A method and device for determining a compromised host and a computer device

Abstract

Embodiments of the present application provide a method and device for determining compromised hosts and a computer device. The method includes detecting malicious domain names based on initial security data of different types of to-be-detected hosts, screening suspected hosts from the to-be-detected hosts, and determining compromised hosts from the suspected hosts based on the initial security data of the suspected hosts. The method provided by the present application determines compromised hosts from suspected hosts based on the initial security data of the suspected hosts, which improves the problem of low accuracy of determining compromised hosts by only using the method of detecting malicious domain names.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus and computer equipment for determining a compromised host. Background Technology

[0002] A compromised host refers to a host that an attacker gains control of through some means. After gaining control, the attacker may use this host as a springboard to continue attacking other hosts on the enterprise's intranet, and may also actively communicate with IPs or domains specified by the attacker, transmitting security data stored on them. Furthermore, compromised hosts often exhibit irregularity and high stealth, making many intrusion actions difficult to identify or confirm the success of the attack. Therefore, it is necessary to perform compromise detection on all hosts and promptly remediate compromised hosts to ensure the security of the enterprise's network.

[0003] In related technologies, the method for determining a compromised host includes obtaining the domain name to be detected and determining whether the domain name to be detected is a malicious domain name. If the domain name to be detected is a malicious domain name, the host to be detected that stores the domain name to be detected is directly determined to be a compromised host.

[0004] However, the above methods for identifying compromised hosts have low accuracy. Summary of the Invention

[0005] This application provides a method, apparatus, and computer device for determining compromised hosts. It can identify suspected hosts from the hosts to be detected after performing malicious domain name detection on the hosts to be detected, and further determine whether the suspected hosts are compromised hosts by using the initial security data in the suspected hosts. This improves the problem of low accuracy caused by determining whether a host is compromised by only detecting malicious domain names.

[0006] The first aspect of this application provides a method for determining a compromised host, the method comprising:

[0007] Acquire the initial security data of each host to be tested, wherein the initial security data is the data generated by the host to be tested during operation;

[0008] The initial security data are fused using a heterogeneous data fusion method to obtain the target security data;

[0009] Each domain name to be detected in the target security data is input into the detection model for malicious domain name detection, and suspected hosts are selected from each host to be detected based on the detection results. Each domain name to be detected of the suspected host includes the malicious domain name. The detection model is trained by normal domain names and malicious domain names.

[0010] Based on the initial security data of the suspected hosts, the compromised hosts are identified from among the suspected hosts.

[0011] A second aspect of this application provides an apparatus for determining a compromised host computer, the apparatus comprising:

[0012] The acquisition module is used to acquire the initial security data of each host to be tested, which is the data generated by the host to be tested during operation;

[0013] The fusion module is used to fuse the initial security data based on the heterogeneous data fusion method to obtain the target security data;

[0014] The detection and filtering module is used to input each domain name to be detected in the target security data into the detection model for malicious domain name detection, and to filter out suspected hosts from each host to be detected based on the detection results. Each domain name to be detected of the suspected host includes the malicious domain name. The detection model is trained by normal domain names and malicious domain names.

[0015] The determination module is used to determine the compromised host from the suspected hosts based on the initial security data of the suspected hosts.

[0016] A third aspect of this application provides a computer device including a processor and a memory for storing processor-executable instructions. The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method for determining a compromised host provided in the first aspect of this application.

[0017] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for determining a compromised host provided in the first aspect of this application.

[0018] The fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the method for detecting a compromised host provided in the first aspect of this application.

[0019] The technical solution provided in this application can achieve at least the following beneficial effects:

[0020] The method for determining compromised hosts provided in this application involves performing malicious domain name detection on each host to be detected based on initial security data of different types of hosts, filtering out suspected hosts from the hosts to be detected, and further determining compromised hosts from among the suspected hosts based on the initial security data of the suspected hosts. This method, in addition to malicious domain name detection, further determines compromised hosts from among the suspected hosts based on the initial security data of the suspected hosts, thus improving the accuracy of determining compromised hosts that is often poor when relying solely on malicious domain name detection. Attached Figure Description

[0021] Figure 1 This is an application scenario diagram illustrating an exemplary embodiment of this application of a method for determining a compromised host;

[0022] Figure 2 This is a flowchart illustrating a method for determining a compromised host, as shown in an exemplary embodiment of this application.

[0023] Figure 3 This is a flowchart illustrating a method for determining a compromised host, as shown in an exemplary embodiment of this application.

[0024] Figure 4 This is a flowchart illustrating another method for determining a compromised host, as shown in an exemplary embodiment of this application.

[0025] Figure 5 This is a flowchart illustrating another method for determining a compromised host, as shown in an exemplary embodiment of this application.

[0026] Figure 6 This is a flowchart illustrating another method for determining a compromised host, as shown in an exemplary embodiment of this application.

[0027] Figure 7 This is a flowchart illustrating another method for determining a compromised host, as shown in an exemplary embodiment of this application.

[0028] Figure 8 This is a flowchart illustrating another method for determining a compromised host, as shown in an exemplary embodiment of this application.

[0029] Figure 9 This is a schematic diagram illustrating another process for determining a compromised host, as shown in an exemplary embodiment of this application.

[0030] Figure 10 This is a structural block diagram of a device for determining a compromised host, as illustrated in an exemplary embodiment of this application.

[0031] Figure 11 This is an exemplary embodiment of the present application illustrating the internal structure of a computer device. Detailed Implementation

[0032] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0033] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0034] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0035] The embodiments disclosed herein can be applied to electronic devices such as terminal devices, computer systems, and servers, and can operate together with a wide range of other general-purpose or special-purpose computing system environments or configurations. Examples of well-known terminal devices, computing systems, environments, and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, and servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems.

[0036] Electronic devices such as terminal devices, computer systems, and servers can be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. Typically, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in distributed cloud computing environments, where tasks are executed by remote processing devices linked through communication networks. In distributed cloud computing environments, program modules can reside on local or remote computing system storage media, including storage devices.

[0037] First, let me introduce the technical terms that appear in this application:

[0038] Host: refers to various devices used in computer networks or communication networks, including but not limited to computers, switches, routers, and security devices.

[0039] A compromised host is a host that an attacker gains control of through some means. After gaining control, the attacker may use the compromised host as a springboard to continue attacking other hosts on the enterprise's intranet. Furthermore, compromised hosts often exhibit irregularity and high stealth; many intrusion actions themselves are difficult to identify or confirm the success of the attack. However, various actions after the compromise can indicate that the host has been compromised. When office equipment or servers are attacked and controlled by an unauthorized organization, they will actively communicate with the unauthorized organization's server using a specified IP address or domain name, transmitting security data stored on it (such as personnel, assets, events, logs, configurations, policies, traffic, etc.). Therefore, it is necessary to detect compromised hosts and repair them promptly to ensure the security of the enterprise's network.

[0040] Domain Name System (DNS): One of the most important core services on the Internet, responsible for providing a unified domain name address space mapping service, mainly resolving domain names that are easy for humans to remember into IP addresses that are easy for machines to recognize.

[0041] Malicious domains are domains generated using a Domain Generation Algorithm (DGA). They are often used by attackers within the domains of malicious programs for communication between trojans and control servers.

