Monitoring method, device, electronic device and storage medium

Abstract

The present invention provides a monitoring method, device, electronic device and storage medium. The monitoring method comprises: obtaining attack events monitored by an intrusion monitoring system; and determining target attack events in the attack events based on CDN feature values ​​of the attack events. The present invention further monitors the attack events monitored by the intrusion monitoring system, that is, determines whether the attack events are target attack events that can be alarmed based on the CDN feature values ​​of the attack events, thereby effectively reducing the probability of false alarms of IPS.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a monitoring method, device, electronic equipment and storage medium. Background Art

[0002] The Intrusion Prevention System (IPS) can deeply sense and detect the data traffic flowing through, discard malicious messages to block attacks, and limit the flow of abused messages to protect network bandwidth resources.

[0003] However, in the existing IPS intrusion prevention monitoring system, the average monthly log volume is as high as 300,000, and the probability of false alarms is high. Summary of the invention

[0004] The present invention provides a monitoring method, device, electronic equipment and storage medium, which are used to solve the defect of high false alarm probability of IPS intrusion defense monitoring system in the prior art, and reduce the false alarm probability of IPS intrusion defense monitoring system.

[0005] In a first aspect, the present invention provides a monitoring method, comprising:

[0006] Obtain attack events monitored by the intrusion monitoring system;

[0007] Based on the CDN feature value of the attack event, a target attack event among the attack events is determined.

[0008] Optionally, according to a monitoring method provided by the present invention, the CDN characteristic value includes any one or any combination of the following:

[0009] The time characteristic Time of the attack event;

[0010] The severity level of the attack;

[0011] The label Protocol information of the attack time;

[0012] CVE / BID information indicating whether the attack event includes CVE / BID;

[0013] The historical attack frequency Att_count of the attack source IP of the attack event;

[0014] Action information of the attack event;

[0015] The third-party interface IP reputation information Asn_rank of the attack event;

[0016] The IP country of the attack source address of the attack event;

[0017] A tag used to indicate whether the attack event includes an attack group or a security event tag;

[0018] The threat type of the attack event is Judgements;

[0019] Severity_IP of the attack source IP tracing severity level of the attack event;

[0020] Malicious information used to indicate whether the attack source IP of the attack event is a malicious IP;

[0021] Used to indicate whether the attack target IP of IPS can retrieve virus information of the host virus;

[0022] NTA_d information used to indicate whether the target IP of IPS initiates DDOS attack;

[0023] NTA_s information used to indicate whether the IPS victim attack source IP initiated a DDOS attack.

[0024] Optionally, according to a monitoring method provided by the present invention, the determining a target attack event in the attack event based on the CDN feature value of the attack event includes:

[0025] Determining a CDN characteristic value of the attack event;

[0026] The CDN feature value of the attack event is input into the CDN monitoring model to obtain whether the attack event is a target attack event.

[0027] Optionally, according to a monitoring method provided by the present invention, the step of inputting the CDN feature value of the attack event into a CDN monitoring model to obtain whether the attack event is a target attack event includes:

[0028] Inputting the CDN feature value of the attack event into the target CDN monitoring model to calculate and obtain the score value of the attack event;

[0029] Based on the score value of the attack event, it is determined whether the attack event is a target attack event.

[0030] Optionally, according to a monitoring method provided by the present invention, the method further comprises:

[0031] Based on the labeled first attack event sample and the CDN feature value of the attack event sample, training and obtaining the CDN monitoring model;

[0032] A target CDN monitoring model is determined based on the labeled second attack event sample and an estimated value of the second attack event sample determined based on the CDN monitoring model.

[0033] Optionally, according to a monitoring method provided by the present invention, determining a target CDN monitoring model based on the second attack event sample with a label and an estimated value of the second attack event sample determined based on the CDN monitoring model includes:

[0034] During each adjustment process of the target CDN monitoring model, the labeled second attack event sample and the estimated value of the second attack event sample determined based on the CDN monitoring model are input into a cross entropy loss function to determine a cross entropy;

[0035] Based on the cross entropy, adjusting the feature value weight and adjustment value of the CDN monitoring model;

[0036] After at least one adjustment process of the target CDN monitoring model is completed, the target CDN monitoring model is determined based on the feature value weight and the adjustment value determined in the last adjustment process of the target CDN monitoring model.

[0037] Optionally, according to a monitoring method provided by the present invention, the intrusion monitoring system includes at least one of the following:

[0038] IPS monitoring system;

[0039] DDOS monitoring system;

[0040] Anti-virus system.

[0041] In a second aspect, the present invention further provides a monitoring device, comprising:

[0042] An acquisition module, used to acquire at least one attack event monitored by an intrusion monitoring system;

[0043] The determination module is used to determine a target attack event in the attack event based on the CDN feature value of the attack event.

[0044] In a third aspect, the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the monitoring methods described above are implemented.

[0045] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the monitoring methods described above.

