Asset identification method and apparatus

Abstract

The application provides an asset identification method and device, and relates to the technical field of data processing. The method comprises the following steps: acquiring security log data of assets; constructing an attack relationship graph between the assets by using the security log data, wherein the attack relationship graph comprises nodes representing the assets and edges representing security events initiated by the assets, and each edge has a transition weight; determining a loss value of each node according to the attack relationship graph; and identifying assets with security threats according to the loss values of the nodes. Thus, assets that threaten security can be identified from a large amount of security log data initiated by the assets, and the workload of security operation and maintenance personnel can be reduced.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an asset identification method and device. Background Art

[0002] The security management platform (including but not limited to situational awareness, SOC, and SIME) leverages security big data to capture, understand, evaluate, and present factors that could cause changes in network dynamics, as well as predict future development trends. This platform enhances the ability to identify, understand, analyze, respond to, and address security threats from a holistic perspective. Through intelligent analysis and coordinated response, it drives closed-loop decision-making within the security brain and enables the practical implementation of security capabilities.

[0003] However, full management platforms typically collect security log data reported by multiple devices. Thousands of assets generating massive amounts of security log data can place enormous pressure on security operations personnel to investigate and resolve these incidents. Currently, security operations personnel can use qualitative methods such as threat level, such as compromised, highly suspicious, and low suspicious, to identify assets with higher compromise levels. However, if a large number of risky assets with the same threat level are present, the workload for security operations personnel becomes significant.

[0004] Therefore, how to identify assets that threaten security from a large amount of security log data initiated by assets while reducing the workload of security operations personnel is one of the technical issues worth considering. Summary of the Invention

[0005] In view of this, the present application provides an asset identification method and device for identifying assets that threaten security from security log data initiated by a large amount of assets, while reducing the workload of security operation and maintenance personnel.

[0006] Specifically, this application is implemented through the following technical solutions:

[0007] According to a first aspect of the present application, there is provided an asset identification method, comprising:

[0008] Obtain security log data for assets;

[0009] Using the security log data, construct an attack relationship graph between assets, the attack relationship graph including nodes for representing assets and edges for representing security events initiated by the assets, each edge having a transfer weight;

[0010] Determine the loss value of each node according to the attack relationship graph;

[0011] Identify assets that pose security threats based on the loss value of each node.

[0012] Optionally, determining the loss value of each node according to the attack relationship graph includes:

[0013] Performing weighted sum processing on the importance value of the node pointed to by the edge connected to the node in the attack relationship graph and the transfer weight of the connected edge to obtain a first value;

[0014] Based on the random walk factor, the first value and the personalized value, the hyperlink inclusion topic search algorithm HITS is used to calculate the loss value of the node.

[0015] Optionally, calculate the importance of the node pointed to by:

[0016] Performing weighted summation processing on the target node pointed to by the edge connected to the pointed node and the transfer weight of the edge connected to the node to obtain a second value;

[0017] Based on the random walk factor, the second value and the personalized value, the importance value of the node is calculated using the hyperlink inclusion topic search algorithm HITS.

[0018] Optionally, the security log data includes asset data of the asset and security events generated by the asset, and the asset data includes an IP address;

[0019] Using the security log data, an attack relationship graph between assets is constructed, including:

[0020] An attack relationship graph is constructed using the asset data of each asset and the security events generated by the asset, where the nodes of the attack relationship graph are the IP addresses of the assets.

[0021] Optionally, an attack relationship graph is constructed using the asset data of each asset and the security events generated by the asset. The nodes of the attack relationship graph are the IP addresses of the assets, including:

[0022] Configure the destination IP address in the asset data of the assets involved in the security incident that meets the set conditions to a specified IP address;

[0023] The attack relationship graph is constructed based on the modified asset data and the security events generated by the assets.

[0024] Alternatively, the transfer weight of each node's edge can be calculated as follows:

[0025] The precision rate of security events occurring at the node pointing to the destination node, calculated based on prior statistics;

[0026] Determine the difference between the set value and the precision rate of each security event respectively;

[0027] Calculate the product value between each difference;

[0028] The difference between the set value and the product value is determined as the transfer weight of the edge of the node.