[0042] Once a host becomes compromised, its secure data is at risk of being leaked, and it also poses a threat to other hosts with which it has access, causing incalculable losses to the enterprise. Therefore, enterprises need to constantly check whether any hosts are compromised during network operations. Currently, a common method for determining whether a host is compromised is to perform malicious domain name detection on all hosts. If a host is found to contain malicious domain names, it is determined to be a compromised host.

[0043] The method described above for determining whether a host is compromised relies solely on malicious domain name detection, and its accuracy is relatively low.

[0044] In view of this, this application proposes a method for determining compromised hosts. Based on malicious domain name detection, it further determines compromised hosts from suspected hosts based on security data in suspected hosts, thus improving the problem that the accuracy of determining compromised hosts is poor when relying solely on malicious domain name detection.

[0045] The method for determining a compromised host provided in this application embodiment can be applied to, for example, Figure 1In the application environment shown, multiple hosts 102 to be detected communicate with a target host 104 via a network. The data storage system can be integrated on the target host 104, or it can be located in the cloud or on another network host. The target host 104 acquires initial security data from the multiple hosts 102 to be detected, processes the initial security data to obtain target security data, and performs malicious domain name detection on the multiple hosts 102 to be detected based on the target security data. Based on the detection results, suspected hosts are selected from the multiple hosts 102. After selecting suspected hosts, the target host 104 continues to acquire security data based on the suspected hosts, thereby identifying compromised hosts from among the suspected hosts. The hosts 102 to be detected and the target host 104 can be implemented using independent servers or a server cluster composed of multiple servers.

[0046] The specific technical solutions of the embodiments of this application are described below with reference to the accompanying drawings.

[0047] Figure 2 This is a flowchart illustrating a method for determining a compromised host, as shown in an exemplary embodiment of this application. (Refer to...) Figure 2 As shown, the specific steps include:

[0048] Step S100: Obtain the initial security data of each host to be tested. The initial security data is the data generated by the host to be tested during operation.

[0049] The host to be detected can be a target enterprise's server device. There can be at least one host, or multiple hosts; this is not limited. Initial security data is data generated during the operation of the host to be detected, used to support subsequent identification of compromised hosts. Initial security data can be obtained from the host's storage, from other monitoring devices, or from both; this is not limited. It should be noted that other monitoring devices are those used to monitor the operational data of the host to be detected, such as traffic monitoring devices and threat intelligence monitoring devices. For example, initial security data may include basic information of the host to be monitored in real time (e.g., the host's memory, kernel version, etc.), asset data (e.g., system accounts, open ports, databases, etc.), asset operation data (e.g., process behavior data, file access data, system operation data, network traffic data, etc.), threat intelligence information, behavior log data (e.g., DNS server request and response logs, HTTP hypertext transfer protocol, server access logs, login logs, process behavior logs, file logs, network logs, etc.), and network traffic data (network protocols, basic fields of the corresponding protocols, traffic data, etc.).

[0050] This application allows the target host to send an acquisition command to the host under test and / or other monitoring devices. Upon receiving the acquisition command from the target host, the host under test and / or other monitoring devices package the initial security data stored in their memory and send it to the target host. When sending data packets, the host under test and / or other monitoring devices carry an identifier corresponding to each host under test, so that the target host can determine the host under test corresponding to the data in the data packet based on the identifier and classify and store it accordingly. Of course, the target host can also store data packets sent by multiple hosts under test and / or other monitoring devices in the same memory address; this application does not limit this.

[0051] Different types of initial security data have the following advantages over single types of initial security data:

[0052] While single-type initial security data may have perceptual errors due to external interference and other factors, different types of initial security data can still provide accurate evidence for identifying compromised hosts even when single-type initial security data deviates significantly or seriously.

[0053] A single type of initial security data can only provide information on a single aspect and cannot provide a holistic description. However, different types of initial security data can complement and superimpose each other to provide more accurate information, ultimately resulting in a clearer and more accurate description.

[0054] While the time and speed at which initial security data of a single type are obtained and transmitted remain constant, different types of initial security data can compensate for this disadvantage, providing real-time data information and improving the efficiency of identifying compromised hosts.

[0055] For example, the target host sends initial security data acquisition instructions to hosts A, B, and C respectively. After receiving the acquisition instructions, host A packages and sends the stored enterprise asset data to the target host, host B packages and sends the stored enterprise log data to the target host, and host C sends the stored enterprise user data to the target host.

[0056] Step S200: The initial security data are fused based on the heterogeneous data fusion method to obtain the target security data;

[0057] Heterogeneous data fusion is a processing method for data from different sources. It utilizes initial security data from different hosts under test and / or other monitoring devices, performing processes such as filtering, completion, transformation, aggregation, merging, and extraction to obtain the target security data. Techniques and algorithms used in heterogeneous data fusion include, for example, least squares, weighted average, Kalman filtering, Bayesian estimation, minimum description length, genetic algorithms, and evidence functions.

[0058] By fusing initial security data using a heterogeneous data fusion method, the output target security data reduces uncertainty in identifying compromised hosts and improves the quality of host identification. More importantly, heterogeneous data fusion effectively utilizes the redundancy and complementarity between data from different sources, enabling more accurate host identification from a global perspective. Furthermore, it reduces data volume and generates intermediate tables such as IP summary tables and IP session logs based on subsequent business needs, comprehensively constructing a basic security data center. This resolves issues such as conflicts and attribute dispersion between different types of initial security data, and incomplete or partial data from single sources, supporting subsequent compromised host analysis needs. The target security data obtained through heterogeneous fusion not only reduces noise to some extent, improving the accuracy of host identification caused by data silos, but also supports subsequent risk assessment and analysis of compromised hosts.

[0059] In one embodiment, such as Figure 3 As shown, Figure 3 An exemplary embodiment of this application illustrates an optional method for fusing initial security data, the method comprising the following steps:

[0060] Step S201: The initial security data are fused based on the heterogeneous data fusion method to obtain intermediate security data;

[0061] For example, embodiments of this application may perform the following operations on each initial security data:

[0062] The system uses a configured data parsing algorithm to extract key information from each initial security data set; it then performs correlation and completion of the key information from each initial security data set; finally, it labels each completed initial security data set; and finally, it obtains intermediate security data.

[0063] Specifically, key information can be extracted from the IP address, current host IP address, domain name, URL, protocol type, event content, etc. of each initial security data, as shown in the table below:

[0064]

[0065] Related completion includes enriching the content of log data, fixed asset information (including the user ID of the user to whom the equipment belongs, the organization ID of the user to whom the equipment belongs, the location information of the user to whom the equipment belongs, and the communication information of the user to whom the equipment belongs), etc.

[0066] This application embodiment can use ATT&CK's technical and tactical IDs to tag initial security data, thereby classifying and labeling each piece of initial security data. This facilitates rapid classification of massive amounts of initial security data, further improving the efficiency and accuracy of data analysis. For example, for text, tags can include subject, predicate, object, nouns, verbs, etc.

[0067] Specifically, when tagging initial security data, it is necessary to extract data features to obtain the characteristics of the initial security data, and then tag the initial security data based on these characteristics. For example, if a link to a known malicious site is found in the host application logs and a user visits that link, the host is tagged with "Potential for phishing".

