Network threat information processing method, device, electronic device and storage medium

Abstract

The embodiments of the present invention disclose a method, device, electronic device and storage medium for processing network threat information, which relate to the field of network security technology. The invention is made to solve the problem of inaccurate source tracing analysis of network threat information. The method for processing network threat information includes: parsing and detecting network traffic data, determining basic threat events, and storing full-factor data of the traffic of basic threat events; screening basic threat events, identifying key threat events; determining the attack chain of key threat events based on a preset attack chain model; establishing a network entity behavior relationship map through the information carried by the key threat events; determining the attack chain of key threat events based on a preset attack chain model; and profiling the attack organization of the key threat event based on the key threat events and full-factor data of the attack chain. It is suitable for application scenarios where the accuracy of source tracing analysis of network threat information needs to be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device, electronic device, and storage medium for processing network threat information. Background Art

[0002] With the increasing complexity of modern network structures, such as complex network partitions, cloud networks, and new network devices, the number of alarms from security devices is increasing dramatically. When processing alarm data, manual alarm correlation analysis is mainly used to find high-threat alarm events from the alarm data, and the source analysis of the high-threat alarm events found is performed based on experience. However, there is a problem of inaccurate source analysis results due to omissions. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a method, apparatus, electronic device, and storage medium for processing network threat information, which can improve the accuracy of source tracing analysis of network threat information.

[0004] To achieve the above objectives, the embodiments of the present invention adopt the following technical solutions:

[0005] In a first aspect, an embodiment of the present invention provides a method for processing network threat information, comprising: parsing and detecting network traffic data to determine basic threat events, and storing full-factor data of the traffic of the basic threat events; screening the basic threat events to identify key threat events; establishing a network entity behavior relationship map based on the information carried by the key threat events; determining the attack chain of the key threat event based on a preset attack chain model; and profiling the attack organization of the key threat event based on the attack chain and the full-factor data.

[0006] According to a specific implementation of the embodiment of the present invention, screening basic threat events to identify key threat events includes: performing aggregate screening on basic threat events to identify key threat events.

[0007] According to a specific implementation of an embodiment of the present invention, determining the attack chain of the key threat event based on a preset attack chain model includes: automatically deriving the attack chain of the key threat event based on a preset long and short attack chain model and a given chain length.

[0008] According to a specific implementation of the embodiment of the present invention, before screening the basic threat events to identify key threat events, the method further includes: performing attack confirmation on the basic threat events.

[0009] According to a specific implementation method of an embodiment of the present invention, the attack confirmation of the basic threat event includes: confirming whether SQL injection, and / or XSS attack, and / or upload vulnerability exists in the basic threat event; confirming whether Struts2 remote code execution vulnerability and / or deserialization remote code execution vulnerability exists in the basic threat event; and verifying whether WEBSHELL exists in the basic threat event, or whether there is a successfully uploaded WEBSHELL file, by analyzing the alarm information and the session flow.

[0010] According to a specific implementation of an embodiment of the present invention, establishing a network entity behavior relationship map based on the information carried by the key threat event includes: extracting behaviors and relationships between behaviors in the key threat event from the information carried by the key threat event; and establishing the network entity behavior relationship map of the key threat event based on the behaviors and relationships between behaviors in the key threat event.

[0011] According to a specific implementation method of an embodiment of the present invention, the profiling of the attack organization of the key threat event based on the attack chain and the full-factor data includes: extracting the behavioral element data of the attack chain and the code of the attack chain from the full-factor data to profile the attack organization of the key threat event.

[0012] In a second aspect, an embodiment of the present invention provides a network threat information processing device, comprising: a basic threat event detection module, for parsing and detecting network traffic data, determining basic threat events, and storing full-factor data of the traffic of basic threat events; a key threat event identification module, for screening the basic threat events and identifying key threat events; a network entity behavior relationship map generation module, for establishing a network entity behavior relationship map through the information carried by the key threat events; an attack chain identification module, for determining the attack chain of the key threat event based on a preset attack chain model; and a profiling module, for profiling the attack organization of the key threat event based on the attack chain and the full-factor data.

[0013] According to a specific implementation of an embodiment of the present invention, the key threat event identification module is specifically configured to aggregate and screen basic threat events to identify key threat events.