[0029] According to a second aspect of the present application, there is provided an asset identification device, comprising:

[0030] The acquisition module is used to obtain the security log data of the asset;

[0031] A construction module is used to construct an attack relationship graph between assets using the security log data, wherein the attack relationship graph includes nodes for representing assets and edges for representing security events initiated by assets, and each edge has a transfer weight;

[0032] A determination module, configured to determine a loss value of each node according to the attack relationship graph;

[0033] The identification module is used to identify assets that pose security threats based on the loss value of each node.

[0034] Optionally, the determination module is specifically used to perform weighted summation processing on the importance value of the node pointed to by the edge connected to the node in the attack relationship graph and the transfer weight of the connected edge to obtain a first numerical value; based on the random walk factor, the first numerical value and the personalized value, the hyperlink inclusion topic search algorithm HITS is used to calculate the loss value of the node.

[0035] Optionally, the determination module is also used to perform weighted summation processing on the loss value of the target node pointed to by the edge connected to the pointed node and the transfer weight of the edge connected to the node to obtain a second value; based on the random walk factor, the second value and the personalized value, the importance value of the node is calculated using the hyperlink inclusion topic search algorithm HITS.

[0036] Optionally, the security log data includes asset data of the asset and security events generated by the asset, and the asset data includes an IP address;

[0037] The construction module is specifically used to construct an attack relationship graph using the asset data of each asset and the security events generated by the asset, where the nodes of the attack relationship graph are the IP addresses of the assets.

[0038] Optionally, the construction module is specifically used to configure the destination IP address in the asset data of the assets involved in the security events that meet the set conditions to a specified IP address; and construct the attack relationship graph based on the modified asset data and the security events generated by the assets.

[0039] Optionally, the asset identification device provided in this embodiment further includes:

[0040] The weight determination module is used to calculate the transfer weight of the edge of each node according to the following method: based on the precision rate of security events occurring when the node points to the destination node, calculated based on prior statistics; determining the difference between a set value and the precision rate of each security event; calculating the product value between the differences; and determining the difference between the set value and the product value as the transfer weight of the edge of the node.

[0041] According to the third aspect of the present application, an electronic device is provided, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores a computer program that can be executed by the processor, and the processor is prompted by the computer program to execute the method provided in the first aspect of the embodiment of the present application.

[0042] According to the fourth aspect of the present application, a machine-readable storage medium is provided, which stores a computer program. When called and executed by a processor, the computer program prompts the processor to execute the method provided in the first aspect of the embodiment of the present application.

[0043] Beneficial effects of the embodiments of the present application:

[0044] In the asset identification method and device provided in the embodiments of the present application, the security log data of the assets is first obtained; then, the security log data is used to construct an attack relationship graph between the assets. The attack relationship graph includes nodes for representing assets and edges for representing security events initiated by the assets, each edge having a transfer weight; and based on the attack relationship graph, the loss value of each node is determined; thus, based on the loss value of each node, assets posing security threats can be identified. In this way, assets posing security threats can be automatically identified based on the loss value, without requiring excessive involvement of security operations and maintenance personnel, greatly reducing the workload of security operations and maintenance personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a flowchart of an asset identification method provided in an embodiment of the present application;

[0046] Figure 2 This is a structural diagram of an asset identification device provided in an embodiment of the present application;

[0047] Figure 3 This is a hardware structure diagram of an electronic device for implementing an asset identification method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] Exemplary embodiments are described in detail herein, with examples illustrated in the accompanying drawings. When the following description refers to the drawings, identical numerals in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with certain aspects of the present application.

[0049] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms "a," "the," and "the" used in this application are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and includes any or all possible combinations of one or more of the corresponding listed items.

[0050] It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0051] The asset identification method provided in this application is described in detail below.

[0052] See also Figure 1 , Figure 1 This is a flowchart of an asset identification method provided by this application. This method can be applied to electronic devices for security protection, such as, but not limited to, flow detection devices, firewall devices, etc. The method may include the following steps:

[0053] S101. Obtain security log data of an asset.

[0054] In this step, the electronic device may capture security log data of the assets that can be captured within the current statistical time period.

[0055] It should be noted that the above-mentioned current statistical time period may be the current statistical cycle, that is, the electronic device obtains the security log data of each target asset that can be detected periodically, and then executes the data processing flow.

[0056] It should be noted that the above-mentioned assets may be, but are not limited to, hosts that perform security business processing, etc.

