IP address, the controlled time point and the corresponding controlled behavior will be marked in the timeline, and the security management and control strategy will be used to process all newly generated log information after the current moment.

[0025] In a second aspect, the present application provides a security analysis device, comprising:

[0026] The acquisition module is used to obtain the alarm log in the target device;

[0027] a determination module, configured to determine in the alarm log target log information whose harm degree is higher than a harm degree threshold and whose alarm certainty is higher than a certainty threshold, and determine the attacked state of the target device based on the target log information;

[0028] The analysis module is used to analyze the alarm log using an analysis strategy corresponding to the attacked state.

[0029] In a third aspect, the present application provides an electronic device, including:

[0030] Memory for storing computer programs;

[0031] A processor is used to execute the computer program to implement the aforementioned disclosed security analysis method.

[0032] In a fourth aspect, the present application provides a readable storage medium for storing a computer program, wherein the computer program implements the aforementioned disclosed security analysis method when executed by a processor.

[0033] It can be seen from the above scheme that the present application provides a security analysis method, including: obtaining an alarm log in a target device; determining target log information in the alarm log whose degree of hazard is higher than a hazard degree threshold and whose alarm confidence is higher than a confidence threshold, and determining the attacked state of the target device based on the target log information; analyzing the alarm log using an analysis strategy corresponding to the attacked state.

[0034] It can be seen that the present application first determines the attacked state of the device based on the target log information in the alarm log whose hazard level is higher than the hazard level threshold and the alarm confidence is higher than the confidence threshold, and then uses the analysis strategy corresponding to the attacked state to analyze the alarm log, so that the alarm log can be analyzed in a targeted manner according to different analysis strategies. For example: when the device is in an attacked state, the alarm log generated at the current moment is analyzed in detail; or, when the device is in a controlled state, the alarm information at the current moment, before the current moment, and after the current moment are analyzed in detail, so as to accurately analyze the current attack event based on the alarm log without associating with historical attack events, and can also improve the analysis efficiency and accuracy.

[0035] Correspondingly, a security analysis device, equipment and readable storage medium provided by the present application also have the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0037] Figure 1 A flow chart of a safety analysis method disclosed in this application;

[0038] Figure 2 A flow chart of another safety analysis method disclosed in this application;

[0039] Figure 3 A schematic diagram of a security analysis device disclosed in this application;

[0040] Figure 4 A schematic diagram of an electronic device disclosed in this application;

[0041] Figure 5 This is a schematic diagram of another electronic device disclosed in this application. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0043] At present, the association analysis rules need to have a large number of association rules built into the device in advance, so security analysts need to analyze the attack events that have already occurred to determine the association rules. However, the attack methods are complex and changeable, so the association rules determined based on historical attack events are likely to be inapplicable to new attack events, and will also introduce a large number of false positives due to the presence of low-confidence logs in the logs to be associated. To this end, the present application provides a security analysis solution that can more accurately analyze attack events based on alarm logs.

[0044] See also Figure 1 As shown, the embodiment of the present application discloses a security analysis method, including:

[0045] S101. Obtain an alarm log in a target device.

[0046] In this embodiment, the target device can be a server, a terminal, a gateway, etc. Each log message in the alarm log can be marked with a degree of harm and a degree of certainty, and this mark is automatically generated based on a preset marking rule when the log message is generated. For example: if the preset marking rule is that the vulnerability exploitation behavior is of high harm and has a high degree of certainty, then the relevant log information about the vulnerability exploitation behavior can be marked with high harm and high degree of certainty. Of course, the degree of harm and degree of certainty can be expressed in points. For example: take a value from 0 to 1.

[0047] S102: Determine in the alarm log target log information whose harm degree is higher than the harm degree threshold and whose alarm certainty is higher than the certainty threshold, and determine the attacked state of the target device based on the target log information.

