Network security defense method, device, equipment and storage medium

Abstract

The present disclosure provides a network security defense method, device, equipment and storage medium, which can be applied to the field of information security technology. The method comprises: based on monitoring of a network system, identifying a suspicious security event existing in the network system and a threat type thereof; and using a pre-arranged verification process to verify an execution subject of the suspicious security event. The verification process comprises: obtaining at least one alternative question from a question set pre-set for the threat type; processing the at least one alternative question based on information of an entity in the suspicious security event to obtain a selected question set; sending the selected question set to the execution subject and obtaining answer information returned by the execution subject in reply to a question in the selected question set; and comparing the answer information with corresponding information in historical record data of the network system to evaluate whether the execution subject is a threat.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of information security, and in particular, to a network security defense method, device, equipment, storage medium and program product. BACKGROUND

[0002] With the development of the times, the places using network systems are increasing, but the attacks on network systems have never stopped, and the forms are becoming more and more. The current network security threat defense is usually to collect different types of data from each subsystem of the network system to train a machine learning algorithm model, and to monitor the network security through the trained machine learning algorithm model.

[0003] However, the scheme of protecting the network system security by training the model through machine learning needs to use multi-level analysis, which takes a long time, and the multi-step processing is easy to accumulate errors, which will affect the efficiency and accuracy of the judgment. Moreover, it may incorrectly judge some attack behaviors, which is easy to cause data loss. SUMMARY

[0004] In view of the above problems, the present disclosure provides a network security defense method, device, equipment, medium and program product, which can determine the legitimacy of the object preliminarily identified as having network security threats through active verification.

[0005] The first aspect of the embodiment of the present disclosure provides a network security defense method. The method comprises: based on monitoring a network system, identifying a suspicious security event existing in the network system and a threat type thereof; and using a pre-arranged verification process to verify an execution subject of the suspicious security event. Wherein, verifying the execution subject of the suspicious security event comprises: obtaining at least one alternative question from a question set pre-set for the threat type; processing the at least one alternative question based on information of an entity in the suspicious security event to obtain a selected question set, wherein the entity in the suspicious security event includes the execution subject of the suspicious security event; sending the selected question set to the execution subject and obtaining answer information returned by the execution subject in reply to the questions in the selected question set; comparing the answer information with corresponding information in historical record data of the network system to obtain a comparison result; when the comparison result meets a predetermined condition, determining that the execution subject does not exist a threat; and when the comparison result does not meet the predetermined condition, determining that the execution subject exists a threat.

[0006] According to an embodiment of the present disclosure, the obtaining the selected question set further includes: based on historical record data in the network system, obtaining other objects having similar behavior characteristics as the execution subject; based on information of the other objects, processing at least part of the questions in the at least one candidate question to generate interference items; and expanding the interference items to the selected question set.

[0007] According to an embodiment of the present disclosure, the obtaining the selected question set further includes: based on historical record data in the network system, obtaining other objects having similar behavior characteristics as the execution subject; based on information of the other objects, processing at least part of the questions in the at least one candidate question to generate interference items; and expanding the interference items to the selected question set.

[0008] According to an embodiment of the present disclosure, the questions in the question set are divided into a plurality of second categories according to similarities between the questions, and the questions in a same second category are similar. The obtaining the at least one candidate question from the question set pre-set for the threat type includes: selecting at least one question from each of the plurality of second categories to obtain the at least one candidate question.

[0009] According to an embodiment of the present disclosure, the questions in the question set are divided into a plurality of first categories according to types of characteristics possessed by the questions, and the questions in each first category have the same type of characteristics. The obtaining the at least one candidate question from the question set pre-set for the threat type includes: selecting at least one question from each of the plurality of first categories to obtain the at least one candidate question. The types of characteristics include at least two of a type that must be answered correctly and a type that allows errors.

[0010] According to an embodiment of the present disclosure, the predetermined condition includes that the questions in the selected question set with the type of characteristics that must be answered correctly are all answered correctly.

[0011] According to an embodiment of the present disclosure, the comparing the answer information with corresponding information in the historical record data of the network system to obtain a comparison result includes: based on the comparison of the answer information with the corresponding information in the historical record data of the network system, obtaining answer result information of whether each question in the selected question set is answered correctly; and traversing the answer result information of the questions in the selected question set with the type of characteristics that must be answered correctly, to determine whether the questions in the selected question set with the type of characteristics that must be answered correctly are all answered correctly.

[0012] According to an embodiment of the present disclosure, the predetermined condition further comprises: in a case where all the questions with the characteristic of having to be answered correctly in the question set are answered correctly, the score of the answering information is greater than or equal to a preset threshold. The comparison of the answering information with the corresponding information in the historical record data of the network system to obtain a comparison result further comprises: in a case where all the questions with the characteristic of having to be answered correctly in the question set are answered correctly, based on the answer result information of each question in the question set and the difficulty level corresponding to each question, a score of each question in the question set is obtained, wherein the questions in the question set are pre-divided into a plurality of difficulty levels according to difficulty, and the questions in each difficulty level have the same scoring rule; according to the importance level of each question in the question set, a weight corresponding to each question is obtained, wherein the questions in the question set are pre-divided into a plurality of importance levels according to importance, and the questions in each importance level have the same weight; and based on the scores of all the questions in the question set and the weights corresponding to each question, a score of the answering information is obtained.

[0013] According to an embodiment of the present disclosure, the predetermined condition is a predetermined condition updated according to cumulative verification result data corresponding to the execution subject; wherein the method further comprises: setting an initial predetermined condition; and updating the predetermined condition based on the cumulative verification result data corresponding to the execution subject. Wherein updating the predetermined condition specifically comprises: storing verification result data obtained by verifying the execution subject by using the verification process each time; obtaining cumulative verification result data corresponding to the execution subject based on the cumulative storage of the verification result data; and periodically or irregularly updating the predetermined condition based on the cumulative verification result data corresponding to the execution subject.

[0014] According to an embodiment of the present disclosure, the identification of the suspicious security event and the threat type thereof existing in the network system based on the monitoring of the network system comprises: identifying the suspicious security event, the threat type and the threat degree by using a machine learning algorithm model. The obtaining of at least one alternative question from the question set pre-set for the threat type comprises: determining the number of questions and / or question difficulty distribution of the at least one alternative question according to the threat degree; wherein the threat degree is positively correlated with the number of questions and the question difficulty, wherein the questions in the question set are pre-divided into a plurality of difficulty levels according to difficulty, and the question difficulty distribution is represented by distribution data of the at least one alternative question in the plurality of difficulty levels.

[0015] In a second aspect, the present disclosure provides a network security defense device. The network security defense device comprises a preliminary identification module and an active verification module. The preliminary identification module is configured to identify a suspicious security event and a threat type of the suspicious security event based on monitoring of a network system. The active verification module is configured to verify an execution subject of the suspicious security event by using a pre-arranged verification process. The active verification module comprises an obtaining sub-module, a question selection sub-module, an answer sub-module, and an answer evaluation sub-module. Specifically, the obtaining sub-module is configured to obtain at least one candidate question from a question set pre-set for the threat type. The question selection sub-module is configured to process the at least one candidate question based on information of an entity in the suspicious security event to obtain a question set, wherein the entity in the suspicious security event comprises the execution subject of the suspicious security event. The answer sub-module is configured to send the question set to the execution subject and obtain answer information returned by the execution subject in response to the question set. The answer evaluation sub-module is configured to compare the answer information with corresponding information in historical record data of the network system to obtain a comparison result, determine that the execution subject is not a threat when the comparison result satisfies a predetermined condition, and determine that the execution subject is a threat when the comparison result does not satisfy the predetermined condition.