[0057] S102: Utilize the security log data to construct an attack relationship graph between assets.

[0058] The attack relationship graph includes nodes for representing assets and edges for representing security events initiated by assets, and each edge has a transfer weight.

[0059] In this step, the above-mentioned security log data may include, but is not limited to, asset data of assets and security events generated by assets, and the above-mentioned asset data includes IP addresses; on this basis, an attack relationship graph between assets can be constructed according to the following process: using the asset data of each asset and the security events generated by the assets, an attack relationship graph is constructed, and the nodes of the attack relationship graph are the IP addresses of the assets.

[0060] Specifically, the security incidents generated by the above-mentioned assets can be understood as security incidents initiated by the assets as the attacking party, and can also be understood as security incidents passively generated by the assets as the attacked party; on this basis, the edges of the above-mentioned attack relationship graph can be understood as edges from the assets as the attacking party to the attacked party.

[0061] Optionally, the attack relationship graph can be constructed by utilizing the asset data of each asset and the security events generated by the assets according to the following process: the destination IP address in the asset data of the assets involved in the security events that meet the set conditions is configured as a specified IP address; and the attack relationship graph is constructed based on the modified asset data and the security events generated by the assets.

[0062] Optionally, the above-mentioned setting conditions may be, but are not limited to, security events where the source IP or destination IP address is empty, and / or security events where the intelligence is not empty, etc.

[0063] On this basis, the electronic device will pre-process the asset data. Specifically, it will identify the security events of the assets. When it is identified that the security event meets the above-mentioned set conditions, the target IP address in the asset data related to the security event will be configured as the specified IP address.

[0064] The above-mentioned designated IP addresses can be, but are not limited to, uncommon IP addresses, such as 255.255.2.1, 255.255.2.2, 255.255.2.3, or 255.255.2.4. For example, for security events where the source IP address or destination IP address is empty, such as one-to-many or many-to-one attack events, based on the semantics (detection logic) of the security event, the destination IP aggregation in various situations is measured:

[0065] Case 1: If it is confirmed based on the security event name that the target asset is infected with a worm virus, the destination IP address in the asset data of the target asset may be converted into a designated IP address 1, such as 255.255.2.1.

[0066] Case 2: If it is confirmed that the target asset has a successful SSH lateral spread / attempt or RDP lateral spread / attempt, the destination IP in the asset data of the target asset is converted to the specified IP address 2, such as 255.255.2.2.

[0067] Case 3: If it is confirmed that a port level scanning event occurs on the target asset, the destination IP in the asset data of the target asset is converted to a specified IP address 3, such as 255.255.2.3.

[0068] Case 4: If it is confirmed that the website access rate of the target asset is abnormal, the same domain name request rate is abnormal, or the domain name request rate is abnormal, the destination IP in the asset data of the target asset is converted to the specified IP address 4, such as 255.255.2.4.

[0069] It should be noted that the above situations 1 to 4 are only examples and do not constitute a limitation on security incidents. Of course, there are other situations, which will not be listed in detail here.

[0070] In addition, for security incidents where the intelligence is not empty, the destination IP addresses in the asset data are not aggregated uniformly. Instead, the actual intelligence IOC content is extracted from the asset data as the destination IP address.

[0071] On this basis, the modified asset data and the security events generated by the assets can be used to form an attack relationship graph.

[0072] Based on any of the above embodiments, in this embodiment, the transfer weight of the edge of each node in the attack relationship graph can be calculated according to the following method: the precision rate of the security event occurring when the node points to the destination node is obtained based on the prior statistical calculation; the difference between the set value and the precision rate of each security event is determined respectively; the product value between each difference is calculated; and the difference between the set value and the product value is determined as the transfer weight of the edge of the node.

[0073] Specifically, multiple security events may occur between two nodes. Accordingly, to simplify the attack relationship graph, the multiple initial edges between each two nodes are quantized to obtain a weighted edge. This weighted edge is each edge in the attack relationship graph, i.e., the quantized edge. Each initial edge is used to represent a security event that occurs when the node points to another node. The transfer weight of the quantized edge is then calculated based on the precision of the multiple initial edges. For example, the above-mentioned set value of 1 is used to illustrate. The difference between 1 and the precision of each initial edge is determined, the product of the differences is calculated, and the difference between 1 and the aforementioned product value is determined as the transfer weight of the quantized edge. For example, asset A points to asset B and generates three security events, namely security event 1 to security event 3. The precision rates of the edges containing each security event are: the precision rate of security event 1 (which is compromised) is 0.851, the precision rate of security event 2 (which is highly suspicious) is 0.329, and the precision rate of security event 3 (which is low suspicious) is 0.017. It should be noted that the above precision rates are calculated based on a priori statistics. On this basis, the transfer weight of the quantized edge from asset A to asset B is: Result = 1-(1-0.851)*(1-0.33)*(1-0.017) = 0.90186.

