Network security data detection method and device, electronic device, and storage medium

Abstract

The present disclosure provides a network security data detection method and device, electronic equipment, and storage medium, which relate to the field of network security technology. The network security data detection method includes: obtaining security events within a predetermined period to obtain a security event set; screening the security events in the security event set based on a false alarm event screening rule to obtain a false alarm event set, wherein the false alarm event screening rule is determined based on the rule id, response code type, and attribute value of the security event; evaluating the importance of the rule id in the false alarm event set based on an importance evaluation model to obtain a rule id importance value; generating a false alarm event detection report based on the rule id importance value and the false alarm event set. The solution disclosed in the present disclosure uses a false alarm event screening rule to screen security events, and measures the importance of false alarm events according to the importance evaluation model, which is conducive to the efficient investigation of false alarm events.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a network security data detection method and device, an electronic device, and a storage medium. Background Art

[0002] With the increasing importance of cybersecurity and the rapid development of the internet, secure web behavior has become particularly crucial. Currently, suspicious web security incidents are typically identified by matching security rules with traffic data. To cover as many suspicious incidents as possible, security rules are adjusted to a broader scope, resulting in a surge in false positives and significantly increasing personnel processing costs. Currently, false positive detection for web security incidents typically involves manual screening of output security events to determine whether they are false positives. This manual screening method is inefficient and difficult to guarantee accuracy. However, adjusting security rules to improve event accuracy requires a high degree of timeliness, which is difficult to achieve. Furthermore, security rules come in a variety of formats, making them difficult to use directly. This makes it difficult to generate intuitive and effective false positive event report results during screening, hindering subsequent false positive event processing and rule adjustments.

[0003] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the Invention

[0004] The purpose of the present disclosure is to provide a network security data detection method and device, an electronic device, and a storage medium, which, at least to a certain extent, overcome the problem of low efficiency in manually troubleshooting false positive security incidents in related technologies.

[0005] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by practice of the present disclosure.

[0006] According to a first aspect of the present disclosure, a network security data detection method is provided, comprising:

[0007] Obtain security events within a predetermined period and obtain a security event set;

[0008] Filter the security events in the security event set based on a false alarm event screening rule to obtain a false alarm event set, wherein the false alarm event screening rule is determined based on a rule ID, a response code type, and an attribute value of the security event;

[0009] Performing an importance evaluation on the rule IDs in the false alarm event set based on an importance evaluation model to obtain a rule ID importance value;

[0010] A false alarm event detection report is generated based on the rule id importance value and the false alarm event set.

[0011] In one embodiment of the present disclosure, generating a false alarm event detection report based on the rule ID importance value and the false alarm event set includes:

[0012] Get the security rule set;

[0013] Matching the security event set with the security rule set to obtain a matching rule set;

[0014] Performing a regular matching test on the security events in the false alarm event set based on the matching rule set to obtain a regular matching result;

[0015] Based on the regular matching result and the rule ID importance value, the false alarm event detection report is generated.

[0016] In one embodiment of the present disclosure, a regular matching test is performed on the security events in the false alarm event set based on the matching rule set to obtain a regular matching result, including:

[0017] Precompiling the regular expressions in the matching rule set to obtain precompiled rules;

[0018] Performing regular expression matching on the security events in the false alarm event set based on the precompiled rules to obtain a matching string;

[0019] The matching substring and the corresponding matching position are recorded.

[0020] In one embodiment of the present disclosure, the regular expressions in the matching rule set are precompiled to obtain precompiled rules, including:

[0021] Get string transcoding rules;

[0022] Precompiling the regular expression according to the string transcoding rule to obtain a precompiled expression;

[0023] Determining whether the precompiled expression conforms to a predetermined format;

[0024] If so, the precompiled expression is used as the precompiled rule.

[0025] In one embodiment of the present disclosure, the security events in the security event set are screened based on the false alarm event screening rule to obtain a false alarm event set, including:

[0026] Dividing the security event set into a plurality of security event subsets based on the rule ID;

[0027] For each of the security event subsets, perform the following steps:

[0028] Determine whether there is a security event with a response code of a preset value in the security event subset;

[0029] If so, retain the security events whose response codes are the preset values ​​and generate a reserved event set;

[0030] If not, all security events are retained to generate a retained event set;

[0031] Obtain the number of security events corresponding to each response code in the retained event set;

[0032] Using a predetermined number of response codes with the largest number of security events as screening response codes;

[0033] Obtaining the security event corresponding to the screening response code to obtain a screening event set;

[0034] Filtering the filtering event set based on the attribute value to obtain false alarm events;

[0035] All false positive events in the security event subset are aggregated to obtain the false positive event set.

