User risk portrait generation method and device, electronic equipment, and storage medium

Abstract

The application discloses a user risk portrait generation method and device, electronic equipment and a storage medium. The method comprises the following steps: receiving a network event data set, wherein the data types in the network event data set comprise at least one of the following: traffic data, risk events and vulnerability information, and each piece of data in the network event data set is associated with an IP address; associating each piece of data with user information in an online user list based on the IP address, determining network risk data associated with each user object; and generating a user risk portrait corresponding to the user object based on a risk behavior label corresponding to the network risk data. The application solves the technical problem that, in the related art, network risk assessment cannot be accurately associated and analyzed in the scene of user authentication and dynamic IP allocation.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular to a user risk portrait generation method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the rapid development of network technology, the importance of network security is gradually highlighted, and situation awareness begins to emerge in the field of network security. In order to ensure the safety of user network assets, the situation awareness product needs to perform network risk assessment regularly (evaluate the threat of attack activities to each asset in the current system, and the risk state of network assets), so that the network security management personnel can discover the information of the lost and high-risk state assets in time according to the safety state evaluation result of the network assets, and protect and process them in a targeted manner.

[0003] In related technologies, when the situation awareness product is subjected to network risk assessment, the basic process is: collecting the data such as traffic, network threat, vulnerability scanning information and the like uploaded by the security devices, user terminals and the like in the network, performing standardized processing on the data, then performing correlation analysis on the effective information therein, thereby discovering attack activities, and on this basis, identifying the source and type of the attack activities. The above network risk assessment method is to associate each risk event in the network according to the IP address, to count the threat events, vulnerabilities and the like risk information for a single IP, to collect the behaviors of initiating or suffering network threat attacks occurring on the same IP address together, and to evaluate and analyze the health status of the network assets.

[0004] However, the above network risk assessment method has the following disadvantages: in the remote user charging authentication network access scene, such as campus network and enterprise network, the terminal user accesses the network through a personal account, and then dynamically allocates an IP address through DHCP or other services. The same IP address is often allocated to different devices used by different users at different time periods, so that the network security management personnel cannot discover the correlation between the risk events in time, locate the actual person responsible for the risk assets, and maintain and manage the risk assets in time.

[0005] At present, no effective solution has been proposed for the above problems. SUMMARY

[0006] The embodiments of the present application provide a user risk portrait generation method and device, electronic equipment and storage medium, to at least solve the technical problem that the network attack behaviors cannot be accurately correlated and analyzed in the scene of user authentication network access and dynamic IP allocation when performing network risk assessment in related technologies.

[0007] According to an aspect of an embodiment of the present application, a method for generating a user risk profile is provided, which is applied to a situation awareness platform in a network security system, and includes: receiving a set of network event data, wherein the data types in the set of network event data include at least one of the following: traffic data, risk events and vulnerability information, and each piece of data in the set of network event data is associated with an IP address; associating each piece of data with user information in an online user list based on the IP address, and determining network risk data associated with each user object, wherein different dimensions of the network risk data correspond to risk behavior labels; generating a user risk profile corresponding to a user object based on the risk behavior labels corresponding to the network risk data, wherein the user risk profile is used to evaluate the health status of network assets of the user object.

[0008] Optionally, the online user list is generated by: receiving N authentication charging messages, wherein the authentication charging messages are traffic messages generated by different user objects through a remote network in a charging authentication online scenario, and N is a positive integer greater than or equal to 1; analyzing the authentication charging messages to obtain IP addresses, user identifiers, physical addresses, user states and timestamps, wherein the user states include online, offline and charging update; constructing the online user list based on the IP addresses, the user identifiers, the physical addresses, the user states and the timestamps; and maintaining the user identifiers and user states associated with different IP addresses in the online user list to update the user information in the online user list.

[0009] Optionally, after receiving the set of network event data, the method further includes: extracting data features of each piece of data in the set of network event data; screening out data indicated to meet a set of network risk features from the data features to obtain a set of network risk data; and storing the set of network risk data and the online user list to a distributed database.

[0010] Optionally, the method for generating a user risk profile further includes: using an attack chain detection engine to match network attack behavior patterns according to user information of multiple pieces of network event data, to determine a complex threat event and extract event features of the complex threat event; using a traffic detection engine to perform traffic analysis and abnormal behavior analysis on network traffic of each user object, to determine traffic risk features and abnormal behavior features; and integrating the event features of the complex threat event, the traffic risk features and the abnormal behavior features into the set of network risk features.

[0011] Optionally, after associating each piece of data with user information in an online user list based on the IP address and determining network risk data associated with each user object, the method further comprises: assigning a threat event attack type label to data indicating that the data feature is a complex threat event and determining an event level of the complex threat event; assigning a vulnerability information level to data indicating that the data feature is vulnerability information; assigning a weak password identifier to data indicating that the number of passwords is less than a preset number threshold; and determining a network behavior risk level of the user object based on the threat event attack type label, the event level, the vulnerability information level, and the weak password identifier.

[0012] Optionally, after associating each piece of data with user information in an online user list based on the IP address and determining network risk data associated with each user object, the method further comprises: establishing an event association relationship between each type of threat event generated by a terminal device used by the user object and scanned vulnerability information; in a case where the event association relationship indicates that the terminal device has a threat event against a target vulnerability, marking the user object as a compromised user and marking the terminal device as a risk terminal device.

[0013] Optionally, after generating a user risk profile corresponding to the user object based on the risk behavior label corresponding to the network risk data, the method further comprises: displaying a risk user list in which the network risk data exists and a user risk profile of each user object in the risk user list; and / or, displaying a network access state of the each user object, a number of risk terminal devices held by the each user object, a number of network attacks suffered by the each user object, and a network attack category.

