A network security monitoring method and device, electronic equipment and storage medium

Abstract

The application discloses a network security monitoring method, comprising: obtaining security threat information; based on the security requirements of a predetermined scene, screening the obtained security threat information to obtain security threat information for the predetermined scene; based on the security threat information for the predetermined scene, identifying non-secure network access under the predetermined scene. The application also discloses a network security monitoring device, an electronic device and a storage medium.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security monitoring method, device, electronic device, and storage medium. Background Technology

[0002] Currently, the risks in the field of information security for home settings include: threats from harmful information and cybersecurity threats.

[0003] With the increasing complexity of the internet environment and the growing threat of harmful information, especially for teenagers, preventing unsafe online activities has become a significant challenge for families. Unsafe online activities harm the physical and mental health of minors. In terms of cybersecurity protection, the rapid onset and high degree of concealment of unsafe online activities present technical difficulties, making them numerous and difficult to detect and intercept.

[0004] Regarding cybersecurity threats, since home network devices, such as smart home devices, mostly incorporate technologies such as networking, hardware, and cloud services, any security vulnerability can lead to the leakage of sensitive privacy data through smart home products, or even launch attacks such as distributed denial-of-service (DDoS) attacks. In terms of cybersecurity protection, due to the diversity of Trojan virus variants and network attack methods, it is difficult to detect and notify users in a timely manner when devices are compromised, and security vulnerabilities cannot be synchronized immediately after disclosure.

[0005] Therefore, improving network access security in home settings is an urgent issue that needs to be addressed. Summary of the Invention

[0006] This application provides a network security monitoring method, apparatus, electronic device, and storage medium.

[0007] The technical solution of this application embodiment is implemented as follows:

[0008] According to a first aspect of the embodiments of this application, a network security monitoring method is provided, comprising:

[0009] Obtain security threat information;

[0010] Based on the security requirements of a predetermined scenario, the acquired security threat information is filtered to obtain security threat information specific to the predetermined scenario.

[0011] Based on security threat information for the predetermined scenario, insecure network access in the predetermined scenario is identified.

[0012] In one embodiment, obtaining security threat information includes at least one of the following:

[0013] Network address information is detected based on sensitive words to identify insecure network address information;

[0014] Based on the attack logs recorded by the preset honeypot, the security threat information is obtained;

[0015] Obtain the security threat information provided by the external platform.

[0016] In one embodiment, the step of detecting network address information based on sensitive words to determine insecure network address information includes:

[0017] Obtain the webpage content in the webpage structure corresponding to the network address information to be detected, wherein the webpage content includes: webpage theme content and / or webpage body content;

[0018] Perform sensitive word detection on the webpage content;

[0019] The webpage content that meets the sensitive word detection criteria will be used for security identification using a preset model;

[0020] Obtain the network address information corresponding to the insecure webpage content identified by the preset model through security identification.

[0021] In one embodiment, the preset model includes:

[0022] Fasttext Natural Language Processing (NLP) model.

[0023] In one embodiment, obtaining the security threat information based on attack logs recorded by a preset honeypot includes:

[0024] The honeypot is constructed based on the network application environment of the predetermined scenario;

[0025] Multiple honeypots are set up, wherein the geographical location and / or cloud server of each honeypot are not the same;

[0026] Obtain attack logs from multiple honeypots.

[0027] Based on the attack logs, the security threat information is determined, wherein the security threat information includes: attack resource information and / or attack method information.

[0028] In one embodiment, the attack resource information includes: a SSH brute-force dictionary for monitoring Secure Shell protocol, SSH connection client information, virus download and distribution server information, and remote control address information;

[0029] Attack method information, including: attack virus sample information, attack command information, and attack impact information.

[0030] In one embodiment, obtaining the security threat information provided by an external platform includes:

[0031] Based on information crawling rules, crawl the security threat information from at least one external platform.

[0032] In one embodiment, the method further includes:

[0033] Configure crawling resources for each external platform based on its priority.

[0034] In one embodiment, the step of filtering the security threat information based on the security requirements of a predetermined scenario to obtain security threat information specific to the predetermined scenario includes:

[0035] Based on the security requirements of the predetermined scenario, multiple screening and detection items are determined;

[0036] Security threat information that fails to pass at least one of the screening detection items is identified as security threat information for the predetermined scenario.

[0037] In one embodiment, the method further includes at least one of the following:

[0038] The security threat information for the predetermined scenario is normalized.

[0039] The security threat information for the predetermined scenario is classified.

[0040] In one embodiment, identifying insecure network access in the predetermined scenario based on security threat information specific to the predetermined scenario includes:

[0041] Security threat information for the predetermined scenario is stored in the gateway device, which then identifies insecure network access in the predetermined scenario based on the security threat information.

[0042] According to a second aspect of the embodiments of this application, a network security monitoring device is provided, comprising:

[0043] The acquisition module is used to acquire security threat information;

[0044] The determination module is used to filter the acquired security threat information based on the security requirements of a predetermined scenario, and obtain security threat information for the predetermined scenario.

[0045] The identification module is used to identify insecure network access in the predetermined scenario based on security threat information for the predetermined scenario.

[0046] In one embodiment, the acquisition module is specifically used for at least one of the following:

[0047] Network address information is detected based on sensitive words to identify insecure network address information;

[0048] Based on the attack logs recorded by the preset honeypot, the security threat information is obtained;

[0049] Obtain the security threat information provided by the external platform.