[0048] Among them, the hazard level threshold and the confidence threshold can be set flexibly. Assuming that the hazard level and the confidence are both obtained from 0 to 1, the hazard level threshold and the confidence threshold can be 0.6. Then the target log information with a hazard level higher than the hazard level threshold and an alarm confidence higher than the confidence threshold is: the log information with a hazard level higher than 0.6 and an alarm confidence higher than 0.6.

[0049] Since the harm degree of the target log information is higher than the harm degree threshold, and the alarm confidence is higher than the confidence threshold, it means that the target log information is very likely to record an attack event, so the device's attacked state can be determined based on the target log information. The attacked state includes: being attacked, successfully attacked, controlled, etc.

[0050] Generally, based on the access direction, attack attribute and attack result, it can be determined whether the device is being attacked, has been successfully attacked, or has been controlled. Therefore, in a specific implementation, determining the attacked state of the target device based on the target log information includes: determining the attacked state based on the access direction, attack attribute and attack result of the target log information.

[0051] The access direction can be determined by directional access information such as source IP and destination IP. The access direction shows whether the current device actively initiates the access or passively accepts the access. According to the difference between the intranet and the extranet, it can be divided into: access from inside to outside, access from outside to inside, and access from inside to inside.

[0052] Attack attributes can be divided into attack and control. Attack means: other devices attack the current device. Control means: other devices control the current device to attack a third device.

[0053] The attack results are: being attacked, being successfully attacked, and / or being controlled, etc. Since a device may be attacked again after being attacked, the device's attack status may not be unique.

[0054] S103: Analyze the alarm log using the analysis strategy corresponding to the attacked state.

[0055] In this embodiment, based on the target log information in the alarm log whose hazard level is higher than the hazard level threshold and whose alarm confidence is higher than the confidence threshold, after determining the attacked state of the device, the alarm log is analyzed using the analysis strategy corresponding to the attacked state, so that the alarm log can be analyzed in a targeted manner according to different analysis strategies.

[0056] For example: when the device is in an attack state, the alarm log generated at the current moment is analyzed in detail; or, when the device is in a controlled state, the alarm information at the current moment, before the current moment, and after the current moment are analyzed in detail, so as to accurately analyze the current attack event based on the alarm log without associating historical attack events, and improve the analysis efficiency and accuracy.

[0057] Based on the above embodiments, it should be noted that, in a specific implementation manner, determining the target log information in the alarm log whose degree of hazard is higher than the hazard degree threshold and whose alarm certainty is higher than the alarm certainty threshold includes: determining the degree of hazard and the alarm certainty of each log information in the alarm log, so as to select the target log information from each log information according to the hazard degree threshold and the certainty threshold, that is, selecting the log information whose degree of hazard is higher than the hazard degree threshold and whose alarm certainty is higher than the alarm certainty threshold.

[0058] Since each log information is marked with a harm degree and a confidence level, the log information to be evaluated whose alarm confidence level is lower than the confidence level threshold can be selected from the log information according to the harm degree threshold and the confidence level threshold.

[0059] If it is determined that the log information to be evaluated is a false alarm, the log information to be evaluated is deleted from the alarm log to remove the erroneous information in the alarm log, reduce the data volume of the alarm log, and provide favorable conditions for subsequent analysis.

[0060] If it is determined that the log information to be evaluated is not a false alarm, the log information to be evaluated is retained to maintain the comprehensiveness of the alarm information and improve the accuracy of the alarm log. At the same time, the log information to be evaluated that is not a false alarm can also indicate that the device is being attacked or controlled, and this state is recorded together with the state determined based on the target log information.

[0061] Among them, if the alarm frequency of the log information to be evaluated is higher than the frequency threshold, and / or the prevalence of the log information to be evaluated is higher than the prevalence threshold, then the log information to be evaluated is determined to be a false alarm; otherwise, it is determined that the log information to be evaluated is not a false alarm. It can be seen that whether it is a false alarm can be determined based on the alarm frequency of the log information to be evaluated being higher than the frequency threshold. Because attack events are generally sporadic events, and normal business running in the device continues and occurs on a large scale, if the alarm frequency is higher than the frequency threshold, and / or the prevalence is higher than the prevalence threshold, it means that the log information is very likely to be a business false alarm, and therefore it can be determined to be a false alarm.