[0036] In one embodiment of the present disclosure, the screening event set is screened based on the attribute value to obtain false positive events, including:

[0037] The security events with the most non-empty attribute values ​​in the filtered event set are regarded as false alarm events.

[0038] In one embodiment of the present disclosure, the preset value of the response code is 2xx, where x represents any numerical value.

[0039] In one embodiment of the present disclosure, the importance of the rule IDs in the false alarm event set is evaluated based on an importance evaluation model to obtain the rule ID importance value, including:

[0040] Obtain the rule ID in the false alarm event set;

[0041] Obtain the importance assessment model, wherein the importance assessment model is expressed as:

[0042]

[0043] Where f(b, n, g) represents the importance of the rule ID; b∈{0, 1}, when there is a security event with a response code equal to the preset value, b=1; when there is no security event with a response code equal to the preset value, b=0; n represents the number of security events corresponding to the rule ID, g represents the risk level corresponding to the rule ID, G represents the number of risk level categories, and G is a constant;

[0044] Obtain the model parameters corresponding to the rule id, the model parameters including b, n, and g;

[0045] The model parameters are input into the importance evaluation model to obtain the importance value of the rule ID.

[0046] In one embodiment of the present disclosure, the content of the false alarm event detection report includes: analysis date, analyzed event period, rule name, rule id, number of security events corresponding to the rule id, number of events corresponding to each response code, event security rule, url regular, event url attribute value, request header regular, event request header attribute value, response header regular, event response header attribute value, request body regular, event request body attribute value, response body regular, and event response body attribute value.

[0047] In one embodiment of the present disclosure, generating the false alarm event detection report based on the regular expression matching result and the rule ID importance value further includes:

[0048] The false alarm event detection report is labeled and / or sorted according to the rule ID importance value and the regular matching result.

[0049] In one embodiment of the present disclosure, the method further includes: acquiring the false alarm event set or the false alarm event detection report according to a preset execution cycle.

[0050] According to a second aspect of the present disclosure, there is provided a network security data detection device, comprising:

[0051] An acquisition module is used to acquire security events within a predetermined period and obtain a security event set;

[0052] a screening module, configured to screen the security events in the security event set based on a false alarm event screening rule to obtain a false alarm event set, wherein the false alarm event screening rule is determined based on a rule ID, a response code type, and an attribute value of the security event;

[0053] An importance evaluation module is used to evaluate the importance of the rule IDs in the false alarm event set based on an importance evaluation model to obtain the rule ID importance value;

[0054] A report generation module is used to generate a false alarm event detection report based on the rule ID importance value and the false alarm event set.

[0055] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-mentioned network security data detection method by executing the executable instructions.

[0056] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned network security data detection method is implemented.

[0057] The network security data detection method and device, electronic device, and storage medium provided by the embodiments of the present disclosure first obtain security events within a certain period, and filter the obtained security events through false alarm event screening rules to obtain a false alarm event set with a higher possibility of false alarms. The false alarm event screening rules are determined based on the rule id, response code type, and attribute value of the security event. This method can effectively reduce the number of repeated and redundant events, extract events with analytical value, and greatly reduce the consumption of computing resources. Then, the importance of the rule id in the false alarm event set is evaluated through the importance evaluation model to obtain the importance value of the rule id. The importance of the security events in the false alarm event set is measured and sorted by the importance value of the rule id, which is conducive to the efficient investigation of false alarm events and greatly improves the work efficiency of security personnel.

[0058] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The accompanying drawings are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0060] Figure 1 A flowchart of network security data detection according to an embodiment of the present disclosure is shown;

[0061] Figure 2 A flowchart showing a false alarm event screening process according to an embodiment of the present disclosure is shown;

[0062] Figure 3 A flowchart illustrating importance evaluation in an embodiment of the present disclosure is shown;

[0063] Figure 4 A diagram showing the structure of an importance assessment model in an embodiment of the present disclosure is shown;

[0064] Figure 5 A flowchart of generating a false alarm event detection report based on the rule ID importance value and the false alarm event set in an embodiment of the present disclosure is shown;

[0065] Figure 6 A flowchart illustrating a method for detecting network security data in a specific application scenario in an embodiment of the present disclosure is shown;