[0050] In one embodiment, the acquisition module is specifically used for:

[0051] Obtain the webpage content in the webpage structure corresponding to the network address information to be detected, wherein the webpage content includes: webpage theme content and / or webpage body content;

[0052] Perform sensitive word detection on the webpage content;

[0053] The webpage content that meets the sensitive word detection criteria will be used for security identification using a preset model;

[0054] Obtain the network address information corresponding to the insecure webpage content identified by the preset model through security identification.

[0055] In one embodiment, the preset model includes:

[0056] Fasttext Natural Language Processing (NLP) model.

[0057] In one embodiment, the acquisition module is specifically used for:

[0058] The honeypot is constructed based on the network application environment of the predetermined scenario;

[0059] Multiple honeypots are set up, wherein the geographical location and / or cloud server of each honeypot are not the same;

[0060] Obtain attack logs from multiple honeypots.

[0061] Based on the attack logs, the security threat information is determined, wherein the security threat information includes: attack resource information and / or attack method information.

[0062] In one embodiment, the attack resource information includes: a SSH brute-force dictionary for monitoring Secure Shell protocol, SSH connection client information, virus download and distribution server information, and remote control address information;

[0063] Attack method information, including: attack virus sample information, attack command information, and attack impact information.

[0064] In one embodiment, the acquisition module is specifically used for:

[0065] Based on information crawling rules, crawl the security threat information from at least one external platform.

[0066] In one embodiment, the apparatus further includes:

[0067] The configuration module is used to configure the crawling resources for each external platform based on the priority of each external platform.

[0068] In one embodiment, the determining module is specifically used for:

[0069] Based on the security requirements of the predetermined scenario, multiple screening and detection items are determined;

[0070] Security threat information that fails to pass at least one of the screening detection items is identified as security threat information for the predetermined scenario.

[0071] In one embodiment, the device further includes at least one of the following:

[0072] The first processing module is used to normalize the security threat information for the predetermined scenario;

[0073] The second processing module is used to classify security threat information for the predetermined scenario.

[0074] In one embodiment, the identification module is specifically used for:

[0075] Security threat information for the predetermined scenario is stored in the gateway device, which then identifies insecure network access in the predetermined scenario based on the security threat information.

[0076] According to a third aspect of the embodiments of this application, a storage medium is provided that stores an executable program, which, when executed by a processor, implements the steps of the network security monitoring method described in the first aspect.

[0077] According to a fourth aspect of the present application, an electronic device is provided, including a memory, a processor, and an executable program stored in the memory and executable by the processor, wherein the processor executes the steps of the network security monitoring method as described in the first aspect when running the executable program.

[0078] The network security monitoring method, apparatus, electronic device, and storage medium provided in this application include: acquiring security threat information; filtering the acquired security threat information based on the security requirements of a predetermined scenario to obtain security threat information specific to the predetermined scenario; and identifying insecure network access in the predetermined scenario based on the security threat information specific to the predetermined scenario. Thus, by filtering the acquired security threat information and using the filtered security threat information specific to the predetermined scenario for identifying insecure network access in the predetermined scenario, the targeting of the identification of insecure network access in the predetermined scenario is improved, thereby enhancing the security of network access in the predetermined scenario.

[0079] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the embodiments of this disclosure. Attached Figure Description

[0080] Figure 1 A flowchart illustrating a network security monitoring method provided in an embodiment of this application;

[0081] Figure 2 This is a schematic diagram illustrating a security threat information acquisition step provided in an embodiment of this application;

[0082] Figure 3 This is a schematic diagram of a security threat information acquisition process provided in an embodiment of this application;

[0083] Figure 4 This is a schematic diagram illustrating another security threat information acquisition step provided in an embodiment of this application;

[0084] Figure 5 This is a schematic diagram illustrating another security threat information acquisition process provided in an embodiment of this application;

[0085] Figure 6 This is a schematic diagram illustrating another security threat information acquisition step provided in an embodiment of this application;

[0086] Figure 7 This is a schematic diagram illustrating another security threat information acquisition process provided in an embodiment of this application;

[0087] Figure 8 This application provides a schematic diagram of a security threat information detection process.

[0088] Figure 9 This application provides a schematic diagram of the system architecture for a network security monitoring method.

[0089] Figure 10 This is a schematic diagram of a network security monitoring device provided in an embodiment of this application. Detailed Implementation

[0090] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the scope of the present application.

[0091] The current technical challenges facing the field of home information security are as follows:

[0092] 1) Insecure domains are difficult to regulate: To evade regulation, insecure websites use multi-layered nested JavaScript frameworks, making them difficult to identify based on the webpage source code alone. Furthermore, they become inactive very quickly, rapidly migrating to new domains after a short period of activity on a particular domain, making them difficult to handle and block.

[0093] 2) Difficulty in covering virus variants: To avoid being blocked by antivirus software, malware variants are numerous and updated rapidly. Intelligence from a single vendor is insufficient to cover multiple malware family variants and cannot reconstruct the attack chain.

[0094] 3) Untimely vulnerability synchronization: Vulnerability indicators are not synchronized with protection devices in a timely manner. Attackers can exploit known vulnerabilities to attack smart home devices, resulting in privacy leaks for home users or attacks by smart devices against external entities.