[0016] In a third aspect, the present disclosure provides an electronic device comprising one or more processors and one or more memories. The memory is configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the above method.

[0017] In a fourth aspect, the present disclosure provides a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the above method.

[0018] In a fifth aspect, the present disclosure provides a computer program product comprising a computer program that, when executed by a processor, implements the above method.

[0019] According to the network security protection method, device, equipment, medium and program product provided by the present disclosure, the suspicious security event existing in the network system is initially identified, and then the execution subject of the suspicious security event is actively verified according to the threat type by using the verification process arranged in advance, and whether the execution subject user or the processing process in the suspicious security event has a threat is finally determined according to the verification result. In this way, the accuracy and precision requirements in the initial identification process can be reduced, so that the initial identification process can be implemented by using less data types and network levels, and the complexity of the algorithm model used in the initial identification is reduced. Moreover, the active verification after the initial identification can reduce the risk of data loss and improve the recognition of network threats. BRIEF DESCRIPTION OF DRAWINGS

[0020] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure, taken in conjunction with the accompanying drawings, in which:

[0021] Figure 1 An application scenario diagram of the network security defense method and device according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 2 A flowchart of the network security defense method according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 3 A data preparation flow of the verification process in the network security defense method according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 4 A flowchart of the evaluation of the answer information in the network security defense method according to an embodiment of the present disclosure is schematically shown;

[0025] Figure 5 A flowchart of the obtaining method of the question set in the network security defense method according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 6 A flowchart of the selection of other objects with similar behavior characteristics in the process of obtaining the question set according to an embodiment of the present disclosure is schematically shown;

[0027] Figure 7 A dynamic adjustment flowchart of the predetermined condition in the network security defense method according to an embodiment of the present disclosure is schematically shown;

[0028] Figure 8 A flowchart of the network security defense method according to another embodiment of the present disclosure is schematically shown;

[0029] Figure 9A structural block diagram of a network security defense device according to an embodiment of the present disclosure is schematically shown; and

[0030] Figure 10 A block diagram of an electronic device suitable for implementing a network security defense method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0031] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood, however, that the description which follows is merely exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description of the embodiments of the present disclosure, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, it would be apparent to one skilled in the art that the present disclosure can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring the concepts of the present disclosure.

[0032] The terms used herein are merely used to describe specific embodiments and are not intended to limit the present disclosure. The terms "include", "comprise" and the like used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0033] All terms used herein, including technical and scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of the present specification, and should not be interpreted in an idealized or overly formal manner.

[0034] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should be generally interpreted as having the meaning of including at least one of the items listed (e.g., "a system having at least one of A, B, and C" should include but not be limited to a system having A alone, a system having B alone, a system having C alone, a system having both A and B, a system having both A and C, a system having both B and C, and / or a system having A, B, and C, etc.).

[0035] In the technical solutions of the present disclosure, the collection, storage, use, processing, transmission, provision, disclosure, and application of data (such as including but not limited to user personal information) involved in the technical solutions comply with the relevant legal regulations, necessary security measures are taken, and do not violate public order and good customs.

[0036] Embodiments of the present disclosure provide a network security defense method, apparatus, device, storage medium and program product. In the network security defense method, first, based on monitoring of a network system, a suspicious security event existing in the network system and a threat type thereof are preliminarily identified, and then a verification process prepared in advance is used to actively verify an execution subject of the suspicious security event, and whether the execution subject of the suspicious security event has a threat is determined according to a verification result. The execution subject of the suspicious security event can be a user of the network system, or a processing process in the network system, or an external processing process interacting with the network system.

[0037] In the embodiments of the present disclosure, after the security threat is preliminarily identified, the legality of the execution subject of the suspicious security event is verified by means of active verification, so that the accuracy and precision requirements in the preliminary identification process can be reduced, and thus the preliminary identification process can be implemented using fewer data types and network levels, reducing the complexity of the monitoring identification algorithm model. Moreover, the active verification after the preliminary identification can reduce the risk of data loss and improve the recognition of network threats.

[0038] Figure 1 An application scenario diagram of the network security defense method and apparatus according to the embodiments of the present disclosure is schematically shown.

[0039] As shown in Figure 1 The application scenario 100 according to the embodiments can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104 and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0040] A user can use at least one of the first terminal device 101, the second terminal device 102 and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102 and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0041] The first terminal device 101, the second terminal device 102 and the third terminal device 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers and desktop computers, etc.

[0042] The server 105 can be a server providing various services, for example, a background management server (for example only) providing support for a website browsed by a user using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server can perform analysis and the like on received user requests and the like, and feed back a processing result (for example, a webpage, information, or data, or the like, obtained or generated according to a user request) to a terminal device.

[0043] It should be noted that the network security defense method provided by the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the network security defense apparatus provided by the embodiments of the present disclosure can generally be arranged in the server 105. The network security defense method provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Accordingly, the network security defense apparatus provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0044] It should be understood that the number of terminal devices, networks, and servers in Figure 1 is merely illustrative. Any number of terminal devices, networks, and servers can be provided according to implementation needs.

[0045] The network security defense method of the embodiments of the present disclosure will be described in detail below based on the scenario described above. Figure 1 Figures 2-8 The network security defense method of the embodiments of the present disclosure will be described in detail below based on the scenario described above.

[0046] Figure 2 A flowchart of a network security defense method according to an embodiment of the present disclosure is schematically shown.

[0047] As shown in Figure 2 , the network security defense method of this embodiment can include operation S210 to operation S280.

[0048] ​First, in operation S210, based on the monitoring of the network system, a suspicious security event existing in the network system and its threat type are identified. Specifically, a machine learning algorithm model can be trained to preliminarily identify the suspicious security event existing in the network system and its threat type. Of course, a non-machine learning algorithm model can also be used, for example, a model that sets corresponding monitoring conditions for each threat type for automatic monitoring. The model used here can perform preliminary screening and identification, so the structure, hierarchy, and algorithm complexity of the model can be much simpler than when the model identification result is used as the final judgment result, saving data collection, data analysis time, and resource consumption, etc.

[0049] Then, through operations S220 to S280, the execution subject of the identified suspicious security event is actively verified using a pre-arranged verification process. The execution subject can be a user or a processing process. The processing process refers to an activity that can modify or redirect the received input to the corresponding output, such as a microservice that receives an API call request and forwards it to an API processing service, or verifies the input data before writing it to a data storage.

[0050] Specifically, in operation S220, at least one alternative question is obtained from a question set pre-set for the threat type.

[0051] The threat types of the network system can include, for example, an attacker impersonating a user or a processing process, an attacker maliciously modifying data, or an attacker maliciously using the system to cause the system to fail to provide normal services.

[0052] The attacker impersonating a user or a processing process specifically manifests as an attacker sending an email with a malicious link to a user to capture the user's credentials, data, and device access permissions through a seemingly legitimate user.

[0053] The attacker maliciously modifying data specifically manifests as modifying data temporarily stored in the cache, sending incorrect data over the network to destroy the integrity of the data, inserting malicious payloads into the browser cache to cause abnormal behavior in the processing process or data storage, or modifying memory through weak API calls, causing system crashes or sensitive information leaks.

[0054] The attacker maliciously using the system to cause the system to fail to provide normal services specifically manifests as, for example, sending a large number of requests to the system, occupying a large amount of memory or CPU resources, or storing too much data to cause the system to crash.

