A detection method and system, and storage medium

Abstract

This application discloses a detection method and system, as well as a storage medium. The detection system acquires log information from a host; analyzes and processes the log information based on a threat intelligence database and a first analysis model to obtain an initial compromise result of the host; wherein, the first analysis model is used to detect unknown risks; and analyzes and processes the initial compromise result based on a second analysis model to obtain a target compromise result; wherein, the second analysis model is used to verify the compromise result; this method can reduce the false negative rate and false positive rate of compromised hosts and effectively improve the efficiency of handling compromised hosts.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a detection method and system, as well as a storage medium. Background Technology

[0002] Compromised host detection refers to identifying hosts infected with Trojan viruses, i.e., compromised hosts, by detecting information such as network traffic and logs of the host; and then promptly eliminating security risks to ensure the security of the host.

[0003] In existing technologies, the main approach is to compare relevant host data with a threat intelligence database to identify risky hosts, and then conduct risk assessments on these hosts to determine the cause of the compromise. However, current detection methods can only detect known risks based on the threat intelligence database and cannot detect unknown risk behaviors, leading to missed detections. Furthermore, due to the large number of hosts being tested, existing detection methods have a high false positive rate and cannot effectively analyze compromised hosts, resulting in low efficiency in handling compromised hosts. Summary of the Invention

[0004] This application provides a detection method and system, as well as a storage medium, which can reduce the false alarm rate and false alarm rate of compromised hosts, and effectively improve the efficiency of handling compromised hosts.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a detection method, the method comprising:

[0007] Obtain the host's log information;

[0008] The log information is analyzed and processed based on the threat intelligence database and the first analysis model to obtain the initial compromise results of the host; wherein, the first analysis model is used to detect unknown risks;

[0009] The initial trapping result is analyzed and processed based on the second analysis model to obtain the target trapping result; wherein, the second analysis model is used to verify the trapping result.

[0010] Secondly, embodiments of this application provide a detection system, which includes an acquisition unit and an analysis unit.

[0011] The acquisition unit is used to acquire the host's log information;

[0012] The analysis unit is used to analyze and process the log information based on a threat intelligence database and a first analysis model to obtain the initial compromise result of the host; wherein the first analysis model is used to detect unknown risks; and to analyze and process the initial compromise result based on a second analysis model to obtain the target compromise result; wherein the second analysis model is used to verify the compromise result.

[0013] Thirdly, embodiments of this application provide a detection system, which further includes a processor and a memory storing processor-executable instructions. When the instructions are executed by the processor, the detection method described above is implemented.

[0014] Fourthly, embodiments of this application provide a computer-readable storage medium having a program stored thereon, which is applied to a detection system. When the program is executed by a processor, it implements the detection method described above.

[0015] This application provides a detection method and system, as well as a storage medium. The detection system acquires log information from a host; analyzes and processes the log information based on a threat intelligence database and a first analysis model to obtain an initial compromise result of the host; wherein, the first analysis model is used to detect unknown risks; and the initial compromise result is analyzed and processed based on a second analysis model to obtain a target compromise result; wherein, the second analysis model is used to verify the compromise result. Therefore, this application, in addition to using a threat intelligence database to obtain known risks, can also use the first analysis model to detect unknown risks, thereby obtaining an initial compromise result of the host using the threat intelligence database and the first analysis model; and then using the second analysis model to analyze and process the initial compromise result is equivalent to verifying the initial compromise result, and finally obtaining the target compromise result, thereby reducing the false negative rate and false positive rate of compromised hosts, and effectively improving the efficiency of handling compromised hosts. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 1 ;

[0017] Figure 2 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 2 ;

[0018] Figure 3 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 3 ;

[0019] Figure 4 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 4 ;

[0020] Figure 5 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 5 ;

[0021] Figure 6 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 6 ;

[0022] Figure 7 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 7 ;

[0023] Figure 8 This is a schematic diagram illustrating the implementation of the detection method proposed in the embodiments of this application;

[0024] Figure 9 This is a schematic diagram of the composition structure of the detection system proposed in the embodiments of this application. Figure 1 ;

[0025] Figure 10 This is a schematic diagram of the composition structure of the detection system proposed in the embodiments of this application. Figure 2 . Detailed Implementation

[0026] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for explaining the relevant application and not for limiting the application. Furthermore, it should be noted that, for ease of description, only the parts related to the relevant application are shown in the accompanying drawings.

[0027] In related technologies, the main method is to match relevant information from logs with a threat intelligence database to confirm whether a host has been compromised. Although this method supports the detection of massive amounts of data, it cannot discover unknown risky hosts in the intelligence database. Furthermore, the detection results depend entirely on the quality of the intelligence in the threat intelligence database, which is prone to false negatives and false negatives. At the same time, it cannot effectively analyze compromised hosts, resulting in low efficiency in handling compromised hosts.

[0028] To address the problems existing in current detection methods, this application provides a detection method and system, as well as a storage medium. The detection system acquires log information from a host; analyzes and processes the log information based on a threat intelligence database and a first analysis model to obtain an initial host vulnerability result; wherein, the first analysis model is used to detect unknown risks; and analyzes and processes the initial vulnerability result based on a second analysis model to obtain a target vulnerability result; wherein, the second analysis model is used to verify the vulnerability result, which can reduce the false negative rate and false positive rate of compromised hosts and effectively improve the efficiency of handling compromised hosts.

[0029] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0030] Example 1

[0031] This application provides a detection method. Figure 1 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 1 ,like Figure 1 As shown, the method for detecting a compromised host by the detection system may include the following steps:

[0032] Step 101: Obtain the host's log information.

[0033] In the embodiments of this application, when the detection system detects a compromised host, it can first obtain the host's log information.

[0034] It should be noted that, in the embodiments of this application, the log information may include various types of logs, such as Domain Name System (DNS) logs, NetFlow logs, etc.