[0046] The monitoring method, device, electronic device and storage medium provided by the present invention further monitor the attack events obtained by the intrusion monitoring system, that is, determine whether the attack event is a target attack event that can be alarmed based on the CDN feature value of the attack event, thereby effectively reducing the probability of IPS false alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 It is a flow chart of the monitoring method provided in the embodiment of the present application;

[0049] Figure 2 is a schematic diagram of a monitoring platform provided in an embodiment of the present application;

[0050] Figure 3 It is a schematic diagram of a sigmoid function image provided by the present invention;

[0051] Figure 4 It is a schematic diagram of the structure of the monitoring device provided by the present invention;

[0052] Figure 5 An example physical structure diagram of an electronic device is provided. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] Combine the following Figure 1-Figure 4 The monitoring method, device, electronic device and storage medium of the present invention are described.

[0055] Figure 1 is a flow chart of the monitoring method provided in the embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0056] Step 100, obtaining attack events monitored by an intrusion monitoring system;

[0057] Step 110: determining a target attack event among the attack events based on the CDN feature value of the attack event.

[0058] With the improvement of mobile network quality and the vigorous development of wired broadband services, network bandwidth resources are becoming more and more abundant, the network resources for users to use the Internet are becoming more complete, and users' dependence on Internet services is gradually increasing. Operators are under tremendous pressure in network operation. How to better improve the user experience of accessing Internet resources and save the cost of network construction to the maximum extent has become the primary issue for major operators and Internet companies.

[0059] Optionally, in order to provide users with a better Internet access experience, the Content Delivery Network (CDN) system is a distributed network built on the bearer network, which can effectively improve the user content access experience, balance the use of bearer network resources, and ensure the development of self-operated business.

[0060] Optionally, on this basis, an anti-virus system, an IPS intrusion prevention monitoring system and a network terminal device (NTA) system can be deployed to monitor security events of the CDN system.

[0061] Optionally, the IPS intrusion prevention monitoring system can deeply sense and detect the data traffic flowing through, discard malicious messages to block attacks, and limit the flow of abused messages to protect network bandwidth resources. For IPS deployed on the data forwarding path, each message flowing through can be deeply detected (protocol analysis and tracking, feature matching, traffic statistics analysis, event correlation analysis, etc.) according to the pre-set security policy. If a network attack hidden in it is found, defensive measures can be taken immediately according to the threat level of the attack. These measures include (according to the processing intensity) alerting the management center, discarding the message, disconnecting the application session, and disconnecting the Transmission Control Protocol (TCP) connection.

[0062] As hacker attack methods continue to evolve, new virus samples are growing exponentially, and traditional antivirus engines are already struggling to cope. The antivirus component of the virtualized system effectively detects and kills malicious programs in files, memory, and processes on the host by installing a host security agent software on the host machine. Administrators can use the control center to perform unified virus detection and killing management on the host, formulate scheduled detection and killing tasks, and use active protection engines and file monitoring modules to ensure virtualized network security.

[0063] For example, based on all the traffic of the six cores of the metropolitan area network, it can be sent to the NTA device of the anti-distributed denial of service (DDOS) system through sampling, with a sampling ratio of 1000:1 and the network monitoring function netflow protocol. The NTA device has built-in templates containing DDOS attack feature libraries and threshold templates. Once the traffic model transmitted through netflow triggers the built-in conditions, an alarm will be generated. At present, the built-in alarm templates on NTA can detect common attacks such as TCP Flood attacks launched against the TCP / IP protocol, UDP Flood attacks of traffic type DoS attacks, Internet Control Message Protocol (ICMP) Flood, Network Time Protocol (NTP) reflection, DNS Query Flood, DNS reflection, Simple Service Discovery Protocol (SSDP), etc., and it also has a certain recognition ability for DDOS attacks at the application layer such as HTTP CC (Challenge Collapsar).

[0064] However, the existing technology cannot combine the CDN business system to analyze the threat level of the network security threat log, which makes it impossible to directly deal with the security monitoring results of the content network system. In addition, the daily storage capacity of the IPS system log in the existing technology is up to 10,000, while the daily average log generation volume far exceeds 10,000. The defects of the IPS system itself lead to log loss. Moreover, it is impossible to directly locate the victim assets, and the operation and maintenance personnel need to manually associate the CDN assets.

[0065] Optionally, the present invention can further monitor the attack events monitored by the intrusion monitoring system, that is, determine whether the attack event is a target attack event that can be alarmed based on the CDN feature value of the attack event, thereby reducing the probability of IPS false alarms.

[0066] Optionally, the intrusion monitoring system includes at least one of the following:

[0067] IPS monitoring system;

[0068] DDOS monitoring system;

[0069] Anti-virus system.

[0070] Alternatively, existing network and host security monitoring systems have single-view limitations and high false alarm rates.