[0066] Figure 7 A schematic diagram showing a network security data detection device according to an embodiment of the present disclosure; and

[0067] Figure 8 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0068] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0069] In addition, the accompanying drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. Identical reference numerals in the figures denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0070] Figure 1 The flowchart of the network security data detection method disclosed in the present invention is exemplified. The execution subject of this method can be a network security device, specifically a physical device or a virtual machine. Figure 1 As shown, the network security data detection method 100 of the present disclosure includes:

[0071] Step S110, obtaining security events within a predetermined period to obtain a security event set;

[0072] Step S120, screening the security events in the security event set based on a false alarm event screening rule to obtain a false alarm event set, wherein the false alarm event screening rule is determined based on a rule ID, a response code type, and an attribute value of the security event;

[0073] Step S130, performing importance evaluation on the rule IDs in the false alarm event set based on the importance evaluation model to obtain the rule ID importance value;

[0074] Step S140: Generate a false alarm event detection report based on the rule ID importance value and the false alarm event set.

[0075] The network security data detection method provided by the embodiment of the present disclosure first obtains security events within a certain period, and then filters the obtained security events through false alarm event screening rules to obtain a set of false alarm events with a higher possibility of false alarms. The false alarm event screening rules are determined based on the rule ID, response code type and attribute value of the security event. This method can effectively reduce the number of repeated and redundant events, extract events with analytical value, and greatly reduce the consumption of computing resources. Then, the importance of the rule ID in the false alarm event set is evaluated through the importance evaluation model to obtain the importance value of the rule ID. The importance of the security events in the false alarm event set is measured and sorted by the importance value of the rule ID, which is conducive to the efficient investigation of false alarm events and greatly improves the work efficiency of security personnel.

[0076] Below, each step of the network security data detection method in this example implementation will be described in more detail with reference to the accompanying drawings and embodiments.

[0077] In step S110, security events within a predetermined period are obtained to obtain a security event set. Specifically, the predetermined period can be set based on the volume of security events generated, for example, obtaining security events generated within the past week. In one embodiment, security events can be read from an Elasticsearch index, and then the security event set is checked for false positives.

[0078] In step S120, the security events in the security event set are screened based on the false alarm event screening rule to obtain a false alarm event set.

[0079] See also Figure 2 In one embodiment of the present disclosure, step S120 specifically includes:

[0080] Step S210: Divide the security event set into multiple security event subsets based on rule IDs. Each rule_id corresponds to a security event subset. For example, rule_ids are 1001, 1002, etc.

[0081] For each of the security event subsets, perform the following steps:

[0082] Step S220, determining whether there is a security event in the security event subset whose response code is a preset value. Specifically, the response code is an HTTP response status code. There are five types of response codes, represented by their first digit. Among them, 1xx means: information, the request is received, and processing continues; 2xx means: success, the behavior is successfully accepted, understood, and adopted; 3xx means: redirection, further action must be performed to complete the request; 4xx means: client error, the request contains a syntax error or the request cannot be implemented; 5xx means: server error, the server cannot implement a clearly invalid request. Specifically, in step S220, the preset value of the response code is 2xx, and x represents any value.

[0083] Step S230: If yes, retain the security events with response codes equal to the preset value and generate a set of retained events, for example, retain only all security events with response codes equal to 2xx.

[0084] Step S240: If not, retain all security events and generate a retained event set.

[0085] Step S250: Obtain the number of security events corresponding to each response code in the retained event set.

[0086] Step S260: Select a predetermined number of response codes with the largest number of security events as screening response codes. Specifically, select the top n response codes with the largest number of security events, where n can be 1, 2, 3, 4, etc. For example, select the top three response codes with the largest number of security events.

[0087] In one embodiment of the present disclosure, if the number of response codes in the reserved event set is less than a predetermined number, all response codes are selected as screening response codes. For example, when n=3, if there are only 2 response codes in the reserved event set, all response codes are selected as screening response codes.

[0088] Step S270: Obtain the security events corresponding to the screening response codes to obtain a screening event set. Specifically, select n security events corresponding to the screening response codes to obtain a screening event set.

[0089] Step S280 filters the filtered event set based on attribute values ​​to obtain false positive events. Specifically, this step includes selecting the security event with the most non-null attribute values ​​in the filtered event set as the false positive event. The attribute values ​​of a security event include a URL string, request header information, request body information, response header information, and response body information. The event with the most non-null attribute values ​​among these five is selected as the false positive event.