[0035] Furthermore, in the embodiments of this application, a file storage system can be established to store massive amounts of log information. The file storage system can adopt a distributed file system (Hadoop Distributed File System, HDFS). The file storage system can receive different types of log information through preset ports. For example, the preset ports may include a File Transfer Protocol (FTP) port and a User Datagram Protocol (UDP) port. The FTP port can be used to receive DNS logs, and the UDP port can be used to receive netflow logs. When receiving netflow logs using the UDP port, a parsing tool can be set up to parse the netflow traffic received by the UDP port and store the parsed netflow logs in the file storage system.

[0036] Step 102: Analyze and process the log information based on the threat intelligence database and the first analysis model to obtain the initial compromise results of the host; wherein, the first analysis model is used to detect unknown risks.

[0037] In the embodiments of this application, after the detection system obtains the log information of the host, the detection system can analyze and process the log information based on the threat intelligence database and the first analysis model to obtain the initial compromise result of the host; wherein, the first analysis model is used to detect unknown risks.

[0038] It should be noted that, in the embodiments of this application, analyzing and processing log information based on a threat intelligence database means using the threat intelligence database to match the domain name and Internet Protocol (IP) fields in the log information to identify suspicious compromised hosts; that is, the threat intelligence database can be used to provide known risk behaviors, thereby using the threat intelligence database to analyze and detect log information and identify compromised hosts.

[0039] Furthermore, in the embodiments of this application, the first analysis model refers to a model used to analyze and detect unknown risks; the first analysis model corresponds to log information, that is, the first analysis model is used to analyze and process the corresponding log information, thereby detecting unknown risks and identifying compromised hosts.

[0040] For example, in the embodiments of this application, for DNS logs, the first analysis model can be a model capable of detecting DNS logs. For example, the first analysis model can be a Long Short-Term Memory (LSTM) artificial neural network. Specifically, the domain names in the DNS logs can be filtered using DGA family rules first, and then the LSTM model can be used to identify the domain names suspected of having DGA family rules after filtering. The identified domain names are associated with the DNS logs, and the number of deduplications N of each request IP accessing the suspected DGA domain name is counted. Then, N is compared with a preset value range. When N meets the preset value range, it can be determined as a compromised host, and the request IP is output. That is to say, when the log information is a DNS log, the compromised host can be determined by combining the LSTM model with DGA family rules.

[0041] For example, in the embodiments of this application, for netflow logs, the first analysis model can be a model capable of detecting netflow logs, such as a scanning attack identification model, including an attack identification model for scanning consecutive IPs, a scanning attack identification model based on send / receive ratio, a scanning identification model for multiple consecutive IPs, a scanning identification model for fixed intrusion ports, etc.; it can also be a spam identification model, such as a spam attack identification model for fixed destination IPs.

[0042] Furthermore, in the embodiments of this application, before analyzing and processing the log information based on the threat intelligence database and the first analysis model to obtain the initial compromise result of the host, the initial first analysis model can be trained first, so that after training, a first analysis model that can be directly used can be obtained.

[0043] It is understood that, in the embodiments of this application, based on the analysis and processing of log information based on the threat intelligence database, a type of compromised host can be identified by detecting known risky behaviors; at the same time, by using the first analysis model to analyze and process the log information, another type of compromised host can be identified by detecting unknown risky behaviors, that is, unknown risky behaviors that cannot be detected based on the threat intelligence database can be detected; thus, by using these two types of compromised hosts together as the initial compromised result, the false negative rate of compromised host detection can be effectively reduced.

[0044] Step 103: Analyze and process the initial trapping results based on the second analysis model to obtain the target trapping results; wherein, the second analysis model is used to verify the trapping results.

[0045] In the embodiments of this application, after the detection system analyzes and processes the log information based on the threat intelligence database and the first analysis model to obtain the initial compromise result of the host, it can analyze and process the initial compromise result based on the second analysis model to obtain the target compromise result; wherein, the second analysis model is used to verify the compromise result.

[0046] It should be noted that in the embodiments of this application, the second analysis model is used to verify the compromise results. That is, after obtaining the initial compromise results, the second analysis model can be used to verify the initial compromise results, thereby reducing the false alarm rate of compromised hosts.

[0047] Furthermore, in the embodiments of this application, after the initial compromise result is analyzed and processed by the second analysis model, the target compromise result can be obtained. The target compromise result can not only identify the compromised host, but also determine the cause of the compromised host. Therefore, the compromised host can be directly dealt with and maintained based on the cause of the compromise, effectively improving the efficiency of dealing with the compromised host.

[0048] Furthermore, in the embodiments of this application, the second analysis model includes a trap matching rule table and a preset calculation model; wherein, the trap matching rule table includes a reduced behavior decision table and a preset threat classification; the preset calculation model can be the DS evidence theory.

[0049] Furthermore, in the embodiments of this application, in DS evidence theory, given that U represents a universe of discourse for all possible values ​​of X, and the elements within U are mutually exclusive, then U is called the recognition frame of X. Let U be a recognition frame, then the function m: 2U → [0,1] satisfies m(φ) = 0, At time: m(A) is called the basic probability assignment of A, and m(A) represents the degree of confidence in proposition A; further, as shown in the following formula (1), BEL(A) is the confidence function on U, which represents the degree of confidence in proposition A.

[0050]

[0051] Furthermore, as shown in Equation (2) below, PL(A) is called the plausibility function, which represents the degree of confidence that proposition A is not false, i.e., a measure of the uncertainty that A may be true.