[0014] According to another aspect of the embodiments of the present application, a user risk profile generation apparatus applied to a situation awareness platform in a network security system is further provided, comprising: a receiving unit configured to receive a network event data set, wherein a data type in the network event data set comprises at least one of the following: traffic data, a risk event, and vulnerability information, and each piece of data in the network event data set is associated with an IP address; a determining unit configured to associate each piece of data with user information in an online user list based on the IP address and determine network risk data associated with each user object, wherein different dimensions of the network risk data correspond to a risk behavior label; and a generating unit configured to generate a user risk profile corresponding to a user object based on the risk behavior label corresponding to the network risk data, wherein the user risk profile is used to evaluate a health state of a network asset of the user object.

[0015] Optionally, the determining unit comprises: a first receiving module, configured to receive N authentication charging messages, wherein the authentication charging messages are traffic messages generated by different user objects through a remote network in a charging authentication online surfing scenario, N is a positive integer greater than or equal to 1; a first analyzing module, configured to analyze the authentication charging messages to obtain an IP address, a user identifier, a physical address, a user state and a timestamp, wherein the user state comprises: online, offline and charging update; a first constructing module, configured to construct the online user list based on the IP address, the user identifier, the physical address, the user state and the timestamp; and a first maintaining module, configured to maintain user identifiers and user states associated with different IP addresses in the online user list to update user information in the online user list.

[0016] Optionally, the user risk portrait generation apparatus further comprises: a first extracting module, configured to extract data features of each piece of data in the network event data set; a first screening module, configured to screen out data indicating compliance with the network risk feature set, to obtain a network risk data set; and a first storage module, configured to store the network risk data set and the online user list to a distributed database.

[0017] Optionally, the user risk portrait generation apparatus further comprises: a first determining module, configured to use an attack chain detection engine to match network attack behavior patterns according to user information of multiple network event data, to determine a complex threat event, and to extract event features of the complex threat event; a second determining module, configured to use a traffic detection engine to perform traffic analysis and abnormal behavior analysis on network traffic of each user object, to determine traffic risk features and abnormal behavior features; and a first integrating module, configured to integrate the event features of the complex threat event, the traffic risk features and the abnormal behavior features into the network risk feature set.

[0018] Optionally, the user risk portrait generation apparatus further comprises: a third determining module, configured to assign a threat event attack type label to data indicating a complex threat event by the data features, and to determine an event level of the complex threat event; a first indicating module, configured to assign a vulnerability information level to data indicating vulnerability information by the data features; a first identifying module, configured to assign a weak password identifier to data indicating that the number of passwords is less than a preset number threshold by the data features; and a fourth determining module, configured to determine a network behavior risk level of the user object based on the threat event attack type label, the event level, the vulnerability information level and the weak password identifier.

[0019] Optionally, the user risk portrait generation apparatus further comprises a first establishing module configured to establish an event association relationship between each type of threat event generated by the user object using a terminal device and scanned vulnerability information; and a first marking module configured to, in a case where the event association relationship indicates that the terminal device has a threat event against a target vulnerability, mark the user object as a compromised user and mark the terminal device as a risk terminal device.

[0020] Optionally, the user risk portrait generation apparatus further comprises a first display module configured to display a risk user list in which the network risk data exists and a user risk portrait of each user object in the risk user list; and / or a second display module configured to display a network access state of the each user object, a number of risk terminal devices held by the each user object, a number of network attacks suffered by the each user object, and a network attack category.

[0021] According to another aspect of the embodiments of the present application, an electronic device is also provided, which comprises a processor and a memory for storing executable instructions of the processor, wherein the processor is configured to execute any one of the user risk portrait generation methods via execution of the executable instructions.

[0022] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, which comprises a stored computer program, wherein the computer readable storage medium controls a device in which the computer readable storage medium is located to execute any one of the user risk portrait generation methods when the computer program is running.

[0023] In the present disclosure, the following steps are adopted: receiving a network event data set, wherein the data types in the network event data set include at least one of the following: traffic data, risk events and vulnerability information, each data in the network event data set is associated with an IP address, each data is associated with user information in an online user list based on the IP address, network risk data associated with each user object is determined, wherein network risk data of different dimensions corresponds to a risk behavior label, a user risk portrait corresponding to the user object is generated based on the risk behavior label corresponding to the network risk data, wherein the user risk portrait is used to evaluate the health status of the network asset of the user object.

[0024] In the present disclosure, when the situational awareness platform collects risk events, vulnerability information and traffic data, the above-mentioned risk data is associated with user information according to user authentication billing message information and then stored, and then risk behavior labels are established according to different dimensions of data, user risk portraits are created, network attack behaviors are accurately associated and analyzed through the user risk portraits, specific users are directly located, and users are timely notified to maintain network security, thereby solving the technical problem that network risk assessment cannot accurately associate and analyze network attack behaviors in the related art in the scene of user authentication online and dynamic IP allocation.

[0025] In the present disclosure, the online user information table is maintained by receiving and analyzing the original RADIUS message, the original traffic data of the situational awareness platform and the detected threat vulnerability information are enriched, and the network risk events are detected through the association analysis in the user and host dimensions under the above conditions.