[0090] Furthermore, in one embodiment of the present disclosure, if there are multiple security events with the same number of non-null attribute values ​​in the filtered event set, a security event is randomly selected as a false alarm event.

[0091] Step S290: Summarize all false alarm events in the security event subset to obtain the false alarm event set.

[0092] In step S130, the importance of the rule IDs in the false alarm event set is evaluated based on the importance evaluation model to obtain the rule ID importance value.

[0093] See also Figure 3 In one embodiment of the present disclosure, step S130 specifically includes:

[0094] Step S310, obtaining the rule ID in the false alarm event set;

[0095] Step S320: Obtain the importance assessment model, wherein the importance assessment model is expressed as:

[0096]

[0097] Wherein, in formula (1), f(b, n, g) represents the importance of the rule id; b∈{0, 1}, when there is a security event with a response code of the preset value, b=1, and when there is no security event with a response code of the preset value, b=0; n represents the number of security events corresponding to the rule id, g represents the risk level corresponding to the rule id, G represents the number of risk level categories, and G is a constant;

[0098] Step S330, obtaining the model parameters corresponding to the rule id, the model parameters including b, n, g;

[0099] Step S340: Input the model parameters into the importance evaluation model to obtain the importance value of the rule ID.

[0100] See also Figure 4 , schematically shows the structure of the importance assessment model. The importance of the rule ID is evaluated by parameters b, n, and g. The importance of the rule ID is evaluated overall from three dimensions: whether there is a security incident with a response code of 2xx (parameter b), the total number of security incidents (parameter n), and the rule risk level (parameter g). This can effectively further investigate and screen security incidents with a high possibility of false alarms.

[0101] Step S140: Generate a false alarm event detection report based on the rule ID importance value and the false alarm event set.

[0102] See also Figure 5In one embodiment of the present disclosure, step S140 includes:

[0103] Step S510: Obtain a security rule set. Specifically, a security rule contains five regular expression string attributes: URL regular expression, request header regular expression, request body regular expression, response header regular expression, and response body regular expression. Correspondingly, a web security event contains five attributes: URL string, request header information, request body information, response header information, and response body information.

[0104] Step S520: Match the security event set and the security rule set to obtain a matching rule set. Specifically, the matching process includes comparing the rule_id in the security rule set with the rule_id in the security event set, retaining only the security rules whose rule_id appears in the security event set, and obtaining a matching rule set.

[0105] Step S530 : performing a regular matching test on the security events in the false alarm event set based on the matching rule set to obtain a regular matching result.

[0106] In one embodiment of the present disclosure, step S530 specifically includes: pre-compiling the regular expressions in the matching rule set to obtain pre-compiled rules; performing regular matching on the security events in the false alarm event set based on the pre-compiled rules to obtain matching strings; and recording the matching substrings and corresponding matching positions. Specifically, for each web security event with a high false alarm possibility in the filtered false alarm event set, the web rule pre-compiled regular object corresponding to rule_id is taken out to perform regular matching tests on each field, and the position of each matching substring is recorded. Through the regular matching test process, it can be known which attribute of the security event hits the corresponding web security event, thereby providing a corresponding basis for the subsequent analysis of false alarm security events.

[0107] Furthermore, in one embodiment of the present disclosure, the regular expression in the matching rule set is precompiled to obtain a precompiled rule, specifically including: obtaining a string transcoding rule; precompiling the regular expression according to the string transcoding rule to obtain a precompiled expression; judging whether the precompiled expression conforms to a predetermined format; if so, taking the precompiled expression as the precompiled rule. For example, in a specific scenario, there is a security rule: (rule_id=1001, URL_regex=”\x68\x65\x6C\x6C\x6F\w+\.jsp”), the hexadecimal part (“\x68\x65\x6C\x6C\x6F”) thereof is transcoded, and after transcoding, the entire regular expression is parsed as: “hello\w+\.jsp”. In subsequent regular matching tests, regular matching tests are performed using the precompiled rule “hello\w+\.jsp”, which can effectively improve matching efficiency.

[0108] All regular expressions are precompiled. For example, if a regular expression such as "hello\w+[\]\.jsp" is present, a compilation error will occur, recording that the URL regular syntax of this rule is incorrect. By transcoding the rules, it is compatible with the encoded regular expressions and can detect regular syntax errors, providing strong robustness and scalability.