[0052]

[0053] Furthermore, [BEL(A),PL(A)] is called the confidence interval of focal element A, and PL(A)-BEL(A) describes the uncertainty of A, called the uncertainty of focal element A. PL(A) is the upper probability measure defined in evidence theory, and BEL(A) corresponds to the lower probability measure. For the same evidence, different probability assignment functions will be obtained due to different sources. Evidence theory proposes to use orthogonal sums to combine these functions. Let BEL1 and BEL2 be two confidence functions on the same recognition frame U, m1 and m2 be the corresponding basic probability assignments, and the focal elements be A1, A2, ..., Ak and B1, B2, ..., Br, respectively. At that time, it is as shown in the following formula (3):

[0054]

[0055] Where m(E) is the joint probability assignment. If K≠1, then m determines a basic probability assignment; if K=1, then m1 and m2 are considered contradictory, and the basic probability assignments cannot be combined. The above evidence combination rule is called the DS combination rule.

[0056] Specifically, in the embodiments of this application, the initial trapping result is analyzed and processed based on the second analysis model to obtain the target trapping result. This includes two calculation processes: one is to obtain the target trapping result by simultaneously using the trapping matching rule table in the second analysis model and the preset calculation model; the other is to obtain the target trapping result directly based on the trapping matching rule table in the second analysis model.

[0057] Figure 2 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 2 ,like Figure 2 As shown, before the detection system analyzes and processes the initial defect results based on the second analysis model to obtain the target defect result, i.e., before step 103, the method for detecting the defective host by the detection system may also include the following steps:

[0058] Step 104: Obtain behavioral characteristic data of the compromised host based on the historical dataset.

[0059] In the embodiments of this application, the detection system analyzes and processes the initial compromise result based on the second analysis model. Before obtaining the target compromise result, it can also obtain the behavioral characteristic data of the compromised host based on the historical dataset.

[0060] It should be noted that, in the embodiments of this application, the historical dataset may include a verified dataset and a Trojan sandbox running dataset. The verified dataset includes data of compromised hosts that have been verified, and the Trojan sandbox dataset includes data such as virus information or risky behavior of these compromised hosts.

[0061] It is understood that, in the embodiments of this application, the behavioral characteristic data of the compromised host obtained from historical data can reflect the behavioral characteristics of the compromised host.

[0062] Furthermore, in the embodiments of this application, the behavioral characteristic data of the compromised host can be presented in the form of a list.

[0063] For example, in an embodiment of this application, the behavioral characteristic data of the compromised host is presented in the form of Table 1 below:

[0064] Table 1

[0065]

[0066]

[0067] Furthermore, in the embodiments of this application, each preset abnormal behavior feature in the behavior decision table of the compromised host can also be numerically judged; for example, as in the C1 feature in Table 1 above, if the compromised host has high CPU, that is, more than 70% of processes, then mark 1 after the C1 feature, that is, it meets the feature; if the compromised host does not have high CPU, then mark 0; the marking method is not specifically limited in this application.

[0068] Step 105: Determine the behavioral decision table of the compromised host based on behavioral feature data.

[0069] In the embodiments of this application, after the detection system obtains the behavioral feature data of the compromised host based on the historical dataset, it can determine the behavioral decision table of the compromised host based on the behavioral feature data.

[0070] It should be noted that, in the embodiments of this application, the behavior decision table of the compromised host is determined based on behavioral feature data. In addition to the features C1 to C18 mentioned above, the behavior decision table of the compromised host may also include decision information, which may be "whether the host is compromised".

[0071] For example, in an embodiment of this application, the behavior decision table of the compromised host can be presented in the form of Table 2 below:

[0072] Table 2

[0073]

[0074] In this context, 1, 2... on the left are different rules that can be composed of C1 to C18; C1 to C18 are the behavioral features in the previous example; D is the decision information; when D is 1, it means that the host is compromised, and when it is 0, it means that the host is not compromised.

[0075] Step 106: Obtain the second analysis model based on the behavioral decision table.

[0076] In the embodiments of this application, after the detection system determines the behavior decision table of the compromised host based on behavioral feature data, a second analysis model can be obtained based on the behavior decision table.

[0077] It should be noted that, in the embodiments of this application, the second analysis model can be obtained based on the behavior decision table; specifically, the behavior decision table can be reduced first to obtain a reduced behavior decision table; then, the trap matching rule table can be determined based on the reduced behavior decision table and the preset threat classification; finally, the second analysis model can be obtained based on the trap matching rule table and the preset calculation model.

[0078] Figure 3 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 3 ,like Figure 3 As shown, the method by which the detection system obtains the second analysis model based on the behavior decision table, i.e., the method proposed in step 106, may include the following steps:

[0079] Step 106a: Reduce the behavioral decision table to obtain the reduced behavioral decision table.

[0080] In the embodiments of this application, the detection system obtains a second analysis model based on the behavior decision table. Specifically, the detection system can first reduce the behavior decision table to obtain a reduced behavior decision table.

[0081] It should be noted that, in the embodiments of this application, the reduction process is performed on the behavior decision table, and its purpose is to remove redundant feature behaviors and ensure that all feature behaviors after reduction are related to host compromise.

[0082] For example, in the embodiments of this application, the behavior decision table has 18 behavior features, C1 to C18. However, some of these 18 behavior features may be invalid and will not cause host compromise. Therefore, these behavior features can be deleted. For example, if nine of the behavior features in C1 to C18 are invalid, these nine behavior features can be deleted. The behavior decision table built based on the remaining nine behavior features is the reduced behavior decision table.

[0083] For example, in an embodiment of this application, the reduced behavior decision table can be as shown in Table 3:

[0084] Table 3

[0085]

[0086] Among them, ε1 to ε9 are the behavioral characteristics after reduction.

[0087] Step 106b: Determine the trap matching rule table based on the reduced behavior decision table and the preset threat classification; wherein, the trap matching rule table is used to determine the probability of occurrence of the preset threat classification in each rule and the trap trust level corresponding to each rule.

[0088] In the embodiments of this application, the detection system reduces the behavior decision table to obtain the reduced behavior decision table, and then determines the trap matching rule table based on the reduced behavior decision table and the preset threat classification; wherein, the trap matching rule table is used to determine the occurrence probability of the preset threat classification in each rule and the trap trust level corresponding to each rule.