[0014] According to a specific implementation of an embodiment of the present invention, the attack chain identification module is specifically configured to:

[0015] Based on the preset long and short attack chain model and the given chain length, the attack chain of key threat events is automatically derived.

[0016] According to a specific implementation of the embodiment of the present invention, it further includes an attack confirmation module, which is used to perform attack confirmation on the basic threat event.

[0017] According to a specific implementation method of an embodiment of the present invention, the attack confirmation module is specifically used to: confirm attacks against SQL injection, XSS attack, and upload vulnerabilities; confirm attacks against Struts2 remote code execution vulnerability and deserialization remote code execution vulnerability; and verify whether the WEBSHELL exists or whether the WEBSHELL file is uploaded successfully by analyzing the alarm information and session flow.

[0018] According to a specific implementation of an embodiment of the present invention, the network entity behavior relationship graph generation module is specifically used to: extract the behaviors of the key threat event and the relationships between the behaviors from the information carried by the key threat event; and establish the network entity behavior relationship graph of the key threat event based on the behaviors of the key threat event and the relationships between the behaviors.

[0019] According to a specific implementation method of an embodiment of the present invention, the portrait module is specifically used to: extract the behavioral element data of the attack chain and the code of the attack chain from the full-factor data to profile the attack organization of the key threat event.

[0020] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute any network threat information processing method described in the first aspect above.

[0021] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, wherein the one or more programs can be executed by one or more processors to implement the network threat information processing method described in any one of the first aspects.

[0022] The network threat information processing method, device, electronic device, and storage medium provided by the embodiments of the present invention include parsing and detecting network traffic data to determine basic threat events and storing full-factor data of the traffic of the basic threat events; screening the basic threat events to identify key threat events; determining the attack chain of the key threat events based on a preset attack chain model; establishing a network entity behavior relationship map based on the information carried by the key threat events; and profiling the attack organization of the key threat event based on the attack chain and the full-factor data. In this way, the network threat information can be traced and analyzed through the network entity behavior relationship map of the key threat events in the network threat information and the portrait of the attack organization, thereby improving the accuracy of the traceability analysis of the network threat information. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0024] Figure 1 This is a flowchart of a method for processing network threat information according to an embodiment of the present invention;

[0025] Figure 2 This is a module diagram of a device for processing network threat information according to an embodiment of the present invention;

[0026] Figure 3 FIG. 1 is a schematic diagram of a module of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0028] It should be understood that the embodiments described are only a portion of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0029] See Figure 1 As shown, the network threat information processing method provided by the embodiment of the present invention includes:

[0030] S101. Analyze and detect network traffic data, determine basic threat events, and store full-factor data of the traffic of the basic threat events.

[0031] Network traffic data can be traffic data between a client and a server, acquired serially or via a bypass from a switch between the client and server. Once acquired, packet analysis techniques can be used to parse and detect the data, extracting information from the link layer, network layer, and application layer. This information can be used to identify the protocol and sample information associated with an event within the network traffic data. This information is then uploaded to the threat detection engine, which can then determine whether the event constitutes a basic threat event based on its threat level.

[0032] Full-factor data storage, also known as full-flow data storage, means storing all data in one place, rather than distributing it across multiple locations. This allows for unified data management, facilitates data query and analysis, and better ensures data integrity and consistency.

[0033] S102: Screen the basic threat events to identify key threat events.

[0034] Among them, basic threat events can also be called low-threat events or grayscale events, while critical threat events can also be called high-threat events. Compared with basic threat events, critical threat events contain more characteristics of attackers or attacking organizations.

[0035] As mentioned above, the threat detection engine can be used to determine whether an event is a basic threat event. However, during the detection process, some key threat events with unclear threat characteristics will be judged as having a low threat level, and thus the event will be determined as a basic threat event. Therefore, it is necessary to further screen the basic threat events and identify key threat events to improve the accuracy of the traceability analysis of network threat information.

[0036] S103: Establish a network entity behavior relationship map based on the information brought by the key threat events.

[0037] The network entity behavior relationship graph is a knowledge graph of key threat events, which can intuitively display the components of key threat events and the relationship between each part.

[0038] When establishing a network entity behavior relationship map, the information brought by key threat events can be manually analyzed to sort out the components of key threat events and the relationships between them to establish a network entity behavior relationship map; the information brought by key threat events can also be passed to a preset network entity behavior ontology model to establish a network entity behavior relationship map.