[0026] In the present disclosure, in the scene of user authentication online and dynamic IP allocation, multi-stage network attack activities can be prevented, the correlation between risk events can be discovered in time, the actual person in charge of the risk asset can be located, and the risk asset can be maintained and managed in time. BRIEF DESCRIPTION OF DRAWINGS

[0027] The accompanying drawings, which are included to provide a further understanding of the application and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0028] Figure 1 is a flowchart of an optional user risk portrait generation method according to an embodiment of the present application;

[0029] Figure 2 is a schematic diagram of a user risk portrait generation system architecture according to an embodiment of the present application;

[0030] Figure 3 is a schematic diagram of a user risk portrait generation device according to an embodiment of the present application;

[0031] Figure 4 is a hardware structure block diagram of an electronic device (or mobile device) of a user risk portrait generation method according to an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to make the person skilled in the art better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work should belong to the scope of protection of the present application.

[0033] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0034] In order to facilitate the person skilled in the art to understand the present application, the following explains some terms or nouns involved in each embodiment of the present application:

[0035] RADIUS, a distributed, client / server (Client / Server) structure information interaction protocol, specifies the process and message format of user information and billing information transmission between client and server, and its use is to complete the authentication, authorization and billing functions of the user.

[0036] Kafka, a high-throughput distributed publish / subscribe message system, can handle all action flow data of consumers in the website.

[0037] DGA domain name, full name Domain Generation Algorithm, domain name generated by DGA algorithm with high randomness.

[0038] C&C server, the abbreviation of control&command server, command and control server, used to control the host, responsible for processing information, the central machine of issuing tasks.

[0039] SMB protocol, where SMB stands for Server Message Block, a network protocol name, can be used for web connection and information communication between client and server, communication protocol in session layer, presentation layer and part of application layer.

[0040] It should be noted that the related information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for display, analyzed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties. For example, an interface is provided between the system and the related user or institution. Before obtaining the related information, the interface needs to send a request to the aforementioned user or institution, and after receiving the consent information feedback from the aforementioned user or institution, the related information is obtained.

[0041] The present application can be applied to various situation awareness systems / products / devices, and provides a user risk behavior portrait method in a remote user billing authentication online scenario. When a risk event, vulnerability information, and traffic data are collected or detected in the situation awareness platform, these risk data are associated with user information according to user authentication billing message information and then stored, and then risk behavior labels are established according to different dimensions of data, user risk portraits are created, the overall health status of network asset security risks of each user is evaluated and displayed, and accurate correlation analysis of network attack behavior and specific users are realized in the scenario of user authentication online and dynamic IP allocation, so as to timely remind users to prevent network attacks.

[0042] A new advanced threat will take different network attack behaviors in different stages. In the attack implementation process, network security products use intrusion detection, virus filtering, unknown threat detection, anti-spam, correlation analysis and other multi-dimensional detection technologies for attack behavior detection and discovery, so as to take a series of mitigation and protection measures in real time. Once the advanced threat penetrates through some technology and enters the post-attack stage, risk asset positioning, abnormal behavior judgment, and traceability evidence can be performed through network traffic analysis, abnormal behavior analysis, etc. In the scenario of remote user authentication billing online (such as a campus network, users may use the same mobile terminal or different terminal equipment through wired or wireless network access to the campus network in the dormitory area or laboratory area), due to the existence of dynamic IP allocation scenario and different IP segment allocation in different venues, it is difficult to completely and effectively correlate the network events only through the IP information of the original network traffic.

[0043] The present application can more comprehensively detect and discover risk events in the network based on the generated user risk portrait, assist network security managers in tracing the threat events in the user dimension, and timely discover users with high network behavior risk levels and locate the corresponding personnel.

[0044] The present application will be described in detail below in combination with various embodiments.

[0045] Example One

[0046] According to the embodiments of the present application, a method for generating a user risk portrait is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0047] Figure 1 is a flowchart of an optional method for generating a user risk portrait according to an embodiment of the present application, as shown in Figure 1 The method comprises the following steps:

[0048] Step S102, receiving a set of network event data, wherein the data types in the set of network event data include at least one of the following: traffic data, risk events and vulnerability information, and each piece of data in the set of network event data is associated with an IP address;

[0049] Step S104, associating each piece of data with the user information in the online user list based on the IP address, and determining the network risk data associated with each user object, wherein the network risk data in different dimensions corresponds to a risk behavior label;

[0050] Step S106, generating a user risk portrait corresponding to the user object based on the risk behavior label corresponding to the network risk data, wherein the user risk portrait is used to evaluate the health status of the network asset of the user object.

[0051] Through the above steps, a network event data set is first received, wherein the data types in the network event data set include at least one of the following: traffic data, risk events and vulnerability information, each piece of data in the network event data set is associated with an IP address, then each piece of data is associated with user information in an online user list based on the IP address, network risk data associated with each user object is determined, wherein network risk data of different dimensions corresponds to a risk behavior label, and finally a user risk portrait corresponding to the user object is generated based on the risk behavior label corresponding to the network risk data, wherein the user risk portrait is used to evaluate the health status of the network asset of the user object. In this embodiment, when the situation awareness platform collects risk events, vulnerability information and traffic data, the above risk data is associated with user information according to user authentication billing message information and then stored, and then risk behavior labels are established according to different dimensions of data, a user risk portrait is created, and the user risk portrait is used to accurately associate and analyze network attack behavior, so as to directly locate to a specific user and timely notify the user to maintain network security, thereby solving the technical problem that in the related art, when network risk assessment is performed, in the scene of user authentication and dynamic IP allocation, network attack behavior cannot be accurately associated and analyzed.

[0052] The embodiment will be described in detail below in combination with the above steps.

[0053] It should be noted that the implementation subject of the embodiment of the present application is a situation awareness platform, and the user risk portrait generation system is deployed in the situation awareness platform. The situation awareness platform can be connected with various servers (for example, a RADIUS authentication server), user related information can be transmitted to the situation awareness platform through the server, and the user risk portrait generation system receives valid information to generate a user risk portrait.