[0089] It should be noted that, in the embodiments of this application, the preset threat classification can be extracted from the threat intelligence database. The preset threat classification can be used as decision information, thereby classifying the information in the reduced behavior decision table into the preset threat classification, thereby creating a trap matching rule table.

[0090] For example, in the embodiments of this application, the preset threat classification may include mining D1, distributed denial-of-service attack (DDOS) D2, worm scanning D3, ransomware D4, and backdoor D5.

[0091] Furthermore, in an embodiment of this application, the process of creating the compromised matching rule table may involve scanning the reduced behavior decision table to obtain records of all corresponding compromised hosts, and then statistically analyzing the records of all compromised hosts to construct the compromised matching rule table.

[0092] It is understood that, in the embodiments of this application, since the compromise matching rule table is composed of records of all compromised hosts by scanning the reduced behavior decision table, the compromise matching rule table can reflect the probability of occurrence of the preset threat category and the compromise trust level corresponding to each rule under each rule.

[0093] For example, in an embodiment of this application, the trap matching rule table can be as shown in Table 4 below:

[0094] Table 4

[0095]

[0096] Based on different rules, the preset threat classification can be represented by different probabilities of occurrence, and the degree of compromise can also be different. For example, as shown in Table 4, if rule 1 is satisfied, the probability of the host being infected by D2 is 41%, and the probability of the host being infected by D3 is 59%. At the same time, when rule 1 is satisfied, the probability of the host being identified as compromised is 70%.

[0097] It is understood that, in the embodiments of this application, the numerical results of the occurrence probability and compromise trust level of the preset threat classification in Table 4 above are obtained by scanning the reduced behavioral decision table and statistically analyzing the records of all compromised hosts. For example, taking the values ​​in Table 4 above as an example, after scanning and statistics, among all hosts that satisfy rule 1, the ratio of compromised hosts infected with D2 to all hosts that satisfy rule 1 is 41%; the ratio of compromised hosts infected with D3 to all hosts that satisfy rule 1 is 59%; and compromised hosts that satisfy rule 1 account for 70% of all hosts that satisfy rule 1.

[0098] Step 106c: Obtain the second analysis model based on the trap matching rule table and the preset calculation model.

[0099] In the embodiments of this application, after the detection system determines the trap matching rule table based on the reduced behavior decision table and the preset threat classification, a second analysis model can be obtained based on the trap matching rule table and the preset calculation model.

[0100] It should be noted that, in the embodiments of this application, the preset calculation model can be the DS evidence theory, that is, the second analysis model can be determined based on the trap matching rule table and the DS evidence theory.

[0101] Figure 4 Schematic diagram of the implementation process of the detection method proposed in this application embodiment Figure 4 ,like Figure 4As shown, the detection system analyzes and processes the initial loss result based on the second analysis model to obtain the target loss result. That is, the method proposed in step 103 may include the following steps:

[0102] Step 103a: Obtain behavioral characteristics from the initial trap results.

[0103] In the embodiments of this application, the detection system analyzes and processes the initial trapping result based on the second analysis model to obtain the target trapping result. Specifically, the detection system can first obtain the behavioral features in the initial trapping result.

[0104] It is understood that, in the embodiments of this application, since the initial compromise results include suspected compromised hosts, the behavioral characteristics obtained from the initial compromise results are the behavioral characteristics of the suspected compromised hosts, and the initial compromise results are further verified based on these behavioral characteristics.

[0105] Step 103b: Match the behavioral characteristics with the second analysis model to obtain the target loss result.

[0106] In the embodiments of this application, after the detection system obtains the behavioral features in the initial trapping result, it can perform matching processing with the second analysis model based on the behavioral features to obtain the target trapping result.

[0107] It should be noted that in the embodiments of this application, the behavioral characteristics of the initial trapping result can be matched with the second analysis model. Specifically, it can include two calculation processes. One is that if the behavioral characteristics match at least two rules in the trapping matching rule table, the rule matching result corresponding to the behavioral characteristics is determined according to the behavioral characteristics and the trapping matching rule table; then, the rule matching result is calculated and processed based on the preset calculation model to obtain the target trapping result. The other is that if the behavioral characteristics match one rule in the trapping matching rule table, the target trapping result is obtained according to the behavioral characteristics and the trapping matching rule table.

[0108] Figure 5 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 5 ,like Figure 5 As shown, if the behavioral characteristics match at least two rules in the trapping matching rule table, then the method for obtaining the target trapping result by matching the behavioral characteristics with the second analysis model, i.e., the method proposed in step 103b, may include the following steps:

[0109] Step 103b1: Determine the rule matching result corresponding to the behavior feature based on the behavior feature and the trap matching rule table.

[0110] In the embodiments of this application, if the behavioral feature matches at least two rules in the trap matching rule table, the detection system performs matching processing with the second analysis model based on the behavioral feature to obtain the target trap result. Specifically, the detection system determines the rule matching result corresponding to the behavioral feature based on the behavioral feature and the trap matching rule table.

[0111] It should be noted that, in the embodiments of this application, if the behavioral feature matches at least two rules in the trap matching rule table, the target trap result needs to be obtained by combining the trap matching rule table and the preset calculation model; first, the rule matching result corresponding to the behavioral feature is determined by using the behavioral feature and the trap matching rule table.

[0112] Furthermore, in the embodiments of this application, the rule matching result refers to the result of sorting out the probability that the behavioral feature occurs under a preset threat category after matching the behavioral feature with the trap matching rule table.