[0074] Similarly, the transfer weight of each quantified edge in the attack relationship graph can be calculated, and then the attack relationship graph used for subsequent asset identification can be constructed.

[0075] S103: Determine the loss value of each node according to the attack relationship graph.

[0076] Optionally, each node in the attack relationship graph has a loss value and an importance value. On this basis, the loss value of each node can be calculated according to the following process: the loss value of the node is calculated according to the importance value of the destination node pointed to by the edge connected to the node and the transfer weight of the aforementioned connected edge.

[0077] Similarly, the importance value of the node can be calculated according to the following method: the node's loss value is calculated based on the loss value of the destination node pointed to by the edge connected to the node and the transfer weight of the aforementioned connected edge.

[0078] Specifically, the loss value of each node can be calculated according to the following method: the importance value of the node pointed to by the edge connected to the node in the attack relationship graph and the transfer weight of the connected edge are weighted summed to obtain a first value; based on the random walk factor, the first value and the personalized value, the loss value of the node is calculated using the hyperlink inclusion topic search algorithm HITS.

[0079] Specifically, when calculating the node's loss value, a personalized HITS algorithm is introduced to iteratively calculate the node's loss value. The following formula 1 or formula 2 can be used to describe the calculation process of the loss value:

[0080] Formula 1:

[0081] h=λM T a+(1-λ)w h

[0082] Formula 2:

[0083]

[0084] In the above formula 1, h is used to represent the node's sink value; M T It is used to represent the transposed vector of the vector composed of the transfer weights of the edges pointed to by the node; a is used to represent the vector composed of the importance values ​​of each node pointed to by the edges connected to the node. In the above formula 2, h i Used to represent the sink value of the i-th node; m ij It is used to represent the transfer weight of the jth edge connected to the i-th node, and the range of j is 1 to the total number of edges connected to the i-th node; a j It is used to represent the importance value of the node pointed by the jth edge. In the above formula 1 and formula 2, λ is used to represent the random walk factor; w h Used to represent personalized values; E is an integer.

[0085] Among them, M in the above formula 1 T a and the above formula 2 It can be understood as the first value mentioned above.

[0086] It should be noted that the above λ and the above w h The specific value of can be configured according to actual conditions, and λ can be set to, but is not limited to, 0.85.

[0087] On this basis, the importance value of the pointed node can be calculated according to the following method: perform weighted summation on the loss value of the target node pointed to by the edge connected to the pointed node and the transfer weight of the edge connected to the node to obtain a second value; based on the random walk factor, the second value and the personalized value, the importance value of the node is calculated using the hyperlink inclusion topic search algorithm HITS.

[0088] Specifically, when calculating the node's loss value, a personalized HITS algorithm is introduced to iteratively calculate the node's importance value. The calculation process of the importance value can be described using the following formula 3 or formula 4:

[0089] Formula 3:

[0090] a=λMh+(1-λ)w a

[0091] Formula 4:

[0092]

[0093] In the above formula 3, a is used to represent the importance value of the node; M is used to represent the transposed vector of the vector composed of the transfer weights of the edges pointed to by the node; h is used to represent the vector composed of the loss values ​​of each node pointed to by the edges connected to the node. In the above formula 4, a i Used to represent the importance value of the i-th node; m ki It is used to represent the transfer weight of the kth edge connected to the i-th node, and the range of k is 1 to the total number of edges connected to the i-th node; h k It is used to represent the loss value of the node pointed by the kth edge. In the above formula 3 and formula 4, λ is used to represent the random walk factor; w a Used to represent personalized values; E is an integer.

[0094] It is worth noting that Mh in the above formula 3 and It can be understood as the second value mentioned above.