[0055] The question set for the threat type can be collected or generated according to each threat type after the threat type to be identified is determined, or the questions related to network security can be collected, and then the collected questions are divided according to the threat types, for example, the questions related to the corresponding threat types are labeled with the corresponding threat type labels.

[0056] Specifically, for the threat type that the attacker impersonates a user or a process, more emphasis is placed on verifying the authenticity of the user or the process, and the user's personal information, the information of the application used, and the questions of daily interaction can be labeled as questions in this direction. For the threat type that the attacker maliciously modifies data, more emphasis is placed on verifying the user's authority and data problems, and the questions about the authority and the data security questions can be labeled as questions in this direction. For the threat type that the attacker maliciously uses the system to cause the system to be unable to provide normal services, more emphasis is placed on verifying the authenticity of the user or the process, and the questions of using the system, the user's personal information, and the correct use of the system can be labeled as questions in this direction. One question can belong to multiple threat categories at the same time, that is, the questions in the question set corresponding to different threat types can be repeated, for example, the questions related to the user information or the user authority can be involved in different types of threats.

[0057] Therefore, when selecting the candidate questions in operation S220, the questions with labels corresponding to the threat type of the suspicious security event can be selected.

[0058] Next, in operation S230, at least one candidate question is processed based on the information of the entity in the suspicious security event to obtain a question set, wherein the entity in the suspicious security event includes the execution subject in the suspicious security event.

[0059] The entity refers to an account, a user, a device, an application, a microservice, data, or an IP, etc. Among them, the application and the microservice belong to the process.

[0060] According to the event description elements, the suspicious security event can be described as: what the execution subject did (for example, which application or data was accessed or called) at what time, by what means (for example, using which account or device), etc. Therefore, the information of the entity in the suspicious security event can be extracted.

[0061] The alternative questions are from a question set, and the questions in the question set are usually processable problem examples or problem templates, such as, “What is the common account of [user]?” and “What is the personnel level requirement for logging into [application]?” where [user] and [application] need to be filled in or replaced according to the information of the entity in the security event when generating the alternative questions.

[0062] Then in operation S240, the alternative question set is sent to the execution subject, and the answer information returned by the execution subject in reply to the questions in the alternative question set is obtained.

[0063] Next, the answer information is evaluated through operations S250-S280 to determine the legitimacy of the execution subject.

[0064] Specifically, in operation S250, the answer information is compared with the corresponding information in the historical record data of the network system to obtain a comparison result.

[0065] Then in operation S260, it is determined whether the comparison result satisfies a predetermined condition. If yes, it is determined in operation S270 that the execution subject does not pose a threat; if not, it is determined in operation S280 that the execution subject poses a threat.

[0066] In some embodiments, whether the execution subject poses a threat can be determined according to whether the answer accuracy rate satisfies a predetermined threshold.

[0067] In other embodiments, when the answer information is evaluated by comparing the comparison result with the predetermined condition, the number of alternative questions in the alternative question set, the difficulty of different questions, and the characteristics of different questions (such as whether they must be answered correctly and the importance) can also be considered to make the final verification result more accurate. Details will be described below.

[0068] Figure 3 The data preparation process of the verification process in the network security defense method according to the embodiments of the present disclosure is schematically shown.

[0069] In combination with Figure 2 and Figure 3 , the network security defense method according to the embodiments of the present disclosure needs to arrange the verification process in advance before operations S220-S280, and the data preparation process of the verification process includes operations S301-S303.

[0070] First, in operation S301, a question data set (which can also be referred to as a question set, and the two are not distinguished herein) is generated. In one embodiment, various network security-related questions are collected or generated, and then are collected together after preprocessing (such as format abstraction or unification).

[0071] The questions in the question data set can include various questions related to network security; for example, it can be a question for the user's personal information, such as the user's account information, commonly used IP information, and device information used; or, for example, it can be a question for the user's commonly used application, such as the name of the application frequently used by the user, the time period frequently accessed, and the last access time; or, for example, it can be a question for daily interaction, such as the name of the department, the object of the report, and the colleague frequently communicated with; or, for example, it can be a question about authority, such as what is the user's role, which resources can be accessed, and the last time the authority was modified; or, for example, it can be a question about data security for access, whether the data to be accessed can be disclosed, the level of confidentiality, and whether it can be copied; or, for example, it can be a question about the correct use of the system, the network bandwidth used by the individual, the maximum throughput that can be supported, and the maximum access frequency.

[0072] Then in operation S302, the questions in the question data set are labeled and classified from different dimensions. The characteristics or classification categories to which each question belongs can be marked in the form of labels. Among them, different question category labels can be used from different dimensions, and each question in the question data set is labeled with the corresponding label.

[0073] For example, as mentioned in the foregoing introduction of operation S220, the collected questions can be divided according to threat types, and each question is labeled with a corresponding threat type label, thereby obtaining a question set corresponding to each threat type. In this way, the selection of the candidate question in operation S220 can be selected from the question set corresponding to each threat type, thereby improving the pertinence of the verification of the execution subject.

[0074] For another example, labels can be set from the characteristics of the questions, the similarity between the questions, the difficulty of the questions, the importance of the questions, and the like. Through such labels, the characteristics of the questions can be more accurately located. This facilitates the selection of the candidate question in operation S220 according to the characteristics of the questions, quickly removes repetitive or redundant information, and achieves a better experience effect.

[0075] Specifically, in some embodiments, the questions in the question set generated in operation S301 can be divided into a plurality of second categories according to the similarity between the questions, and the questions in each second category can be labeled with the same label, wherein the questions in the same second category are similar. In this way, in the above operation S220, at least one question can be selected from each of the plurality of second categories. Moreover, a number of questions can be selected from different second categories. In this way, questions that are as unrelated as possible can be selected as much as possible, thereby avoiding repetitive or redundant information in the candidate questions and increasing the breadth of the selected candidate questions.

[0076] When the set of questions is divided according to the similarity between the questions, in one embodiment, the question data in the set of questions can be vectorized first according to a clustering algorithm, and then the vectorized data is clustered, so that the question data in a class constitutes a second category; in another embodiment, similar questions (for example, both involving user information, both involving operation process) can be divided into a category according to experience, and the questions in a class constitute a second category.

[0077] In some embodiments, when the set of questions is divided according to the similarity between the questions and labeled, the label values between different second categories are set according to the correlation between the classes, and the mutual exclusion or similarity between the questions is reflected through the label values. For example, a binary value can be used to identify the correlation component between labels, and the value range is {0, 1}, and the higher the correlation, the closer to 1. The similarity between personal information and frequently used applications is relatively high, both of which belong to user's personal information or behavior, and the similarity between personal information and data security issues is relatively low, which verifies the authenticity of the object from the perspective of the subject and the object. In this way, when the candidate questions are selected from the question set in the above operation S220, more questions can be selected from the second category with lower correlation according to the label value.

[0078] In some embodiments, the questions in the question data set generated in operation S301 can be divided into a plurality of first categories according to the types of characteristics possessed by the questions, and the questions in each first category have the same characteristics and can be set with the same label to represent. Among them, the types of characteristics can include at least two types such as must answer correctly and allow errors. In some implementations, the allowed errors can be divided into multiple categories according to the probability or degree of allowed errors. In some implementations, the characteristics possessed by the questions can even include categories such as should not answer correctly. For example, the must answer correctly question can be transformed to form an error-inducing question with interference. Such transformation can be static, for example, the transformed question is generated as part of the question data set. Of course, it can also be dynamic transformation, for example, transformation in the process of processing the candidate questions into selected questions, that is, changing the characteristics of the questions in the process of generating selected questions from candidate questions, generating interfering questions, such as the interference term mentioned in the following Figure 5 In this way, when the candidate questions are selected from the question set in the above operation S220, at least one question can be selected from each of the plurality of first categories. In this way, questions of various characteristics can be ensured to be selected, which helps to enrich the depth level of the selected candidate questions.