[0113] For example, in an embodiment of this application, the behavioral characteristics conform to two rules in the trap matching rule table, as shown in Table 5 below:

[0114] Table 5

[0115]

[0116]

[0117] Here, 'a' and 'b' are the rules that the behavioral characteristics conform to. Based on different rules, according to rule 'a', the host is considered compromised with a compromise trust level of 0.75, the probability of infecting D1 is 0.5, and the probability of infecting D3 is 0.5. According to rule 'b', the host is considered compromised with a compromise trust level of 0.95, the probability of infecting D1 is 0.3, the probability of infecting D2 is 0.15, and the probability of infecting D4 is 0.55.

[0118] Furthermore, if a behavioral feature matches two rules in the trap matching rule table, the rule matching result corresponding to the behavioral feature is determined based on the behavioral feature and the trap matching rule table; for example, the rule matching result can be shown in Table 6 below:

[0119] Table 6

[0120]

[0121] The result is the product of the occurrence probability of the preset threat category in Table 5 and the compromise trust level. For example, based on rule a, the occurrence probability of D1 in Table 5 is multiplied by the compromise trust level, i.e., 0.5 × 0.75 = 0.375, so the compromise trust level of D1 in Table 6 is 0.375; Φ is the trust level of not being able to confirm whether the host is compromised.

[0122] Step 103b2: Calculate and process the rule matching results based on the preset calculation model to obtain the target loss result.

[0123] In the embodiments of this application, after the detection system determines the rule matching result corresponding to the behavior feature based on the behavior feature and the trapping matching rule table, it can perform calculation processing on the rule matching result based on the preset calculation model to obtain the target trapping result.

[0124] It should be noted that, in the embodiments of this application, the preset calculation model can be the DS evidence theory. After obtaining the rule matching results corresponding to the behavioral features, the rule matching results can be calculated and processed based on the DS evidence theory to obtain the target loss result.

[0125] For example, in the embodiments of this application, the rule matching results are calculated based on DS evidence theory to obtain the target loss result. Taking Table 6 above as an example: K = 0.375 × 0.1425 + 0.375 × 0.5225 + 0.375 × 0.285 + 0.375 × 0.1425 + 0.375 × 0.5225 = 0.606; M(D1) = (0.375 ×0.285+0.375×0.05+0.285×0.25) / (1-K)=0.46; M(D2)=(0.1425×0.25) / (1-K)=0. 1; M(D3)=(0.375×0.05) / (1-K)=0.05; M(D4)=(0.5225×0.25) / (1-K)=0.33; M(D5)=0

[0126] The calculation results are summarized in tabular form as shown in Table 7 below:

[0127] Table 7

[0128]

[0129] As can be understood, as shown in Table 7, the probability of host infection with D1 is 0.46, the probability of infection with D2 is 0.1, the probability of infection with D3 is 0.05, the probability of infection with D4 is 0.33, and the probability of infection with D5 is 0. Adding the probabilities of D1 to D5, the probability of host compromise is 0.94. Therefore, the above results are the results of target compromise.

[0130] Figure 6 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 6 ,like Figure 6As shown, if a behavioral feature matches a rule in the trap matching rule table, the detection system performs matching processing between the behavioral feature and the second analysis model to obtain the target trap result. The method proposed in step 103b may include the following steps:

[0131] Step 103b3: Obtain the target trap result based on behavioral characteristics and the trap matching rule table.

[0132] In the embodiments of this application, if the behavioral feature matches a rule in the trap matching rule table, the detection system performs matching processing with the second analysis model based on the behavioral feature to obtain the target trap result. Specifically, the detection system obtains the target trap result based on the behavioral feature and the trap matching rule table.

[0133] It is understood that in the embodiments of this application, since the behavioral feature only matches one rule in the trap matching rule table, and the occurrence probability and trap trust level of the preset threat category corresponding to each rule have been statistically calculated in the trap matching rule table, there is no need to use the preset calculation model for calculation, and the target trap result corresponding to the behavioral feature can be obtained directly from the trap matching rule table.

[0134] For example, in an embodiment of this application, if the behavioral characteristics only meet rule a in the trap matching rule table, as shown in Table 8 below, the target trap result can be determined as follows: the probability of infecting D1 is 0.5, the probability of infecting D3 is 0.5, and the trap trust level is 0.75.

[0135] Table 8

[0136]

[0137] Figure 7 This is a schematic diagram of the implementation process of the detection method proposed in the embodiments of this application. Figure 7 ,like Figure 7 As shown, the detection system analyzes and processes log information based on a threat intelligence database and a first analysis model to obtain the initial compromise result of the host. The method proposed in step 102 may include the following steps:

[0138] Step 102a: Compare and process the threat intelligence database and log information to obtain the first compromise result.

[0139] In the embodiments of this application, the detection system analyzes and processes log information based on a threat intelligence database and a first analysis model to obtain the initial compromise result of the host. Specifically, the detection system can compare and process the threat intelligence database and log information to obtain the first compromise result.

[0140] It is understood that in the embodiments of this application, the threat intelligence database can be used to detect known risky behaviors. Therefore, by comparing the threat intelligence database and log information, the first compromise result obtained is the compromised host determined based on the known risky behaviors.

[0141] Step 102b: Use the first analysis model to identify the threat information in the log information, obtain the threat identification result, and obtain the second vulnerability result based on the threat identification result.

[0142] In the embodiments of this application, the detection system analyzes and processes log information based on a threat intelligence database and a first analysis model to obtain the initial compromise result of the host. Specifically, the detection system can also use the first analysis model to identify threat information in the log information to obtain threat identification results, and obtain a second compromise result based on the threat identification results.

[0143] It is understood that, in the embodiments of this application, since the first analysis model can be used to detect unknown risk behaviors, the first analysis model can be used to identify threat information in log information, which may include information about unknown risk behaviors, thereby obtaining threat identification results.