[0039] S104: Determine the attack chain of the key threat event based on a preset attack chain model.

[0040] The attack chain refers to the seven stages of the attacker's intrusion process, including reconnaissance of the target (Reconnaissance), weaponization, delivery of the tool (Delivery), triggering of the tool (Exploitation), installation of the Trojan (Installation), establishment of the connection (Command & Control), and execution of the attack (Acions on Objective).

[0041] S105: Based on the attack chain and the full-factor data, profile the attack organization of the key threat event.

[0042] The attack organization portrait obtained in this way is a labeling system, so it may be a known attack organization or an unknown attack organization.

[0043] Similar to establishing a network entity behavior relationship map for key threat events, the attack organization of key threat events can also be profiled through manual or preset profiling models.

[0044] The network threat information processing method provided by an embodiment of the present invention includes parsing and detecting network traffic data to determine basic threat events and storing full-factor data of the traffic of the basic threat events; screening the basic threat events to identify key threat events; determining the attack chain of the key threat event based on a preset attack chain model; establishing a network entity behavior relationship map based on the information carried by the key threat event; and profiling the attack organization of the key threat event based on the attack chain and the full-factor data. In this way, the network threat information can be traced and analyzed through the network entity behavior relationship map of the key threat event in the network threat information and the portrait of the attack organization, thereby improving the accuracy of the traceability analysis of the network threat information.

[0045] In one embodiment, screening the basic threat events to identify the key threat events includes: performing aggregate screening on the basic threat events to identify the key threat events.

[0046] When performing aggregated filtering on basic threat events, these events can be passed to a pre-set event filtering model for aggregated filtering. This helps threat analysts quickly derive key threat events from basic threat events. Aggregated filtering using the event filtering model is also easy to maintain and expand, such as by adding new dimensions or modifying aggregate filtering rules.

[0047] Specifically, the preset event screening model can extract eigenvalues ​​of features from basic threat events. For example, the preset event screening model can use a hidden Markov model to extract eigenvalues ​​of features related to packet length and time changes in basic threat events. Based on the eigenvalues ​​of the extracted features of the basic threat events, a matrix of basic threat events is constructed. The same features have the same position in the matrices of different basic threat events.

[0048] In one example, the features of the matrix used to construct basic threat events include: source port, destination port, inbound traffic, outbound traffic, number of inbound packets, number of outbound packets, duration, message length variation matrix, message time variation matrix, byte distribution, HTTP request header threat level, IP (Internet Protocol) threat level, decoded content threat level, JA3 threat level, etc.

[0049] After obtaining the matrix of basic threat events, the preset event screening model can process the matrix using unsupervised learning, for example, using a clustering algorithm to process the matrix of basic threat events, thereby obtaining an anomaly matrix from the matrix of basic threat events. The basic threat events corresponding to the anomaly matrix are considered key threat events. When processing the matrix of basic threat events using unsupervised learning, the Apriori algorithm can be used to discover correlations between the matrices of basic threat events to enhance unsupervised learning.

[0050] In one embodiment, determining the attack chain of the key threat event based on a preset attack chain model includes automatically deriving the attack chain of the key threat event based on a preset long-short attack chain model and a given chain length.

[0051] After a given chain length, the preset long and short attack chain model can automatically deduce the attack chain of key threat events through timing / correlation algorithms such as the hidden Markov model and the Apriori algorithm, solving the problem of incomplete attack chains caused by omissions when manually restoring the attack chain.

[0052] In one embodiment, before screening the basic threat events and identifying key threat events, the method further includes: performing attack confirmation on the basic threat events. Attack confirmation refers to confirming whether the attack in the basic threat event is successful. Attack confirmation on the basic threat event is performed to reduce the probability of false positives and make the established relationship map more accurate.

[0053] Based on the stored full-factor data of basic threat events, the success of the basic threat event can be confirmed. For example, the basic threat event's IoC (Indicators of Compromise) information, such as the IP address, URL (Universal Resource Locator), and DNS (Domain Name System), can be passed to the file download Trojan attack detection and confirmation model and the email attachment Trojan attack detection and confirmation model to confirm the success of the basic threat event.

[0054] After confirming that the basic threat event can be successfully attacked, the event can be identified as a key threat event and processed through the aforementioned steps S103-S105.

