Cyberspace asset log correlation analysis system based on finite state machine

Abstract

The present invention relates to a network space asset log association analysis system based on a finite state machine. The system comprises: a rule configuration module, which is provided to a security administrator to configure association analysis rules, and the configured rules are stored in a database in the form of a tree; a built-in condition and knowledge base, which provides the implementation and parameter dictionary of built-in basic sub-rules, and the user configures and combines the built-in conditions to form rules; a rule compiler, which converts the tree-shaped rule configuration stored in the rule configuration module into a finite state machine corresponding to the rule; a log event receiving module, which provides the events in the cache as input events to a task scheduler; the task scheduler, for each event in the cache, schedules all finite state machines for matching, and outputs the matching results, i.e., the matching event list, to an alarm generation module; the alarm generation module receives the matching event list in the task scheduler, extracts relevant attributes in the event according to the definition of the alarm, and generates an alarm report to send to the security administrator.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a cyberspace asset log association analysis system based on a finite state machine. Background Art

[0002] In the prior art, the closest one is the association analysis system based on rule tree. (Association analysis device based on event classification and rule tree. Patent application number: 200920182619.3 Authorization announcement number: CN 201491020 U).

[0003] The rule-tree-based association analysis system models rules based on rule trees. The basic principle of the rule tree system is: first, create an initial rule tree Tree0 and add it to the rule tree set. This tree contains 3 tree nodes. The root node contains >> (followed by the operator identifier). The root node has two rule node children, rule A and rule B. When event E1 matches rule A, it is necessary to copy an initial tree Tree1, add E1 to the rule node A of Tree1, move the matching cursor to the rule B node, and add Tree2 to the rule tree set. The main purpose of this copy operation is to save the intermediate results so that when the next event E2 comes in, RuleB can be matched directly from the intermediate results of Tree1.

[0004] From the above, we can see that the rule tree system has at least the following three problems:

[0005] 1. Saving intermediate results requires copying the event instances in the rule nodes of the entire rule tree, which has a high copying cost.

[0006] 2. Since the event stream is continuous, if there are many intermediate results or the rule tree itself occupies a large space, the storage overhead will be relatively large.

[0007] 3. As the rule tree is replicated, the number of trees in the rule tree set may increase, the matching time overhead will increase, and the matching delay will be higher. Summary of the invention

[0008] The purpose of the present invention is to overcome the defects of the prior art and provide a cyberspace asset log association analysis system based on a finite state machine.

[0009] To achieve the above purpose, the technical solution of the present invention is: a cyberspace asset log association analysis system based on a finite state machine:

[0010] Rule configuration module: This module is a user interface for security administrators to configure association analysis rules. The configured rules are saved in the database in the form of a tree.

[0011] Built-in conditions and knowledge base, providing the implementation of built-in basic sub-rules and parameter dictionaries. Users configure and combine built-in conditions to form rules through the rule configuration module;

[0012] Rule compiler: The function of this module is to convert the tree-shaped rule configuration saved in the rule configuration module into a finite state machine corresponding to the rule;

[0013] The log event receiving module is an event stream cache. The events in the cache are provided to the task scheduler as input events.

[0014] The task scheduler schedules all finite state machines to match each event in the cache, and outputs the matching result, i.e., the list of matching events, to the alarm generation module;

[0015] The alarm generation module receives the matching event list from the task scheduler, extracts relevant attributes from the event according to the definition of the alarm, generates an alarm report and sends it to the security administrator.

[0016] In one embodiment of the present invention, the system operation steps are as follows:

[0017] S1. Initialization steps:

[0018] S11, read the rule configuration set from the database;

[0019] S12, instantiating the judgment conditions of each sub-rule in the rule configuration set, and combining them into a tree-shaped configuration object;

[0020] S13, extracting the configuration object in step S12, and translating the configuration object into a state and transition set in a state machine, thereby creating a state machine corresponding to the current rule;

[0021] S14. For each state machine in step S13, create a task object, register the task object in the scheduler, and put the task in a dormant state; when an event comes, the scheduler will wake up each registered task at the same time, match them, and assign the running results to the alarm processing module;

[0022] S2, event matching steps:

[0023] S21, the task scheduler wakes up each registered state machine task at the same time and starts matching input events;

[0024] S22. Update the built-in cache of the state machine according to the timestamp of the current event and prune out the expired intermediate matching results.