[0054] In many local area network environments, the IP address of a user terminal is dynamically allocated, a user can access a network using different terminals, or access a network using a same mobile terminal device in different venues, or access an internal network using a VPN channel, and the correspondence between the IP address, the terminal device and the user is constantly changed, which interferes with the judgment of network attack activities of the situation awareness platform and the risk state evaluation of network assets. User authentication access to a network is a widely used scene of terminal access to a local area network, such as a campus network and an internal network of an enterprise. A terminal user inputs an account and a password, an access device and a RADIUS server exchange RADIUS protocol messages, the user identity is verified, and the network is accessed. The correspondence between the IP address, the terminal device and the user in the network can be obtained through the RADIUS server.

[0055] It should be noted that before receiving the network event data set, an online user list needs to be created first, which is stored in the cache with IP as the key to provide efficient query performance.

[0056] In the embodiment of the application, the online user list is generated by the following method: receiving N authentication charging messages, wherein the authentication charging message is a traffic message generated by different user objects through a remote network in the charging authentication online scenario, and N is a positive integer greater than or equal to 1; analyzing the authentication charging message to obtain an IP address, a user identifier, a physical address, a user state and a timestamp, wherein the user state includes online, offline and charging update; constructing an online user list based on the IP address, the user identifier, the physical address, the user state and the timestamp; and maintaining the user identifier and the user state associated with different IP addresses in the online user list to update the user information in the online user list.

[0057] Optionally, the server forwards the authentication charging message to a specified port of the situation awareness platform, the situation awareness platform receives the original message information and stores it in the kafka message component, reads the received original message information through the stream processing component, parses the IP address, the username (corresponding to the user identifier), the Mac address (corresponding to the physical address), the user state, the timestamp and other data according to the RADIUS protocol, and creates an online user list according to the above data, wherein the user state includes but is not limited to online, offline, charging update, and Table 1 shows the content of the online user list with the online user state.

[0058] Table 1 Online user list

[0059] IP address User name Mac address Online time 10.0.0.1 aaa 00-00-00-00-00-01 2022-09-28 23:00 10.0.0.2 bbb 00-00-00-00-00-02 2022-09-28 22:00 ······ ······ ······ ······

[0060] After the online user list is created, the online user list is maintained according to the parsed message fields, and the specific maintenance rules are as follows: when a user is online, the corresponding record in the online user list is added; when a user is offline, the corresponding record in the online user list is deleted; and the influence of message loss and disorder is reduced through IP, Mac conflict and manual marking, timeout detection; if the target IP does not exist in the online user list, or the username corresponding to the target IP is inconsistent with the message, the state is changed to online, otherwise the data is ignored; after a user is online, the user equipment with the same Mac address in the user table is offline; the administrator is allowed to mark the specified user as offline through the interface operation, and the online user is marked offline in a timely manner.

[0061] After the online user list is generated, it can be stored in the cache with IP as the key value KEY to provide efficient query performance, and the situation awareness platform receives the network event data set and parses it.

[0062] Step S102, receiving a network event data set, wherein the data types in the network event data set include at least one of the following: traffic data, risk events and vulnerability information, and each data in the network event data set is associated with an IP address.

[0063] In the embodiment of the application, after receiving the network event data set, the method further comprises: extracting data features of each data in the network event data set; screening out data indicated to meet the network risk feature set to obtain a network risk data set; and storing the network risk data set and the online user list to a distributed database.

[0064] It should be noted that after the situational awareness platform collects the original data in the network (corresponding to the network event data described above), feature extraction and behavior analysis are performed to obtain threat events, traffic data, host vulnerabilities and the like, and then in the data stream processing module, the corresponding user information and host information are queried according to the IP addresses of the event data to complete the user and host information in the event data and stored to the distributed database.

[0065] In the embodiment of the application, the attack chain detection engine is used to match network attack behavior patterns according to the user information of the multiple network event data, determine complex threat events, and extract event features of the complex threat events; the traffic detection engine is used to perform traffic analysis and abnormal behavior analysis on the network traffic of each user object to determine traffic risk features and abnormal behavior features; and the event features of the complex threat events, the traffic risk features and the abnormal behavior features are set as the network risk feature set.

[0066] It should be noted that after obtaining the multiple network event data, the situational awareness platform detects risks by associating network events through user information, matches network attack behavior patterns according to the user information of the multiple network events through the attack chain detection engine, discovers complex threat events, such as the user equipment has the behavior of querying DGA domain names, and then establishes a connection with one or more file servers through the SMB protocol and reads and writes files, which may be that the host is infected with ransomware, queries domain names generated by the domain name generation algorithm, and if an effective C&C server is found, the query is stopped and the file server is connected through the SMB protocol to encrypt sensitive data, and the traffic detection engine is used to perform traffic analysis and abnormal behavior analysis on the network traffic of a single user, including traffic threshold detection, traffic mutation analysis and the like.

[0067] Step S104, associating each data with the user information in the online user list based on the IP address to determine network risk data associated with each user object, wherein the network risk data of different dimensions correspond to risk behavior labels.

[0068] Optionally, the situational awareness platform aggregates the risk events through the user information dimension, generates a risk behavior label of the user, and scores the network behavior risk level of the user.

[0069] In the embodiment of the present application, after associating each piece of data with the user information in the online user list based on the IP address and determining the network risk data associated with each user object, the following steps are included: assigning a threat event attack type label to the data whose data characteristics indicate a complex threat event, and determining the event level of the complex threat event; assigning a vulnerability information level to the data whose data characteristics indicate vulnerability information; assigning a weak password identifier to the data whose data characteristics indicate that the number of passwords is less than a preset number threshold; and determining the network behavior risk level of the user object based on the threat event attack type label, the event level, the vulnerability information level, and the weak password identifier.