[0071] Figure 2is a schematic diagram of a monitoring platform provided in an embodiment of the present application, such as Figure 2 As shown, optionally, compared with the traditional security defense idea, the present invention can combine the IPS intrusion detection system and anti-DDOS system at the network level with the anti-virus system at the host level, perform correlation analysis on the threat logs of the three systems and the CDN business data, and introduce the data of the third-party security intelligence library. Compared with the traditional security monitoring system, the present invention can reduce the limitation of a single perspective and achieve the effect of reducing the false alarm rate.

[0072] Optionally, the attack events monitored by the intrusion monitoring system may be first acquired; and then based on the CDN feature values ​​of the attack events, the target attack events among the attack events may be determined.

[0073] Optionally, you can use Python crawlers and syslog technology to obtain the full security threat logs of the IPS system, host antivirus system, and DDOS system, and write Python rules to complete the automatic parsing of the syslog logs of the three security systems. Configure scheduled tasks to automatically update the Mysql database table.

[0074] Optionally, the present invention introduces a CDN network asset centralized management function, and dynamically manages CDN network assets by building a Mysql database window.

[0075] Optionally, the present invention obtains threat logs regularly through a python crawler, thereby solving the functional defect that the maximum daily storage capacity of IPS system logs is 10,000.

[0076] Optionally, you can sort out all CDN assets, including physical information such as host room racks, business attributes, open ports and other detailed information, and use the MySQL database window to achieve dynamic management of CDN assets.

[0077] Optionally, you can work with a third-party security threat intelligence library and use Python programs to call API interfaces to automatically complete the reputation analysis of the attack source address. For the attack source address, it can provide the IP's geographic location and Aviation Safety Network (ASN) information, and accurately determine whether the IP is malicious, the risk severity level, and the credibility level through judgment rules; identify threat types, such as: vulnerability exploits, zombies, proxies, suspicious, and other related security events or gang labels.

[0078] Optionally, a whitelist function for attack source addresses can be added to automatically shield security threat logs whose source addresses are local and scanned addresses.

[0079] Optionally, a security evaluation system can be defined to redefine the threat level of some fields of the IPS threat log, screen out CDN feature values ​​that are unique to CDN services, and use a large number of data samples through CDN feature values ​​to complete machine learning predictions. This can realize event linkage between different security monitoring systems in the CDN business, predict the severity level of future security threat events, prevent the limitations of a single perspective, and reduce the false alarm rate of security threats.

[0080] Alternatively, you can use the logistic regression (LR) model in machine learning for model training, input the data into the LR model built by tensorflow, and train it in batches for multiple rounds. After training, perform model prediction and output the threat assessment score for each security threat log; TensorFlow is a symbolic mathematical system based on dataflow programming.

[0081] Optionally, the predicted security threat logs can be matched with the database asset information to achieve accurate positioning of threat assets.

[0082] Optionally, the present invention can be combined with the CDN business system to personalize the threat level of the IPS security threat log, so that the security monitoring results of the CDN system can be directly processed;

[0083] Optionally, compared with the traditional security defense idea, the present invention combines the IPS intrusion detection system and anti-DDOS system at the network level with the anti-virus system at the host level, performs correlation analysis on the threat logs of the three systems and the CDN business data, and introduces the security intelligence library data of the third-party Internet. Compared with the traditional security monitoring system, the present invention can reduce the limitation of a single perspective and achieve the effect of reducing the false alarm rate.

[0084] Optionally, the present invention also provides a portal interface that can intuitively present the affected assets, without the need for operation and maintenance personnel to manually associate CDN assets.

[0085] Optionally, the present invention can reduce the average monthly log volume of the IPS intrusion defense monitoring system from 300,000 to about 80,000, significantly reducing invalid alarms and lowering the false alarm rate.

[0086] Optionally, if the victim asset has a host virus or is threatened by a DDOS attack, the present invention can display it synchronously, reducing the time cost of operation and maintenance personnel logging into different security systems multiple times to view alarms.

[0087] The monitoring method provided by the present invention further monitors the attack events obtained by the intrusion monitoring system, that is, determines whether the attack event is a target attack event that can be alarmed based on the CDN feature value of the attack event, thereby effectively reducing the probability of IPS false alarms.

[0088] Optionally, according to a monitoring method provided by the present invention, the CDN characteristic value includes any one or any combination of the following:

[0089] The time characteristic Time of the attack event;

[0090] The severity level of the attack;

[0091] The label Protocol information of the attack time;

[0092] CVE / BID information indicating whether the attack event includes CVE / BID;

[0093] The historical attack frequency Att_count of the attack source IP of the attack event;

[0094] Action information of the attack event;

[0095] The third-party interface IP reputation information Asn_rank of the attack event;

[0096] The IP country of the attack source address of the attack event;

[0097] A tag used to indicate whether the attack event includes an attack group or a security event tag;

[0098] The threat type of the attack event is Judgements;

[0099] Severity_IP of the attack source IP tracing severity level of the attack event;

[0100] Malicious information used to indicate whether the attack source IP of the attack event is a malicious IP;

[0101] Used to indicate whether the attack target IP of IPS can retrieve virus information of the host virus;

[0102] NTA_d information used to indicate whether the target IP of IPS initiates DDOS attack;

[0103] NTA_s information used to indicate whether the IPS victim attack source IP initiated a DDOS attack.