[0068] The technical solution provided in this application firstly uses a preprocessing method for initial security data, and then, based on multiple key pieces of information extracted from the processed initial security data, combines them with subsequent determination methods to make the determination of compromised hosts more accurate and reduce the error rate of determining compromised hosts based on only a single key piece of information.

[0069] Step S202: Standardize the intermediate security data to obtain the target security data. The standardization process is used to define the data format and the presentation of the data content of the security data.

[0070] Since the storage rules for storing initial security data differ among the various hosts under test and other monitoring devices, there may be inconsistencies in data format and content presentation. Therefore, in order to quickly identify compromised hosts based on the initial security data, it is necessary to standardize the intermediate data to unify the data format and content presentation of all intermediate data, thereby improving the efficiency of identifying compromised hosts.

[0071] Step S300: Input each domain name to be detected in the target security data into the detection model to detect malicious domain names, and filter out suspected hosts from each host to be detected based on the detection results. Each domain name to be detected of the suspected host includes malicious domain names. The detection model is trained by normal domain names and malicious domain names.

[0072] The domain name to be detected originates from target security data, such as DNS log data within the target security data. Detecting the domain name allows us to determine whether the host under test has a communication relationship with an attacker. If an attacker uses the domain name to communicate with the host under test, the domain name can be identified as malicious. Furthermore, based on the malicious domain name, suspected hosts can be identified from among the hosts under test. This embodiment of the application uses a detection model to detect malicious domain names, which allows for faster detection results.

[0073] After obtaining the malicious domain name using the above method, the host to be detected that contains the malicious domain name can be screened as a suspected host. The suspected host can be one or more, and there is no limitation here.

[0074] In addition, in this embodiment of the application, after a suspected host is selected from each host to be detected, an alarm mechanism can be triggered, for example, the alarm level of the suspected host can be adjusted to medium level.

[0075] In another embodiment, such as Figure 4 As shown, Figure 4 An optional method embodiment for obtaining a detection model, as illustrated in an exemplary embodiment of this application, includes the following steps:

[0076] Step S301: Obtain multiple legitimate domain names and multiple malicious domain names;

[0077] For example, one could select the top 1,000,000 data points from Alexa (http: / / www.secrepo.com) and Cisco datasets as a sample of normal domain names: such normal domain names include google.com, facebook.com, youtube.com, baidu.com, yahoo.com, amazon.com, wikipedia.org, qq.com, twitter.com, etc.

[0078] This can be done by obtaining malicious domain datasets from open-source websites such as http: / / data.netlab.360.com / dga / , selecting datasets like abcbot, ccleaner, dmsniff, fobber, madmax, necro, proslikefan, rovnix, tempedreve, and vidro, and then choosing the top 1,000,000 data points from these datasets as malicious domain samples. Examples of selected malicious domains include kyyjpvvbi.com, bkiypvvjy.pages.dev, kyyjpvvbi.tk, vyvpykbij.com, kyyjpvvbi.pages.dev, yivvjbypk.com, ykjbpvviy.pages.dev, ykjbpvviy.com, kvyjiyvpb.pages.dev, pikbyjyvv.pages.dev, and kyjivpvyb.pages.dev.

[0079] After obtaining normal domain name samples and malicious domain name samples, the embodiments of this application may also perform extraction operations such as cleaning the samples and extracting the main domain name.

[0080] Step S302: Extract the feature information of each normal domain name and the feature information of each malicious domain name. The feature information includes the randomness of the domain name characters, the length of the characters, the proportion of vowels in the characters, the proportion of unique characters in the characters, and at least one of the top-level domains.

[0081] The characteristic information includes, for example, character randomness, character length, the proportion of vowels in the character, the proportion of unique characters in the character, and at least one of the top-level domains.

[0082] The characteristics of character randomness in normal domain names and malicious domain names are as follows: the character randomness of malicious domain names is greater than that of normal domain names;

[0083] The characteristics of the character length of normal and malicious domain names are as follows: the character length of normal domain names is within 19, concentrated between 8 and 12, with only a few normal domain names having a character length of more than 19; while the length of malicious domain names ranges from 8 to 32, with two peaks, namely 12 and 30, with more malicious domain names having a character length of 30.

[0084] The characteristics of vowel proportions in normal and malicious domain names are as follows: To facilitate user memorization and improve readability, normal domain names typically use words or names in their pinyin, often incorporating vowels to make the domain name easier to pronounce. In contrast, malicious domain names are randomly generated and readability is not considered, resulting in a higher proportion of vowels in normal domain names compared to malicious domain names.

[0085] The characteristics of the ratio of unique characters in the characters of normal and malicious domain names are as follows: A unique character is the number of distinct characters in the domain name. For example, the unique character in the domain name baidu is [baidu], which has 5 characters; the unique character in the domain name urlzt.com is [urlzt], which has 4 characters. Because malicious domain names have a high degree of randomness, they contain a higher proportion of unique characters. Therefore, the characteristic is that the proportion of unique characters in normal domain names is lower than that in malicious domain names.

[0086] The characteristics of normal and malicious top-level domains are as follows: Normal domains generally use common top-level domains, such as .cn and .com. Malicious domains use more arbitrary top-level domains; attackers may choose less strictly vetted top-level domains, such as .biz and .ru. For example, normal domains include 1933 commonly used top-level domains and 67 other top-level domains; malicious domains might include 1342 commonly used top-level domains and 658 other top-level domains. This shows that nearly two-thirds of the top-level domains in malicious domains are uncommon. Therefore, the proportion of commonly used top-level domains in normal domains is higher than that in malicious domains.

[0087] In machine learning, since the inputs to the model are almost always numerical variables, while categorical variables themselves do not have numerical attributes, they usually need to be processed separately. Therefore, based on the above method, after extracting the feature information of normal and malicious domain names, it is also necessary to perform character-level label encoding on the normal and malicious domain names. This is typically done using variable transformation methods commonly found in label encoding tree models to convert categorical variables into numerical values. For example, [g, o, o, g, l, e, c, o, m] is converted to [1, 2, 2, 1, 3, 4, 5, 6, 2, 7]. This completes the numerical conversion of normal and malicious domain names, facilitating machine learning based on normal and malicious domain names to obtain more robust detection models.

[0088] Step S303: Based on the feature information of each normal domain name and the feature information of each malicious domain name, train the long short-term memory neural network to obtain the detection model.

[0089] For example, in this application embodiment, the feature information of each normal domain name and the feature information of each malicious domain name can be divided into training data and test data. First, based on classification algorithms such as K-nearest neighbor, logistic regression, SVN, and iterative algorithm, the long short-term memory neural network is trained with training data to obtain an initial detection model. Then, the test data can be predicted using the initial detection model. Based on the accuracy, false positive rate, and recall rate of DGA domain name detection in the prediction results, cross-validation is used to obtain the algorithm with the best effect, thereby obtaining a detection model with better accuracy.

[0090] After obtaining the detection model through the above training and prediction, the embodiments of this application can re-select normal domain name samples and malicious domain name samples to perform secondary verification on the detection model. Further adjustments can be made based on the verification results, such as the ratio of normal domain names to malicious domain names, algorithm selection, and parameter tuning, in order to finally obtain a more optimized detection model.