[0109] Step S540: Generate the false alarm event detection report based on the regular expression matching result and the rule ID importance value. The false alarm event detection report is compiled based on the regular expression matching process of the false alarm event set and the analysis results of the importance evaluation model.

[0110] In one embodiment of the present disclosure, the content of the false alarm event detection report includes: analysis date, analyzed event period, rule name, rule id, number of security events corresponding to the rule id, number of events corresponding to each response code, event security rule, url regular, event url attribute value, request header regular, event request header attribute value, response header regular, event response header attribute value, request body regular, event request body attribute value, response body regular, event response body attribute value, etc.

[0111] In one embodiment of the present disclosure, after step S540, the process further includes: annotating and / or sorting the false positive event detection report based on the rule ID importance value and the regular expression matching result. Specifically, false positive events are sorted based on the rule ID importance value, with web security events with higher importance values ​​placed first for easier review. Alternatively, based on the position of the matching string recorded in the regular expression matching result, the matching substring is marked with special formatting in the false positive event detection report, such as bolding, highlighting, etc.

[0112] Furthermore, false alarm event detection reports can be output according to a pre-set report format. By providing intuitive report output and displaying and marking the most important information, the efficiency of security personnel can be greatly improved, and security rules can be modified and updated quickly.

[0113] In one embodiment of the present disclosure, the network security data detection method of the present disclosure further includes:

[0114] Step S150, obtain the false alarm event set or the false alarm event detection report according to the preset execution cycle. The false alarm event detection report can be obtained by setting a periodic task execution. The execution cycle can be configured according to the time granularity of the required analysis, and the execution cycle can be one day, one week, one month, etc., which is specifically limited by the present disclosure. In addition, an independent program module can be deployed separately, and a scheduled task of an independent program can be configured using crontab to be executed every Monday at 10 am. Run in off-peak to avoid running in parallel with other programs that consume more resources. In other embodiments, a calling interface can also be provided for the security event analysis program to call to achieve real-time analysis.

[0115] See also Figure 6 As shown, the network security data monitoring method disclosed in the present invention is further explained below by taking a certain web security incident as an example.

[0116] In step S601, all web security events generated in the past week are read from the elasticsearch index as the original event set to be checked, recorded as event set D 610; all web security rules in the MySQL rule base are read as the rule set to be matched, recorded as rule set R 620.

[0117] Step S602 , find the set RID consisting of all rule_ids in the event set D, remove the rules that are not in RID from R, that is, retain {r|r.rule_id∈RID∧r∈R}, and obtain the matching rule set r630 .

[0118] Step S603 precompiles the security rules in the matching rule set r. For example, if the security rule is (rule_id=1001, URL_regex=”\x68\x65\x6C\x6C\x6F\w +\.jsp”), the hexadecimal portion “\x68\x65\x6C\x6C\x6F” is identified and transcoded, and the entire regular expression is parsed as “hello\w+\.jsp”. Then, all security rules (regular expressions) are precompiled to obtain precompiled regular expression 640. If a regular expression such as “hello\w+[\]\.jsp” exists, a compilation error occurs, and the URL regular expression syntax of this security rule is recorded as incorrect.

[0119] In step S604, assuming the existing data is as shown in Table 1, the security event set includes two security event subsets: rule_id = 1001 and rule_id = 1002. In the security event subset with rule_id = 1001, the number of events with a response code of 200 is 20; the number of events with a response code of 202 is 2; and the number of events with a response code of 301 is 24. In the security event subset with rule_id = 1002, the number of events with a response code of 301 is 23; and the number of events with a response code of 302 is 99.

[0120] Table 1

[0121] rule_id http_code:count 1001 200:20,202:2,301:24 1002 301:23,302:99

[0122] For the security event subset with rule_id = 1001, remove event data with a response code of 301. Since the number of events with a response code of 200 is the largest, select response code 200 as the screening response code. Next, among the events with (rule_id = 1001, http_code = 200), select the event with the most non-empty values ​​for the five attributes: URL string, request header information, request body information, response header information, and response body information. If multiple events meet this condition, randomly select one of them as the false positive event corresponding to rule_id = 1001.

[0123] For the security event subset with rule_id = 1002, since there are no events with response codes 2xx, all security events are retained. Events with response code 302 are the most numerous, so response code 302 is selected as the screening response code. Next, among the events with (rule_id = 1002, http_code = 302), the event with the most non-null attributes (URL string, request header information, request body information, response header information, and response body information) is selected. If multiple events meet this condition, one is randomly selected as the false positive event corresponding to rule_id = 1002.