[0079] When classifying the question set according to the types of characteristics of the questions, a corresponding label can be set according to the characteristics of each question. For example, some questions must be correct, and some questions can be wrong: such as account information, device information used, department name, personal role, and such frequently used or currently used information questions are questions that the user must answer correctly, that is, the characteristics of these questions are that they must be answered correctly. For example, for interactive questions: such as the last modification time, the last login time, and such historical questions allow the user to have a certain probability of error, and the characteristics of such questions are that errors are allowed. For example, the maximum supported throughput and the maximum access frequency are relatively professional settings that can also allow the user to answer with a certain error, and the characteristics of these questions are that errors are allowed. If further subdivided according to the error tolerance probability, the characteristics of these questions are relatively rare and have a high error tolerance probability, and if they can be answered accurately, the authenticity of the object will be increased.

[0080] In some embodiments, the questions in the question set generated in operation S301 can also be divided into a plurality of third categories according to the difficulty levels of the questions, and the questions in each third category are labeled with a label corresponding to a same difficulty level. The questions in a same third category have a same difficulty level. The difficulty level can be set according to artificial experience, or a plurality of levels can be set according to the occurrence probability of the question and the probability of successfully answering the question after a large amount of statistics.

[0081] In this way, when the candidate questions are selected from the question set in operation S220, at least one question can be selected from each of the plurality of third categories. In this way, it can be ensured that questions of various difficulty levels are selected, which helps to ensure the difficulty distribution of the selected candidate questions, where the difficulty distribution of the questions can be represented by the distribution data of the finally selected candidate questions in operation S220.

[0082] In addition, in some embodiments, when the suspicious security event and the threat type are identified by using the machine learning algorithm model in operation S220, the threat degree is also identified at the same time. When selecting the candidate questions from the question set in operation S220, the number of questions and / or the difficulty distribution of the questions of at least one candidate question can be determined according to the threat degree, and then the candidate questions are selected from the question set. Wherein, the threat degree is positively correlated with the number of questions and the difficulty of questions, and the questions in the question set are pre-divided into a plurality of difficulty levels according to the difficulty. For example, a mapping relationship between the threat degree and the number of questions and the difficulty of questions is pre-set, so that the greater the threat degree identified initially, the more questions can be selected in operation S220, and as many difficult questions as possible can be selected.

[0083] In some embodiments, the questions in the question dataset generated in operation S301 can also be divided into a plurality of fourth categories according to the importance levels of the questions, and the questions in each fourth category are labeled with a same importance level. The questions in a same fourth category have the same importance level. In this way, in some embodiments, when selecting the candidate questions from the question set in operation S220 described above, the candidate questions can be selected from the questions corresponding to various importance levels, so that the importance levels of the selected questions are balanced. Alternatively, in some embodiments, the number of questions in various importance levels can also be determined according to the identified threat levels or the strictness of the evaluation on the execution subject, and the questions can be selected accordingly.

[0084] It can be seen that, by labeling and classifying the questions in the question set from different dimensions in operation S302, the embodiments of the present disclosure can provide more information basis for selecting candidate questions in the active verification process, quickly remove repeated or redundant information, increase the depth and breadth of the selected candidate questions, improve the comprehensiveness of verifying the execution subject of the security event, and achieve better and more accurate verification effect.

[0085] Next, in operation S303, a random code can also be generated to prevent robot attacks. The random code can be extracted and mixed into the selected question set, and the selected question set is sent to the execution subject of the suspicious security event in operation S240 together with the random code. The random code can be a random verification code configured as needed, which can be in the form of a picture or characters, and is used to prevent robot attacks.

[0086] After operations S301 to S303, the data preparation in the verification process is basically completed. Next, in accordance with Figure 2 When performing network security defense in the process shown in FIG. 8, in operation S220, the questions under the corresponding labels can be extracted by means of the labels in the question data, such as the questions with related labels for different types of security threats, and then in operation S230, the corresponding selected questions are generated in combination with the information of specific users or processing processes and the like, and the selected question set is obtained. Different labels, different numbers, and relatively low relevance of the questions can be selected according to the threat types and / or threat levels of the security threats. For the objects that relatively obviously exist security threats, several questions can be selected to more accurately judge whether the action is real or the threat really exists.

[0087] When the selected question set is sent in operation S240, the questions in the selected question set can be verified by disordering the order and using the random code, to ensure the validity of the questions, the accuracy of the question expression, and the reasonableness of the option setting, and then the questions are sent to the user or the processing process, and the corresponding answer information is recorded.

[0088] Next, in the process of evaluating the answer information by operation S250 to operation S280, the specific predetermined condition or evaluation rule, etc. can also be set according to the label information of various dimensions in the question set.

[0089] For example, in one embodiment, the predetermined condition is set to be that all the questions with the characteristic of must be answered correctly in the selected question set are answered correctly.

[0090] In another embodiment, the predetermined condition can be further set to be that, in the case that all the questions with the characteristic of must be answered correctly in the selected question set are answered correctly, the score of the answer information is greater than or equal to a preset threshold. The score of the answer information can be obtained based on the correct or incorrect result after comparing the answer information with the historical record in the network system, combined with the scoring rule of each question, wherein the scoring rule of each question is preset and can be associated with the label of each question in one dimension or multiple dimensions.

[0091] Figure 4 A flowchart of evaluating the answer information in the network security defense method according to an embodiment of the present disclosure is schematically shown.

[0092] As shown in Figure 4 operation S260, the determination of whether the comparison result meets the predetermined condition can specifically include operation S261 or operation S261 to operation S265.

[0093] In operation S261, it is determined whether all the questions with the characteristic of must be answered correctly in the selected question set are answered correctly. If yes, operation S262 is performed. If no, it can be determined in operation S280 that the execution subject is threatened.

[0094] Specifically, first, the reply result information of whether each question in the selected question set is replied correctly can be obtained based on the comparison of the answer information with the corresponding information in the historical record data of the network system, and then the reply result information of the questions with the characteristic of must be answered correctly in the selected question set is traversed to determine whether all the questions with the characteristic of must be answered correctly in the selected question set are answered correctly.

[0095] According to this embodiment, when there is a question with the characteristic of must be answered correctly in the selected question set that is answered incorrectly, it can be directly determined that the current suspicious security event is unsafe, and the execution subject (user or processing program) of the suspicious security event is threatened. For example, for the questions with the characteristic of must be answered correctly of a user, such as account information and personal role, if they are not answered correctly, the authenticity of the user is seriously suspected, and it is directly determined that the execution subject is threatened.

[0096] If all questions in the question set that require a correct answer are answered correctly, in operation S262, the score for each question in the question set is obtained based on the answer results and the corresponding difficulty level of each question. As mentioned earlier, the questions in the question set can be pre-divided into multiple difficulty levels. In this embodiment, the same scoring rules can be set for questions within each difficulty level. For example, a certain number of points are awarded for a correct answer, and a certain number of points are deducted for an incorrect answer, or no points are deducted. For example, no points are deducted for incorrect answers to obscure or difficult questions. In this way, different scoring rules can be applied based on the difficulty level and obscurity of the questions; more difficult questions receive higher scores for correct answers, more obscure questions receive higher scores for correct answers, and vice versa.