[0095] 4) Lack of targeted support from vendors: Current third-party vendor intelligence focuses on government and enterprise / server protection scenarios, lacking specific support for home security scenarios.

[0096] like Figure 1 As shown in the exemplary embodiment, this network security monitoring method provides a network security monitoring method, which includes:

[0097] Step 101: Obtain security threat information;

[0098] Step 102: Based on the security requirements of the predetermined scenario, filter the acquired security threat information to obtain security threat information for the predetermined scenario;

[0099] Step 103: Based on the security threat information for the predetermined scenario, identify insecure network access in the predetermined scenario.

[0100] In this embodiment, the network security monitoring method can be executed by network devices, such as network servers, gateway devices, and routing devices.

[0101] Security threat information includes, but is not limited to:

[0102] Data source information containing harmful online information, such as information from websites containing harmful information;

[0103] Information related to cybersecurity threats, such as: network address information that causes cybersecurity threats, cybersecurity threat name information, cybersecurity threat form information, cybersecurity threat consequences information, etc.

[0104] Network devices can acquire security threat information through various methods and data sources. For example, they can obtain security threat information from multiple data sources or from identified attacks against network devices. This allows for the acquisition of more security threat information, improving the identification rate when identifying insecure network access based on this information.

[0105] In one embodiment, the predetermined scenario can be a predetermined network usage scenario. For example, the predetermined scenario can include a home scenario, etc. A home scenario can include: access to a wide area network from a home local area network, network access within a home local area network, and / or a software environment within a home environment, etc.

[0106] The security threat information acquired here is not scenario-specific and can include threats targeting home environments, servers, public networks, and cloud environments. Therefore, the acquired security threat information may not be entirely suitable for home scenarios. For example, cloud-based security threat information is not applicable to home environments; using cloud-based security threat information for home network security protection will not produce optimal results. Outdated or untrusted security threat information will not positively impact home network security protection and will instead consume excessive resources.

[0107] Here, a threat intelligence review mechanism for home scenarios is established to screen the acquired security threat information and remove security threat information that is not applicable to home scenarios, such as deleting outdated or untrusted security threat information, so as to ensure the reliability of security threat information for the intended scenarios.

[0108] Insecure network access can include attacks on home networks, malicious network information from external networks accessible through the home network, etc.

[0109] For example, based on the security threat information corresponding to Trojan virus attacks, attacks targeting home environments can be identified. Similarly, based on the security threat information corresponding to harmful information, such as the URLs of harmful websites, visits to such websites can be identified.

[0110] When insecure network access is detected, alerts can be sent to the user or the access can be blocked directly on terminals such as computers. This improves the security of the home network.

[0111] In this way, by filtering the acquired security threat information, the filtered security threat information for a predetermined scenario is used to identify insecure network access in that scenario, thereby improving the targeting of the identification of insecure network access in the predetermined scenario and enhancing the security of network access in that scenario.

[0112] In one embodiment, obtaining security threat information includes at least one of the following:

[0113] Network address information is detected based on sensitive words to identify insecure network address information;

[0114] Based on the attack logs recorded by the preset honeypot, the security threat information is obtained;

[0115] Obtain the security threat information provided by the external platform.

[0116] Here, sensitive words can be words or phrases containing inappropriate information. Detecting network address information based on sensitive words involves matching the webpage content of the network address with the sensitive words. If the match between the webpage content and the sensitive words exceeds a threshold, the webpage content of the network address is determined to contain inappropriate information, and network devices can identify the network address information as a security threat. Insecure network address information can be used to identify malicious websites, etc.

[0117] Here, honeypots can attract various cyberattack behaviors and record attack logs. Security threat information can be extracted from these logs, including attack methods and sources. Based on the security threat information obtained from the honeypot, it can at least be used to identify malicious attacks.

[0118] Security threat information obtained from external platforms can include insecure network address information and network attack information obtained from external devices. Security threat information obtained from external platforms can also include software-related security threat information and / or hardware-related security threat information; for example: recent security incidents, device vulnerabilities, vendor patches, active malware families, etc.

[0119] Obtaining security threat information from external platforms can increase the sources of security threat information, increase the amount of information on security threats, and thus identify more insecure network access.

[0120] In this way, obtaining security threat information through different channels increases the flexibility of information gathering and expands the amount of security threat information available.

[0121] In one embodiment, the step of detecting network address information based on sensitive words to determine insecure network address information includes:

[0122] Obtain the webpage content in the webpage structure corresponding to the network address information to be detected, wherein the webpage content includes: webpage theme content and / or webpage body content;

[0123] Perform sensitive word detection on the webpage content;

[0124] The webpage content that meets the sensitive word detection criteria will be used for security identification using a preset model;

[0125] Obtain the network address information corresponding to the insecure webpage content identified by the preset model through security identification.

[0126] Here, network address information can be collected by network devices such as gateways, or it can be obtained through web crawlers. Network address information can include, but is not limited to, network addresses, IP addresses, and domain names.

[0127] First, sensitive words can be detected on the web page content corresponding to the network address information. Then, web page content that meets the sensitive word detection conditions can be further identified using a preset model.

[0128] Here, meeting the conditions for sensitive word detection can include a degree of matching between the webpage content and the sensitive word being greater than a matching threshold.

[0129] The preset model can include machine learning models, etc. The preset model can be trained, and the trained model can then be used to further identify webpage content that meets the sensitive word detection criteria. This improves the accuracy of webpage content identification.