[0144] For example, in the embodiments of this application, the first analysis model is an LSTM model. The LSTM model is used to identify DGA domains with suspected DGA family rules in the DNS logs to obtain threat identification results, that is, the threat identification results include the identified DGA domains. Then, statistics can be performed based on the threat identification results to obtain the number N of deduplications of each request IP accessing the identified DGA domains. When N meets the preset value range, the request IPs are output, and the compromised hosts corresponding to these request IPs are the second compromise results. For example, the preset value range can be [5, 20]. If 5≤N≤20, the request IPs can be output, and the compromised hosts corresponding to these request IPs can be determined as the second compromise results.

[0145] Step 102c: Determine the initial trap result based on the first trap result and the second trap result.

[0146] In the embodiments of this application, after the detection system compares and processes the threat intelligence database and log information to obtain a first vulnerability result, identifies the threat information in the log information using a first analysis model to obtain a threat identification result, and obtains a second vulnerability result based on the threat identification result, it can determine the initial vulnerability result based on the first vulnerability result and the second vulnerability result.

[0147] It is understood that, in the embodiments of this application, after comparing and identifying the log information using the threat intelligence database and the first analysis model respectively, the initial compromise result can be determined based on the first compromise result and the second compromise result. This allows the initial compromise result to include compromised hosts determined based on known risk behaviors and hosts determined based on unknown risk behaviors, thereby reducing the false negative rate of compromised host detection.

[0148] This application provides a detection method in which the detection system acquires log information of a host; analyzes and processes the log information based on a threat intelligence database and a first analysis model to obtain an initial compromise result of the host; wherein, the first analysis model is used to detect unknown risks; and the initial compromise result is analyzed and processed based on a second analysis model to obtain a target compromise result; wherein, the second analysis model is used to verify the compromise result. Therefore, this application, in addition to using a threat intelligence database to obtain known risks, can also use the first analysis model to detect unknown risks, thereby obtaining an initial compromise result of the host using the threat intelligence database and the first analysis model; and then using the second analysis model to analyze and process the initial compromise result is equivalent to verifying the initial compromise result, and finally obtaining the target compromise result, thereby reducing the false negative rate and false positive rate of compromised hosts, and thus effectively improving the efficiency of handling compromised hosts.

[0149] Example 2

[0150] In another embodiment of this application, for example, Figure 8 This is a schematic diagram illustrating the implementation of the detection method proposed in the embodiments of this application, as shown below. Figure 8 As shown, the detection system's method for detecting compromised hosts can be divided into three parts: a data storage module, an initial detection module, and a verification detection module. Further, the data storage module primarily uses HDFS. When the log information includes DNS logs and NetFlow logs, it receives NetFlow logs via a UDP port and DNS logs via an FTP port. Then, in the initial detection module, the log information is analyzed or detected, including detecting known risks and unknown risks using a threat intelligence database and a first analysis model, respectively. The initial compromise results obtained from these detections are then sent to the verification detection module. The verification detection module obtains the target compromise result by acquiring the behavioral characteristics from the initial compromise results and combining them with a second analysis model and the behavioral characteristics.

[0151] Specifically, in the embodiments of this application, taking DNS logs and netflow logs as examples, after obtaining the log information, the domain name and IP fields in the log information are first matched based on the threat intelligence database to identify suspicious compromised hosts and determine the first compromise result; at the same time, the threat information in the DNS logs and netflow logs is identified based on the first analysis model to obtain the threat identification result, and the threat identification result is used as the second compromise result. Thus, the initial compromise result is determined based on the first and second compromise results; for the initial compromise result, the detection system can first issue an alarm for the compromised hosts in the initial compromise result.

[0152] Therefore, in the embodiments of this application, the analysis of suspected compromised hosts based on the threat intelligence database and the first analysis model can not only discover known risk behaviors in the threat intelligence database, but also detect unknown risks, thereby reducing the false negative rate of compromised host detection.

[0153] Furthermore, in the embodiments of this application, before verifying the initial trapping result using the second analysis model, it is first necessary to obtain the second analysis model; the second analysis model mainly consists of a trapping matching rule table and a preset calculation model.

[0154] Specifically, in the embodiments of this application, the method for creating a compromised matching rule table mainly includes: firstly, obtaining behavioral characteristic data of compromised hosts based on historical datasets; wherein, the historical dataset may include verified datasets and Trojan sandbox running datasets, the verified datasets include data of compromised hosts that have been verified, and the Trojan sandbox datasets include data such as virus information or risky behaviors of these compromised hosts; and then presenting the behavioral characteristic data of compromised hosts in the form of a list.

[0155] Furthermore, in the embodiments of this application, after obtaining the behavioral characteristic data of the compromised host, a behavioral decision table of the compromised host can be determined based on the behavioral characteristic data.

[0156] Furthermore, in the embodiments of this application, after the behavior decision table is determined, the behavior decision table can be reduced to obtain a reduced behavior decision table.

[0157] Furthermore, in the embodiments of this application, a compromise matching rule table is determined based on the reduced behavior decision table and the preset threat classification; for example, the preset threat classification may include mining type D1, DDoS type D2, worm scanning type D3, ransomware type D4, and backdoor type D5.

[0158] Furthermore, in the embodiments of this application, a second analysis model is obtained based on a fault matching rule table and a preset calculation model; wherein, the preset calculation model can be the DS evidence theory.

[0159] Furthermore, in the embodiments of this application, after the second analysis model is determined by the above method, the second analysis model can be used to further verify the initial trapping results; specifically, the behavioral characteristics in the initial trapping results can be obtained first.

[0160] Furthermore, in the embodiments of this application, if the behavioral feature matches at least two rules in the trap matching rule table in the second analysis model, the rule matching result corresponding to the behavioral feature is determined according to the behavioral feature and the trap matching rule table; finally, the rule matching result is calculated and processed based on the preset calculation model to obtain the target trap result.

[0161] Furthermore, in the embodiments of this application, if the behavioral characteristics match one of the rules in the trap matching rule table, the target trap result can be obtained directly based on the behavioral characteristics and the trap matching rule table.