[0070] In the embodiment of the present application, after associating each piece of data with the user information in the online user list based on the IP address and determining the network risk data associated with each user object, the following steps are included: establishing an event association relationship between each type of threat event generated by the user object using the terminal device and the scanned vulnerability information; in the case where the event association relationship indicates that the terminal device has a threat event against a target vulnerability, marking the user object as a compromised user and marking the terminal device as a risk terminal device.

[0071] It should be noted that the situational awareness platform processes the risk data through a timing task, counts the threat event attack type label, the threat event level, the vulnerability information level, and the number of weak passwords generated on the user device, scores the risk level of the user network behavior according to these data, and stores the information in the database.

[0072] The threat event generated by the user is associated with the scanned vulnerability information, and if a threat event against a certain vulnerability is generated, the user object is marked as a compromised user.

[0073] In step S106, a user risk profile corresponding to the user object is generated based on the risk behavior label corresponding to the network risk data, wherein the user risk profile is used to evaluate the health status of the network asset of the user object.

[0074] In the embodiment of the present application, after generating the user risk profile corresponding to the user object based on the risk behavior label corresponding to the network risk data, the following steps are included: displaying a risk user list with network risk data and a user risk profile of each user object in the risk user list; and / or displaying the network access state of each user object, the number of risk terminal devices held, the number of network attacks suffered, and the network attack category.

[0075] It should be noted that after generating the user risk portrait corresponding to the user object, the risk user list in the intranet is displayed through the visualization page, which can be sorted by risk level, and the user's loss state, the number of risk devices held by the user, the number of network attacks suffered by the user and the like are displayed, and alarm information is sent to the relevant user in time to inform the user to prevent network attacks.

[0076] Through the above embodiment, in the scene of user authentication network access and dynamic IP allocation, the user and host information can be used to more accurately associate and analyze network attack behaviors, and prevent multi-stage network attack activities. And through the user dimension, the threat events and vulnerability information are aggregated, and the risk level and loss state of the user asset are displayed, and the network security management personnel can directly locate to the specific user through the risk user list of the situation awareness platform, and inform the user to maintain and upgrade the terminal.

[0077] The application will be described below in conjunction with a more specific embodiment.

[0078] Figure 2 is a schematic diagram of an optional user risk portrait generation system architecture according to an embodiment of the application, as Figure 2 shown, when performing network risk assessment, the message receiving component of the situation awareness platform receives the message, stores the original message information in the message queue, then parses the message (such as Figure 2 in the Radius message parsing diagram), and normalizes the data to obtain user online and offline information, transmits the user online and offline information to the user list maintenance module, updates the list information, and transmits it to the cache component for storage, the online user information can be queried through the user list, and displayed to the visualization interface, the correlation query module can query the user information through the cache component, based on threat events, vulnerability information scanning events Figure 2 (simplified as leak scanning events in the text) and traffic information for correlation query (correlation query through the correlation detection engine), and store the risk information, while providing risk information aggregation and evaluation, generating a risk portrait table, and displaying it through the visualization interface.

[0079] When performing network asset security risk assessment, the following steps can be included:

[0080] Step one, the RADIUS authentication server forwards the authentication billing message to the designated port of the situation awareness platform, and the situation awareness platform receives the original message information and stores it in the kafka message component;

[0081] Step two, read the received original message information through the stream processing component, parse the IP address, username, Mac address, user state, timestamp and the like according to the RADIUS protocol;

[0082] Step three, according to the parsed message field to maintain online user table;

[0083] Among them, in the maintenance of online user table, the maintenance strategy includes: the user state in the message information contains online, offline, billing update, etc., the user is online, the corresponding record is added in the online user table; the user is offline, the corresponding record in the online user table is deleted, and the influence of message loss and disorder is reduced through IP, Mac conflict and manual marking, timeout detection, billing update data: if the target IP does not exist in the online user table, or the username corresponding to the target IP is inconsistent with the message, its state is changed to online, otherwise ignore the data. After the user is online, the user equipment with the same Mac address in the user table is offline according to the Mac address. The administrator can mark the specified user as offline through the interface operation, and mark the online user offline at regular intervals.

[0084] Step four, the online user information is stored in the cache component with IP as the key value KEY to provide efficient query performance. After the situational awareness platform collects the raw data in the network, it carries out feature extraction and behavior analysis to obtain threat events, traffic data, host vulnerabilities and other information. Then in the data stream processing module, the IP address of the event data is queried to obtain the corresponding user information and host information, and the user and host information are supplemented in the event data and stored in the distributed database.

[0085] Step five, the situational awareness platform detects risks by associating network events with user information;

[0086] Through the attack chain detection engine, the user information of multiple network events is matched with the network attack behavior mode, and complex threat events are found, such as user equipment with the behavior of querying DGA domain name, and then establishing connection with one or more file servers through SMB protocol and reading and writing files. It may be that the host is infected with ransomware, and the domain name generated by the domain name generation algorithm is queried. Once the effective C&C server is found, the query is stopped and the file server is connected through the SMB protocol to encrypt sensitive data.

[0087] Through the traffic detection engine, the network traffic of a single user is analyzed, including traffic threshold detection, traffic mutation analysis, and other abnormal behavior analysis.

[0088] Step six, the situational awareness platform processes risk data through timed tasks to generate user risk portrait and assess user network risk state;

[0089] The threat event attack type label, threat event level, vulnerability information level, and weak password quantity generated on the user equipment are counted, and the risk level of user network behavior is scored according to these data, and the information is stored in the database.