[0091] Step S400: Based on the initial security data of the suspected hosts, identify the compromised hosts from among the suspected hosts.

[0092] In this process, after filtering out suspected hosts from the hosts to be detected using the above method, the initial security data of the suspected hosts can be further obtained. Based on the security data of the suspected hosts, IOC security threat intelligence can be matched. According to the relevant matching results, it can be determined whether the suspected host is a compromised host. This improves the problem that the accuracy of identifying compromised hosts is poor when relying solely on malicious domain name detection.

[0093] In one embodiment, such as Figure 5 As shown, Figure 5 This application provides an exemplary embodiment of an optional method for determining a compromised host, which includes the following steps:

[0094] Step S401: The risk data identification risk model is used to identify the initial security data of the suspected host and obtain the identification result. The risk data identification risk model is obtained by training a neural network model based on different types of risk data and different types of normal data.

[0095] The risk data is obtained through model training based on different types of risk data and different types of normal data, using a neural network model. Normal data can be security data obtained from non-victory hosts, while risk data can be target asset data, vulnerability data, target user data, and threat intelligence data obtained from compromised hosts. Both normal and risk data can also be data collected during the historical process of identifying compromised hosts; this application does not limit this. The trained risk data identification model can be stored on the target host.

[0096] After filtering out suspected hosts from multiple hosts to be detected using the above method, this application can obtain different types of initial security data from the suspected hosts, input different types of initial security data into a trained risk data identification model, and obtain the output results of the risk data identification model. The output results may be empty (i.e., no risk data was identified from the initial security data), or the output results may be the corresponding risk data. The risk data may include only one type of risk data, or it may include multiple different types of risk data; and the risk data may also carry risk type labels, so that the risk type of the suspected host can be quickly obtained based on the identification results of the risk identification model, thereby improving the efficiency of identifying compromised hosts.

[0097] Step S402: If the identification result is that risk data is identified from the initial security data of the suspected host, then the suspected host is identified as a compromised host; the risk data includes at least one of target asset data, vulnerability data, target user data, and threat intelligence data, the target asset data is asset data with a confidentiality level greater than a predetermined level, and the target user data is user data with predetermined operation permissions.

[0098] Based on the results output by the aforementioned risk data identification model, compromised hosts can be quickly identified from suspected hosts. Specifically, if the identification result indicates that there is no risk data in the initial security data of the suspected host, then the suspected host is not a compromised host. Conversely, if the identification result indicates that there is at least one of the following in the initial security data of the suspected host: target asset data, vulnerability data, target user data, and threat intelligence data, then the suspected host is identified as a compromised host.

[0099] Furthermore, after acquiring asset data, vulnerability data, user data, and threat intelligence data from a suspected host, the target host can continue to perform operations such as searching the suspected host's asset data for asset data with a confidentiality level higher than a predetermined level, searching the initial security data for vulnerability data, searching the user data for user data with predetermined operating permissions, and searching the initial security data for threat intelligence data. Based on the search results, it can be determined whether the suspected host is a compromised host. Specifically, if the target host finds at least one of the following: asset data with a confidentiality level higher than the predetermined level (i.e., target asset data), vulnerability data, user data with predetermined operating permissions (i.e., target user data), and threat intelligence data, the suspected host is determined to be a compromised host. It should be noted that the predetermined confidentiality level and predetermined operating permissions are determined by the enterprise based on its own business needs.

[0100] In addition, the embodiments of this application can also trigger the alarm mechanism again after determining that there is risky data in the suspected host, for example, by adjusting the alarm level of the suspected host to high.

[0101] By determining whether there is risky data in the security data of suspected hosts, compromised hosts can be identified from among the suspected hosts. Risky data is easy to obtain, and it is possible to quickly determine whether a suspected host is a compromised host, thus improving the efficiency of identifying compromised hosts.

[0102] After identifying the compromised host from multiple hosts under testing using the methods described above, the compromised host needs to be repaired to prevent further losses to the enterprise and thus ensure network security. Specifically, such as... Figure 6 As shown, Figure 6 This application provides an exemplary embodiment of an optional method for repairing a compromised host, which includes the following steps:

[0103] Step S600: Obtain risk data of the compromised host;

[0104] In this embodiment, the method described above for determining whether a suspected host is a compromised host is based on the presence of risky data in the security data of the suspected host. Therefore, a compromised host must contain risky data. The target host can send an acquisition command to the compromised host to obtain the risky data sent by the compromised host. This risky data can be at least one of target asset data, vulnerability data, target user data, and threat intelligence data.

[0105] Step S700: Determine the risk type of the compromised host based on the risk data of the compromised host;

[0106] In this embodiment of the application, the risk type of the compromised host can be determined based on the risk data of the compromised host obtained above. The risk types include asset risk, vulnerability risk, user risk, and threat intelligence risk.

[0107] Therefore, if the risk data of the compromised host is the target asset data, then the risk type of the compromised host is determined to be asset risk.

[0108] If the risk data of the compromised host is vulnerability data, then the risk type of the compromised host is determined to be vulnerability risk;

[0109] If the risk data of the compromised host is target user data, then the risk type of the compromised host is determined to be user risk;

[0110] If the risk data of a compromised host is threat intelligence data, then the risk type of the compromised host is determined to be threat intelligence risk.

[0111] Furthermore, in this embodiment of the application, an alarm mechanism may be triggered after determining that there is any one of the risks of asset risk, vulnerability risk, user risk, and threat intelligence risk in the suspected host. For example, the alarm level of the suspected host may be adjusted to high level.

[0112] In this embodiment of the application, after determining that there are any two of the risks among asset risk, vulnerability risk, user risk and threat intelligence risk in the suspected host, an alarm mechanism can be triggered. For example, the alarm level of the suspected host can be adjusted to the low-high level.

[0113] In this embodiment of the application, after determining that there are any three of the risks among asset risk, vulnerability risk, user risk and threat intelligence risk in the suspected host, an alarm mechanism can be triggered. For example, the alarm level of the suspected host can be adjusted to medium or high level.

[0114] In this embodiment of the application, after determining that there are four types of risks in the suspected host, namely asset risk, vulnerability risk, user risk and threat intelligence risk, an alarm mechanism can be triggered. For example, the alarm level of the suspected host can be adjusted to the highest level.

[0115] Step S800: Based on the risk type, obtain at least one classification and remediation strategy corresponding to the risk type from the security knowledge base. The security knowledge base includes multiple risk types and classification and remediation strategies corresponding to the multiple risk types.

[0116] The security knowledge base is the ATT&CK (Adversarial Tactics Techniques and Common Knowledge) knowledge base stored on the target host. ATT&CK is a set of models and knowledge bases proposed by MITRE that reflect attack behaviors at various stages of the attack lifecycle. For more observable attacker behaviors, it has built a more granular and easily shared knowledge model and framework. Through continuous accumulation, it has formed a network attacker behavior knowledge base jointly participated in and maintained by governments, public service enterprises, private enterprises and academic institutions to guide users to take targeted detection, defense and response work.