[0095] Thus, we can iterate the calculations according to Formula 1 or Formula 2 above to calculate the loss value of each node, that is, the loss value of each asset. Similarly, we can iterate the calculations according to Formula 3 or Formula 4 above to calculate the importance value of each node, that is, the importance value of each asset.

[0096] It should be noted that the above λ and the above w h The specific value of can be configured according to actual conditions, and λ can be set to, but is not limited to, 0.85.

[0097] It should be noted that the loss value and importance value of each of the above nodes have initial values, and the initial values ​​of the loss value and importance value can be configured according to actual conditions. Since the loss value and importance value of each node are obtained iteratively, they will converge to a stable state as the number of iterations increases. Therefore, the initial values ​​of the above importance value and loss value will not affect the ranking results of the loss values ​​between nodes.

[0098] S104: Identify assets that pose security threats based on the loss value of each node.

[0099] Specifically, after determining the vulnerability value of each asset based on the above steps, since the larger the vulnerability value, the higher the probability of the asset being compromised, the identified vulnerability value can be compared with a set vulnerability value threshold. If the vulnerability value is greater than the set threshold, the asset can be confirmed to pose a security threat; otherwise, the asset is confirmed to not pose a security threat. In this way, assets that pose a security threat can be automatically identified, greatly reducing the asset investigation workload for security operations personnel.

[0100] It should be noted that the specific value of the above-mentioned set sink value threshold can be configured according to actual conditions, and this embodiment does not limit its value.

[0101] In addition, when determining asset loss, the following assumption can be made: If, in a security incident from asset A to asset B, asset A has already been lost, then:

[0102] If an asset attacks multiple target assets multiple times, the probability of that asset being compromised is high. If an asset is attacked multiple source assets multiple times, the probability of that asset being compromised is high. Based on these assumptions, each asset has two attributes: a compromise value and a criticality value. The compromise value of each asset is then used to measure the likelihood of its compromise.

[0103] On this basis, in this step, after calculating the loss value of each asset based on the method of step S103, the loss values ​​of each asset can be ranked. The higher the ranking, the greater the loss value, and the greater the probability of asset loss. On this basis, the assets with the top 100 loss values ​​can be output to instruct security operations personnel to investigate and process these assets, thereby screening out assets that have been lost. In this way, security operations personnel can prioritize the investigation and confirmation of the few assets that are ranked high, and can also reduce alarm fatigue to a certain extent, alleviating the investigation energy of operations personnel.

[0104] Optionally, based on the above embodiment, the asset identification method provided in this embodiment further includes:

[0105] The personalized value is adjusted according to the asset identification result obtained in step S104.

[0106] Specifically, after obtaining the TOPN loss values ​​in steps S101 to S104, these N assets can be confirmed as lost assets, that is, as the first asset identification result identified by the electronic device; in addition, the electronic device can output the TOPN assets to instruct the security operation and maintenance personnel to proactively check whether these N assets pose a security threat, that is, whether they have been lost (poisoned), and then confirm the actual asset identification result. The security operation and maintenance personnel then input the actual asset identification result into the electronic device to instruct the electronic device to adjust the random walk factor and personalized value according to the actual asset identification result. Specifically, when the actual asset identification result is lost, the above-mentioned personalized value is configured to 1; if the actual asset identification result is not lost, the personalized value is configured to 0.

[0107] It should be noted that when the security operation and maintenance personnel confirm the above-mentioned actual asset identification results, if the number of compromised assets among the N output assets is greater than the set number, the actual asset identification results can be confirmed as compromised; otherwise, the actual asset identification results are confirmed as not compromised.

[0108] By continuously iterating and adjusting the personalized values ​​through feedback, and then using the adjusted HITS algorithm to identify the asset's loss value, the readiness of the asset loss determination results can be gradually improved.

[0109] On this basis, once the lost assets are confirmed, they can be checked and processed.

[0110] By implementing the asset identification method provided in this application, the security log data of the assets is first obtained. Then, using this security log data, an attack relationship graph between assets is constructed. This attack relationship graph includes nodes used to represent assets and edges used to represent security events initiated by the assets, each edge having a transfer weight. Based on this attack relationship graph, the loss value of each node is determined. Thus, based on the loss value of each node, assets posing security threats can be identified. In this way, assets posing security threats can be automatically identified based on the loss value, eliminating the need for excessive involvement of security operations personnel and significantly reducing their workload.