[0090] The threat event generated by the user is associated with the scanned vulnerability information, and if there is a threat event for a certain vulnerability, the user is marked as a compromised user.

[0091] Step seven, the risk user list in the intranet is displayed through a visual page, which can be sorted by risk level size, and the compromised state of the user, the number of risk devices held by the user, the number of network attacks suffered by the user and the category are displayed.

[0092] Through the above embodiment, the online user information table is maintained by receiving and analyzing the original RADIUS message, the original traffic data and the detected threat vulnerability information of the situation awareness platform are enriched, under the condition, the correlation analysis is carried out through the user and host dimensions, the network risk event is detected, the risk event is aggregated through the user information dimension, the risk behavior label of the user is generated, and the specific user is located, and the network behavior risk level of the user is scored.

[0093] The application will be described below in combination with another alternative embodiment.

[0094] Example Two

[0095] The embodiment provides a user risk portrait generation device, each implementation unit included in the user risk portrait generation device corresponds to each implementation step in the first embodiment.

[0096] Figure 3 It is a schematic diagram of an alternative user risk portrait generation device according to the embodiment of the application, as shown in the figure, comprising: a receiving unit 30, a determining unit 32, a generating unit 34, wherein, Figure 3

[0097] The receiving unit 30 is used for receiving a network event data set, wherein the data types in the network event data set include at least one of the following: traffic data, risk events and vulnerability information, and each piece of data in the network event data set is associated with an IP address;

[0098] The determining unit 32 is used for associating each piece of data with the user information in the online user list based on the IP address, and determining the network risk data associated with each user object, wherein different dimensions of network risk data correspond to risk behavior labels;

[0099] The generating unit 34 is used for generating a user risk portrait corresponding to the user object based on the risk behavior label corresponding to the network risk data, wherein the user risk portrait is used for evaluating the health status of the network asset of the user object.

[0100] ​The user risk portrait generation device receives a network event data set through the receiving unit 30, wherein the data types in the network event data set include at least one of the following: traffic data, risk events and vulnerability information, and each piece of data in the network event data set is associated with an IP address; the determining unit 33 associates each piece of data with the user information in the online user list based on the IP address, and determines the network risk data associated with each user object, wherein different dimensions of network risk data correspond to risk behavior labels; the generating unit 34 generates a user risk portrait corresponding to the user object based on the risk behavior labels corresponding to the network risk data, wherein the user risk portrait is used to evaluate the health status of the network assets of the user object. In this embodiment, when the situation awareness platform collects risk events, vulnerability information and traffic data, the above risk data is associated with the user information according to the user authentication billing message information and then stored, and then risk behavior labels are established according to different dimensions of data, and a user risk portrait is created. Through the user risk portrait, the network attack behavior can be accurately associated and analyzed to directly locate the specific user and timely notify the user to maintain network security, thereby solving the technical problem that in the related art, when network risk assessment is performed, in the scene of user authentication and dynamic IP allocation, the network attack behavior cannot be accurately associated and analyzed.

[0101] It should be noted that the implementation subject of the embodiment of the present application is a situation awareness platform, and the user risk portrait generation system is deployed in the situation awareness platform. The situation awareness platform is connected with an authentication server, user related information can be transmitted to the situation awareness platform through the server, and the user risk portrait generation system receives effective information to generate a user risk portrait.

[0102] In many local area network environments, the IP address of the user terminal is dynamically allocated, the user can access the network using different terminals, or access the network using the same mobile terminal device in different venues, or access the internal network using a VPN channel, etc. In this case, the correspondence between the IP address, the terminal device and the user is constantly changing, which interferes with the judgment of network attack activities of the situation awareness platform and the risk state evaluation of network assets. User authentication is a widely used terminal access local area network scenario, such as campus network and enterprise internal network. The terminal user inputs an account password, the access device and the RADIUS server interact with each other through RADIUS protocol messages, the user identity is verified, and the network is accessed. Through the RADIUS server, the correspondence between the IP address, the terminal device and the user in the network can be obtained.

[0103] Optionally, the determining unit 32 comprises: a first receiving module configured to receive N authentication charging messages, wherein the authentication charging message is a traffic message generated by different user objects through a remote network in a charging authentication online scenario, N is a positive integer greater than or equal to 1; a first analysis module configured to analyze the authentication charging message to obtain an IP address, a user identifier, a physical address, a user state and a timestamp, wherein the user state comprises: online, offline and charging update; a first construction module configured to construct an online user list based on the IP address, the user identifier, the physical address, the user state and the timestamp; and a first maintenance module configured to maintain the user identifier associated with different IP addresses and the user state in the online user list to update the user information in the online user list.

[0104] Optionally, the RADIUS authentication server forwards the authentication charging message to a specified port of the situation awareness platform, the situation awareness platform receives the original message information, stores it in a kafka message component, reads the received original message information through a streaming processing component, parses the IP address, username (corresponding to the above-mentioned user identifier), Mac address (corresponding to the above-mentioned physical address), user state, timestamp and other data according to the RADIUS protocol, and creates an online user list according to the above-mentioned data, wherein the user state includes but is not limited to: online, offline, charging update.

[0105] When the online user list is created, the online user list is maintained according to the parsed message fields, and the specific maintenance rules are as follows: when a user is online, the corresponding record in the online user list is increased; when a user is offline, the corresponding record in the online user list is deleted; and the influence of message loss and disorder is reduced through IP, Mac conflict and manual marking, timeout detection; if the target IP does not exist in the online user list, or the username corresponding to the target IP is inconsistent with the message, the state is changed to online, otherwise the data is ignored; after a user is online, the user equipment with the same Mac address in the user table is offline; the administrator is allowed to mark the specified user as offline through the interface operation, and the online user is marked offline in a timely manner.