[0130] In one embodiment, the preset model includes:

[0131] Fasttext Natural Language Processing (NLP) model.

[0132] For example, such as Figure 2 As shown, domains obtained through gateway collection and external exchange crawlers can be used as data sources to extract webpage content from the domain's webpage structure: webpage title content and / or webpage body content. After sensitive word detection, a lightweight NLP model based on Fasttext is established to classify and identify insecure domains. Figure 3 As shown, the specific steps include:

[0133] Step 301: Collect the domain names of the websites to be tested. The following sources can be used to collect the domain names to be tested:

[0134] 1) Gateway data collection: Collect internet access data of home users from the home gateway and extract domain names.

[0135] 2) Cooperation and exchange: Sharing intelligence data with external parties to obtain domain names.

[0136] 3) Open source collection: Collecting collections of insecure open source websites, such as Openphish.

[0137] Step 302: Obtain the webpage structure and content of the domain to be tested. The webpage content includes the webpage's main theme and / or body text. The main process is as follows:

[0138] 1) Web page crawling: A distributed multi-threaded request parsing module can be used to crawl the source code of the web page of the domain to be tested.

[0139] 2) Structure parsing: Using regular expressions, identify the webpage content in the domain structure to be detected.

[0140] Step 303: Sensitive word detection for webpage content. The main process is as follows:

[0141] 1) Collecting a sensitive word database: Here, the sensitive word database can be used to match web page content. Open-source sensitive word databases can be used, containing illegal and inappropriate words. Sensitive words can also be extracted from the content of identified unsafe websites and added to the database.

[0142] 2) Sensitive word filtering: The webpage content from step 202 is matched against the collected sensitive word database. If a sensitive word in the database matches the webpage content, it is identified as potentially unsafe webpage content, and the network address is determined to be an unsafe network address.

[0143] Step 304: Build a Fasttext NLP model to identify insecure websites.

[0144] 1) The Fasttext NLP model can identify character variations of sensitive words. Because insecure websites often use a mix of Chinese, English, and even internet slang to evade detection, the Fasttext NLP model incorporates the concept of subword n-grams to address word form changes. The subwords of a word phrase are all the n-gram words within the phrase itself. These subwords form a dictionary, and these n-grams are hashed to integers from 1 to K. Simultaneously, words within the word phrase are used as n-grams to learn the word vector, thus constructing a dictionary for each word.

[0145] A different scoring function s can be proposed, taking subword information into account. For a given word w, the set of n-grams appearing on w is defined as: G w ∈1,...,G. Represent a vector z.g Associated with each n-gram g, word w can be represented by summing the vectors of these n-grams. The scoring function of word w is then obtained, as indicated by expression (1):

[0146]

[0147] For a word w, its n-gram set contains word w, and a vector representation can be learned for each word. The n-gram set is also a superset of the vocabulary. For example, for a word and an n-gram that share the same word sequence, different vectors will be assigned to them; for example, in "yellow petals" and "yellow online movies," the two instances of "yellow" will be assigned different vectors. This model allows for the sharing of reputation ratings among different words, thus learning reliable vector representations for some rare words. The vector representation of word w can be used to classify word w, determine whether word w belongs to a sensitive word character variation, and further determine whether the webpage content containing that word is safe.

[0148] 2) Improve accuracy and speed

[0149] The Fasttext NLP model addresses the class imbalance problem and improves the accuracy of identifying illegal and prohibited categories by employing a hierarchical softmax method. The hierarchical softmax technique, based on Huffman coding, encodes labels, significantly reducing the number of targets the model needs to predict. FastText leverages the class imbalance by using the Huffman algorithm to build a tree structure representing the categories. Therefore, the depth of the tree structure for frequently occurring categories is smaller than that for infrequently occurring categories, further enhancing the computational efficiency of the Fasttext NLP model. Testing has shown that the Fasttext NLP model effectively handles tasks with a large number of domain samples and numerous category labels, achieving sub-second response times.

[0150] Thus, by employing sensitive word detection on webpage content and further identifying content that meets the sensitive word detection criteria using a pre-defined model, the efficiency of security threat information identification is improved, false positives from multiple webpages are reduced, and the accuracy of the obtained security threat information is increased. Combining sensitive words with a pre-defined model for identification improves the webpage content recognition rate and speed.

[0151] In one embodiment, obtaining the security threat information based on attack logs recorded by a preset honeypot includes:

[0152] The honeypot is constructed based on the network application environment of the predetermined scenario;

[0153] Multiple honeypots are set up, wherein the geographical location and / or cloud server of each honeypot are not the same;

[0154] Obtain attack logs from multiple honeypots.

[0155] Based on the attack logs, the security threat information is determined, wherein the security threat information includes: attack resource information and / or attack method information.

[0156] Here, honeypots can attract various cyberattack behaviors and record attack logs. Security threat information can be extracted from these logs, including attack methods and sources. Based on the security threat information obtained from the honeypot, it can at least be used to identify malicious attacks.

[0157] Honeypots can be set up on multiple cloud servers and / or in different geographical locations to attract more attacks and obtain more security threat information.

[0158] By employing multiple honeypot trapping attacks, on the one hand, the scope of security threat information acquisition is expanded, and the amount of security threat information obtained is increased. On the other hand, it preserves evidence of attacker operations and malicious samples, further increasing the avenues for obtaining security threat information.