[0111] Based on the same inventive concept, the present application also provides an asset identification device corresponding to the above-mentioned asset identification method. The specific implementation of the asset identification device can refer to the above-mentioned description of the asset identification method, and will not be discussed here one by one.

[0112] See also Figure 2 , Figure 2 An exemplary embodiment of the present application provides an asset identification device, which can be provided in the above-mentioned electronic device. The device includes:

[0113] The acquisition module 201 is configured to acquire security log data of assets.

[0114] The construction module 202 is configured to construct an attack relationship graph between the assets by using the security log data, wherein the attack relationship graph comprises nodes representing the assets and edges representing security events initiated by the assets, and each edge has a transition weight.

[0115] The determination module 203 is configured to determine a compromise value of each node according to the attack relationship graph.

[0116] The identification module 204 is configured to identify the assets with security threats according to the compromise values of the nodes.

[0117] Optionally, the determination module 203 is specifically configured to perform weighted summation processing on an importance value of a node pointed to by a connected edge of the node in the attack relationship graph and a transition weight of the connected edge, to obtain a first value; and calculate the compromise value of the node by using the hyperlinked inclusion theme search algorithm HITS based on a random walk factor, the first value and a personalized value.

[0118] Optionally, the determination module 203 is further configured to perform weighted summation processing on a compromise value of a target node pointed to by a connected edge of the pointed-to node and a transition weight of the connected edge of the node, to obtain a second value; and calculate the importance value of the node by using the hyperlinked inclusion theme search algorithm HITS based on a random walk factor, the second value and a personalized value.

[0119] Optionally, the security log data comprises asset data of the assets and security events generated by the assets, and the asset data comprises an IP address.

[0120] On this basis, the construction module 202 is specifically configured to configure a destination IP address in the asset data of the assets involved in a security event meeting a set condition as a specified IP address; and construct the attack relationship graph according to the modified asset data and the security events generated by the assets.

[0121] Optionally, based on any of the above embodiments, the asset identification apparatus provided in this embodiment further comprises:

[0122] The weight determination module (not shown in the figure) is configured to calculate the transition weight of the edge of each node according to the following method: based on a precision of a security event occurring when the node points to a destination node, which is calculated according to prior statistics; determine a difference value between a set value and the precision of each security event respectively; calculate a product value between the difference values; and determine a difference value between the set value and the product value as the transition weight of the edge of the node.

[0123] By setting up any of the above-mentioned asset identification devices, assets posing security threats can be automatically identified based on the loss value, without requiring excessive involvement of security operation and maintenance personnel, which greatly reduces the workload of security operation and maintenance personnel.

[0124] Based on the same inventive concept, the embodiment of the present application provides an electronic device, such as Figure 3 As shown, the electronic device includes a processor 301 and a machine-readable storage medium 303. The machine-readable storage medium 303 stores a computer program executable by the processor 301. The computer program prompts the processor 301 to execute the asset identification method provided in any embodiment of the present application. Furthermore, the electronic device includes a communication interface 304 and a communication bus 302. The processor 301, the communication interface 304, and the machine-readable storage medium 303 communicate with each other via the communication bus 302.

[0125] The communication bus mentioned in the electronic device mentioned above may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0126] The communication interface is used for communication between the above electronic device and other devices.

[0127] The memory may include random access memory (RAM), DDR SRAM (Double Data Rate Synchronous Dynamic Random Access Memory), or non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory may be at least one storage device located remotely from the processor.

[0128] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0129] In addition, an embodiment of the present application provides a machine-readable storage medium, which stores a computer program. When called and executed by a processor, the computer program prompts the processor to execute the asset identification method provided by the embodiment of the present application.

[0130] As for the electronic device and machine-readable storage medium embodiments, since the method contents involved are basically similar to the aforementioned method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0131] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0132] The implementation process of the functions and effects of each unit / module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0133] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely schematic, wherein the units / modules described as separate components may or may not be physically separated, and the components displayed as units / modules may or may not be physical units / modules, that is, they may be located in one place, or they may be distributed over multiple network units / modules. Some or all of the units / modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0134] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. An asset identification method, characterized in that: include: Obtain security log data for assets; Using the security log data, construct an attack relationship graph between assets, the attack relationship graph including nodes for representing assets and edges for representing security events initiated by the assets, each edge having a transfer weight; Determine the loss value of each node according to the attack relationship graph; Identify assets that pose security threats based on the loss value of each node; Determining the loss value of each node specifically includes: For each node, calculate the node's loss value based on the importance value of the destination node pointed to by the edge connected to the node and the transfer weight of the edge connected to the node; The importance of the node pointed to is calculated as follows: Performing weighted summation processing on the target node pointed to by the edge connected to the pointed node and the transfer weight of the edge connected to the node to obtain a second value; Based on the random walk factor, the second value and the personalized value, the importance value of the node is calculated using the hyperlink inclusion topic search algorithm HITS.