[0106] The online user list is generated and stored in the cache with IP as KEY to provide efficient query performance, and the situation awareness platform receives a network event data set and analyzes it.

[0107] Optionally, the user risk portrait generation device further comprises: a first extraction module configured to extract data features of each data in the network event data set; a first screening module configured to screen out data indicated by the data features to meet the network risk feature set to obtain a network risk data set; and a first storage module configured to store the network risk data set and the online user list to a distributed database.

[0108] It should be noted that after the situational awareness platform collects the original data in the network (corresponding to the network event data described above), feature extraction and behavior analysis are performed to obtain threat event, traffic data, host vulnerability, etc., and then in the data stream processing module, the corresponding user information and host information are queried according to the IP address of the event data, the user and host information are completed in the event data, and stored in the distributed database.

[0109] Optionally, the user risk portrait generation device further comprises: a first determination module configured to determine a complex threat event by matching network attack behavior patterns according to user information of the plurality of network event data using an attack chain detection engine, and extract event features of the complex threat event; a second determination module configured to determine traffic risk features and abnormal behavior features by performing traffic analysis and abnormal behavior analysis on network traffic of each user object using a traffic detection engine; and a first integration module configured to integrate the event features of the complex threat event, the traffic risk features and the abnormal behavior features into a network risk feature set.

[0110] It should be noted that after obtaining the plurality of network event data, the situational awareness platform detects risks by associating network events through user information, discovers complex threat events by matching network attack behavior patterns according to user information of the plurality of network events using an attack chain detection engine, such as user equipment having a behavior of querying DGA domain names, and then establishing a connection with one or more file servers through an SMB protocol and reading and writing files, which may be a domain name generated by a domain name generation algorithm after a host is infected with ransomware, and if an effective C&C server is found, the query is stopped and the file server is connected through the SMB protocol to encrypt sensitive data; the traffic detection engine performs traffic analysis and abnormal behavior analysis on network traffic of a single user, including traffic threshold detection, traffic mutation analysis, etc.

[0111] Optionally, the user risk portrait generation device further comprises: a third determination module configured to assign a threat event attack type label to data whose data features indicate a complex threat event, and determine an event level of the complex threat event; a first indication module configured to assign a vulnerability information level to data whose data features indicate vulnerability information; a first identification module configured to assign a weak password identification to data whose data features indicate a number of passwords less than a preset number threshold; and a fourth determination module configured to determine a network behavior risk level of the user object based on the threat event attack type label, the event level, the vulnerability information level and the weak password identification.

[0112] In the embodiments of the present application, the risk events are aggregated through the user information dimension to generate a risk behavior label of the user, and the network behavior risk level of the user is scored, so as to notify the user to take corresponding operations to prevent network threats.

[0113] It should be noted that the situational awareness platform processes the risk data through a timing task, counts the threat event attack type label, threat event level, vulnerability information level, and number of weak passwords generated on the user equipment, scores the risk level of the user network behavior according to the data, and stores the information in the database. The threat event of the user and the scanned vulnerability information are associated, and if a threat event occurs for a certain vulnerability, the user is marked as a compromised user.

[0114] Optionally, the user risk portrait generation apparatus further comprises: a first establishing module configured to establish an event association relationship between each type of threat event generated by the user object using the terminal equipment and the scanned vulnerability information; and a first marking module configured to mark the user object as a compromised user and mark the terminal equipment as a risk terminal equipment if the event association relationship indicates that the terminal equipment has a threat event against a target vulnerability.

[0115] Optionally, the user risk portrait generation apparatus further comprises: a first display module configured to display a risk user list having network risk data and a user risk portrait of each user object in the risk user list; and / or a second display module configured to display a network access state of each user object, a number of risk terminal equipments held by each user object, a number of network attacks suffered by each user object, and a network attack category.

[0116] It should be noted that after the user risk portrait corresponding to the user object is generated, a risk user list in the intranet is displayed through a visual page, the risk user list is sorted according to the risk level, the compromised state of the user, the number of risk equipments held by the user, the number and category of network attacks suffered by the user are displayed, and alarm information is sent to the related user in time to inform the user to prevent network attacks.

[0117] The user risk portrait generation apparatus described above can further comprise a processor and a memory, and the receiving unit 30, the determining unit 32, the generating unit 34, and the like are stored in the memory as program units, and the corresponding functions are realized by the processor executing the program units stored in the memory.

[0118] The processor contains a kernel, and the kernel calls the corresponding program units in the memory. The kernel can be set to one or more, and the user risk portrait is generated by adjusting the kernel parameters, and then the network risk of the network asset is evaluated.

[0119] According to another aspect of the embodiment of the present application, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the user risk portrait generation methods via execution of the executable instructions.

[0120] According to another aspect of the embodiments of the present application, there is also provided a computer-readable storage medium comprising a stored computer program which, when executed by a device in which the computer-readable storage medium is located, controls the device to perform any of the methods of generating a user risk profile.

[0121] The present application also provides a computer program product adapted to execute a program that, when executed on a data processing device, is configured to perform the following method steps: receiving a set of network event data, wherein the data types in the set of network event data comprise at least one of the following: traffic data, risk events and vulnerability information, and each piece of data in the set of network event data is associated with an IP address; associating each piece of data with user information in an online user list based on the IP address, and determining network risk data associated with each user object; and generating a user risk profile corresponding to the user object based on a risk behavior label corresponding to the network risk data.