[0097] In operation S263, the weight corresponding to each question is obtained based on the importance level of each question in the question set. The questions in the question set are pre-divided into multiple importance levels, with each question in each importance level having the same weight. For example, a mapping relationship between each importance level and its weight can be preset. In some embodiments, the importance level division can be consistent with the characteristics of the questions, so that the weight of a question can be determined based on its characteristics.

[0098] In operation S264, a score for the answer information is obtained based on the scores of all questions in the question set and the weight corresponding to each question. The scores of each question can be weighted and summed, and the overall score can be normalized.

[0099] Next, in step S265, it is determined whether the score of the answer information is greater than or equal to a preset threshold. If yes, then in step S270, it is determined that the executing entity poses no threat. If not, then in step S280, it is determined that the executing entity poses a threat.

[0100] In this way, by using various characteristics or labels of the question, the answer information is filtered and scored in different ways, and compared with the preset threshold, so as to accurately determine whether the object poses a security threat.

[0101] Figure 5 The flowchart illustrating the method for obtaining a topic set in a network security defense method according to an embodiment of the present disclosure is shown.

[0102] like Figure 5 As shown, in the network security defense method according to the embodiments of this disclosure, in addition to the operation S230 described above, the method of obtaining the topic selection set may further include operations S231 to S233.

[0103] At operation S231, based on the historical record data in the network system, other objects having similar behavior characteristics as the execution subject are obtained. When there are many other objects having similar behavior characteristics as the execution subject, a few objects can be randomly selected. A specific implementation process of determining other objects having similar behavior characteristics can refer to the introduction below. Figure 6

[0104] Next, at operation S232, based on the information of the other objects, at least part of the problems in the at least one alternative question are processed to generate interference items.

[0105] Thereafter, at operation S233, the interference items are added to the selected question set. Based on the information of the other objects having similar behavior characteristics as the execution subject (such as users or processing processes), the alternative questions can be processed to generate interference items, and then the interference items are added to the selected question set obtained in operation S230 to jointly constitute the questions to be investigated this time.

[0106] Figure 6 A flowchart schematically showing the process of selecting other objects having similar behavior characteristics in the process of obtaining the selected question set according to an embodiment of the present disclosure is shown.

[0107] As shown in Figure 6 According to an embodiment of the present disclosure, operation S231 can include operation S601 to operation S603.

[0108] At operation S601, entity data is extracted from the historical record data of the network system to obtain a plurality of entities, wherein the plurality of entities include the execution subject.

[0109] The historical record data of the network system includes data collected in various ways and at various granularities. The following two collection methods are used but are not limited thereto: logs and traffic.

[0110] The collected data is processed to extract account, user, device, application, data, and IP elements (i.e., entity data) from the data so that a plurality of entities can be obtained.

[0111] At operation S602, the behavior data of each entity in the plurality of entities is extracted from the historical record data of the network system and formed into a time series to obtain the behavior characteristics of each entity.

[0112] ​The behavior data of the entity in the collected historical record data can be continuously tracked and sorted based on time sequence to form baseline information of the entity. The baseline information of the entity may, for example, be information of connection relationship between each entity and other entities in time sequence, connection frequency information in each period, and the like. For example, which accounts a certain user or processing process has, which applications are accessed, which files are used, which sensitive data is used, which devices are used, when online, location, and the like.

[0113] With the baseline information of the entity, the behavior comparison between entities can be performed based on the baseline information of the entity. For example, the behavior characteristics of the entity can be obtained based on the baseline information of the entity. In one embodiment, the baseline information of the entity can be directly used as the behavior characteristics of the entity, and in another embodiment, the baseline information of the entity can be encoded or digitized to extract the behavior characteristics of the entity.

[0114] Next, in operation S603, other objects with similar behavior characteristics to the execution subject are determined based on similarity judgment of the behavior characteristics of the execution subject and other entities in the plurality of entities.

[0115] There are many methods for similarity judgment, which can be cosine similarity or distance of vectors corresponding to the behavior characteristics of two entities, or can be coincidence degree of baseline information of two entities.

[0116] According to embodiments of the present disclosure, the execution subject is a user or a processing process, and accordingly, the other objects with similar behavior characteristics to the execution subject are also users or processing processes.

[0117] As can be seen, embodiments of the present disclosure can use information of the other objects with similar behavior characteristics to the execution subject to process and generate interference items for the alternative problem. Thus, interference items can be added in the selected problem set, so that the execution subject can be verified more intelligently and accurately, the recognition of network threats can be improved, and the risk of missing threats or data loss can be avoided.

[0118] According to embodiments of the present disclosure, the predetermined condition used when the answer information is evaluated in operation S270 and operation S280 can be a condition commonly set in the network system. In other embodiments, the strictness of verification of the execution subject can be determined according to historical performance of the execution subject of the identified suspicious security event, and then the corresponding predetermined condition can be set or adjusted according to certain principles, so that the predetermined condition is a personalized condition for different execution subjects.

[0119] Moreover, in some embodiments, the predetermined condition can even be a condition obtained by dynamically adjusting according to a variation trend of verification results obtained by verifying the execution subject by using the above verification process in the past. Influenced by the external environment, the network system is also in a dynamic change process, and it is necessary to dynamically adjust the parameters of the network system. For example, in the case of a small number of users, a loose judgment standard can be used. With the increase of the number of users, the system also accumulates a certain sample, which can more accurately judge the security threat and reduce the friction of interaction.

[0120] Specifically, in one embodiment, the predetermined condition used in the above operations S270 and S280 is a predetermined condition updated most recently according to the cumulative verification result data corresponding to the execution subject. The cumulative verification result data is obtained by cumulatively processing the stored verification result data obtained by verifying the execution subject by using the above verification process.

[0121] Figure 7 A flowchart of a dynamic adjustment process of a predetermined condition in a network security defense method according to an embodiment of the present disclosure is schematically shown.

[0122] As Figure 7 shown, the network security defense method according to the embodiment of the present disclosure can further include operations S701-S704.

[0123] In operation S701, an initial predetermined condition is set. The initial predetermined condition can be a general condition uniformly set.

[0124] The cumulative verification result data corresponding to the execution subject can then be continuously updated through operations S702 and S703.

[0125] Specifically, in operation S702, the verification result data obtained by verifying the execution subject by using the verification process each time through operations S210-S280 is stored.

[0126] In operation S703, the cumulative verification result data corresponding to the execution subject is obtained based on the cumulative storage of the verification result data.

[0127] Next, in operation S704, the predetermined condition is regularly or irregularly updated based on the cumulative verification result data corresponding to the execution subject.

[0128] After each active verification of the execution subject according to operations S210-S280, verification result data of the execution subject can be obtained, and the execution subject can be more accurately judged. The verification result data of the execution subject is stored, and trend analysis is performed. If the verification result of the execution subject is stable, the security threat alarm threshold of the execution subject can be reduced in the predetermined condition, so that the access of the execution subject is smoother, and vice versa, the threshold can be increased.

[0129] In this way, the embodiment of the disclosure can dynamically adjust the predetermined condition applied to the active verification of the execution subject according to the verification result data. The judgment standard of the execution subject is dynamically adjusted according to the cumulative verification result data of the execution subject, which meets the security defense of the network system while increasing the flexibility of the network system.

[0130] Figure 8 A flowchart of a network security defense method according to another embodiment of the disclosure is schematically shown.