[0104] Optionally, a security evaluation system can be defined to redefine the threat level of some fields of the IPS threat log, and 16 CDN feature values ​​can be screened out, including: Time, Severity, Protocol, CVE, BID, Att_count, Action, Asn_rank, Country, Tags, Judgements, Severity_IP, Malicious, Virus, NTA_d, and NTA_s.

[0105] Optionally, in this feature set, Severity represents the severity level corresponding to different threat features when the IPS system covers CDN services, Severity_IP represents the CDN attack source IP reputation analysis value provided by the third-party threat intelligence library, Virus represents whether the attacked CDN host in the IPS is also implanted with virus trojans, and NTA_D and NTA_S represent whether the attack source IP and destination IP in the CDN service in the IPS initiate DDOS attack traffic. The above features are unique to CDN services. Through these features, using a large number of data samples to complete machine learning predictions, it is possible to realize the event linkage of different security monitoring systems in CDN services, predict the severity level scores of future security threat events, prevent the limitations of a single perspective, and reduce the false alarm rate of security threats.

[0106] Optionally, the time feature Time of the attack event may represent the time of the attack event. For example, the attack event span may be divided into 24 values ​​[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23] at an hourly granularity. The time of the attack event may be assigned a corresponding value to Time in which time period the attack event falls. The value of the feature value is only an example, and the present invention does not limit this.

[0107] Optionally, the severity level Severity of the attack event can represent the internal feature Severity of the IPS system as the threat score of each IPS threat feature (a total of nearly 8000). The characteristic value of Severity can be [0, 30, 60, 90], where 0 corresponds to no risk, 30 corresponds to low risk, 60 corresponds to medium risk, and 90 corresponds to high risk. The value of this characteristic value is only an example and the present invention does not limit this.

[0108] Optionally, the judgment basis can be the CDN current network service risk. Each threat name is classified and the alarm frequency from a preset start time to the present is counted, and the time when the alarm occurs and the attack source / destination address involved are traced back from the database to judge the threat level of each threat.

[0109] Optionally, the scanning behavior of the scanner can be distinguished. When all the alarms with the threat name are scanner behaviors, the behavior poses no threat to the actual business and is a low risk, corresponding to 30 points.

[0110] Optionally, it can be determined based on the object of the threat name. If there is no such threatened application in the CDN system, the threat is a false positive, not a real attack, and has no zero risk, corresponding to a score of 0.

[0111] Optionally, you can judge based on the attack source / destination address. If the attack source address is an internal address of the CDN, and through historical data backtracking, the backtracking result is the company's own business, which is risk-free and corresponds to 0 points.

[0112] Optionally, in addition to the above special threat items, other threats can be assigned values ​​according to severity levels based on the frequency of alarms and alarm tracebacks.

[0113] For example, the following Table 2 shows an example of assigning values ​​to severity feature values ​​according to severity levels.

[0114] Table 2 Examples of severity characteristic values

[0115]

[0116]

[0117] Optionally, the label Protocol information of the attack time can use the original label of IPS, for example, the original value can include but is not limited to ['image browsing', 'snmp', 'http', 'APP1', 'APP2', 'rtsp', 'APP3', 'APP4', 'APP5', 'APP6', 'APP7', 'APP8', 'APP9', 'APP10', 'APP11', 'APP12', 'APP13', 'APP14', 'file download', 'APP15', 'APP16', 'general_udp', 'https', 'General HTTP Download', 'HTTP Proxy', 'APP17', 'APP18', 'ICMP', 'APP19', 'rdp', 'APP20'] and the like.

[0118] Optionally, the CDN feature value may include CVE / BID, which is used to indicate whether the attack event includes CVE / BID information of CVE / BID, that is, whether the threat vulnerability itself has CVE / BID information, which is divided into two features: yes or no.

[0119] Optionally, the CDN feature value may include a historical attack frequency Att_count of an attack source IP of an attack event, that is, a historical attack frequency of the same attack source IP.

[0120] Optionally, the Att_count feature value may include [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, other]. The value of the feature value is only an example and the present invention is not limited to this.

[0121] Optionally, the Action information of the attack event may be an internal field of the IPS, and the characteristic value of the Action information involved in the CDN service may include [2, 145, 146, 148, 152]. The value of the characteristic value is only an example, and the present invention does not limit this.

[0122] Optionally, the third-party interface IP reputation information Asn_rank of the attack event may include characteristics of third-party interface IP reputation tracing, and the Asn_rank feature value may include [0, 1, 2, 3, 4], where a larger Asn_rank feature value represents a higher risk. The value of the feature value is only an example and the present invention is not limited to this.

[0123] Optionally, the IP attribution characteristic value of the attack source address of the attack event may include: [country A, country B, other countries].