[0122] Figure 4 is a hardware structure block diagram of an electronic device (or mobile device) according to the embodiments of the present application. As shown in Figure 4 , the electronic device can include one or more (in the figure, 402a, 402b, …, 402n are used to show) processors 402 (the processor 402 can include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 404 for storing data. In addition, it can also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply and / or a camera. Those skilled in the art can understand that Figure 4 The structure shown is only schematic, and does not limit the structure of the above-mentioned electronic device. For example, the electronic device can also include more or fewer components than those shown in Figure 4 , or have a different configuration from Figure 4 .

[0123] The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0124] In the above-mentioned embodiments of the present application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0125] In several embodiments provided in the present application, it should be understood that the disclosed technology can be implemented by other means. Among them, the above-mentioned device embodiments are only schematic, for example, the division of the units can be a logical function division, and actual implementation can have another division mode, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be through some interface, indirect coupling or communication connection between units or modules, which can be electrical or other forms.

[0126] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0127] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0128] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0129] The above is only the preferred embodiment of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A method for generating a user risk profile, characterized in that, Suitable for network environments where the correspondence between IP addresses, terminal devices, and users is constantly changing, the generation method is applied to the situational awareness platform of a network security system, including: Receive a network event data set, wherein the data types in the network event data set include at least one of the following: traffic data, risk events and vulnerability information, and each piece of data in the network event data set is associated with an IP address; An attack chain detection engine is used to match network attack behavior patterns with user information from multiple network event data to identify complex threat events and extract event features of the complex threat events. A traffic detection engine is used to perform traffic analysis and abnormal behavior analysis on the network traffic of each user object to determine traffic risk features and abnormal behavior features. The event features of the complex threat events, the traffic risk features, and the abnormal behavior features are integrated into a network risk feature set. Based on the IP address, each piece of data is associated with user information in the online user list to determine the network risk data associated with each user. The network risk data of different dimensions corresponds to risk behavior tags, and the network risk data is data that conforms to the network risk feature set. Based on the risk behavior tags corresponding to the network risk data, a user risk profile corresponding to the user object is generated, wherein the user risk profile is used to assess the health status of the user object's network assets.

2. The generation method according to claim 1, characterized in that, The list of online users is generated using the following method: Receive N authentication and billing messages, wherein the authentication and billing messages are traffic messages generated by different user objects through the remote network in the scenario of billing and authentication Internet access, and N is a positive integer greater than or equal to 1; Parse the authentication and billing message to obtain the IP address, user identifier, physical address, user status, and timestamp, wherein the user status includes: online, offline, and billing update; The online user list is constructed based on the IP address, the user identifier, the physical address, the user status, and the timestamp. The identifiers and statuses of users associated with different IP addresses in the online user list are maintained in order to update the user information in the online user list.

3. The generation method according to claim 1, characterized in that, After receiving the network event data set, it also includes: Extract the data features of each piece of data in the network event dataset; Data whose data characteristics match the network risk characteristic set are filtered out to obtain the network risk data set; The network risk data set and the online user list are stored in a distributed database.

4. The generation method according to claim 3, characterized in that, After associating each piece of data with user information in the online user list based on the IP address to determine the network risk data associated with each user, the process includes: Data whose characteristics indicate complex threat events are assigned threat event attack type labels, and the event level of the complex threat event is determined; Data whose data characteristics indicate vulnerability information are assigned a vulnerability information level; Data whose number of passwords indicated by the data characteristics is lower than a preset threshold are assigned a weak password identifier; Based on the threat event attack type label, the event level, the vulnerability information level, and the weak password identifier, the network behavior risk level of the user object is determined.

5. The generation method according to claim 3, characterized in that, After associating each piece of data with user information in the online user list based on the IP address to determine the network risk data associated with each user, the process includes: Establish event correlation relationships between the various types of threat events generated by the user object using the terminal device and the scanned vulnerability information; If the event correlation indicates that a threat event targeting the target vulnerability has occurred on the terminal device, the user object is marked as a compromised user, and the terminal device is marked as a risky terminal device.

6. The generation method according to claim 1, characterized in that, After generating a user risk profile corresponding to the user based on the risk behavior tags corresponding to the network risk data, the process includes: Display a list of users with the aforementioned network risk data and a user risk profile for each user in the list; and / or, It displays the network access status of each user, the number of risky terminal devices they possess, the number of network attacks they have suffered, and the types of network attacks.

7. A device for generating user risk profiles, characterized in that, Suitable for network environments where the correspondence between IP addresses, terminal devices, and users is constantly changing, the generating device is applied to the situational awareness platform of a network security system, and includes: A receiving unit is configured to receive a network event data set, wherein the data types in the network event data set include at least one of the following: traffic data, risk events, and vulnerability information, and each piece of data in the network event data set is associated with an IP address; The first determination module is used to match network attack behavior patterns with user information from multiple network event data using an attack chain detection engine to determine complex threat events and extract event features of the complex threat events; the second determination module is used to perform traffic analysis and abnormal behavior analysis on the network traffic of each user object using a traffic detection engine to determine traffic risk features and abnormal behavior features; the first integration module is used to integrate the event features of the complex threat events, the traffic risk features, and the abnormal behavior features into a network risk feature set; The determining unit is used to associate each piece of data with user information in the online user list based on the IP address, and to determine the network risk data associated with each user object. The network risk data of different dimensions corresponds to risk behavior tags, and the network risk data is data that conforms to the network risk feature set. The generation unit is used to generate a user risk profile corresponding to a user object based on the risk behavior tags corresponding to the network risk data, wherein the user risk profile is used to assess the health status of the user object's network assets.

8. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the user risk profile generation method according to any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the user risk profile generation method according to any one of claims 1 to 6.

Images