[0159] For example, it can be as follows Figure 4 The diagram shows honeypot decoy nodes that can be deployed across multiple public clouds. These nodes create a highly realistic operating system environment for home devices to lure and capture attacks. Once captured, the honeypot logs are monitored to identify dangerous system operations and attack methods, thus generating cybersecurity threat information for home devices. Figure 5 The specific steps may include:

[0160] Step 501: Configure a high-interaction honeypot based on a real-world home network application environment

[0161] 1) Honeypot Type: High-interaction honeypots (such as Sysdig) can be selected, and can be built based on real-world home network application environments. This provides realistic services, increasing the sweetness of the honeypot environment and enticing attackers to intrude into the system, achieving their attack objectives. High-interaction honeypots can be used to acquire a large amount of information, capturing various attacker behaviors, thus enabling the discovery of new attack methods and vulnerability exploitation techniques.

[0162] 2) Proactive Exposure: Honeypots proactively expose vulnerabilities to attract attack fire. Compared to traditional firewalls and intrusion detection technologies, honeypots are more proactive and covert. Their main advantage lies in their ability to induce and record network attack behavior, preventing or delaying attacks on the real target. Furthermore, they record attack logs for easy auditing and backtracking. By actively distributing vulnerabilities and weaknesses, honeypots proactively lure and capture attackers, placing attack detection in a proactive position for the first time. This makes attack detection no longer a matter of luck, thereby increasing attack detection sensitivity and effectively improving the probability of detection.

[0163] Step 502: Deploy honeypots on multiple cloud servers

[0164] Honeypot Deployment: A distributed deployment strategy is employed, placing honeypots across different regions. Highly interactive honeypot trapping nodes are set up on multiple public clouds and in various geographical locations globally, with public network access provided. The honeypots can detect and report new attack events on local infrastructure and the internet. By configuring vulnerable services on the system, ongoing attacker behavior can be collected. Honeypot logs and traffic information are retained, including but not limited to: attack source IP, attack port, attack network requests, intrusion time, and shellcode.

[0165] Step 5033: Generate network security threat information for home devices based on honeypot attack logs.

[0166] 1) Honeypot Attack Log Monitoring and Analysis: Analyze honeypot logs to identify dangerous system operations and attack methods, including scanning, brute-force attacks, Trojan deployment, and vulnerability exploitation. Extract attacker IPs and ports, addresses for downloading malicious samples, and remote control IPs and ports to create a profile. The resulting intelligence includes two categories: attack resource information and / or attack method information.

[0167] In one embodiment, the attack resource information, i.e., asset-related intelligence, includes: a brute-force dictionary for monitoring the Secure Shell protocol (SSH), SSH connection client information, virus download and distribution server information, and remote control address information;

[0168] Attack method information, i.e. weapon intelligence, includes: attack virus sample information, attack command information, and attack impact information.

[0169] For example, attack resource information can be recorded in the manner described in Table (1).

[0170] Table 1

[0171]

[0172]

[0173] For example, attack method information can be recorded in the manner described in Table (2).

[0174] Table 2

[0175]

[0176] In one embodiment, obtaining the security threat information provided by an external platform includes:

[0177] Based on information crawling rules, crawl the security threat information from at least one external platform.

[0178] Here, the external platform can be any external platform used to publicize cybersecurity incidents. Cybersecurity incidents can include hardware-related incidents, such as hardware vulnerabilities. Cybersecurity incidents can also include software-related incidents, such as software patches.

[0179] The content, method, and format of the cybersecurity incidents reported by various external platforms differ.

[0180] Therefore, it is necessary to set up information crawling rules to extract the required security threat information from cybersecurity incidents published by various external platforms. Information crawling rules can be configured based on the method of publication and the format of the content published by each external platform. For example, for insecure network address information published by external platforms, only the website's IP address can be extracted.

[0181] In one embodiment, the method further includes:

[0182] Configure crawling resources for each external platform based on its priority.

[0183] Simultaneous scraping of information from multiple external platforms consumes significant resources. These resources include network bandwidth and the computing resources of the scraping devices. Therefore, it's advisable to prioritize different external platforms. When sufficient resources are available, resources can be scraped simultaneously. If resources are insufficient, information from each external platform can be scraped sequentially based on its priority.

[0184] For example, such as Figure 6 The system allows for distributed collection of publicly available cybersecurity threat information from multiple external platforms. Information crawling rules can be configured to ensure real-time data consumption, enabling monitoring and collection of security threat information published by security incident platforms, including recent security incidents, device vulnerabilities, vendor patches, and active malware families. Figure 7 The specific steps may include:

[0185] Step 701: External Platform Research and Data Collection

[0186] 1) Coverage: Access to network security vendor announcement platforms, threat intelligence platforms, security vulnerability reporting platforms, and network security news platforms, basically achieving full coverage of external platforms.

[0187] 2) Coverage content: Includes tags such as recent security incidents, device vulnerabilities, vendor patches, and active malware families.

[0188] Step 702: Setting up information crawling rules and scheduling tasks

[0189] 1) Information Crawling Rules: Generate site crawling information and rules. The parsing engine will analyze the crawled content according to these rules. Different sites display intelligence news and reports differently, and storing the entire article in the database would consume too many resources. Therefore, it is necessary to extract the core actionable content for storage. Core actionable content may include: Indicators of Compromise (IOCs), families, execution commands, etc.