[0124] The false alarm event set 650 obtained through the above steps includes the two web events with high false alarm possibilities obtained through the above screening.

[0125] In step S605, for the two web events with high false positive potential (rule_id = 1001, http_code = 200, url = / app / helloworld.jsp, ...) and (rule_id = 1002, http_code = 302, url = ...), the web rule pre-compiled regular expression objects for rule_id = 1001 and rule_id = 1002 are extracted and tested for regular expression matching on the five fields: URL, request header, request body, response header, and response body. The position of each matching substring is recorded. For example, in the case of rule_id = 1001, the string " / app / helloworld.jsp" is matched by the regular expression "hello\w+\.jsp" to the substring "helloworld.jsp", and the matching position is recorded as (5, 18).

[0126] Step S606: Use the importance assessment model 660 to measure the importance of rule_id. Define three attributes: whether there is a response code of 2xx, the number of events, and the risk level of the rule, which are recorded as If there are three risk levels (high, medium, and low), then G = 3. Taking the data in Table 1 as an example, the parameters of the importance assessment model are shown in Table 2. In the security event subset with rule_id = 1001, there are events with a response code of 2xx, so b = 1; the number of security events with rule_id = 1001 is 46 (20 + 2 + 24), so n = 46; the risk level is 3, so g = 3. In the security event subset with rule_id = 1002, there are no events with a response code of 2xx, so b = 0, the number of security events with rule_id = 1002 is 122 (23 + 99), and the risk level is 1.

[0127] Table 2

[0128] rule_id b n g 1001 1 46 3 1002 0 122 1

[0129] According to formula (1), we can get:

[0130] f(1,46,3)≈0.77556

[0131] f(0,122,1)≈0.27852

[0132] Therefore, the importance value of rule_id=1001 is 0.77556, and the importance value of rule_id=1002 is 0.27852.

[0133] In step S607, based on the matching results of step S605 and the importance measurement results of step S606, the following information is compiled: analysis date, analyzed event period, rule name, rule ID, number of events associated with that ID, number of events associated with each response code, URL regular expression, URL event attribute value, request header regular expression, event request header attribute value, response header regular expression, event response header attribute value, request body regular expression, event request body attribute value, response body regular expression, and event response body attribute value, and a false positive event detection report 670 is generated. Since rule_id = 1001 has a higher importance, it is marked in bold and red font in the report based on the position of the matching substring recorded, such as (5, 18). The report is then sorted by rule_id importance, with events associated with rule_id = 1001 listed first and events associated with rule_id = 1002 listed last.

[0134] Figure 7 This is a module diagram of an embodiment of the network security data detection device disclosed in the present invention. Figure 7 As shown, a network security data detection device 700 includes:

[0135] An acquisition module 710 is configured to acquire security events within a predetermined period and obtain a security event set;

[0136] a screening module 720 for screening the security events in the security event set based on a false alarm event screening rule to obtain a false alarm event set, wherein the false alarm event screening rule is determined based on a rule ID, a response code type, and an attribute value of the security event;

[0137] The importance evaluation module 730 is used to evaluate the importance of the rule ID in the false alarm event set based on the importance evaluation model to obtain the rule ID importance value;

[0138] The report generation module 740 is configured to generate a false alarm event detection report based on the rule ID importance value and the false alarm event set.

[0139] The network security data detection device provided by the embodiment of the present disclosure first obtains security events within a certain period, and filters the obtained security events through false alarm event screening rules to obtain a set of false alarm events with a higher possibility of false alarms. The false alarm event screening rules are determined based on the rule ID, response code type and attribute value of the security event. This method can effectively reduce the number of repeated and redundant events, extract events with analytical value, and greatly reduce the consumption of computing resources. Then, the importance of the rule ID in the false alarm event set is evaluated through the importance evaluation model to obtain the importance value of the rule ID. The importance of the security events in the false alarm event set is measured and sorted by the importance value of the rule ID, which is conducive to the efficient investigation of false alarm events and greatly improves the work efficiency of security personnel.

[0140] In one embodiment of the present disclosure, the network security data detection device 700 may further include modules for implementing other process steps of the aforementioned network security data detection method embodiments. Since the various functions of the network security data detection device 700 have been described in detail in their corresponding method embodiments, this disclosure will not repeat them here.