2. The method according to claim 1, characterized in that According to the attack relationship graph, the loss value of each node is determined, including: Performing weighted sum processing on the importance value of the node pointed to by the edge connected to the node in the attack relationship graph and the transfer weight of the connected edge to obtain a first value; Based on the random walk factor, the first value and the personalized value, the hyperlink inclusion topic search algorithm HITS is used to calculate the loss value of the node.

3. The method according to claim 1, characterized in that The security log data includes asset data of the asset and security events generated by the asset, and the asset data includes IP addresses; Using the security log data, an attack relationship graph between assets is constructed, including: An attack relationship graph is constructed using the asset data of each asset and the security events generated by the asset, where the nodes of the attack relationship graph are the IP addresses of the assets.

4. The method according to claim 3, characterized in that Using the asset data of each asset and the security events generated by the asset, an attack relationship graph is constructed. The nodes of the attack relationship graph are the IP addresses of the assets, including: Configure the destination IP address in the asset data of the assets involved in the security incident that meets the set conditions to a specified IP address; The attack relationship graph is constructed based on the modified asset data and the security events generated by the assets.

5. The method according to claim 3, characterized in that The transfer weight of each node's edge is calculated as follows: The precision rate of security events occurring at the node pointing to the destination node, calculated based on prior statistics; Determine the difference between the set value and the precision rate of each security event respectively; Calculate the product value between each difference; The difference between the set value and the product value is determined as the transfer weight of the edge of the node.

6. An asset identification device, characterized in that: include: The acquisition module is used to obtain the security log data of the asset; A construction module is used to construct an attack relationship graph between assets using the security log data, wherein the attack relationship graph includes nodes for representing assets and edges for representing security events initiated by assets, and each edge has a transfer weight; A determination module, configured to determine a loss value of each node according to the attack relationship graph; Identification module, used to identify assets that pose security threats based on the loss value of each node; Determining the loss value of each node specifically includes: For each node, calculate the node's loss value based on the importance value of the destination node pointed to by the edge connected to the node and the transfer weight of the edge connected to the node; The determining module is further configured to calculate the importance value of the pointed node according to the following method: Performing weighted summation processing on the target node pointed to by the edge connected to the pointed node and the transfer weight of the edge connected to the node to obtain a second value; Based on the random walk factor, the second value and the personalized value, the importance value of the node is calculated using the hyperlink inclusion topic search algorithm HITS.

7. The device according to claim 6, characterized in that The determination module is specifically used to perform weighted summation processing on the importance value of the node pointed to by the edge connected to the node in the attack relationship graph and the transfer weight of the connected edge to obtain a first numerical value; based on the random walk factor, the first numerical value and the personalized value, the hyperlink inclusion topic search algorithm HITS is used to calculate the loss value of the node.

8. The device according to claim 6, characterized in that The security log data includes asset data of the asset and security events generated by the asset, and the asset data includes an IP address; The construction module is specifically used to construct an attack relationship graph using the asset data of each asset and the security events generated by the asset, where the nodes of the attack relationship graph are the IP addresses of the assets.

9. The device according to claim 8, characterized in that The construction module is specifically used to configure the destination IP address in the asset data of the assets involved in the security events that meet the set conditions to a specified IP address; and construct the attack relationship graph based on the modified asset data and the security events generated by the assets.

10. The device according to claim 8, characterized in that Also includes: A weight determination module is configured to calculate the transfer weight of the edge of each node according to the following method: based on the precision rate of security events occurring at the node pointing to the destination node obtained by prior statistical calculation; and determining the difference between the set value and the precision rate of each security event; Calculate the product value between each difference value; and determine the difference between the set value and the product value as the transfer weight of the edge of the node.

Images