[0190] 2) Task scheduling: Based on the task status, the task manager automatically determines to reclaim and release crawling resources, schedule priorities, and distribute services to arrange crawling resources.

[0191] Step 703: Monitor the system through a distributed collection engine to ensure real-time data consumption.

[0192] Real-time consumption: After the crawled content is normalized by fields, it is consumed in real time and stored in the security threat information database for the identification of insecure network access, ensuring timeliness.

[0193] In one embodiment, the step of filtering the security threat information based on the security requirements of a predetermined scenario to obtain security threat information specific to the predetermined scenario includes:

[0194] Based on the security requirements of the predetermined scenario, multiple screening and detection items are determined;

[0195] Security threat information that fails to pass at least one of the screening detection items is identified as security threat information for the predetermined scenario.

[0196] Here, a threat intelligence review mechanism for home scenarios can be established to screen the acquired security threat information and remove security threat information that is not applicable to home scenarios, such as deleting outdated or untrusted security threat information, so as to ensure the reliability of security threat information for the intended scenario.

[0197] Here, the filtering and detection items can be set based on the security requirements of a predetermined scenario. Different filtering items can detect different content. For example, based on the security requirements of web page content in a predetermined scenario, filtering and detection items can be set to detect whether security threat information is trustworthy.

[0198] A predetermined scenario can be detected using one or more filtering and detection items. If a security threat passes all filtering and detection items, it can be determined that the security threat is safe for the predetermined scenario and can be removed from the list of security threat information. If a security threat fails one or more filtering and detection items, it can be determined that the security threat is unsafe for the predetermined scenario and can be identified as a security threat for the predetermined scenario.

[0199] Security threat information for the predetermined scenario can be accessed by network devices in insecure networks within the predetermined scenario.

[0200] In one embodiment, the method further includes at least one of the following:

[0201] The security threat information for the predetermined scenario is normalized.

[0202] The security threat information for the predetermined scenario is classified.

[0203] Security threat information obtained through preset models, honeypots, and / or external platforms varies in form and format. Therefore, security threat information for the predetermined scenario can be normalized to obtain security threat information with uniform form and format, which facilitates the subsequent use of security threat information.

[0204] The security threat information for the predetermined scenario can also be categorized, for example, based on the security attributes of the security threat information. This allows the classification of security threat information to indicate the type of insecure network access when determining insecure network access.

[0205] For example, security threat information can be categorized into: vulnerability security threat information, network threat security threat information, and business security threat information. Vulnerability security threat information can include information such as network device vulnerabilities; network threat security threat information can include information such as network attack information; and business security threat information can include information such as insecure web page content.

[0206] For example, regarding the preset models for identifying malicious websites, highly realistic honeypots, and security threat information obtained from external platforms, multi-dimensional threat features and related information can be added to establish a threat intelligence review mechanism for home scenarios. This involves screening and detecting outdated and untrusted information to ensure the reliability of intelligence in home scenarios. Figure 8 The specific steps may include:

[0207] Step 801: Set up a veto mechanism for intelligence review, that is, a veto system for each screening and detection item.

[0208] Because false alarms about security threats can easily generate a large number of false alerts, the real threats can be hidden beneath this sea of ​​alerts, making investigation difficult. Therefore, a veto mechanism for intelligence review is used to eliminate false security threat reports.

[0209] 1) Set false alarm criteria: Since different security threat information has its own abnormal characteristics, multiple screening and detection items are used for detection. The obtained security threat information is verified according to the screening and detection items in the table below. If all screening and detection items pass, the security threat information is considered safe, that is, the security threat information is a false alarm; otherwise, the obtained security threat information is determined to be a security threat information for the preset scenario.

[0210] The detection was performed using multiple screening and testing items, as shown in Table 3.

[0211] Table 3

[0212]

[0213]

[0214] Step 802: Classification and Normalization of Security Threat Information

[0215] Threat intelligence application techniques: Intelligence that has undergone an intelligence review mechanism can be mainly divided into the following categories:

[0216] (a) Vulnerability and Security Threat Information: This section comes from a cyberspace threat information collection engine, targeting vulnerabilities in various home IoT devices, such as weak passwords, information leaks, and unauthorized access. When device manufacturer, product, model, and version information are known, vulnerability intelligence can be linked to promptly identify potential problems.

[0217] (b) Threat and security information: This part comes from the honeypot threat capture system, which can promptly detect attack activities and trends in the current network, capture new malicious samples, etc.

[0218] (c) Business security threat information: This part comes from the malicious information identification model, which is specifically designed for home business scenarios, such as preventing unsafe network activities. It has obvious characteristics of content identification and illegal text content interception.

[0219] (d) Security Threat Information from Other Industries / Vertical Sectors: Security threats to IoT devices can also be discovered by leveraging intelligence from other industries / vertical sectors. For example, by associating the domain names and IP addresses accessed by IoT devices with blockchain intelligence (domain names and IP addresses of insecure websites), cryptocurrency mining activities of IoT devices can be detected.

[0220] After multi-source intelligence aggregation, correlation, aging, and reputation calculation, the security threat information for home scenarios is shown in Table 4.

[0221] Table 4

[0222]

[0223] In one embodiment, identifying insecure network access in the predetermined scenario based on security threat information specific to the predetermined scenario includes:

[0224] Security threat information for the predetermined scenario is stored in the gateway device, which then identifies insecure network access in the predetermined scenario based on the security threat information.