[0141] It should be noted that although several modules or units of the device for action execution are mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0142] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above-mentioned network security data detection method is also provided.

[0143] Those skilled in the art will appreciate that various aspects of the present invention may be implemented as systems, methods, or program products. Therefore, various aspects of the present invention may be implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which may be collectively referred to herein as "circuits," "modules," or "systems."

[0144] Refer to the following Figure 8 The electronic device 800 shown in FIG8 is merely an example and does not limit the functions and scope of use of the embodiment of the present invention.

[0145] like Figure 8As shown, electronic device 800 is implemented as a general-purpose computing device. Components of electronic device 800 may include, but are not limited to, the aforementioned at least one processing unit 810, the aforementioned at least one storage unit 820, and a bus 830 connecting various system components (including storage unit 820 and processing unit 810).

[0146] The storage unit stores program codes that can be executed by the processing unit 810, so that the processing unit 810 performs the steps according to various exemplary embodiments of the present invention described in the "Exemplary Method" section above. For example, the processing unit 810 may perform the following steps: Figure 1 In step S110 shown in the figure, security events within a predetermined period are obtained to obtain a security event set; in step S120, security events in the security event set are screened based on false alarm event screening rules to obtain a false alarm event set, wherein the false alarm event screening rules are determined based on the rule ID, response code type and attribute value of the security event; in step S130, importance evaluation is performed on the rule ID in the false alarm event set based on an importance evaluation model to obtain a rule ID importance value; in step S140, a false alarm event detection report is generated based on the rule ID importance value and the false alarm event set.

[0147] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 8201 and / or a cache memory unit 8202 , and may further include a read-only memory unit (ROM) 8203 .

[0148] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0149] Bus 830 may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0150] The electronic device 800 can also communicate with one or more external devices 900 (e.g., a keyboard, a pointing device, a Bluetooth device, etc.), one or more devices that enable a user to interact with the electronic device 600, and / or any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., a router, a modem, etc.). Such communication can occur via an input / output (I / O) interface 850. Furthermore, the electronic device 800 can communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 860. As shown, the network adapter 860 communicates with other modules of the electronic device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device 800, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0151] Through the description of the above embodiments, it will be readily understood by those skilled in the art that the example embodiments described herein can be implemented via software or via a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or mobile hard drive) or on a network and includes instructions for causing a computing device (such as a personal computer, server, terminal device, or network device) to execute the methods according to the embodiments of the present disclosure.

[0152] In exemplary embodiments of the present disclosure, a computer-readable storage medium is also provided, on which is stored a program product capable of implementing the aforementioned methods of this specification. In some possible implementations, various aspects of the present invention may also be implemented in the form of a program product comprising program code. When the program product is executed on a terminal device, the program code is configured to cause the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the "Exemplary Methods" section of this specification.

[0153] A program product for implementing the above-described method according to an embodiment of the present invention is described. The program product may be a portable compact disc read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0154] The program product may be implemented in any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0155] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0156] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0157] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a stand-alone software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0158] It should be noted that although several modules or units of the device for action execution are mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0159] Furthermore, although the steps of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that the steps must be performed in this particular order, or that all steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0160] Through the description of the above embodiments, it will be readily understood by those skilled in the art that the example embodiments described herein can be implemented via software or via a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or mobile hard drive) or on a network and includes a number of instructions for causing a computing device (such as a personal computer, server, mobile terminal, or network device) to execute the methods according to the embodiments of the present disclosure.

[0161] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the appended claims.

Claims

1. A network security data detection method, characterized in that: include: Obtain security events within a predetermined period and obtain a security event set; Filter the security events in the security event set based on a false alarm event screening rule to obtain a false alarm event set, wherein the false alarm event screening rule is determined based on a rule ID, a response code type, and an attribute value of the security event; Performing an importance evaluation on the rule IDs in the false alarm event set based on an importance evaluation model to obtain a rule ID importance value; A false alarm event detection report is generated based on the rule id importance value and the false alarm event set, and the false alarm event detection report is output according to a preset report format.

2. The network security data detection method according to claim 1, characterized in that: Generating a false alarm event detection report based on the rule ID importance value and the false alarm event set includes: Get the security rule set; Matching the security event set with the security rule set to obtain a matching rule set; Performing a regular matching test on the security events in the false alarm event set based on the matching rule set to obtain a regular matching result; Based on the regular matching result and the rule ID importance value, the false alarm event detection report is generated.