[0025] S23, matching the current event, if the event matches the current state successfully, saving the event into the built-in cache of the state machine; if the current event causes a certain intermediate result to fail to match, clearing the intermediate result from the cache and discarding the event; if the current state can ignore the current event, directly discarding the event;

[0026] S24, if the event matching is successful and causes the state machine to enter the end state, extract the matched event list from the state machine cache and send it to the alarm generation module;

[0027] S25. The alarm generation module receives the event list set in step S24, extracts corresponding event attributes from the event list according to the alarm configuration corresponding to each rule, generates an alarm report, and sends it to the security administrator.

[0028] Compared with the prior art, the present invention has the following beneficial effects: the cyberspace asset log association analysis system based on the finite state machine of the present invention has the following advantages:

[0029] 1. Apply the finite state machine model to the security log correlation analysis scenario.

[0030] 2. The application of the state machine model also improves the semantic expression ability of association analysis.

[0031] 3. Solved the problems existing in the existing model:

[0032] 1) Only one copy of the rule definition in the state machine needs to be saved. During the running process, there is no need to copy the rule definition for the intermediate results, which reduces the overhead of rule copying.

[0033] 2) The state machine does not need to replicate events, but only needs to save one instance. The intermediate results are saved in the state machine's built-in cache through index paths, reducing the overhead of event replication.

[0034] 3) During the matching process, the state machine only needs to consider the current state and the attributes of the current event, and does not need to consider the previous matching results (multiple copy trees in the rule tree). Therefore, the matching efficiency is higher than that of the rule tree, especially when the rules are more complex, this advantage is more obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a structural diagram of the cyberspace asset log association analysis system based on the finite state machine of the present invention.

[0036] Figure 2 is the initialization step.

[0037] Figure 3 Matching processes to events. DETAILED DESCRIPTION

[0038] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings.

[0039] The present invention provides a network space asset log association analysis system based on a finite state machine, comprising:

[0040] Rule configuration module: This module is a user interface for security administrators to configure association analysis rules. The configured rules are saved in the database in the form of a tree.

[0041] Built-in conditions and knowledge base, providing the implementation of built-in basic sub-rules and parameter dictionaries. Users configure and combine built-in conditions to form rules through the rule configuration module;

[0042] Rule compiler: The function of this module is to convert the tree-shaped rule configuration saved in the rule configuration module into a finite state machine corresponding to the rule;

[0043] The log event receiving module is an event stream cache. The events in the cache are provided to the task scheduler as input events.

[0044] The task scheduler schedules all finite state machines to match each event in the cache, and outputs the matching result, i.e., the list of matching events, to the alarm generation module;

[0045] The alarm generation module receives the matching event list from the task scheduler, extracts relevant attributes from the event according to the definition of the alarm, generates an alarm report and sends it to the security administrator.

[0046] The following are specific implementation examples of the present invention.

[0047] 1. Module introduction of cyberspace asset log correlation analysis system based on finite state machine

[0048] The cyberspace asset log association analysis system based on finite state machine mainly includes 6 modules such as Figure 1 shown.

[0049] 1. Rule configuration module

[0050] This module is a user interface that is provided to security administrators to configure association analysis rules. The configured rules are saved in the database in the form of a tree.

[0051] 2. Built-in conditions and knowledge base

[0052] It provides the implementation of built-in basic sub-rules and parameter dictionaries, and users can configure and combine built-in conditions to form rules through the rule configuration module.

[0053] 3. Rule Compiler

[0054] The function of this module is to convert the tree-shaped rule configuration saved in the rule configuration module into a finite state machine corresponding to the rule.

[0055] 4. Log event receiving module

[0056] This module is an event stream buffer, and the events in the buffer are provided to the task scheduler as input events.

[0057] 5. Task Scheduler

[0058] For each event in the cache, all state machines are scheduled for matching, and the matching results (matching event list) are output to the alarm generation module.

[0059] 6. Alarm generation module

[0060] Receive the output event list from the task scheduler, extract relevant attributes from the event according to the definition of the alarm, generate an alarm report and send it to the administrator.