[0117] The security knowledge base includes technical information, general knowledge, multiple risk types, and corresponding classification and remediation strategies. Therefore, once the risk type of a compromised host is determined, the corresponding classification and remediation strategy can be found in the security knowledge base. A classification and remediation strategy is a set of corresponding operations performed to repair an object. It can include multiple execution steps, which can be for the same object or for different objects; there is no limitation on this. It should be noted that the object to be repaired can be, for example, a processor, memory, output module, input module, display module, audio module, etc. Repairing an object involves performing corresponding operations on its components, drivers, programs, code, and other external devices that interact with the object to achieve the repair operation.

[0118] For example, categorized remediation strategies include: Wi-Fi blocking, firewall linkage, agent linkage, email notification, SMS notification, automated execution of response blocking processes, blocking network connections, blocking IP addresses, and blocking domain names.

[0119] In one embodiment, such as Figure 7 As shown, Figure 7 This application provides an exemplary embodiment of an optional method for obtaining a classification and remediation strategy corresponding to a risk type. The method embodiment includes the following steps:

[0120] Step S801: Obtain risk type labels for at least one risk type;

[0121] The risk data identified by the risk data identification model can be at least one, or possibly multiple. These multiple risk data can be of the same type or different types. If the identified risk data is of the same type, the compromised host will only have one type of risk. Similarly, if the identified risk data is of different types, the compromised host will have multiple different risks. Furthermore, because the risk data identified by the risk data identification model carries a risk type label, the risk type label can be directly obtained from the model's output, thereby improving the efficiency of identifying compromised hosts. This risk type label can be represented by letters, numbers, symbols, etc., and this application does not limit its representation.

[0122] Step S802: Obtain at least one classification and remediation strategy corresponding to the risk type label from the security knowledge base based on the risk type label of the risk type. The security knowledge base includes multiple risk type labels and multiple classification and remediation strategies corresponding to each risk type label.

[0123] Since the security knowledge base includes risk type tags for each risk type and corresponding classification and remediation strategies, based on the risk type tags obtained for the affected host, the corresponding classification and remediation strategies can be found in the security knowledge base. This allows for faster determination of classification and remediation strategies, further improving the efficiency of repairing compromised hosts, preventing more serious losses for the enterprise, and ensuring secure network usage.

[0124] Step S900: Combine the classification and remediation strategies corresponding to the risk types according to a predetermined logical relationship to obtain the target remediation strategy. The predetermined logical relationship is used to characterize the correlation between the classification and remediation strategies.

[0125] The predetermined logical relationship may be determined based on the correlation between the operation steps of each category repair strategy for the repair object, or it may be determined based on the correlation between the steps of each category repair strategy. This application does not limit this.

[0126] In one embodiment, such as Figure 8 As shown, Figure 8 This application provides an exemplary embodiment of an alternative method for obtaining a target repair strategy, which includes the following steps:

[0127] Step S9011: Determine multiple operation objects and multiple target execution steps associated with each operation object from the classification and repair strategy;

[0128] The classification and repair strategy includes multiple execution steps. Each execution step can be for a single operation object or for multiple operation objects. Therefore, it is easy to identify multiple operation objects and the multiple target execution steps associated with each operation object from the classification and repair strategy.

[0129] Step S9012: Sort the multiple target execution steps associated with each operation object according to the target order to obtain multiple combined repair strategies. The target order is the order that satisfies the continuous operation.

[0130] In this embodiment, the execution steps of multiple targets can be sorted according to whether the conditions for continuous operation are met between the multiple target execution steps for each operation object, so as to obtain a combined repair strategy.

[0131] For example, if there are multiple classification repair strategies, and the first step of the first classification repair strategy, the second step of the second classification repair strategy, and the third step of the third classification strategy are all execution steps for the router and have a sequential operation relationship, then the first step of the first classification repair strategy, the second step of the second classification repair strategy, and the third step of the third classification strategy can be used as a combined repair strategy.

[0132] Step S9013: Each combined repair strategy is taken as the target repair strategy.

[0133] Based on the above determination process, three combined repair strategies were obtained, and these three combined repair strategies can be determined as the target repair strategies.

[0134] The target repair strategy determined in this way is highly operable and can improve repair efficiency, thereby preventing more serious losses for enterprises and ensuring their safe network use.

[0135] It's also worth noting that the target remediation strategy's workflow is editable, automating risk emergency response and handling to address a wider range of practical applications beyond automatic repair of compromised hosts. Once configured, the target remediation strategy's workflow executes automatically without human intervention, improving the speed of risk response. Once a host is confirmed as compromised, it quickly and automatically initiates repairs, with full log recording for easy post-incident tracking by administrators.

[0136] The target repair strategy obtained through the above method can simultaneously repair all objects involved in the repair process, thereby improving repair efficiency, preventing more serious losses for enterprises, and ensuring the safe use of the network by enterprises.

[0137] Step S1000: Repair the compromised host based on the target repair strategy.

[0138] This could involve the target host automatically performing repair operations on the compromised host based on the generated target repair strategy.

[0139] Furthermore, since attackers, after gaining control of a compromised host, will not only steal data stored on it, but also use it as a springboard to continue attacking other hosts that have access to the compromised host, thus putting those other hosts at risk, it is necessary to identify other hosts that have access to the compromised host after identifying the compromised host, so as to repair those other hosts simultaneously and thus comprehensively ensure the security of the enterprise's network.

[0140] In one embodiment, such as Figure 9 As shown, Figure 9This is an exemplary embodiment of an possible method for determining other hosts (target objects) illustrated in this application. The method embodiment includes the following steps:

[0141] Step S1001: Obtain network security events of the compromised host. A network security event refers to an event caused by a compromised host that harms the network, information system, and data.

[0142] Network security incidents refer to events that harm networks and information systems or their data due to human error, host hardware or software defects or malfunctions, natural disasters, etc., and have a negative impact on society. These incidents can be categorized into malicious program incidents, network attack incidents, information destruction incidents, information content security incidents, equipment and facility malfunctions, disasters, and other incidents. This application focuses on network security incidents involving compromised hosts, specifically incidents that may be caused by hardware or software defects or malfunctions of compromised hosts, resulting in harm to networks, information systems, and data. Network security incidents involving compromised hosts originate from initial security data, and more specifically, from log data within that initial security data.

[0143] Step S1002: Based on the network security incident, determine the attack path of the compromised host;

[0144] Based on the network security events obtained from the initial security data of the compromised host, the compromised host can reconstruct the interaction process between the compromised host and other hosts in chronological order, thereby obtaining the attack path of the compromised host.

[0145] Step S1003: Identify the target objects that have access relationships with the compromised host from the attack path.

[0146] The attack path includes the interaction between the compromised host and other hosts or objects. Therefore, the target objects (i.e., other hosts) that have access relationships with the compromised host can be identified by reconstructing the attack path. This access relationship includes the relationship of the compromised host actively accessing the target object and / or the relationship of the target object accessing the compromised host.

[0147] After identifying the target object using the methods described above, the compromised host and the target object can be repaired simultaneously using the following methods:

[0148] The target repair strategy is sent to the compromised host and the target object so that the compromised host and the target object can perform the corresponding repair operations based on the target repair strategy.