[0131] As shown in Figure 8 The network security defense method according to the embodiment can include operations S801-S807.

[0132] First, in operation S801, the network system is modeled from the perspective of security threats. The business is processed as a data stream, mainly focusing on specific processing processes, types of data storage, forms of data flow, and states of external entities. The purpose of modeling is to facilitate subsequent data collection and monitoring, determine the location, data, and time point of collected data or monitored, and provide a basic framework for network security designers or managers to study.

[0133] The flowchart of the network system can be drawn according to the network system to be constructed and the required context, which can include system relationships representing the working principle of the system and the interaction mode with each other, and should also include detailed data flow relationships of each system part. Among them, the specific description of the main processing process, data storage, data flow, and external entities is as follows.

[0134] The processing process represents an activity that can modify or redirect received input to corresponding output. For example, a microservice that receives an API call request and forwards it to an API processing service, or verifies input data before writing it to a data store.

[0135] Data storage includes temporary or permanent storage of data, such as storing session-related data using a browser, or adding security log information to a file.

[0136] Data flow refers to communication between data sources and targets, such as user-submitted credentials for accessing services, requests from processing processes to add content to data storage, and interactions between various system elements, including outputs and responses and their transmission methods.

[0137] The external entity can be another processing process, data storage, or even a complete system outside direct control, such as a user interacting with the system or a service created by another team.

[0138] Such establishment of a system security threat model is beneficial to risk management throughout the development process, tracking of discovered security threats, discovery of threats and design of effective countermeasures before the system goes online, security review of the system during the design phase to reduce security threat problems, and cost reduction.

[0139] At operation S802, the types of threats that can exist in the system are summarized and data is collected.

[0140] Specifically, the types of threats that can exist in the system are summarized and corresponding data is collected. According to statistical analysis, the types of threats that exist in the network system can include several types: an attacker impersonating a user or a processing process, an attacker maliciously modifying data, or an attacker maliciously using the system to cause the system to fail to provide normal services.

[0141] Different data can be collected for real-time monitoring for each type of threat. Different data collection methods obtain different types and granularities of data, and the following two collection methods are used but not limited to: logs and traffic. The log method generates log data according to the relevant rules of the data format, content, etc. provided by the device and network system, and similarly, the agent method also generates various log data, and sends the log data to the log collector. The log method requires more resources as the content of the log data increases from less to more and the granularity becomes finer, and a rule needs to be set to retain log information within a certain time period, and previous information will be deleted, which needs to be processed in advance. The traffic method is to copy a copy of the network traffic through the switch and send it to the traffic collector. The network traffic method is real and real-time network traffic, which contains more comprehensive information and has no invasiveness to the current system, and is easy and flexible to deploy.

[0142] Next, at operation S803, the collected data is processed for preliminary anomaly detection to identify suspicious security events. The foregoing operation S210 is one specific embodiment of operation S803 for security monitoring.

[0143] Specifically, various machine learning algorithms such as random forest, support vector machine, K-Means clustering, and neural network can be used for anomaly detection, and the comparative feature analysis of individuals and groups is identified and discovered to find security threats.

[0144] Since the identification result in operation S803 is only a preliminary identification, subsequent active verification will be performed through a verification process, and therefore, the number of layers of the machine learning algorithm model used in this process can not be too large, which helps to reduce the analysis time and avoid the problem of accumulated errors in multi-step processing. Compared with the scheme of directly using a machine learning algorithm model to obtain the final judgment result, the embodiments of the present disclosure can reduce the number of machine learning model associated subsystems, reduce the number of layers of the processing process, reduce the difficulty of processing, and quickly respond. Then the anomaly detection result output by the machine learning algorithm model can be adjusted through the following subsequent active verification.

[0145] The data on which the machine learning algorithm is trained can come from the historical record data of the network system. Through processing of the historical record data, baseline information of each entity in the network system can be output. When the baseline information of the user and the entity is obtained, the machine learning algorithm model can be trained to automatically analyze the security events in combination with various data. Most security events are difficult to be discovered in one or two dimensional analysis, and need to be considered in multiple dimensions, such as time, network level, security business object, etc. For example, real-time correlation analysis can be performed from the user, device, application, and data dimensions, which is not a one-time event, but an automatic and continuous process.

[0146] Next, in operation S804, it is determined whether the result of the preliminary detection and identification is abnormal. If yes, then in operation S805 and operation S806, a pre-written verification process is used for active verification. If no, then in operation S807, the current event detection is directly ended.

[0147] Specifically, in operation S805, the problems corresponding to the labels are extracted. Specifically, as described in operation S220, the problems with labels corresponding to the detected threat types can be determined from the total problem set to obtain the extractable problem range, and then the candidate problems can be extracted according to the difficulty level classification labels, or the characteristic category labels, or the similarity or mutual exclusion labels, etc.

[0148] After the questions are extracted, the candidate questions can be processed in the manner shown in operation S230 or operations S230 and S231-S233 to obtain a question set that can be used for interaction. In some embodiments, a random verification code can be added to the question set before it is sent out. When the question set is sent to the subject (user or process) of the suspected security event, the questions can be sent in a scrambled order, and the reply of the subject of the suspected security event to the question set is obtained to obtain the answer information, which can be referred to operation S240.

[0149] Next, in operation S806, the feedback result of the question is evaluated. Details can be referred to the foregoing detailed description of the evaluation of the answer information in operations S250-S280.

[0150] The evaluation result information obtained in operation S806 can be dynamically fed back to the machine learning algorithm model used for preliminary identification of the suspected security event, for continuous learning and updating of the machine learning algorithm model, and the predetermined condition used for evaluation in operation S806 can also be dynamically adjusted according to the evaluation result information, to improve the flexibility of network system security protection.

[0151] As can be seen, according to the embodiments of the present disclosure, the network system can be modeled from the perspective of security threats according to the network system and the context, the possible threats of the system can be collected and data can be collected, and then the network system can be preliminarily detected in real time, the user or process suspected to have security threats can be further verified by using the pre-arranged verification process, so as to reduce the diversity of data types and the complexity of algorithm model levels required for automatic anomaly detection under the premise of ensuring the accuracy of security threat verification, and reduce the complexity of the machine learning algorithm model used.

[0152] According to the embodiments of the present disclosure, the user can be actively guided to enter the pre-arranged verification process for further verification, and the risk of missing or misidentifying real data caused by the algorithm model is avoided.

[0153] According to some embodiments of the present disclosure, the identity and authority of the user or process can be further verified, and the system can dynamically adjust the judgment standard of the user or process according to the verification information of the user or process, to meet the security of the system while increasing the flexibility of the system.

[0154] Based on the network security defense method of the above various embodiments, the embodiments of the present disclosure further provide a network security defense device. The following will be described in detail in combination with Figure 9 The network security defense device 900 will be described in detail.

[0155] Figure 9 A structural block diagram of the network security defense apparatus 900 according to an embodiment of the present disclosure is shown schematically.

[0156] As shown, the network security defense apparatus 900 according to an embodiment of the present disclosure includes a preliminary identification module 910 and an active verification module 920. Figure 9

[0157] The preliminary identification module 910 is configured to identify suspicious security events and their threat types existing in the network system based on monitoring of the network system. In one embodiment, the preliminary identification module 910 can perform the operation S210 as described above.

[0158] The active verification module 920 is configured to verify the execution subject of the suspicious security event by using a pre-arranged verification procedure.