[0055] Furthermore, after confirming that the basic threat event is a successful attack event, the firewall can be notified to cut off the Internet Protocol address (also called IP address) of the event according to pre-configuration to ensure user safety.

[0056] In one embodiment, the attack confirmation of the basic threat event includes: confirming whether SQL injection, and / or XSS attack, and / or upload vulnerability exists in the basic threat event; confirming whether Struts2 remote code execution vulnerability and / or deserialization remote code execution vulnerability exists in the basic threat event; and verifying whether WEBSHELL exists in the basic threat event or whether a WEBSHELL file is successfully uploaded by analyzing the alarm information and the session flow.

[0057] Among them, SQL injection, XSS attack, and upload vulnerability are all important common vulnerabilities, Struts2 remote code execution vulnerability and deserialization remote code execution vulnerability are all important hot vulnerabilities, and WEBSHELL is a common malicious script in network threats. In this way, by confirming attacks on important common vulnerabilities, important hot vulnerabilities, and WEBSHELL, rather than using a universal method to confirm attacks on all vulnerabilities, we can avoid missing new vulnerabilities and improve the accuracy of attack confirmation.

[0058] Furthermore, in this embodiment, attack confirmation of basic threat events may also include: confirming the success of attack samples: correlating sample IoC information (IP, URL, DNS) with external traffic detection information. For example, using a file download Trojan attack detection and confirmation model or an email attachment Trojan attack detection and confirmation model, the file or email data is correlated with the Trojan sample to identify whether a file download Trojan and / or email attachment Trojan attack has been successful.

[0059] Preferably, in this embodiment, when confirming the attack of the basic threat event, in addition to confirming whether the basic threat event is a successful attack event, the consequences of the attack will also be determined, such as whether the SQL injection has a database drag behavior, so as to notify the firewall to perform targeted interception of the database drag behavior caused by the SQL injection to ensure user safety.

[0060] In one embodiment, the establishing of a network entity behavior relationship map using the information carried by the key threat event includes: extracting behaviors and relationships between behaviors in the key threat event from the information carried by the key threat event; and establishing the network entity behavior relationship map of the key threat event based on the behaviors and relationships between behaviors in the key threat event.

[0061] Before establishing a network entity behavior relationship map using the information brought by the key threat events, the events that confirm successful attacks or pre-collected attack events can be analyzed to determine the common features between these events, such as IP, Trojan files, C2 domain names, download addresses, etc., and the relationship between these common features can be determined by performing homology analysis on these events. For example, the relationship between two common features is: Trojan file 1 transmitted by IP1 is linked back to the download address www.a.html, etc.

[0062] After the common features and the relationships between the common features are obtained, a first entity behavior ontology model may be established based on the common features and the relationships between the common features.

[0063] Among them, attack events with common characteristics can be identified as attack events carried out by the same attacker. Attack events carried out by different attackers have different common characteristics. Therefore, based on confirmed successful attack events or pre-collected attack events, a second entity behavior ontology model and a third entity behavior ontology model can be established. Among them, the first entity behavior ontology model, the second entity behavior ontology model, and the third entity behavior ontology model correspond to different attackers respectively.

[0064] After establishing a series of entity behavior ontology models, machine learning can be performed on the series of entity behavior ontology models to obtain a preset network entity behavior ontology model.

[0065] After establishing the preset network entity behavior ontology model, the information carried by the key threat event can be passed to the preset network entity behavior ontology model. The preset network entity behavior ontology model determines which entity behavior ontology model the key threat event is applicable to, and extracts the behavior of the key threat event and the relationship between the behaviors based on the appropriate entity behavior ontology model, establishes a network entity behavior relationship map of the key threat event, and then determines the attack organization to which the network traffic data belongs based on the network entity behavior relationship map.

[0066] Before building a network entity behavior relationship map based on the information from these key threat events, we can also obtain behavioral elements (specific factors describing sample behavior) of these key threat events, such as code structure, functionality, and attack payload, to determine whether the key threat event shares similar characteristics with known malware. Specifically, this can be reflected in whether the two release the same files, connect back to the same C2 domain name, modify the same registry, etc. By performing sample homology analysis on these events, we can determine whether they are known malware.