[0124] Optionally, the CDN feature value may include a Tag for indicating whether the attack event includes an attack group or a security event tag: an attack group or a security event tag, and the feature values ​​are yes or no.

[0125] Optionally, the CDN feature value may include the threat type of the attack event. Judgements: the threat type judged by a third party. The feature value may include [0, 'Gateway', '', 'HTTP Proxy In', 'DNS', 'CDN', 'Spam', 'Exploit', 'Proxy', 'Mobile', 'Zombie', 'Brute Force', 'VPN In', 'Whitelist', 'FullBogon', 'Bogon', 'Malware', 'Scanner', 'Web Login Brute Force', 'Edu', 'DynamicIP', 'IDC', 'Suspicious'];

[0126] Optionally, the CDN feature value may include the attack source IP tracing severity level Severity_IP of the attack event, and the Severity_IP feature value may include [0, high, medium, low, info];

[0127] Optionally, the CDN feature value may include Malicious information for indicating whether the attack source IP of the attack event is a malicious IP. The Malicious information feature value may include [0, true, false];

[0128] Optionally, the CDN feature value may include Virus information indicating whether the attack target IP of the IPS can retrieve the host virus. The feature value of the Virus information may include [0, 1];

[0129] Optionally, the CDN feature value may include NTA_d information for indicating whether the attack target IP of the IPS initiates a DDOS attack, and the feature value of the NTA_d information may include [0, 1];

[0130] Optionally, the CDN feature value may be used to indicate NTA_s information of whether the IPS victim attack source IP initiates a DDOS attack, and the NTA_s information feature value may include [0, 1].

[0131] Optionally, you can read data from each table from the database, take ips_log_ips_log as the main table, and perform LEFT JOIN with other secondary tables. Among them, ips_log_ips_log and the asset whitelist Own_scanner table are INNER JOIN, the purpose is to filter out the threat event records generated by the own scanning detection. This step can generate a security event association list with ips threat records as the main one.

[0132] Fields can include: ID, Time, ThreatType, ThreatName, Protocol, SrcIPAddr, SrcPort, DestIPAddr, DestPort, Policy, ThreatID, Severity, UserID, Application, DestZoneName, CVE, BID, MSB, User, AttackCount, SrcZoneName, Action, ContextName, SrcVrfIndex, lab, label, business attributes, server name, IP address, project affiliation, device attributes, hardware manufacturer, software manufacturer, software function, software version, operating system, CPU, memory, system disk, data disk, network card, rack location, port, service, type, asn_rank, country, province, city, judgments, severity, tags_classconfidence_level, is_malicious, update_time, resource.

[0133] Optionally, the present invention provides a set of predefined feature combinations, and the fields may include: Time, Severity, Protocol, CVE, BID, Att_count, Action, Asn_rank, Country, Tags, Judgements, Severity_IP, Malicious, Virus, NTA_d, NTA_s. In this feature set, Severity represents the severity level corresponding to different threat features when the IPS system covers the CDN service, Severity_IP represents the CDN attack source IP reputation analysis value provided by a third-party threat intelligence library, Virus represents whether the attacked CDN host in the IPS is also implanted with viruses and Trojans, and NTA_D and NTA_S represent whether the attack source IP and destination IP in the CDN service in the IPS initiate DDOS attack traffic externally.

[0134] Optionally, the determining a target attack event in the attack event based on the CDN feature value of the attack event includes:

[0135] Determining a CDN characteristic value of the attack event;

[0136] The CDN feature value of the attack event is input into the CDN monitoring model to obtain whether the attack event is a target attack event.

[0137] Optionally, the CDN feature value of the attack event may be determined first, and then the CDN feature value of the attack event may be input into a CDN monitoring model to determine whether the attack event is a target attack event.

[0138] Optionally, the result of whether the attack event is a target attack event can be obtained through a CDN monitoring model that uses the CDN characteristic value as a feature. This can realize event linkage of different security monitoring systems in the CDN business and predict future security threat events. For example, it can directly determine whether the attack event is a target attack event, or determine the severity level score of future security threat events, thereby preventing the limitations of a single perspective and reducing the false alarm rate of security threats.

[0139] Optionally, according to a monitoring method provided by the present invention, the step of inputting the CDN feature value of the attack event into a CDN monitoring model to obtain whether the attack event is a target attack event includes:

[0140] Inputting the CDN feature value of the attack event into the target CDN monitoring model to calculate and obtain the score value of the attack event;

[0141] Based on the score value of the attack event, it is determined whether the attack event is a target attack event.

[0142] Optionally, when determining the severity level score of future security threat events, the CDN feature value of the attack event can first be input into the target CDN monitoring model to calculate the score value of the attack event; based on the score value of the attack event, determine whether the attack event is a target attack event.

[0143] Optionally, according to a monitoring method provided by the present invention, the method further comprises:

[0144] Based on the labeled first attack event sample and the CDN feature value of the attack event sample, training and obtaining the CDN monitoring model;

[0145] A target CDN monitoring model is determined based on the labeled second attack event sample and an estimated value of the second attack event sample determined based on the CDN monitoring model.