[0062] Based on the above embodiments, it should be noted that, in a specific implementation manner, the alarm log is analyzed using an analysis strategy corresponding to the attacked state, including: if the attacked state is an attacking state, the log information in the alarm log whose degree of harm is higher than the threshold value of the degree of harm is displayed according to the timeline; and / or if the attacked state is an attack success state, the log information in the alarm log whose degree of harm is higher than the threshold value of the degree of harm is displayed according to the timeline, and the attack time point and the corresponding attack IP address are marked in the timeline, and the security management and control strategy is used to process the log information newly generated after the current moment and whose degree of harm is higher than the threshold value of the degree of harm, and the log information newly generated after the current moment and whose degree of harm is lower than the threshold value of the degree of harm is monitored; and / or if the attacked state is a controlled state, the alarm log is displayed according to the timeline, and the attack time point and the corresponding attack IP address, the controlled time point and the corresponding controlled behavior are marked in the timeline, and the security management and control strategy is used to process all log information newly generated after the current moment.

[0063] Since the attacked state of the device is determined based on the log information with high harm degree and high alarm certainty in the alarm log, after the attacked state of the device is determined, it means that the attack event has been recorded in the alarm log.

[0064] It can be seen that if the device is being attacked, it means that information about the attack has been recorded in the alarm log, and the high-risk alarm in the alarm log is very dangerous. Therefore, the log information in the alarm log with a hazard level higher than the hazard level threshold is displayed according to the timeline, so that technical personnel can check important information such as the time when the attack event was initiated.

[0065] If the device has been successfully attacked, it means that the alarm log has recorded important information such as the time when the attack event was launched and the time when the current device was breached. In addition, the device is very likely to perform other highly harmful operations in the future. Therefore, the log information in the alarm log with a degree of harm higher than the threshold of the degree of harm is displayed according to the timeline, and the attack time point and the corresponding attack IP address are marked in the timeline. Then, the security control strategy is used to process the newly generated log information after the current moment with a degree of harm higher than the threshold of the degree of harm, and the newly generated log information after the current moment with a degree of harm lower than the threshold of the degree of harm is monitored, so as to respond to the harmful operations made by the device in a timely manner. For example, prevent the installation of unknown software, delete important files, etc. Because the device has been successfully attacked at this time, it is necessary to pay attention to various newly generated alarms.

[0066] If the device is already in a controlled state, it means that the alarm log has recorded important information such as the time when the attack event was launched, the time when the current device was breached, the behavior and time of the current device attacking other devices, and the device is likely to continue to perform other high-risk operations. Therefore, the alarm log is displayed according to the timeline, and the attack time point and the corresponding attack IP address, the controlled time point and the corresponding controlled behavior are marked in the timeline. All newly generated log information after the current moment is processed using the security control strategy, and any dangerous operations made by the device are promptly responded to. Because the device has been maliciously controlled at this time, various newly generated alarms may be extremely threatening.

[0067] For the successfully attacked state and the controlled state, the thresholds of various alarms can be adjusted to make the device more sensitive to various alarms and have a lower alarm tolerance, so that the device pays attention to various alarms.

[0068] The following embodiments apply the method provided by the present application to a network security detection device (such as a gateway), see Figure 2 The specific implementation process includes:

[0069] 1. Network security detection equipment divides the security alarm logs of a host in the intranet into four levels according to the hazard level and confidence level:

[0070] Class A logs: high risk, high confidence;

[0071] Class B logs: high risk, low confidence;

[0072] Class C logs: low risk, high confidence;

[0073] Class D logs: low risk, low confidence.