[0149] Finally, based on the target repair strategy obtained through the above process and the identified target object, the embodiments of this application may send the repair strategy related to the compromised host in the target repair strategy to the compromised host, and send the repair strategy related to the target object in the target repair strategy to the target object, so as to simultaneously instruct the compromised host and the target object to perform corresponding repair operations according to the steps of the repair strategy, thereby achieving the purpose of quickly repairing the compromised host and the target object, thereby avoiding more serious losses for the enterprise and ensuring the enterprise's secure network use.

[0150] This application embodiment combines the results of backtracking analysis of the compromised host with target asset information, and flexibly formulates target repair strategies for the compromised host based on SOAR technology, executes corresponding risk emergency response operations for the compromised host, and deeply integrates risk identification and security protection equipment to realize the functions of compromised host confirmation and automatic repair, ensuring the accuracy and precision of the handling while being highly efficient.

[0151] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0152] Based on the same inventive concept, this application also provides a compromised host determination apparatus for implementing the compromised host determination method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more compromised host determination apparatus embodiments provided below can be found in the limitations of the compromised host determination method described above, and will not be repeated here.

[0153] In one embodiment, such as Figure 10 As shown, a device 2000 for determining a compromised host computer is provided. This processing device includes: an acquisition processing module 2001, a fusion module 2002, a detection and screening module 2003, and a determination module 2004.

[0154] The processing module 2001 is used to acquire the initial security data of each host to be tested. The initial security data is the data generated by the host to be tested during operation.

[0155] The fusion module 2002 is used to fuse various initial security data based on the heterogeneous data fusion method to obtain target security data;

[0156] The detection and screening module 2003 is used to input each domain name to be detected in the target security data into the detection model to detect malicious domain names, and to screen out suspected hosts from each host to be detected based on the detection results. Each domain name to be detected of the suspected host includes malicious domain names. The detection model is trained by normal domain names and malicious domain names.

[0157] The determination module 2004 is used to identify compromised hosts from among suspected hosts based on initial security data of suspected hosts.

[0158] In one embodiment, the determining module 2005 is specifically used to determine that the suspected host is a compromised host if risky data exists in the initial security data of the suspected host. The risky data includes at least one of target asset data, vulnerability data, target user data, and threat intelligence data. The target asset data is asset data with a confidentiality level greater than a predetermined level, and the target user data is user data with predetermined operation permissions.

[0159] In one embodiment, the above-described apparatus further includes a repair module (not shown in the figure).

[0160] The repair module is used to acquire risk data of compromised hosts; determine the risk type of compromised hosts based on the risk data; based on the risk type, acquire at least one classification repair strategy corresponding to the risk type from the security knowledge base, which includes multiple risk types and multiple classification repair strategies corresponding to multiple risk types; combine the classification repair strategies corresponding to the risk types according to a predetermined logical relationship to obtain the target repair strategy, the predetermined logical relationship is used to characterize the correlation between the classification repair strategies; and repair the compromised hosts based on the target repair strategy.

[0161] In one embodiment, the repair module is specifically used to obtain labels for risk types, which are used to mark different risk types; and to obtain at least one classification repair strategy corresponding to the label of the risk type from the security knowledge base, which includes the label corresponding to each risk type and multiple classification repair strategies corresponding to each label.

[0162] In one embodiment, the repair module is further configured to determine multiple operation objects and multiple target execution steps associated with each operation object from each category of repair strategies; combine the multiple target execution steps associated with each operation object to obtain multiple combined repair strategies; and use each combined repair strategy as a target repair strategy.

[0163] In one embodiment, the repair module is further configured to sort multiple target execution steps associated with each operation object according to the target order to obtain multiple combined repair strategies, wherein the target order is the order that satisfies the continuity of operation.

[0164] In one embodiment, the aforementioned fusion module 2002 is further configured to fuse the initial security data based on the heterogeneous data fusion method to obtain intermediate security data; and to standardize the intermediate security data to obtain target security data. The standardization process is used to limit the data format and the representation of the data content of the security data.

[0165] In one embodiment, the determining module 2005 is further configured to acquire network security events of the compromised host, wherein a network security event refers to an event caused by the compromised host that harms the network, information system, and data; determine the attack path of the compromised host based on the network security event; and determine the target object with an access relationship to the compromised host from the attack path.

[0166] In one embodiment, the repair module is further configured to send the target repair strategy to the compromised host and the target object, so that the compromised host and the target object can perform corresponding repair operations based on the target repair strategy.

[0167] In one embodiment, the above-described apparatus further includes a training module (not shown in the figure).

[0168] The training module is used to acquire multiple normal domain names and multiple malicious domain names; extract feature information of each normal domain name and each malicious domain name, including the randomness of the domain name characters, the length of the characters, the proportion of vowels in the characters, the proportion of unique characters in the characters, and at least one of the top-level domains; based on the feature information of each normal domain name and each malicious domain name, a long short-term memory neural network is trained to obtain a detection model.

[0169] Each module in the aforementioned device for determining a compromised host can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the operations corresponding to each module.

[0170] In one embodiment, a computer device is provided, the internal structure of which can be as follows: Figure 11As shown. The computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores security data for each host under test. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a method for determining a compromised host.

[0171] Those skilled in the art will understand that Figure 11 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0172] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0173] Acquire the initial security data of each host under test. The initial security data is the data generated by the host under test during operation.

[0174] The target security data is obtained by fusing the initial security data based on the heterogeneous data fusion method.

[0175] Each domain name to be detected in the target security data is input into the detection model to detect malicious domain names, and suspected hosts are selected from each host to be detected based on the detection results. Each domain name to be detected of the suspected hosts includes malicious domain names. The detection model is trained by normal domain names and malicious domain names.

[0176] Based on the initial security data of the suspected hosts, the compromised hosts are identified from among the suspected hosts.

[0177] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0178] If risky data is found in the initial security data of a suspected host, the suspected host is identified as a compromised host. Risky data includes at least one of the following: target asset data, vulnerability data, target user data, and threat intelligence data. Target asset data is asset data with a confidentiality level greater than a predetermined level, and target user data is user data with predetermined operating permissions.

[0179] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0180] Obtain risk data of compromised hosts; determine the risk type of compromised hosts based on the risk data; based on the risk type, obtain at least one classification remediation strategy corresponding to the risk type from the security knowledge base, which includes multiple risk types and multiple classification remediation strategies corresponding to multiple risk types; combine the classification remediation strategies corresponding to each risk type according to a predetermined logical relationship to obtain the target remediation strategy, where the predetermined logical relationship is used to characterize the correlation between the classification remediation strategies; and remediate the compromised hosts based on the target remediation strategy.

[0181] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0182] Obtain risk type labels, which are used to mark different risk types; retrieve at least one classification and remediation strategy corresponding to the risk type label from the security knowledge base, which includes the label corresponding to each risk type and multiple classification and remediation strategies corresponding to each label.

[0183] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0184] Multiple operational objects and multiple target execution steps associated with each operational object are identified from each category of repair strategy; the multiple target execution steps associated with each operational object are combined to obtain multiple combined repair strategies; each combined repair strategy is used as a target repair strategy.