[0159] Specifically, the active verification module 920 can include an obtaining sub-module 921, a question generation sub-module 922, an answer sub-module 923 and an answer evaluation sub-module 924.

[0160] The obtaining sub-module 921 is configured to obtain at least one candidate question from a pre-set question set for the threat type. In one embodiment, the obtaining sub-module 921 can perform the operation S220 as described above.

[0161] The question generation sub-module 922 is configured to process the at least one candidate question based on information of an entity in the suspicious security event to obtain a question set, wherein the entity in the suspicious security event includes the execution subject of the suspicious security event. In one embodiment, the question generation sub-module 922 can perform the operation S230 as described above. In other embodiments, the question generation sub-module 922 can further perform the operations S231-S233 as described above.

[0162] The answer sub-module 923 is configured to send the question set to the execution subject and obtain answer information returned by the execution subject in reply to the questions in the question set. In one embodiment, the answer sub-module 923 can perform the operation S240 as described above.

[0163] The answer evaluation sub-module 924 is configured to: compare the answer information with corresponding information in historical record data of the network system to obtain a comparison result; determine that the execution subject does not exist a threat when the comparison result satisfies a predetermined condition; and determine that the execution subject exists a threat when the comparison result does not satisfy the predetermined condition. In one embodiment, the answer evaluation sub-module 924 can perform the operations S260-S280 as described above.

[0164] ​According to some other embodiments of the present disclosure, the network security defense apparatus 900 can further include a question set generation module 930, a predetermined condition dynamic setting module 940, and / or an entity behavior analysis module 950.

[0165] The question set generation module 930 can collect and generate a large number of questions, and can classify the generated questions from different dimensions, for example, can identify the category to which each question belongs in the form of a label. For example, the question set generation module 930 can classify the generated questions according to threat types, and add corresponding labels to questions belonging to corresponding threat types. For another example, the question set generation module 930 can set labels according to the category of characteristics and / or the difficulty level of the questions, and classify the questions. For another example, the question set generation module 930 can cluster the generated questions, or classify them according to the similarity between the questions by experience, where questions in the same class can be set with the same label and considered as similar questions, and questions between different classes can be considered as mutually exclusive questions.

[0166] The predetermined condition dynamic setting module 940 can be configured to set an initial predetermined condition, and update the predetermined condition based on the cumulative verification result data corresponding to the execution subject. The updating of the predetermined condition includes storing the verification result data obtained by verifying the execution subject by using the verification process each time, obtaining the cumulative verification result data corresponding to the execution subject based on the accumulation of the stored verification result data, and regularly or irregularly updating the predetermined condition based on the cumulative verification result data corresponding to the execution subject. In one embodiment, the predetermined condition dynamic setting module 940 can perform the operations S701-S704.

[0167] The entity behavior analysis module 950 can be configured to extract entity data from the historical record data of the network system to obtain a plurality of entities, where the plurality of entities include the execution subject, extract behavior data of each entity in the plurality of entities from the historical record data of the network system and form a time sequence to obtain the behavior characteristics of each entity, and determine other objects having similar behavior characteristics with the execution subject based on the similarity of the behavior characteristics of the execution subject and other entities in the plurality of entities. After obtaining the other objects similar to the execution subject, the question generation sub-module 922 can process and modify the candidate questions by using the information of the other objects, generate interference terms, and then expand the interference terms into the questions. In one embodiment, the entity behavior analysis module 950 can perform the operations S601-S603.

[0168] The network security defense apparatus 900 can perform the network security defense method described with reference to Figures 2-8 The described network security defense method is described in detail above, and will not be repeated here.

[0169] According to embodiments of the present disclosure, any multiple of the preliminary identification module 910, the active verification module 920, the acquisition sub-module 921, the question generation sub-module 922, the answer sub-module 923, the answer evaluation sub-module 924, the question set generation module 930, the predetermined condition dynamic setting module 940 and the entity behavior analysis module 950 can be combined in one module for implementation, or any one of them can be split into multiple modules. Alternatively, at least part of the function of one or more of these modules can be combined with at least part of the function of other modules, and implemented in one module. According to embodiments of the present disclosure, at least one of the preliminary identification module 910, the active verification module 920, the acquisition sub-module 921, the question generation sub-module 922, the answer sub-module 923, the answer evaluation sub-module 924, the question set generation module 930, the predetermined condition dynamic setting module 940 and the entity behavior analysis module 950 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable way of hardware or firmware by integrating or packaging the circuit, or in any one of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the preliminary identification module 910, the active verification module 920, the acquisition sub-module 921, the question generation sub-module 922, the answer sub-module 923, the answer evaluation sub-module 924, the question set generation module 930, the predetermined condition dynamic setting module 940 and the entity behavior analysis module 950 can be at least partially implemented as a computer program module which can perform corresponding functions when it is run.

[0170] Figure 10 A block diagram of an electronic device 1000 suitable for implementing the network security defense method according to embodiments of the present disclosure is schematically shown.

[0171] As shown in Figure 10 The electronic device 1000 according to embodiments of the present disclosure includes a processor 1001 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 1002 or loaded from a storage portion 1008 into a random access memory (RAM) 1003. The processor 1001 can include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset, and / or a special-purpose microprocessor (such as an application specific integrated circuit (ASIC)), and the like. The processor 1001 can also include an on-board memory for cache use. The processor 1001 can include a single processing unit or multiple processing units for performing different actions of the method processes according to embodiments of the present disclosure.

[0172] In the RAM 1003, various programs and data required by the electronic device 1000 to operate are stored. The processor 1001, the ROM 1002, and the RAM 1003 are connected to each other via the bus 1004. The processor 1001 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROM 1002 and / or the RAM 1003. It needs to be noted that the programs can also be stored in one or more memories other than the ROM 1002 and the RAM 1003. The processor 1001 can also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0173] According to an embodiment of the present disclosure, the electronic device 1000 can further include an input / output (I / O) interface 1005, which is also connected to the bus 1004. The electronic device 1000 can further include one or more of the following components connected to the I / O interface 1005: an input part 1006 including a keyboard, a mouse, etc.; an output part 1007 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 1008 including a hard disk, etc.; and a communication part 1009 including a network interface card such as a LAN card, a modem, etc. The communication part 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as necessary. A removable medium 1011 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 1010 as necessary, so that a computer program read out therefrom is installed in the storage part 1008 as necessary.

[0174] The embodiments of the present disclosure further provide a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0175] According to an embodiment of the present disclosure, the computer readable storage medium can be a nonvolatile computer readable storage medium, for example, can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more memories such as the ROM 1002 and / or the RAM 1003 described above and / or one or more memory chips other than the ROM 1002 and the RAM 1003.

[0176] Embodiments of the present disclosure also include a computer program product that includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to cause the computer system to implement the methods provided by the embodiments of the present disclosure.

[0177] The above-described functions defined in the system / apparatus / module / unit of the embodiments of the present disclosure are performed when the computer program is executed by the processor 1001. According to an embodiment of the present disclosure, the above-described system, apparatus, module, unit, etc. can be implemented by the computer program modules.

[0178] In one embodiment, the computer program can rely on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program can also be transmitted, distributed, and / or downloaded in the form of a signal over a network medium and installed and / or installed from the removable medium 1011 through the communication part 1009. The program codes contained in the computer program can be transmitted using any appropriate network medium, including but not limited to wireless, wired, etc., or any appropriate combination thereof.

[0179] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009 and / or installed from the removable medium 1011. When the computer program is executed by the processor 1001, the above-described functions defined in the system of the embodiments of the present disclosure are performed. According to an embodiment of the present disclosure, the above-described system, apparatus, device, module, unit, etc. can be implemented by computer program modules.