[0146] Optionally, data from various sources can be collected into the database and updated regularly, including IPS, DDOS, host anti-virus products, IPR, asset lists, sensitive ports and other data.

[0147] Optionally, the ips threat records in the feature table may be labeled, and scores of 0 and 1 may be used to identify invalid risks that do not require processing and high-risk risks that require processing.

[0148] Optionally, you can crawl the IPS intrusion defense monitoring system log using a python crawler, and set a scheduled task on the Linux server to crawl and store it in the database ips_log_ips_log table at a scheduled time.

[0149] Optionally, the threat logs of the host anti-virus system and anti-DDOS system can be sent to the Linux server in the form of syslog, and scheduled tasks can be set to be stored in the virus_threat and nta_nta_alarm tables of the database respectively.

[0150] Optionally, you can enter a complete list of CDN assets, including host names, IP addresses, and computer room racks.

[0151] Optionally, you can enter business open ports and commonly used sensitive ports. Business open ports may include manufacturers, business categories (such as CACHE, CDN), detailed business categories (HCS, TIS, Report, BMS, DigitalView, etc.), open ports, protocol types (such as TCP, HTTP, HTTPS, etc.), and open services (such as: providing HTTPS cache services, ISA open ports, ports for HTTPS access to BMS servers, ports for user access to Portal, DV web interface ports, or DV advanced web interface ports, etc.);

[0152] Commonly used sensitive ports can be shown in Table 1 below:

[0153] Table 1 Commonly used sensitive ports

[0154] Index port Serve type 1 21 FTP FTP 2 22 SSH SSH 3 23 TELNET TELNET 4 80 (NULL) Business Port 5 89 (NULL) Business Port 6 443 https Web browsing 7 445 (NULL) shared 8 1433 SQL Server database 9 1521 Oracle database 10 3306 Mysql database 11 3389 RDP remote desktop 12 5000 DB2 database 13 6379 Redis database

[0155] Optionally, the threat records in the merged table may be labeled, and scores of 0 and 1 may be used to identify invalid risks that do not require processing and high-risk risks that require processing.

[0156] For example, the scanning behavior of a target scanner and other scanners is judged as 0 points. Judgment rules: The attack source address is an address in the whitelist; the threat title contains the words "target scanner" or "scanner".

[0157] For example, a real attack on the live network is judged as 1 point. Judgment rule: Confirmed live network attack events.

[0158] Optionally, you can perform effective feature extraction on the merged table. Feature field values ​​include: Time, Severity, Protocol, CVE, BID, Att_count, Action, Asn_rank, Country, Tags, Judgements, Severity_IP, Malicious, Virus, NTA_d, NTA_s

[0159] Optionally, the extracted features can also be processed:

[0160] First, we can first determine whether the feature is continuous or discrete and determine all possible values ​​of the feature.

[0161] Second, for discrete features, the features can be converted into one-hot vectors.

[0162] Third, different models can be used to handle continuous features in different ways.

[0163] Optionally, the present invention can convert continuous features into discrete features after standardization and then into one-hot vectors.

[0164] Fourth, the vectors of all features can be connected together to form a multi-dimensional vector table.

[0165] Optionally, the feature multidimensional vector table and label data may be stored together in a csv file and used as a training set and a prediction set, that is, the first attack event sample.

[0166] Optionally, the LR model is a logistic regression model, which is the most commonly used and effective classification model and is suitable for scenarios with more discrete features. The LR model is widely used in the industry because of its simplicity, easy parallelization, and strong interpretability.

[0167] For a binary classification problem, the ordinary linear regression model can be expressed as:

[0168] y=wx+b Formula (1)

[0169] Among them, y is the label (training) or scoring (prediction) variable, x is the feature data, and w and b are the coefficients we need to obtain during training. When the parameters w and b are trained to the optimal value, for a new security threat log, each feature can be substituted into the above formula to calculate the y result, and the category can be determined based on a certain threshold. However, the ordinary linear regression model can only fit the linear relationship between features and labels, and this relationship almost does not exist in common scenarios.

[0170] Optionally, logistic regression can be based on a linear regression model and introduce nonlinear factors through a sigmoid function, so as to more accurately fit the relationship between security threat characteristics and security threat judgments in real scenarios.

[0171] Optionally, the sigmoid function can be:

[0172]

[0173] Figure 3 is a schematic diagram of a sigmoid function image provided by the present invention, such as Figure 3 As shown in the figure, the ordinate is g(z) and the abscissa is z. Here, the ordinate can represent the value of the sigmoid function, and z can represent the variable of the function, such as the label (training) or scoring (prediction) variable y; the value of the sigmoid function is between [0,1], and the overall curve is an S-shaped curve. At positions far away from 0 and 1, the function value will quickly approach 0 and 1. This feature is particularly important for classification tasks - the model pays more attention to the classification boundary, which can increase the robustness of the model.