[0074] 2. When the detection time point is reached, the B and D logs are detected.

[0075] Since the confidence of B and D logs is low, there may be a large number of false alarms. Analyze the frequency or access relationship of B and D logs to determine whether such logs are alarms triggered by hacker attacks or false alarms triggered by business access.

[0076] 1) Use the time series recognition algorithm to determine whether these logs are sporadic or continuous. Since hacker attacks are more sporadic, while business access is more continuous. Therefore, if the log is sporadic, it is considered to be an alarm caused by a hacker attack and is not a false alarm; if the log is continuous, it is considered to be a false alarm triggered by business access.

[0077] 2) Use the access relationship identification algorithm to determine whether these logs are common to a large number of devices or only occur in a small number of devices. Since business access is a large number of hosts accessing a server, there will be a many-to-one attack phenomenon, so the probability of false alarms for this type of alarm is high. However, hacker attacks are sporadic in nature, so only a small number of devices are involved in this type of alarm. It can be determined that the alarm is caused by a hacker attack. At this time, it is necessary to use the access relationship to determine whether the access is from inside to outside, from outside to inside, or from inside to inside.

[0078] If it is a false alarm log, delete the relevant log. If it is confirmed to be a real attack, keep the relevant log.

[0079] 3. For Class A logs, determine the host's security status (attacked, successful attack, controlled) based on the access direction (external-to-internal attack, internal-to-internal access, internal-to-external access), attack attributes (attack type, remote control type), and attack results.

[0080] 4. Determine the alarm log analysis strategy for the host based on its security status.

[0081] (1) If the host is under attack, it means that the host is not currently controlled by the hacker, but there is an attack event. At this time, the A and B class logs before the current time point can be aggregated according to the attack attributes and the attacker's IP address, and displayed in the timeline order of the alarm occurrence.

[0082] (2) If the host is in a state of being successfully attacked, it means that the host is about to be controlled by hackers. At this time, the alarm log at the time of successful attack should be marked. The A and B class logs before this moment should be aggregated according to the attack attributes and the attacker's IP, and displayed in the order of the alarm occurrence timeline. At the same time, the alarm log corresponding to the IP of the successful attack should be marked. The A and B class alarm logs after this moment should be responded to and handled in a timely manner. For example: timely stop related dangerous operations. The C and D class attack logs of the intranet after this moment should also be monitored and analyzed.

[0083] (3) If the host is already in a controlled (compromised) state, it is necessary to aggregate the A, B, C, and D logs before that moment according to the attack attributes and the attacker's IP address, and display them in the timeline of the alarm occurrence, with detailed identification of the time when the host was attacked, the time when it was controlled, and its behavior. At the same time, all subsequent alarm logs issued by the controlled host should be monitored and analyzed.

[0084] 5. Execute steps 2, 3, and 4 every 5 minutes to detect the host in real time.

[0085] It can be seen that this embodiment can calculate the security status of the host in real time, automatically analyze the log based on the security status of the host, and automatically mark each process of the hacker attack according to the timeline.

[0086] A security analysis device provided in an embodiment of the present application is introduced below. The security analysis device described below and the security analysis method described above can be referenced to each other.

[0087] See also Figure 3 As shown, the embodiment of the present application discloses a security analysis device, including:

[0088] The acquisition module is used to obtain the alarm log in the target device;

[0089] A determination module, used to determine in the alarm log the target log information whose harm degree is higher than the harm degree threshold and whose alarm certainty is higher than the certainty threshold, and determine the attacked state of the target device based on the target log information;

[0090] The analysis module is used to analyze the alarm log using an analysis strategy corresponding to the attacked state.

[0091] In a specific implementation, the determination module includes:

[0092] The first selection unit is used to determine the harm degree and alarm confidence of each log information in the alarm log, so as to select target log information from each log information according to the harm degree threshold and the confidence threshold.