[0067] Before building a network entity behavior relationship map based on the information from these key threat events, code similarity analysis tools can be used to compare the code of confirmed successful attack events or pre-collected attack events with the code of malware from known malicious code families to determine their similarity. This process can also be accomplished using security software, which typically categorizes malware into different families and classifies the malware within each family. By using security software to detect key threat events, it can be determined whether they belong to a particular malware family.

[0068] The attack organization to which the network traffic data belongs can be determined based on whether it is known malware and whether it belongs to a malware family.

[0069] In addition, it can also provide traceability data of key threat events, such as log data, PCAP data, full traffic data, protocol metadata and threat intelligence data, so that humans can build attack path diagrams by combining attack stages, time, and event correlation relationships for traceability analysis.

[0070] In one embodiment, the profiling of the attack organization of the key threat event based on the attack chain and the full-factor data includes: extracting the behavioral element data of the attack chain and the code of the attack chain from the full-factor data to profile the attack organization of the key threat event.

[0071] Before profiling the attacking organizations behind key threat incidents, we can first profile known attacking organizations and obtain a corresponding profiling system. Since there are multiple possible definitions of attacking organizations, there are multiple corresponding profiling systems. Through the aforementioned steps, we can obtain a series of profiling systems. After obtaining a series of profiling systems, we can perform machine learning on these systems to obtain a pre-profiling model.

[0072] After obtaining the portrait model, all factor data can be passed to the portrait model, which will determine which portrait system the attack chain is suitable for, and then profile the attack organization of the key threat event corresponding to the attack chain based on the corresponding portrait system.

[0073] After obtaining the network entity behavior relationship map of key threat events and the portrait of the attack organization, we can combine the attacker's techniques and tactics, such as slow and dispersed reconnaissance and detection, slow scanning, covert channels, domain name generation algorithms and docked domain names, to analyze the assets associated with the targets of key threat events, determine the assets with a higher probability of subsequent attacks and the attack techniques used, so as to further protect user security.

[0074] Secondly, see Figure 2 An embodiment of the present invention provides a network threat information processing device, including: a basic threat event detection module 201, used to parse and detect network traffic data, determine basic threat events, and store full-factor data of the traffic of basic threat events; a key threat event identification module 202, used to screen the basic threat events and identify key threat events; a network entity behavior relationship graph generation module 203, used to establish a network entity behavior relationship graph based on the information carried by the key threat events; an attack chain identification module 204, used to determine the attack chain of the key threat event based on a preset attack chain model; a profiling module 205, used to profile the attack organization of the key threat event based on the attack chain and the full-factor data.

[0075] In one embodiment, the key threat event identification module 202 is specifically configured to aggregate and screen basic threat events to identify key threat events.

[0076] In one embodiment, the attack chain identification module 204 is specifically configured to automatically derive the attack chain of a key threat event based on a preset long and short attack chain model and a given chain length.

[0077] In one embodiment, an attack confirmation module is further included, configured to perform attack confirmation on the basic threat event.

[0078] In one embodiment, the attack confirmation module is specifically used to: confirm attacks against SQL injection, XSS attack, and upload vulnerability; confirm attacks against Struts2 remote code execution vulnerability and deserialization remote code execution vulnerability; and verify whether WEBSHELL exists or whether the WEBSHELL file is uploaded successfully by analyzing the alarm information and session flow.

[0079] In one embodiment, the network entity behavior relationship graph generation module 203 is specifically used to: extract the behavior of the key threat event and the relationship between the behaviors from the information carried by the key threat event; and establish the network entity behavior relationship graph of the key threat event based on the behavior of the key threat event and the relationship between the behaviors.

[0080] In one embodiment, the profiling module 205 is specifically used to extract the behavioral element data of the attack chain and the code of the attack chain from the full-factor data to profile the attack organization of the key threat event.

[0081] The device of this embodiment can be used to implement the technical solution of the embodiment of the first aspect. Its implementation principle and technical effects are similar and will not be repeated here.

[0082] Thirdly, see Figure 3 An embodiment of the present invention provides an electronic device, comprising: a housing 301, a processor 302, a memory 303, a circuit board 304, and a power supply circuit 305, wherein the circuit board 304 is placed inside the space enclosed by the housing 301, and the processor 302 and the memory 303 are arranged on the circuit board 304; the power supply circuit 305 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 303 is used to store executable program code; the processor 302 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 303, so as to execute the method for displaying the system screen saver wallpaper described in any of the above-mentioned embodiments.