[0162] Therefore, in the embodiments of this application, the verification of the initial compromise results by the second analysis model can not only reduce false alarms, but also directly locate the cause of the host compromise, such as the compromised host being infected with a certain type of virus. Thus, the compromised host can be dealt with directly based on the cause of the compromise, instead of having to investigate the compromised host to locate the cause of the compromise, which improves the efficiency of handling and realizes the closed loop of analysis, alarm and handling tasks.

[0163] This application provides a detection method in which the detection system acquires log information of a host; analyzes and processes the log information based on a threat intelligence database and a first analysis model to obtain an initial compromise result of the host; wherein, the first analysis model is used to detect unknown risks; and the initial compromise result is analyzed and processed based on a second analysis model to obtain a target compromise result; wherein, the second analysis model is used to verify the compromise result. Therefore, this application, in addition to using a threat intelligence database to obtain known risks, can also use the first analysis model to detect unknown risks, thereby obtaining an initial compromise result of the host using the threat intelligence database and the first analysis model; and then using the second analysis model to analyze and process the initial compromise result is equivalent to verifying the initial compromise result, and finally obtaining the target compromise result, thereby reducing the false negative rate and false positive rate of compromised hosts, and thus effectively improving the efficiency of handling compromised hosts.

[0164] Example 3

[0165] Based on the above embodiments, in another embodiment of this application... Figure 9 This is a schematic diagram of the composition structure of the detection system proposed in the embodiments of this application. Figure 1 ,like Figure 9As shown, the detection system 10 proposed in this application embodiment may include an acquisition unit 11, an analysis unit 12, and a determination unit 13.

[0166] The acquisition unit 11 is used to acquire the host's log information.

[0167] The analysis unit 12 is used to analyze and process the log information based on the threat intelligence database and the first analysis model to obtain the initial compromise result of the host; wherein the first analysis model is used to detect unknown risks; and to analyze and process the initial compromise result based on the second analysis model to obtain the target compromise result; wherein the second analysis model is used to verify the compromise result.

[0168] The acquisition unit 11 is further configured to acquire behavioral characteristic data of the compromised host based on historical datasets before the analysis unit 12 analyzes and processes the initial compromise result based on the second analysis model to obtain the target compromise result.

[0169] The determining unit 13 is used to determine the behavior decision table of the compromised host based on the behavior feature data.

[0170] The acquisition unit 11 is further configured to obtain the second analysis model based on the behavior decision table.

[0171] Further, the acquisition unit 11 is specifically used to reduce the behavior decision table to obtain a reduced behavior decision table; and to determine a trap matching rule table based on the reduced behavior decision table and a preset threat classification; wherein the trap matching rule table is used to determine the occurrence probability of the preset threat classification in each rule and the trap trust level corresponding to each rule; and to obtain the second analysis model based on the trap matching rule table and a preset calculation model.

[0172] Furthermore, the analysis unit 12 is specifically used to obtain behavioral features in the initial trapping result; and to perform matching processing with the second analysis model based on the behavioral features to obtain the target trapping result.

[0173] Furthermore, the analysis unit 12 is also specifically used to determine the rule matching result corresponding to the behavior feature based on the behavior feature and the trap matching rule table if the behavior feature matches at least two rules in the trap matching rule table; and to perform calculation processing on the rule matching result based on the preset calculation model to obtain the target trap result.

[0174] Furthermore, the analysis unit 12 is specifically used to obtain the target trapping result based on the behavioral feature and the trapping matching rule table if the behavioral feature matches one of the rules in the trapping matching rule table.

[0175] Furthermore, the analysis unit 12 is specifically configured to compare and process the threat intelligence database and the log information to obtain a first compromise result; and to use the first analysis model to identify the threat information in the log information to obtain a threat identification result, and to obtain a second compromise result based on the threat identification result; and to determine the initial compromise result based on the first compromise result and the second compromise result.

[0176] Figure 10 This is a schematic diagram of the composition structure of the detection system proposed in the embodiments of this application. Figure 2 ,like Figure 10 As shown, the detection system 10 proposed in this application embodiment may further include a processor 14, a memory 15 storing instructions executable by the processor 14, and further, the detection system 10 may further include a communication interface 16 and a bus 17 for connecting the processor 14, the memory 15 and the communication interface 16.

[0177] In the embodiments of this application, the processor 14 can be at least one of the following: Application-Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field-Programmable Gate Array (FPGA), Central Processing Unit (CPU), Controller, Microcontroller, and Microprocessor. It is understood that for different devices, the electronic device used to implement the above-mentioned processor function can also be other types, and this application embodiment does not specifically limit this. The processor 14 may also include a memory 15, which can be connected to the processor 14. The memory 15 is used to store executable program code, which includes computer operation instructions. The memory 15 may include high-speed RAM memory and may also include non-volatile memory, such as at least two disk drives.

[0178] In embodiments of this application, bus 17 is used to connect communication interface 16, processor 14, and memory 15, as well as the mutual communication between these devices.

[0179] In embodiments of this application, memory 15 is used to store instructions and data.

[0180] Furthermore, in the embodiments of this application, the processor 14 is used to obtain the host's log information;

[0181] The log information is analyzed and processed based on the threat intelligence database and the first analysis model to obtain the initial compromise results of the host; wherein, the first analysis model is used to detect unknown risks;

[0182] The initial trapping result is analyzed and processed based on the second analysis model to obtain the target trapping result; wherein, the second analysis model is used to verify the trapping result.

[0183] In practical applications, the aforementioned memory 15 can be volatile memory, such as random-access memory (RAM); or non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD); or a combination of the above types of memory, and provide instructions and data to the processor 14.

[0184] Furthermore, in this embodiment, the functional modules can be integrated into one analysis unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional module.