[0093] In a specific implementation, the determination module further includes:

[0094] The second selection unit is used to select the log information to be evaluated whose alarm confidence is lower than the confidence threshold from each log information according to the hazard degree threshold and the confidence threshold;

[0095] The deleting unit is used to delete the log information to be evaluated from the alarm log if it is determined that the log information to be evaluated is a false alarm.

[0096] In a specific implementation, the deletion unit is specifically used to:

[0097] If the alarm frequency of the log information to be evaluated is higher than the frequency threshold, and / or the prevalence of the log information to be evaluated is higher than the prevalence threshold, it is determined that the log information to be evaluated is a false alarm; otherwise, it is determined that the log information to be evaluated is not a false alarm.

[0098] In a specific implementation, the determination module further includes:

[0099] The retaining unit is used to retain the log information to be evaluated if it is determined that the log information to be evaluated is not a false alarm.

[0100] In a specific implementation, the determination module is specifically used to:

[0101] The attacked state is determined based on the access direction, attack attributes and attack results of the target log information.

[0102] In a specific implementation, the analysis module is specifically used to:

[0103] If the attacked state is in the attacking state, the log information in the alarm log whose harm degree is higher than the harm degree threshold will be displayed according to the timeline;

[0104] and / or

[0105] If the attacked state is a successful attack state, the log information in the alarm log with a hazard level higher than the hazard level threshold will be displayed according to the timeline, and the attack time point and the corresponding attack IP address will be marked in the timeline. The security control strategy will be used to process the log information newly generated after the current time with a hazard level higher than the hazard level threshold, and the log information newly generated after the current time with a hazard level lower than the hazard level threshold will be monitored;

[0106] and / or

[0107] If the attacked state is the controlled state, the alarm log will be displayed according to the timeline, and the attack time point and the corresponding attack IP address, the controlled time point and the corresponding controlled behavior will be marked in the timeline, and the security control strategy will be used to process all newly generated log information after the current time.

[0108] Among them, for more specific working processes of each module and unit in this embodiment, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0109] It can be seen that this embodiment provides a security analysis device, which can automatically analyze logs based on the security status of the host and automatically mark each process of the hacker attack according to the timeline.

[0110] An electronic device provided in an embodiment of the present application is introduced below. The electronic device described below and the security analysis method and device described above can be referenced to each other.

[0111] See also Figure 4 As shown, the embodiment of the present application discloses an electronic device, including:

[0112] Memory 401, used for storing computer programs;

[0113] The processor 402 is used to execute the computer program to implement the method disclosed in any of the above embodiments.

[0114] Please refer to Figure 5 , Figure 5 Another electronic device schematic diagram provided for this embodiment, the electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 322 (for example, one or more processors) and memory 332, one or more storage media 330 (for example, one or more mass storage devices) storing application programs 342 or data 344. Among them, the memory 332 and the storage medium 330 can be short-term storage or permanent storage. The program stored in the storage medium 330 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data processing device. Furthermore, the central processor 322 can be configured to communicate with the storage medium 330 to execute a series of instruction operations in the storage medium 330 on the electronic device 301.

[0115] The electronic device 301 may further include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341. For example, Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0116] exist Figure 5 In the example, application 342 may be a program for executing the security analysis method, and data 344 may be data required or generated for executing the security analysis method.

[0117] The steps in the security analysis method described above can be implemented by the structure of an electronic device.

[0118] A readable storage medium provided in an embodiment of the present application is introduced below. The readable storage medium described below and the security analysis method, device and equipment described above can be referenced to each other.

[0119] A readable storage medium is used to store a computer program, wherein the computer program, when executed by a processor, implements the security analysis method disclosed in the above embodiment. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiment, and will not be repeated here.

[0120] The "first", "second", "third", "fourth", etc. (if any) referred to in this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods or devices.

[0121] It should be noted that the descriptions involving "first", "second", etc. in this application are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0122] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0123] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of readable storage medium known in the art.