[0185] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0186] The multiple target execution steps associated with each operation object are sorted according to the target order to obtain multiple combined repair strategies. The target order is the order that satisfies the continuity of operations.

[0187] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0188] The initial security data are fused using a heterogeneous data fusion method to obtain intermediate security data. The intermediate security data is then standardized to obtain the target security data. The standardization process is used to define the data format and the presentation of the data content of the security data.

[0189] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0190] The process involves obtaining network security incidents related to compromised hosts. Network security incidents refer to events caused by compromised hosts that result in damage to networks, information systems, and data. Based on these incidents, the attack paths of the compromised hosts are determined. From these attack paths, target objects with access relationships to the compromised hosts are identified.

[0191] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0192] The target repair strategy is sent to the compromised host and the target object so that the compromised host and the target object can perform the corresponding repair operations based on the target repair strategy.

[0193] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0194] Multiple normal domain names and multiple malicious domain names are obtained; feature information of each normal domain name and feature information of each malicious domain name are extracted. Feature information includes the randomness of the domain name characters, the length of the characters, the proportion of vowels in the characters, the proportion of unique characters in the characters, and at least one of the top-level domains; based on the feature information of each normal domain name and feature information of each malicious domain name, a long short-term memory neural network is trained to obtain a detection model.

[0195] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0196] Acquire the initial security data of each host under test. The initial security data is the data generated by the host under test during operation.

[0197] The target security data is obtained by fusing the initial security data based on the heterogeneous data fusion method.

[0198] Each domain name to be detected in the target security data is input into the detection model to detect malicious domain names, and suspected hosts are selected from each host to be detected based on the detection results. Each domain name to be detected of the suspected hosts includes malicious domain names. The detection model is trained by normal domain names and malicious domain names.

[0199] Based on the initial security data of the suspected hosts, the compromised hosts are identified from among the suspected hosts.

[0200] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0201] If risky data is found in the initial security data of a suspected host, the suspected host is identified as a compromised host. Risky data includes at least one of the following: target asset data, vulnerability data, target user data, and threat intelligence data. Target asset data is asset data with a confidentiality level greater than a predetermined level, and target user data is user data with predetermined operating permissions.

[0202] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0203] Obtain risk data of compromised hosts; determine the risk type of compromised hosts based on the risk data; based on the risk type, obtain at least one classification remediation strategy corresponding to the risk type from the security knowledge base, which includes multiple risk types and multiple classification remediation strategies corresponding to multiple risk types; combine the classification remediation strategies corresponding to each risk type according to a predetermined logical relationship to obtain the target remediation strategy, where the predetermined logical relationship is used to characterize the correlation between the classification remediation strategies; and remediate the compromised hosts based on the target remediation strategy.

[0204] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0205] Obtain risk type labels, which are used to mark different risk types; retrieve at least one classification and remediation strategy corresponding to the risk type label from the security knowledge base, which includes the label corresponding to each risk type and multiple classification and remediation strategies corresponding to each label.

[0206] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0207] Multiple operational objects and multiple target execution steps associated with each operational object are identified from each category of repair strategy; the multiple target execution steps associated with each operational object are combined to obtain multiple combined repair strategies; each combined repair strategy is used as a target repair strategy.

[0208] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0209] The multiple target execution steps associated with each operation object are sorted according to the target order to obtain multiple combined repair strategies. The target order is the order that satisfies the continuity of operations.

[0210] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0211] The initial security data are fused using a heterogeneous data fusion method to obtain intermediate security data. The intermediate security data is then standardized to obtain the target security data. The standardization process is used to define the data format and the presentation of the data content of the security data.

[0212] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0213] The process involves obtaining network security incidents related to compromised hosts. Network security incidents refer to events caused by compromised hosts that result in damage to networks, information systems, and data. Based on these incidents, the attack paths of the compromised hosts are determined. From these attack paths, target objects with access relationships to the compromised hosts are identified.

[0214] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0215] The target repair strategy is sent to the compromised host and the target object so that the compromised host and the target object can perform the corresponding repair operations based on the target repair strategy.

[0216] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0217] Multiple normal domain names and multiple malicious domain names are obtained; feature information of each normal domain name and feature information of each malicious domain name are extracted. Feature information includes the randomness of the domain name characters, the length of the characters, the proportion of vowels in the characters, the proportion of unique characters in the characters, and at least one of the top-level domains; based on the feature information of each normal domain name and feature information of each malicious domain name, a long short-term memory neural network is trained to obtain a detection model.

[0218] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0219] Acquire the initial security data of each host under test. The initial security data is the data generated by the host under test during operation.

[0220] The target security data is obtained by fusing the initial security data based on the heterogeneous data fusion method.

[0221] Each domain name to be detected in the target security data is input into the detection model to detect malicious domain names, and suspected hosts are selected from each host to be detected based on the detection results. Each domain name to be detected of the suspected hosts includes malicious domain names. The detection model is trained by normal domain names and malicious domain names.

[0222] Based on the initial security data of the suspected hosts, the compromised hosts are identified from among the suspected hosts.

[0223] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0224] If risky data is found in the initial security data of a suspected host, the suspected host is identified as a compromised host. Risky data includes at least one of the following: target asset data, vulnerability data, target user data, and threat intelligence data. Target asset data is asset data with a confidentiality level greater than a predetermined level, and target user data is user data with predetermined operating permissions.

[0225] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0226] Obtain risk data of compromised hosts; determine the risk type of compromised hosts based on the risk data; based on the risk type, obtain at least one classification remediation strategy corresponding to the risk type from the security knowledge base, which includes multiple risk types and multiple classification remediation strategies corresponding to multiple risk types; combine the classification remediation strategies corresponding to each risk type according to a predetermined logical relationship to obtain the target remediation strategy, where the predetermined logical relationship is used to characterize the correlation between the classification remediation strategies; and remediate the compromised hosts based on the target remediation strategy.

[0227] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0228] Obtain risk type labels, which are used to mark different risk types; retrieve the classification and remediation strategies corresponding to the risk type labels from the security knowledge base, which includes the labels corresponding to each risk type and the classification and remediation strategies corresponding to each label.

[0229] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0230] Obtain risk type labels, which are used to mark different risk types; retrieve at least one classification and remediation strategy corresponding to the risk type label from the security knowledge base, which includes the label corresponding to each risk type and multiple classification and remediation strategies corresponding to each label.

[0231] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0232] The multiple target execution steps associated with each operation object are sorted according to the target order to obtain multiple combined repair strategies. The target order is the order that satisfies the continuity of operations.

[0233] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0234] The initial security data are fused using a heterogeneous data fusion method to obtain intermediate security data. The intermediate security data is then standardized to obtain the target security data. The standardization process is used to define the data format and the presentation of the data content of the security data.

[0235] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0236] The process involves obtaining network security incidents related to compromised hosts. Network security incidents refer to events caused by compromised hosts that result in damage to networks, information systems, and data. Based on these incidents, the attack paths of the compromised hosts are determined. From these attack paths, target objects with access relationships to the compromised hosts are identified.

[0237] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0238] The target repair strategy is sent to the compromised host and the target object so that the compromised host and the target object can perform the corresponding repair operations based on the target repair strategy.