3. The network security data detection method according to claim 2, characterized in that: Performing a regular matching test on the security events in the false alarm event set based on the matching rule set to obtain a regular matching result, including: Precompiling the regular expressions in the matching rule set to obtain precompiled rules; Performing regular expression matching on the security events in the false alarm event set based on the precompiled rules to obtain a matching string; The matching substring and the corresponding matching position are recorded.

4. The network security data detection method according to claim 3, characterized in that: The regular expressions in the matching rule set are precompiled to obtain precompiled rules, including: Get string transcoding rules; Precompiling the regular expression according to the string transcoding rule to obtain a precompiled expression; Determining whether the precompiled expression conforms to a predetermined format; If so, the precompiled expression is used as the precompiled rule.

5. The network security data detection method according to claim 1, characterized in that: The security events in the security event set are screened based on the false positive event screening rule to obtain a false positive event set, including: Dividing the security event set into a plurality of security event subsets based on the rule ID; For each of the security event subsets, perform the following steps: Determine whether there is a security event with a response code of a preset value in the security event subset; If so, retain the security events whose response codes are the preset values ​​and generate a reserved event set; If not, all security events are retained to generate a retained event set; Obtain the number of security events corresponding to each response code in the retained event set; Using a predetermined number of response codes with the largest number of security events as screening response codes; Obtaining the security event corresponding to the screening response code to obtain a screening event set; Filtering the filtering event set based on the attribute value to obtain false alarm events; All false positive events in the security event subset are aggregated to obtain the false positive event set.

6. The network security data detection method according to claim 5, characterized in that: The screening event set is screened based on the attribute value to obtain false positive events, including: The security events with the most non-empty attribute values ​​in the filtered event set are regarded as false alarm events.

7. The network security data detection method according to claim 5, characterized in that: The preset value of the response code is 2xx, where x represents any value.

8. The network security data detection method according to claim 1, characterized in that: The importance of the rule IDs in the false alarm event set is evaluated based on the importance evaluation model to obtain the rule ID importance value, including: Obtain the rule ID in the false alarm event set; Obtain the importance assessment model, wherein the importance assessment model is expressed as: Where f(b, n, g) represents the importance of the rule id; b∈{0, 1}, when there is a security event with a response code equal to the preset value, b=1; when there is no security event with a response code equal to the preset value, b=0; n represents the number of security events corresponding to the rule id, g represents the risk level corresponding to the rule id, G represents the number of risk level categories, and G is a constant; Obtain the model parameters corresponding to the rule id, the model parameters including b, n, and g; The model parameters are input into the importance evaluation model to obtain the importance value of the rule ID.

9. The network security data detection method according to claim 1, characterized in that: The contents of the false alarm event detection report include: analysis date, analyzed event cycle, rule name, rule ID, number of security events corresponding to the rule ID, number of events corresponding to each response code, event security rule, URL regular expression, event URL attribute value, request header regular expression, event request header attribute value, response header regular expression, event response header attribute value, request body regular expression, event request body attribute value, response body regular expression, and event response body attribute value.

10. The network security data detection method according to claim 2, characterized in that: Generating the false alarm event detection report based on the regular expression matching result and the rule ID importance value further includes: The false alarm event detection report is labeled and / or sorted according to the rule ID importance value and the regular matching result.

11. The network security data detection method according to claim 1, characterized in that: Also includes: The false alarm event set or the false alarm event detection report is obtained according to a preset execution cycle.

12. A network security data detection device, characterized in that: include: An acquisition module is used to acquire security events within a predetermined period and obtain a security event set; a screening module, configured to screen the security events in the security event set based on a false alarm event screening rule to obtain a false alarm event set, wherein the false alarm event screening rule is determined based on a rule ID, a response code type, and an attribute value of the security event; An importance evaluation module is used to evaluate the importance of the rule IDs in the false alarm event set based on an importance evaluation model to obtain the rule ID importance value; The report generation module is used to generate a false alarm event detection report based on the rule ID importance value and the false alarm event set, and the false alarm event detection report is output according to a pre-set report format.

13. An electronic device, characterized in that: include: processor; as well as a memory for storing executable instructions of the processor; The processor is configured to execute the network security data detection method according to any one of claims 1 to 11 by executing the executable instructions.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network security data detection method according to any one of claims 1 to 11 is implemented.

Images