[0061] 2. Operation steps of the cyberspace asset log correlation analysis system based on finite state machine

[0062] The operation steps of the cyberspace asset log association analysis system based on the finite state machine are described in two major parts. The initialization step is executed first, and the matching step is executed after the initialization step is successful.

[0063] 2.1. Initialization steps

[0064] The initialization process includes 4 specific steps, such as Figure 2 :

[0065] 1. Read the rule configuration set from the database.

[0066] 2. Instantiate the judgment conditions of each sub-rule in the rule configuration set and combine them into a tree-shaped configuration object.

[0067] 3. Extract the configuration object in step 2 and translate the configuration object into the state and transition in the state machine to create a state machine corresponding to the rule.

[0068] 4. For each state machine in step 3, create a task object, register the task object with the scheduler, and put the task in a sleeping state. When an event comes, the scheduler will wake up each registered task one by one, match them, and assign the running results to the alarm processing module.

[0069] 2.2 Event matching steps

[0070] The event matching process mainly includes 5 specific steps, such as Figure 3shown.

[0071] 1. The scheduler wakes up each registered state machine task and starts matching input events.

[0072] 2. Update the state machine’s built-in cache based on the timestamp of the current event and prune outdated intermediate results.

[0073] 3. Match the current event. If the event matches the current state successfully, save the event into the built-in cache of the state machine. If the current event causes a certain intermediate result to fail to match, clear the intermediate result from the cache and discard the event. If the current state can ignore the current event, discard the event directly.

[0074] 4. If the event matching is successful and causes the state machine to enter the end state, the matched event list is extracted from the state machine cache and sent to the alarm generation module.

[0075] 5. The alarm generation module receives the event list set in step 4, extracts the corresponding event attributes from the event list according to the alarm configuration corresponding to each rule, and generates an alarm report and sends it to the security administrator.

[0076] The above are preferred embodiments of the present invention. Any changes made according to the technical solution of the present invention, as long as the resulting functions do not exceed the scope of the technical solution of the present invention, belong to the protection scope of the present invention.

Claims

1. A cyberspace asset log association analysis system based on a finite state machine, characterized in that: include: Rule configuration module: This module is a user interface for security administrators to configure association analysis rules. The configured rules are saved in the database in the form of a tree. Built-in conditions and knowledge base, providing the implementation of built-in basic sub-rules and parameter dictionaries. Users configure and combine built-in conditions to form rules through the rule configuration module; Rule compiler: The function of this module is to convert the tree-shaped rule configuration saved in the rule configuration module into a finite state machine corresponding to the rule; The log event receiving module is an event stream cache. The events in the cache are provided to the task scheduler as input events. The task scheduler schedules all finite state machines to match each event in the cache, and outputs the matching result, i.e., the list of matching events, to the alarm generation module; The alarm generation module receives the matching event list from the task scheduler, extracts relevant attributes from the event according to the definition of the alarm, generates an alarm report and sends it to the security administrator.

2. According to the finite state machine-based cyberspace asset log association analysis system of claim 1, it is characterized in that: The system operation steps are as follows: S1. Initialization steps: S11, read the rule configuration set from the database; S12, instantiate the judgment conditions of each sub-rule in the rule configuration set, and combine them into a tree-shaped configuration object; S13, extracting the configuration object in step S12, and translating the configuration object into a state and transition set in a state machine, thereby creating a state machine corresponding to the current rule; S14. For each state machine in step S13, create a task object, register the task object in the scheduler, and put the task in a dormant state; when an event comes, the scheduler will wake up each registered task at the same time, match them, and assign the running results to the alarm processing module; S2, event matching steps: S21, the task scheduler wakes up each registered state machine task and starts matching input events; S22. Update the built-in cache of the state machine according to the timestamp of the current event and prune out the expired intermediate results. S23, matching the current event, if the event matches the current state successfully, saving the event into the built-in cache of the state machine; If the current event causes an intermediate result to fail to match, the intermediate result is cleared from the cache and the event is discarded; If the current state ignores the current event, the event is discarded directly; S24, if the event matching is successful and causes the state machine to enter the end state, extract the matched event list from the state machine cache and send it to the alarm generation module; S25. The alarm generation module receives the event list set in step S24, extracts corresponding event attributes from the event list according to the alarm configuration corresponding to each rule, generates an alarm report, and sends it to the security administrator.

Images