[0083] The specific execution process of the above steps by the processor 302 and the steps further executed by the processor 302 by running the executable program code can be found in the description of the above embodiment and will not be repeated here.

[0084] The aforementioned electronic devices exist in various forms, including but not limited to:

[0085] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and are primarily designed to provide voice and data communications. These terminals include smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones.

[0086] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0087] (3) Portable entertainment devices: These devices can display and play multimedia content. These devices include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0088] (4) Server: A device that provides computing services. The server consists of a processor 302, a hard disk, memory, a system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0089] (5) Other electronic devices with data interaction functions.

[0090] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the method for displaying the system screen saver wallpaper described in any of the above-mentioned embodiments. Therefore, the corresponding technical effects can also be achieved. The above description has been made in detail and will not be repeated here.

[0091] It should be noted that, in this article, the emphasis of the schemes described in the various embodiments is different, but the various embodiments are mutually related. When understanding the scheme of the present invention, the various embodiments can refer to each other; in addition, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device that includes a series of elements includes not only those elements, but also other elements that are not explicitly listed, or also includes elements that are inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the presence of other identical elements in the process, method, article or device that includes the elements.

[0092] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for processing network threat information, characterized in that: include: Analyze and detect network traffic data, identify basic threat events, and store all elements of the traffic of basic threat events; Screening the basic threat events to identify key threat events; Establishing a network entity behavior relationship map based on the information carried by the key threat event; wherein establishing the network entity behavior relationship map based on the information carried by the key threat event includes: extracting behaviors and relationships between behaviors in the key threat event from the information carried by the key threat event; and establishing the network entity behavior relationship map for the key threat event based on the behaviors and relationships between behaviors in the key threat event; Determine the attack chain of the key threat event based on a preset attack chain model; Based on the attack chain and the full-factor data, the attack organization of the key threat event is profiled, wherein the profiling of the attack organization of the key threat event based on the attack chain and the full-factor data includes: extracting behavioral element data of the attack chain and code related to the attack chain from the full-factor data to profile the attack organization of the key threat event.

2. The method for processing network threat information according to claim 1, characterized in that: The basic threat events are screened to identify key threat events, including: Aggregate and filter basic threat events to identify key threat events.

3. The method for processing network threat information according to claim 1, characterized in that: Determining the attack chain of the key threat event based on a preset attack chain model includes: Based on the preset long and short attack chain model and the given chain length, the attack chain of key threat events is automatically derived.

4. The method for processing network threat information according to claim 1, characterized in that: Before screening the basic threat events to identify key threat events, the method further includes: An attack confirmation is performed on the basic threat event.

5. The method for processing network threat information according to claim 4, characterized in that: The confirming the attack on the basic threat event includes: Confirm whether there are SQL injections, XSS attacks, and / or upload vulnerabilities in basic threat events; Confirm whether there are Struts2 remote code execution vulnerabilities and / or deserialization remote code execution vulnerabilities in the basic threat events; By analyzing the alarm information and conversation flow, verify whether there is a webshell in the basic threat event, or whether there is a successfully uploaded webshell file.

6. A network threat information processing device, characterized in that: include: The basic threat event detection module is used to parse and detect network traffic data, identify basic threat events, and store all elements of the traffic of basic threat events; A key threat event identification module, configured to screen the basic threat events and identify key threat events; A network entity behavior relationship graph generation module is configured to establish a network entity behavior relationship graph based on the information carried by the key threat event; wherein establishing the network entity behavior relationship graph based on the information carried by the key threat event comprises: extracting behaviors and relationships between behaviors in the key threat event from the information carried by the key threat event; and establishing the network entity behavior relationship graph for the key threat event based on the behaviors and relationships between behaviors in the key threat event; An attack chain identification module, configured to determine the attack chain of the key threat event based on a preset attack chain model; A profiling module is used to profile the attack organization of the key threat event based on the attack chain and the full-factor data, wherein the profiling of the attack organization of the key threat event based on the attack chain and the full-factor data includes: extracting the behavioral element data of the attack chain and the code of the attack chain from the full-factor data to profile the attack organization of the key threat event.

7. An electronic device, characterized in that: The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute the network threat information processing method described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the network threat information processing method according to any one of claims 1 to 5.

Images