[0174] Therefore, the formula for the logistic regression model is

[0175]

[0176] Optionally, according to a monitoring method provided by the present invention, determining a target CDN monitoring model based on the second attack event sample with a label and an estimated value of the second attack event sample determined based on the CDN monitoring model includes:

[0177] During each adjustment process of the target CDN monitoring model, the labeled second attack event sample and the estimated value of the second attack event sample determined based on the CDN monitoring model are input into a cross entropy loss function to determine a cross entropy;

[0178] Based on the cross entropy, adjusting the feature value weight and adjustment value of the CDN monitoring model;

[0179] After at least one adjustment process of the target CDN monitoring model is completed, the target CDN monitoring model is determined based on the feature value weight and the adjustment value determined in the last adjustment process of the target CDN monitoring model.

[0180] Alternatively, if we let θ = [w, b], the formula for logistic regression can be written as:

[0181]

[0182] The optimization objective of the logistic regression model, i.e. the loss function, is cross entropy. For the security threat dataset D = {(x1, y1), (x2, y2), Λ, (x m ,y m )}, the cross entropy can be expressed as:

[0183]

[0184] During training, a large amount of data can be input into the logistic regression formula to calculate the estimated value of the security threat level, and then the estimated value and the true label y are input into the cross entropy loss function, and the parameters are adjusted in the direction of minimizing the loss function. Finally, when the loss function is reduced to a certain degree and stabilized, the training is considered complete and the optimal parameters w and b can be obtained.

[0185] When predicting, you can input the characteristic value x of the security feature data extracted from the solution: Time, Severity, Protocol, CVE, BID, Att_count, Action, Asn_rank, Country, Tags, Judgements, Severity_IP, Malicious, Virus, NTA_d, and NTA_s into the logistic regression formula, and use the trained optimal w and b to calculate the score. At this time, w represents the weight of the characteristic value of the solution, and b is the adjustment value. The score is used to determine whether the new security threat event deserves the attention of the operation and maintenance personnel.

[0186] Optionally, the characteristics of security threat data are relatively stable, the regularity is relatively obvious, and the correlation between the characteristics is low, which makes the logistic regression model more suitable for the current scenario.

[0187] Optionally, the factor decomposition machine FM introduces the cross terms between features into the regression formula to make the model more accurate in describing the law of security threats, but at the same time, too many cross terms will also cause some performance problems. Another example is a neural network or an integrated learning algorithm, which gives data to more basic classifiers to make decisions, so there will be more parameters and a higher degree of fit. All of the above are applicable to the present invention.

[0188] Optionally, in actual training and testing, Python 3.7 can be used as the main programming language, and TensorFlow can be used to build models and deploy them. The model runs regularly in the server and can process security threat data in a timely manner. The main parameters used are shown in Table 3 below:

[0189] Table 3 Training and testing parameters

[0190] Train_batch_size 128 Test_batch_size 128 Learning_rate 0.01 Max_epoch 5

[0191] Train_batch_size refers to the size of the input data batch during training, and Test_batch_size refers to the size of the input data batch during testing. Learning_rate is the learning rate during machine learning training, and Max_epoch is the maximum number of training rounds. Through reasonable parameter settings, we have obtained the most optimized training framework, and on this basis, we have continuously improved data quality and training capabilities to more effectively identify and prevent threats.

[0192] In actual business, a complete CDN network security threat analysis system can be formed. In the system, you can see basic statistical tables of threat data, alarm compression comparison charts, CDN security threat lists, results of scoring using machine learning LR models, CDN security threat details, whitelist address management and other modules. The modules are tightly coupled, and when used, not only can the source of the threat be quickly located, but also the basic information of the threat and its degree of harm can be fully understood.

[0193] The monitoring method provided by the present invention further monitors the attack events obtained by the intrusion monitoring system, that is, determines whether the attack event is a target attack event that can be alarmed based on the CDN feature value of the attack event, thereby effectively reducing the probability of IPS false alarms.

[0194] The monitoring device provided by the present invention is described below. The monitoring device described below and the monitoring method described above can be referenced to each other.

[0195] Figure 4 Schematic diagram of the structure of the monitoring device provided by the present invention, such as Figure 4 As shown, the monitoring device includes: an acquisition module 410 and a determination module 420, wherein:

[0196] The acquisition module 410 is used to acquire at least one attack event monitored by an intrusion monitoring system;

[0197] The determination module 420 is used to determine a target attack event among the attack events based on the CDN feature value of the attack event.

[0198] Optionally, the monitoring device may obtain at least one attack event monitored by the intrusion monitoring system through the acquisition module 410; and then determine a target attack event among the attack events through the determination module 420 based on the CDN feature value of the attack event.

[0199] The monitoring device provided by the present invention further monitors the attack events obtained by the intrusion monitoring system, that is, determines whether the attack event is a target attack event that can be alarmed based on the CDN feature value of the attack event, thereby effectively reducing the probability of IPS false alarms.