[0239] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0240] Multiple normal domain names and multiple malicious domain names are obtained; feature information of each normal domain name and feature information of each malicious domain name are extracted. Feature information includes the randomness of the domain name characters, the length of the characters, the proportion of vowels in the characters, the proportion of unique characters in the characters, and at least one of the top-level domains; based on the feature information of each normal domain name and feature information of each malicious domain name, a long short-term memory neural network is trained to obtain a detection model.

[0241] It is readily understood that, based on the several embodiments provided in this application, those skilled in the art can combine, split, or reorganize the embodiments of this application to obtain other embodiments, none of which exceed the protection scope of this application.

[0242] The above detailed embodiments further illustrate the purpose, technical solution, and beneficial effects of the embodiments of this application. It should be understood that the above are merely specific embodiments of the embodiments of this application and are not intended to limit the protection scope of the embodiments of this application. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solutions of the embodiments of this application should be included within the protection scope of the embodiments of this application.

Claims

1. A method for determining a compromised host computer, characterized in that, The determination method includes: Acquire initial security data for each host to be detected. The initial security data is the data generated by the host to be detected during operation. The initial security data includes basic information, asset data, asset operation data, threat intelligence information, behavior log data, or network traffic data of the host to be detected that is accessed in real time. The initial security data are fused using a heterogeneous data fusion method to obtain the target security data; Each domain name to be detected in the target security data is input into the detection model for malicious domain name detection, and suspected hosts are selected from each host to be detected based on the detection results. Each domain name to be detected of the suspected host includes the malicious domain name. The detection model is trained by normal domain names and malicious domain names. Based on the initial security data of the suspected hosts, a compromised host is identified from the suspected hosts, wherein identifying the compromised host from the suspected hosts based on the initial security data of the suspected hosts includes: The risk data identification risk model is used to identify the initial security data of the suspected host by risk data identification risk model, and the identification result is obtained. The risk data identification risk model is obtained by training a neural network model based on different types of risk data. If the identification result is that risk data is identified from the initial security data of the suspected host, then the suspected host is determined to be a compromised host; the risk data includes at least one of target asset data, vulnerability data, target user data, and threat intelligence data, wherein the target asset data is asset data with a confidentiality level greater than a predetermined level, and the target user data is user data with predetermined operation permissions; Obtain the risk data of the compromised host; The risk type of the compromised host is determined based on the risk data of the compromised host. Based on the risk type, at least one classification and remediation strategy corresponding to the risk type is obtained from the security knowledge base, wherein the security knowledge base includes multiple risk types and multiple classification and remediation strategies corresponding to the multiple risk types; The risk type and its corresponding classification and repair strategies are combined according to a predetermined logical relationship to obtain the target repair strategy. The predetermined logical relationship is used to characterize the correlation between the classification and repair strategies. The compromised host is repaired based on the target repair strategy.

2. The determination method according to claim 1, characterized in that, The risk data of the compromised host carries a risk type label. The step of obtaining at least one classification and remediation strategy corresponding to the risk type from the security knowledge base based on the risk type includes: Obtain at least one risk type label for the aforementioned risk type; Based on the risk type label of the risk type, at least one classification and remediation strategy corresponding to the risk type label is obtained from the security knowledge base. The security knowledge base includes multiple risk type labels and multiple classification and remediation strategies corresponding to each risk type label.

3. The determination method according to claim 2, characterized in that, The classification and remediation strategy includes multiple execution steps. The step of combining the classification and remediation strategies corresponding to the risk types according to a predetermined logical relationship to obtain the target remediation strategy includes: Multiple operational objects and multiple target execution steps associated with each of the aforementioned classification and repair strategies are identified. Multiple target execution steps associated with each of the aforementioned operation objects are sorted according to the target order to obtain multiple combined repair strategies, wherein the target order is the order that satisfies the continuity of operation; Each of the aforementioned combined repair strategies is taken as the target repair strategy.

4. The determining method according to any one of claims 1-3, characterized in that, The method of fusing the initial security data based on heterogeneous data fusion to obtain the target security data includes: The initial security data are fused using a heterogeneous data fusion method to obtain intermediate security data. The intermediate security data is standardized to obtain the target security data. The standardization process is used to define the data format and the presentation of the data content of the security data.

5. The determining method according to any one of claims 1-3, characterized in that, The method further includes: The network security events of the compromised host are obtained, wherein the network security events refer to events caused by the compromised host that result in damage to the network, information system, and data; Based on the aforementioned network security incident, the attack path of the compromised host was determined; Identify target objects that have access relationships with the compromised host from the attack path; The repair of the compromised host based on the target repair strategy includes: The target repair strategy is sent to the compromised host and the target object, so that the compromised host and the target object perform corresponding repair operations based on the target repair strategy.

6. The determining method according to any one of claims 1-3, characterized in that, The generation process of the detection model includes: Acquire multiple legitimate domain names and multiple malicious domain names; Extract the feature information of each normal domain name and the feature information of each malicious domain name. The feature information includes the randomness of the domain name characters, the length of the characters, the proportion of vowels in the characters, the proportion of unique characters in the characters, and at least one of the top-level domains. Based on the feature information of each normal domain name and the feature information of each malicious domain name, a long short-term memory neural network is trained to obtain the detection model.

7. A device for determining a compromised host computer, characterized in that, The device includes: The acquisition module is used to acquire the initial security data of each host to be detected. The initial security data is the data generated by the host to be detected during operation. The initial security data includes the basic information, asset data, asset operation data, threat intelligence information, behavior log data or network traffic data of the host to be detected that is accessed in real time. The fusion module is used to fuse the initial security data based on the heterogeneous data fusion method to obtain the target security data; The detection and filtering module is used to input each domain name to be detected in the target security data into the detection model for malicious domain name detection, and to filter out suspected hosts from each host to be detected based on the detection results. Each domain name to be detected of the suspected host includes the malicious domain name. The detection model is trained by normal domain names and malicious domain names. The determination module is used to determine a compromised host from the suspected hosts based on the initial security data of the suspected hosts, wherein determining the compromised host from the suspected hosts based on the initial security data of the suspected hosts includes: The risk data identification risk model is used to identify the initial security data of the suspected host by risk data identification risk model, and the identification result is obtained. The risk data identification risk model is obtained by training a neural network model based on different types of risk data. If the identification result is that risk data is identified from the initial security data of the suspected host, then the suspected host is determined to be a compromised host; the risk data includes at least one of target asset data, vulnerability data, target user data, and threat intelligence data, wherein the target asset data is asset data with a confidentiality level greater than a predetermined level, and the target user data is user data with predetermined operation permissions; A repair module is used to acquire risk data of the compromised host; determine the risk type of the compromised host based on the risk data; acquire at least one classification repair strategy corresponding to the risk type from a security knowledge base, wherein the security knowledge base includes multiple risk types and multiple classification repair strategies corresponding to the multiple risk types; combine the classification repair strategies corresponding to the risk types according to a predetermined logical relationship to obtain a target repair strategy, wherein the predetermined logical relationship is used to characterize the correlation between the classification repair strategies; and repair the compromised host based on the target repair strategy.

8. A computer device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method for determining a compromised host as described in any one of claims 1 to 6.

Images