[0225] The aforementioned security threat information targeting home scenarios is integrated into network devices such as gateways and routers via plugins. When a user accesses a malicious website through the gateway, the system can send a warning to the user or directly block the access. The backend home security system can periodically or in real-time update the plugins with security threat information specific to home scenarios.

[0226] The following provides a specific example in conjunction with any of the above embodiments:

[0227] The system architecture of the network security monitoring method provided in this example is as follows: Figure 9 As shown.

[0228] Network security monitoring methods can obtain security threat information through at least three paths:

[0229] 1. Identify the webpage content of malicious websites and determine security threat information such as network address information by using a lightweight NLP model based on FastText.

[0230] 2. By using highly realistic honeypots to lure and capture network attacks, the attacks are profiled to generate security threat information;

[0231] 3. Collect security threat information such as home copper leakage intelligence and high-risk incident intelligence through external platforms;

[0232] By using an in-home intelligence review mechanism, which involves reviewing security threat information through multiple screening and detection items on devices, security threat information targeting the home environment, including information from insecure websites, is obtained.

[0233] By setting up security threat information specific to home environments in the gateway, when insecure network access is detected, the gateway can send alerts to users or directly block access via computers or other terminals, thereby improving the security of the home network.

[0234] Figure 10 This illustration shows an optional flowchart of a network security monitoring device provided in an embodiment of this application. The network security monitoring device 100 includes:

[0235] Module 110 is used to acquire security threat information;

[0236] The determination module 120 is used to filter the acquired security threat information based on the security requirements of a predetermined scenario, and obtain security threat information for the predetermined scenario.

[0237] The identification module 130 is used to identify insecure network access in the predetermined scenario based on security threat information for the predetermined scenario.

[0238] In one embodiment, the acquisition module 110 is specifically used for at least one of the following:

[0239] Network address information is detected based on sensitive words to identify insecure network address information;

[0240] Based on the attack logs recorded by the preset honeypot, the security threat information is obtained;

[0241] Obtain the security threat information provided by the external platform.

[0242] In one embodiment, the acquisition module 110 is specifically used for:

[0243] Obtain the webpage content in the webpage structure corresponding to the network address information to be detected, wherein the webpage content includes: webpage theme content and / or webpage body content;

[0244] Perform sensitive word detection on the webpage content;

[0245] The webpage content that meets the sensitive word detection criteria will be used for security identification using a preset model;

[0246] Obtain the network address information corresponding to the insecure webpage content identified by the preset model through security identification.

[0247] In one embodiment, the preset model includes:

[0248] Fasttext Natural Language Processing (NLP) model.

[0249] In one embodiment, the acquisition module 110 is specifically used for:

[0250] The honeypot is constructed based on the network application environment of the predetermined scenario;

[0251] Multiple honeypots are set up, wherein the geographical location and / or cloud server of each honeypot are not the same;

[0252] Obtain attack logs from multiple honeypots.

[0253] Based on the attack logs, the security threat information is determined, wherein the security threat information includes: attack resource information and / or attack method information.

[0254] In one embodiment, the attack resource information includes: a SSH brute-force dictionary for monitoring Secure Shell protocol, SSH connection client information, virus download and distribution server information, and remote control address information;

[0255] Attack method information, including: attack virus sample information, attack command information, and attack impact information.

[0256] In one embodiment, the acquisition module 110 is specifically used for:

[0257] Based on information crawling rules, crawl the security threat information from at least one external platform.

[0258] In one embodiment, the device 100 further includes:

[0259] Configuration module 140 is used to configure crawling resources for each external platform based on the priority of each external platform.

[0260] In one embodiment, the determining module 120 is specifically used for:

[0261] Based on the security requirements of the predetermined scenario, multiple screening and detection items are determined;

[0262] Security threat information that fails to pass at least one of the screening detection items is identified as security threat information for the predetermined scenario.

[0263] In one embodiment, the device 100 further includes at least one of the following:

[0264] The first processing module 150 is used to normalize the security threat information for the predetermined scenario.

[0265] The second processing module 160 is used to classify security threat information for the predetermined scenario.

[0266] In one embodiment, the identification module 130 is specifically used for:

[0267] Security threat information for the predetermined scenario is stored in the gateway device, which then identifies insecure network access in the predetermined scenario based on the security threat information.

[0268] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program commands. The aforementioned program can be stored in a storage medium, including various media capable of storing program code such as mobile storage devices, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0269] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several commands to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0270] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network security monitoring method, characterized in that, include: Obtain security threat information; Based on the security requirements of a predetermined scenario, the acquired security threat information is filtered to obtain security threat information specific to the predetermined scenario. Based on security threat information for the predetermined scenario, identify insecure network access in the predetermined scenario; The acquisition of security threat information includes: Network address information is detected based on sensitive words to identify insecure network address information; Based on the attack logs recorded by the preset honeypot, the security threat information is obtained; Obtain the security threat information provided by the external platform; The security threat information is filtered based on the security requirements of the predetermined scenario to obtain security threat information specific to the predetermined scenario, including: Based on the security requirements of the predetermined scenario, multiple screening and detection items are determined; among them, the screening and detection items include: connectivity, ICP filing, page integrity, content compliance, and detection status of third-party detection platforms; The security threat information that fails to pass at least one of the screening detection items is identified as security threat information for the predetermined scenario; The security threat information for the predetermined scenario is normalized. The security threat information for the predetermined scenario is classified; wherein, the types of security threat information include: vulnerability security threat information, network threat security threat information, business security threat information, and other industry / vertical domain security threat information.