[0185] If the integrated unit is implemented as a software functional module and is not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the method of this embodiment. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0186] This application provides a detection system that acquires log information from a host; analyzes and processes the log information based on a threat intelligence database and a first analysis model to obtain an initial compromise result of the host; wherein, the first analysis model is used to detect unknown risks; and the initial compromise result is analyzed and processed based on a second analysis model to obtain a target compromise result; wherein, the second analysis model is used to verify the compromise result. Therefore, this application, in addition to using a threat intelligence database to obtain known risks, can also use the first analysis model to detect unknown risks, thereby obtaining an initial compromise result of the host using the threat intelligence database and the first analysis model; and then using the second analysis model to analyze and process the initial compromise result is equivalent to verifying the initial compromise result, and finally obtaining the target compromise result, thereby reducing the false negative rate and false positive rate of compromised hosts, and effectively improving the efficiency of handling compromised hosts.

[0187] Specifically, the program instructions corresponding to a detection method in this embodiment can be stored on storage media such as optical discs, hard disks, and USB flash drives. When the program instructions corresponding to a detection method in the storage media are read or executed by an electronic device, the following steps are included:

[0188] Obtain the host's log information;

[0189] The log information is analyzed and processed based on the threat intelligence database and the first analysis model to obtain the initial compromise results of the host; wherein, the first analysis model is used to detect unknown risks;

[0190] The initial trapping result is analyzed and processed based on the second analysis model to obtain the target trapping result; wherein, the second analysis model is used to verify the trapping result.

[0191] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0192] This application is described with reference to schematic and / or block diagrams of implementations of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the schematic and / or block diagrams can be implemented by computer program instructions, and combinations of blocks in the schematic and / or block diagrams can be implemented. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the schematic and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0193] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the implementation flow diagram. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0194] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0195] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A detection method, characterized in that, The method includes: Obtain the host's log information; The log information is analyzed and processed based on the threat intelligence database and the first analysis model to obtain the initial compromise result of the host; wherein, the first analysis model is used to detect unknown risks; the first analysis model includes a model for identifying domain names of DGA family rules in the Domain Name System logs, determining the number of deduplications of accessing DGA domain names based on the identified domain names, and comparing the number of deduplications with a preset numerical range. The initial compromise result is analyzed and processed based on the second analysis model to obtain the target compromise result; wherein, the second analysis model is used to verify the initial compromise result and determine the compromised host and the cause of the compromise; the second analysis model includes a compromise matching rule table and a preset calculation model; the compromise matching rule table is used to characterize the probability of occurrence of a preset threat category under each rule and the compromise trust level corresponding to each rule; The step of analyzing and processing the initial loss result based on the second analysis model to obtain the target loss result includes: Obtain the behavioral characteristics from the initial trap results; If the behavioral feature matches at least two rules in the trap matching rule table, then the rule matching result corresponding to the behavioral feature is determined based on the behavioral feature and the trap matching rule table. The rule matching results are processed based on the preset calculation model to obtain the target loss result.

2. The method according to claim 1, characterized in that, Before analyzing and processing the initial loss result based on the second analysis model to obtain the target loss result, the method further includes: Obtain behavioral characteristic data of compromised hosts based on historical datasets; The behavioral decision table of the compromised host is determined based on the behavioral characteristic data; The second analytical model is obtained based on the behavioral decision table.

3. The method according to claim 2, characterized in that, Obtaining the second analysis model based on the behavioral decision table includes: The behavior decision table is reduced to obtain a reduced behavior decision table; A compromise matching rule table is determined based on the reduced behavior decision table and the preset threat classification; wherein, the compromise matching rule table is used to determine the probability of occurrence of the preset threat classification in each rule and the compromise trust level corresponding to each rule; The second analysis model is obtained based on the loss matching rule table and the preset calculation model.

4. The method according to claim 1, characterized in that, If the behavioral feature matches a rule in the trapping matching rule table, then the step of matching the behavioral feature with the second analysis model to obtain the target trapping result includes: The target trapping result is obtained based on the behavioral characteristics and the trapping matching rule table.

5. The method according to claim 1, characterized in that, The analysis and processing of the log information based on the threat intelligence database and the first analysis model to obtain the initial compromise results of the host includes: The first compromise result is obtained by comparing the threat intelligence database and the log information. The first analysis model is used to identify threat information in the log information to obtain threat identification results, and a second vulnerability result is obtained based on the threat identification results; The initial trap result is determined based on the first trap result and the second trap result.

6. A detection system, characterized in that, The detection system includes an acquisition unit and an analysis unit. The acquisition unit is used to acquire the host's log information; The analysis unit is used to analyze and process the log information based on a threat intelligence database and a first analysis model to obtain the initial compromise result of the host; wherein, the first analysis model is used to detect unknown risks; and to analyze and process the initial compromise result based on a second analysis model to obtain the target compromise result; The analysis unit is also used to obtain behavioral characteristics in the initial loss result; The analysis unit is further configured to: if the behavioral feature matches at least two rules in the trap matching rule table, determine the rule matching result corresponding to the behavioral feature based on the behavioral feature and the trap matching rule table; and perform calculation processing on the rule matching result based on a preset calculation model to obtain the target trap result. The detection system also includes: The first analysis model includes a model for identifying domains that follow DGA family rules in the Domain Name System logs, determining the number of duplicates of accessing DGA domains based on the identified domains, and comparing the number of duplicates with a preset numerical range. The second analysis model is used to verify the initial compromise results and determine the compromised host and the cause of the compromise. The second analysis model includes a compromise matching rule table and a preset calculation model. The compromise matching rule table is used to characterize the probability of occurrence of a preset threat category under each rule and the compromise trust level corresponding to each rule.

7. A detection system, characterized in that, The detection system further includes a processor and a memory storing processor-executable instructions, which, when executed by the processor, implement the method as described in any one of claims 1-5.

8. A computer-readable storage medium having a program stored thereon for use in a detection system, wherein the program, when executed by a processor, implements the method as described in any one of claims 1-5.

Images