[0200] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the monitoring method, which includes: obtaining the attack events monitored by the intrusion monitoring system;

[0201] Based on the CDN feature value of the attack event, a target attack event among the attack events is determined.

[0202] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0203] On the other hand, the present invention also provides a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, when the program instructions are executed by a computer, the computer can execute the monitoring method provided by the above methods, the method comprising: obtaining an attack event monitored by an intrusion monitoring system;

[0204] Based on the CDN feature value of the attack event, a target attack event among the attack events is determined.

[0205] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, the computer program being implemented when executed by a processor to perform the above-mentioned monitoring methods, the method comprising: obtaining an attack event monitored by an intrusion monitoring system;

[0206] Based on the CDN feature value of the attack event, a target attack event among the attack events is determined.

[0207] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0208] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0209] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A monitoring method, characterized in that: include: Obtain attack events monitored by the intrusion monitoring system; Determining a target attack event among the attack events based on a content delivery network CDN feature value of the attack event; The obtaining of attack events monitored by the intrusion monitoring system includes: Use Python crawlers and syslog technology to regularly obtain attack events obtained by the IPS monitoring system at the network level, the DDOS monitoring system, and the anti-virus system monitoring at the host level; The determining, based on the CDN feature value of the attack event, a target attack event in the attack event includes: Determine a CDN feature value of the attack event; the CDN feature value includes third-party interface IP reputation information Asn_rank of the attack event; Inputting the CDN feature value of the attack event into the CDN monitoring model to obtain whether the attack event is a target attack event; The step of inputting the CDN feature value of the attack event into the CDN monitoring model to obtain whether the attack event is a target attack event includes: Inputting the CDN feature value of the attack event into the target CDN monitoring model to calculate and obtain the score value of the attack event; Based on the score value of the attack event, it is determined whether the attack event is a target attack event.

2. The monitoring method according to claim 1, characterized in that: The CDN characteristic value includes any one or any combination of the following: The time characteristic Time of the attack event; The severity level of the attack; The label Protocol information of the attack event; CVE / BID information indicating whether the attack event includes a common vulnerability exposure CVE / BID; The historical attack frequency Att_count of the attack source IP of the attack event; Action information of the attack event; The IP country of the attack source address of the attack event; A tag used to indicate whether the attack event includes an attack group or a security event tag; The threat type of the attack event is Judgements; Severity_IP of the attack source IP tracing severity level of the attack event; Malicious information used to indicate whether the attack source IP of the attack event is a malicious IP; Used to indicate whether the attack target IP of the intrusion prevention system IPS can retrieve the virus information of the host virus; NTA_d information used to indicate whether the target IP of IPS initiates anti-distributed denial of service (DDOS) attack; NTA_s information used to indicate whether the IPS victim attack source IP initiated a DDOS attack.

3. The monitoring method according to claim 1, characterized in that: The method further comprises: Based on the labeled first attack event sample and the CDN feature value of the attack event sample, training and obtaining the CDN monitoring model; A target CDN monitoring model is determined based on the labeled second attack event sample and an estimated value of the second attack event sample determined based on the CDN monitoring model.

4. The monitoring method according to claim 3, characterized in that: The determining of the target CDN monitoring model based on the second attack event sample with the label and the estimated value of the second attack event sample determined based on the CDN monitoring model includes: During each adjustment process of the target CDN monitoring model, the labeled second attack event sample and the estimated value of the second attack event sample determined based on the CDN monitoring model are input into a cross entropy loss function to determine a cross entropy; Based on the cross entropy, adjusting the feature value weight and adjustment value of the CDN monitoring model; After at least one adjustment process of the target CDN monitoring model is completed, the target CDN monitoring model is determined based on the feature value weight and the adjustment value determined in the last adjustment process of the target CDN monitoring model.

5. A monitoring device, characterized in that: include: An acquisition module, used to acquire at least one attack event monitored by an intrusion monitoring system; A determination module, configured to determine a target attack event in the attack event based on a CDN feature value of the attack event; The obtaining of at least one attack event monitored by an intrusion monitoring system includes: Use Python crawlers and syslog technology to regularly obtain attack events obtained by the IPS monitoring system at the network level, the DDOS monitoring system, and the anti-virus system monitoring at the host level; The determining, based on the CDN feature value of the attack event, a target attack event in the attack event includes: Determine a CDN feature value of the attack event; the CDN feature value includes third-party interface IP reputation information Asn_rank of the attack event; Inputting the CDN feature value of the attack event into the CDN monitoring model to obtain whether the attack event is a target attack event; The step of inputting the CDN feature value of the attack event into the CDN monitoring model to obtain whether the attack event is a target attack event includes: Inputting the CDN feature value of the attack event into the target CDN monitoring model to calculate and obtain the score value of the attack event; Based on the score value of the attack event, it is determined whether the attack event is a target attack event.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the monitoring method according to any one of claims 1 to 4 are implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the monitoring method according to any one of claims 1 to 4 are implemented.

Images