2. The method according to claim 1, characterized in that, The method of detecting network address information based on sensitive words to determine insecure network address information includes: Obtain the webpage content in the webpage structure corresponding to the network address information to be detected, wherein the webpage content includes: webpage theme content and / or webpage body content; Perform sensitive word detection on the webpage content; The webpage content that meets the sensitive word detection criteria will be used for security identification using a preset model; Obtain the network address information corresponding to the insecure webpage content identified by the preset model through security identification.

3. The method according to claim 2, characterized in that, The preset model includes: Fasttext Natural Language Processing (NLP) model.

4. The method according to claim 1, characterized in that, The security threat information is obtained by analyzing attack logs recorded by a pre-set honeypot, including: The honeypot is constructed based on the network application environment of the predetermined scenario; Multiple honeypots are set up, wherein the geographical location and / or cloud server of each honeypot are not the same; Obtain attack logs from multiple honeypots. Based on the attack logs, the security threat information is determined, wherein the security threat information includes: attack resource information and / or attack method information.

5. The method according to claim 4, characterized in that, The attack resource information includes: SSH brute-force dictionary for monitoring Secure Shell protocol, SSH connection client information, virus download and distribution server information, and remote control address information; Attack method information, including: attack virus sample information, attack command information, and attack impact information.

6. The method according to claim 1, characterized in that, The acquisition of the security threat information provided by the external platform includes: Based on information crawling rules, crawl the security threat information from at least one external platform.

7. The method according to claim 6, characterized in that, The method further includes: Configure crawling resources for each external platform based on its priority.

8. The method according to any one of claims 1 to 7, characterized in that, The step of identifying insecure network access in the predetermined scenario based on security threat information for that scenario includes: Security threat information for the predetermined scenario is stored in the gateway device, which then identifies insecure network access in the predetermined scenario based on the security threat information.

9. A network security monitoring device, characterized in that, include: The acquisition module is used to acquire security threat information; The determination module is used to filter the acquired security threat information based on the security requirements of a predetermined scenario, and obtain security threat information for the predetermined scenario. The identification module is used to identify insecure network access in the predetermined scenario based on security threat information for the predetermined scenario. The acquisition module is specifically used for: Network address information is detected based on sensitive words to identify insecure network address information; Based on the attack logs recorded by the preset honeypot, the security threat information is obtained; Obtain the security threat information provided by the external platform; The determining module is specifically used for: Based on the security requirements of the predetermined scenario, multiple screening and detection items are determined; among them, the screening and detection items include: connectivity, ICP filing, page integrity, content compliance, and detection status of third-party detection platforms; The security threat information that fails to pass at least one of the screening detection items is identified as security threat information for the predetermined scenario; The first processing module is used to normalize the security threat information for the predetermined scenario; The second processing module is used to classify security threat information for the predetermined scenario; wherein the types of security threat information include: vulnerability security threat information, network threat security threat information, business security threat information, and other industry / vertical domain security threat information.

10. The apparatus according to claim 9, characterized in that, The acquisition module is specifically used for: Obtain the webpage content in the webpage structure corresponding to the network address information to be detected, wherein the webpage content includes: webpage theme content and / or webpage body content; Perform sensitive word detection on the webpage content; The webpage content that meets the sensitive word detection criteria will be used for security identification using a preset model; Obtain the network address information corresponding to the insecure webpage content identified by the preset model through security identification.

11. The apparatus according to claim 10, characterized in that, The preset model includes: Fasttext Natural Language Processing (NLP) model.

12. The apparatus according to claim 11, characterized in that, The acquisition module is specifically used for: The honeypot is constructed based on the network application environment of the predetermined scenario; Multiple honeypots are set up, wherein the geographical location and / or cloud server of each honeypot are not the same; Obtain attack logs from multiple honeypots. Based on the attack logs, the security threat information is determined, wherein the security threat information includes: attack resource information and / or attack method information.

13. The apparatus according to claim 12, characterized in that, The attack resource information includes: SSH brute-force dictionary for monitoring Secure Shell protocol, SSH connection client information, virus download and distribution server information, and remote control address information; Attack method information, including: attack virus sample information, attack command information, and attack impact information.

14. The apparatus according to claim 9, characterized in that, The acquisition module is specifically used for: Based on information crawling rules, crawl the security threat information from at least one external platform.

15. The apparatus according to claim 14, characterized in that, The device further includes: The configuration module is used to configure the crawling resources for each external platform based on the priority of each external platform.

16. The apparatus according to any one of claims 9 to 15, characterized in that, The identification module is specifically used for: Security threat information for the predetermined scenario is stored in the gateway device, which then identifies insecure network access in the predetermined scenario based on the security threat information.

17. A storage medium storing an executable program, characterized in that, When the executable program is executed by the processor, it implements the steps of the network security monitoring method according to any one of claims 1 to 8.

18. An electronic device comprising a memory, a processor, and an executable program stored in the memory and executable by the processor, characterized in that, When the processor runs the executable program, it performs the steps of the network security monitoring method as described in any one of claims 1 to 8.

Images