[0180] According to embodiments of the present disclosure, program code of the computer program for performing the methods provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and can be implemented in a computer program product. Specifically, the computer program can be implemented in a high-level procedural and / or object-oriented programming language, and / or in assembly / machine language. The programming language includes, but is not limited to, Java, C++, python, “C” language, or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's device, and partly on a remote computing device, or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider (ISP).

[0181] The computer program product of the present disclosure can be a computer program product, which is a machine-readable medium (or computer readable medium) having stored therein a sequence of instructions readable by a machine (e.g., a computer). The instructions in the machine-readable medium focus on the function of the computer program (e.g., in the form of a program unit) and on the cooperation behavior between such program units. The program can be distributed over networks coupled to one or more processors or computers, and can be stored on computer readable media including computer program products, hard drives, RAMs, or any other device (internal or external) from which a processor or computer reads incoming data or instructions. In addition to being distributed over the Internet, or over any other publicly or privately accessed network, the aforementioned program product can also be stored in the memory of the respective machine and / or processor.

[0182] Those skilled in the art can understand that the features described in various embodiments of the present disclosure and / or claims can be combined or / and integrated, even if such combinations or integrations are not explicitly described in the present disclosure. In particular, the features described in various embodiments of the present disclosure and / or claims can be combined and / or integrated in various combinations, without departing from the spirit and teachings of the present disclosure. All these combinations and / or integrations fall within the scope of the present disclosure.

[0183] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. A network security defense method, comprising: identifying a suspicious security event and its threat type existing in a network system based on monitoring of the network system; and verifying an execution subject of the suspicious security event by using a pre-arranged verification procedure, comprising: obtaining at least one candidate question from a question set pre-set for the threat type; processing the at least one candidate question based on information of an entity in the suspicious security event to obtain a selected question set, wherein the entity in the suspicious security event comprises the execution subject in the suspicious security event; sending the selected question set to the execution subject and obtaining answer information returned by the execution subject in reply to questions in the selected question set; comparing the answer information with corresponding information in historical record data of the network system to obtain a comparison result; determining that the execution subject does not exist a threat when the comparison result meets a predetermined condition; and determining that the execution subject exists a threat when the comparison result does not meet the predetermined condition.

2. The method of claim 1, wherein, The obtaining of the selected question set further comprises: obtaining other objects having similar behavior characteristics as the execution subject based on the historical record data in the network system; processing at least some of the at least one candidate question based on information of the other objects to generate a distractor; and expanding the distractor to the selected question set.

3. The method of claim 2, wherein, The obtaining of the other objects having similar behavior characteristics as the execution subject based on the historical record data in the network system comprises: extracting entity data from the historical record data of the network system to obtain a plurality of entities, wherein the plurality of entities comprises the execution subject; extracting behavior data of each entity of the plurality of entities from the historical record data of the network system and forming a time sequence to obtain a behavior characteristic of each entity; determining the other objects having similar behavior characteristics as the execution subject based on similarity judgment of the behavior characteristics of the execution subject and other entities in the plurality of entities.

4. The method of claim 1, wherein, Questions in the question set are divided into a plurality of second categories according to similarity between questions, wherein questions in a same second category are similar; The obtaining of the at least one candidate question from the question set pre-set for the threat type comprises: selecting at least one question from each second category of the plurality of second categories to obtain the at least one candidate question.

5. The method of claim 1, wherein, Questions in the question set are divided into a plurality of first categories according to a type of characteristics possessed by questions, wherein questions in each first category have a same type of characteristics; The obtaining of the at least one candidate question from the question set pre-set for the threat type comprises: selecting at least one question from each first category of the plurality of first categories to obtain the at least one candidate question; wherein the type of characteristics comprises at least two of a type of having to answer correctly and a type of allowing to appear errors.

6. The method of claim 5, wherein, The predetermined condition comprises that all questions in the selected question set having the type of having to answer correctly are answered correctly.

7. The method of claim 6, wherein, The comparison of the answer information and the corresponding information in the historical record data of the network system includes: Based on the comparison of the answer information and the corresponding information in the historical record data of the network system, the answer result information of whether each question in the selected question set is answered correctly is obtained; and Traverse the answer result information of the question in the selected question set with the characteristic of having to be answered correctly, and determine whether the question in the selected question set with the characteristic of having to be answered correctly is answered correctly.

8. The method of claim 7, wherein, The predetermined condition further includes: in the case that the question in the selected question set with the characteristic of having to be answered correctly is answered correctly, the score of the answer information is greater than or equal to a preset threshold value; The comparison of the answer information and the corresponding information in the historical record data of the network system includes: In the case that the question in the selected question set with the characteristic of having to be answered correctly is answered correctly, the score of each question in the selected question set is obtained based on the answer result information of each question in the selected question set and the difficulty level corresponding to each question; wherein, the questions in the question set are pre-divided into multiple difficulty levels according to difficulty, and the scoring rules of the questions in each difficulty level are the same; According to the importance level of each question in the selected question set, the weight corresponding to each question is obtained, wherein the questions in the question set are pre-divided into multiple importance levels according to importance, and the weight of the questions in each importance level is the same; and Based on the score of all questions in the selected question set and the weight corresponding to each question, the score of the answer information is obtained.

9. The method of claim 1, wherein, The predetermined condition is a predetermined condition updated according to the cumulative verification result data corresponding to the execution subject; wherein the method further includes: Setting an initial predetermined condition; and Updating the predetermined condition based on the cumulative verification result data corresponding to the execution subject, including: Storing the verification result data obtained by verifying the execution subject each time using the verification process; Based on the cumulative verification result data stored, the cumulative verification result data corresponding to the execution subject is obtained; Based on the cumulative verification result data corresponding to the execution subject, the predetermined condition is updated regularly or irregularly.

10. The method of claim 1, wherein, The identification of the suspicious security event and the threat type thereof existing in the network system based on the monitoring of the network system includes: identifying the suspicious security event, the threat type and the threat degree by using a machine learning algorithm model; The obtaining of at least one alternative question from the question set pre-set for the threat type includes: determining the number of questions and / or question difficulty distribution of the at least one alternative question according to the threat degree; wherein the threat degree is positively correlated with the number of questions and the question difficulty, wherein the questions in the question set are pre-divided into multiple difficulty levels according to difficulty, and the question difficulty distribution is represented by distribution data of the at least one alternative question in the multiple difficulty levels.

11. A network security defense device, comprising: The preliminary identification module is configured to identify a suspicious security event and a threat type of the suspicious security event existing in the network system based on monitoring of the network system. And The active verification module is configured to verify an execution subject of the suspicious security event by using a pre-arranged verification process, including: An obtaining sub-module is configured to obtain at least one candidate question from a question set pre-set for the threat type; A question selection generation sub-module is configured to process the at least one candidate question based on information of an entity in the suspicious security event to obtain a question set, wherein the entity in the suspicious security event includes the execution subject in the suspicious security event; An answering sub-module is configured to send the question set to the execution subject and obtain answering information returned by the execution subject in reply to questions in the question set; An answering evaluation sub-module is configured to: Compare the answering information with corresponding information in historical record data of the network system to obtain a comparison result; When the comparison result meets a predetermined condition, determine that the execution subject does not exist a threat; and When the comparison result does not meet the predetermined condition, determine that the execution subject exists a threat. 12.An electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1-10. 13.A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1-10. 14.A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-10.

Images