[0124] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A security analysis method, characterized in that: include: Get the alarm log in the target device; Determine in the alarm log target log information whose harm degree is higher than the harm degree threshold and whose alarm certainty is higher than the certainty threshold, and determine the attacked state of the target device based on the target log information; Analyzing the alarm log using an analysis strategy corresponding to the attacked state; Among them, when the target device is in a state of being attacked, the alarm log generated at the current moment is analyzed in focus; when the target device is in a controlled state, the alarm information at the current moment, before the current moment, and after the current moment is analyzed in focus without associating historical attack events; when the attacked state is a successful attack state, the log information in the alarm log with a hazard level higher than the hazard level threshold is displayed according to the timeline, and the attack time point and the corresponding attack IP address are marked in the timeline.

2. The security analysis method according to claim 1, characterized in that: The target log information determined in the alarm log that the degree of harm is higher than the threshold of the degree of harm and the degree of alarm certainty is higher than the threshold of the degree of alarm certainty includes: The harm degree and alarm confidence of each piece of log information in the alarm log are determined, so as to select the target log information from each piece of log information according to the harm degree threshold and the confidence threshold.

3. The security analysis method according to claim 2, characterized in that: Also includes: According to the hazard level threshold and the confidence threshold, select the log information to be evaluated whose alarm confidence is lower than the confidence threshold from each log information; If it is determined that the log information to be evaluated is a false alarm, the log information to be evaluated is deleted from the alarm log.

4. The security analysis method according to claim 3, characterized in that: If the alarm frequency of the log information to be evaluated is higher than the frequency threshold, and / or the prevalence of the log information to be evaluated is higher than the prevalence threshold, it is determined that the log information to be evaluated is a false alarm; otherwise, it is determined that the log information to be evaluated is not a false alarm.

5. The security analysis method according to claim 3, characterized in that: If it is determined that the log information to be evaluated is not a false alarm, the log information to be evaluated is retained.

6. The security analysis method according to claim 1, characterized in that: The determining the attacked state of the target device based on the target log information includes: The attacked state is determined based on the access direction, attack attribute and attack result of the target log information.

7. The security analysis method according to any one of claims 1 to 6, characterized in that: The analyzing the alarm log by using the analysis strategy corresponding to the attacked state includes: If the attacked state is an attacking state, the log information in the alarm log whose harm degree is higher than the harm degree threshold is displayed according to the timeline; and / or If the attacked state is a successful attack state, the security control strategy is used to process the log information newly generated after the current time and whose harm degree is higher than the harm degree threshold, and the log information newly generated after the current time and whose harm degree is lower than the harm degree threshold is monitored; and / or If the attacked state is a controlled state, the alarm log will be displayed according to the timeline, and the attack time point and the corresponding attack IP address, the controlled time point and the corresponding controlled behavior will be marked in the timeline, and the security management and control strategy will be used to process all newly generated log information after the current moment.

8. A security analysis device, characterized in that: include: The acquisition module is used to obtain the alarm log in the target device; a determination module, configured to determine in the alarm log target log information whose harm degree is higher than a harm degree threshold and whose alarm certainty is higher than a certainty threshold, and determine the attacked state of the target device based on the target log information; An analysis module, configured to analyze the alarm log using an analysis strategy corresponding to the attacked state; Among them, when the target device is in a state of being attacked, the alarm log generated at the current moment is analyzed in focus; when the target device is in a controlled state, the alarm information at the current moment, before the current moment, and after the current moment is analyzed in focus without associating historical attack events; when the attacked state is a successful attack state, the log information in the alarm log with a hazard level higher than the hazard level threshold is displayed according to the timeline, and the attack time point and the corresponding attack IP address are marked in the timeline.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the security analysis method according to any one of claims 1 to 7.

10. A readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the security analysis method according to any one of claims 1 to 7 is implemented.

Images