Method and system for automatically distinguishing network security verification results based on dynamic templates

Abstract

The present invention discloses a method and system for automatically distinguishing network security verification results based on dynamic templates. The method first executes a script according to the type of simulated attack event, removes overlapping and merges the full field names of the security event of the security system, finds differences and merges the field names with transformed values, and creates a dynamic distinction template configuration file. During the script execution process, the distinction feature information of the script is dynamically constructed according to the template configuration file. When a security event of the security system is received, the security event feature information is cleaned according to the template configuration file, and the relevant fields and content in the template configuration file are retained. Finally, the similarity of the two sets of feature information is distinguished according to the configured comparison algorithm, and the script execution result is then distinguished. The present invention improves the accuracy of the script execution results of the CP-BAS system and greatly improves the credibility of the evaluation results of the CP-BAS system for the security system.

Description

Technical Field

[0001] The present invention relates to a method and system for automatically distinguishing network security verification results based on a dynamic template, and belongs to the technical field of network security. Background Art

[0002] The Cybersecurity Verification System (hereinafter referred to as the CP-BAS system) verifies the effectiveness of a user's established cybersecurity protection system (including security protection equipment, systems, policies, etc., collectively referred to as the security system) by simulating hacker attacks and intrusions. Through CP-BAS verification, the system assesses the user's current cybersecurity protection risks, proposes risk mitigation recommendations and security reinforcement measures, maximizes the value of the user's network protection equipment, systems, and policies, continuously optimizes the user's security system, and reduces the risk of intrusion.

[0003] CP-BAS system is deployed with the user's existing security system as follows Figure 1 As shown, the CP-BAS system primarily consists of an application system, scripts for simulating hacker attacks, and a simulator. The CP-BAS system performs security verification as follows: 1) The application system creates a verification task, selects a certain number of scripts, and assigns them to the simulator for execution; 2) The simulator sequentially executes the configured scripts; 3) The application system determines the execution results of each script, including non-interception, blocking, and alarm; 4) The application system integrates the script results to conduct a comprehensive assessment of the user's security system. The CP-BAS application system determines the execution results of each script, based on whether the user's security system recognizes and detects a simulated attack. The application system then receives security events pushed by the security system via syslog to determine whether information about CP-BAS simulated attacks exists.

[0004] When the verification task executes the script, the verification result of each script is divided into the following two situations: 1. If the security event pushed by the security system contains the attacker IP of the CP-BAS system as the source IP, the attacked IP as the destination IP, the attacker port as the source port, the attacked port as the destination port, and the simulated attack time occurs within the security event time period, the execution result of the verification script is considered to be an alarm or block, indicating that the security system can effectively protect against the currently simulated hacker attack method; 2. If there is no security event that matches the four-tuple plus time in the security event pushed by the security system, the execution result of the verification script is considered to be not intercepted, indicating that the security system cannot protect against the currently simulated hacker attack method, and the current security system is at risk.

[0005] While the CP-BAS application system can automatically connect to the security system's security events via syslog to determine verification results, it suffers from the following issues: 1. Its use of a four-tuple (source, destination IP, source, destination port) plus time-based verification method results in a high false positive rate. When the CP-BAS system executes verification scripts sequentially, the simulated attack traffic is detected and identified by the security equipment and reported to the security system. The security system then periodically pushes all detected security events to the CP-BAS system. Because each type of attack traffic is identified by a different security device, the simulated attack time and the detection and identification time are not in sequential order. Scripts executed later may be detected earlier, while scripts executed earlier may be queued for detection. 2. Because there is no unified industry standard for the names and values ​​of security event fields, there are differences in the names of security event fields reported by security systems from different manufacturers, or by different types of security devices from the same manufacturer. For example, the attack IP address in the security event field name is "attack_ip," "src_ip," "SrcIP," etc.; the value type of the security event field also varies. For example, the IP address can be an unsigned integer or a dotted decimal. The field value also varies. For example, the name of the CP-BAS system simulation attack is inconsistent with the attack name of the security event. This inconsistency in the field name, field value type, and field value content of security events also causes great difficulties in identification. Summary of the Invention

[0006] Purpose of the invention: In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a method and system for automatically distinguishing network security verification results based on dynamic templates, so as to improve the accuracy of the judgment of script execution results of the CP-BAS system.

[0007] Technical solution: To achieve the above-mentioned purpose, the present invention adopts the following technical solution:

[0008] A method for automatically determining network security verification results based on a dynamic template comprises the following steps:

[0009] Execute the script according to the type of simulated attack event, remove duplicated and merge all field names of the security event of the security system, find out the differences and merge the field names with transformed values, and create a dynamic discrimination template configuration file. The template configuration file is configured with the correspondence between the source IP address, destination IP address, source port, destination port, time, traffic characteristics, URL address and IOC information in the simulated attack event and the security event field names of the security system, as well as the field value type and comparison algorithm;

[0010] Extract relevant fields and content during script execution based on template configuration files, and dynamically construct discriminant feature information for the script;

[0011] When receiving a security event from the security system, clean the security event feature information according to the template configuration file and retain the relevant fields and content in the template configuration file;

[0012] The similarity of the two sets of feature information is determined based on the comparison algorithm in the template configuration file. If the judgment result is similar, the script execution result is considered to be blocking or alarming, otherwise the script execution result is considered to be not intercepted.

[0013] Preferably, the comparison algorithm in the template configuration file includes a data comparison method and an edit distance algorithm, and supports setting a similarity judgment threshold.

[0014] Preferably, in the template configuration file, a field name in the simulated attack event corresponds to one or more security event field names of the security system, and multiple field names are separated by agreed symbols.

[0015] Preferably, for fields representing source IP address and destination IP address, the value type is divided into dotted decimal type and integer type; for fields representing source port, destination port, and time, the value type is integer type; for fields representing traffic characteristics, the value type is divided into no need to restore the response message and need to restore the response message; for fields representing URL address and IOC information, the value type is divided into no need to carry a protocol type and need to carry a protocol type.

[0016] Preferably, the similarity of two sets of feature information is calculated as follows: if one of the source IP address, destination IP address, source port, destination port and time of the two sets of feature information does not match, then they are not similar. After they are completely matched, feature matching is performed on the traffic features, URL address and IOC information. If the non-empty feature information meets the set matching threshold, then they are considered similar.

[0017] A network security verification result automatic identification system based on dynamic templates, comprising:

[0018] The template configuration module is used to execute the script according to the type of simulated attack event, remove overlaps and merge the full field names of the security event of the security system, find differences and merge the field names with transformed values, and create a dynamic discrimination template configuration file. The template configuration file is configured with the correspondence between the source IP address, destination IP address, source port, destination port, time, traffic characteristics, URL address and IOC information in the simulated attack event and the security event field names of the security system, as well as the field value type and comparison algorithm;

[0019] The feature extraction module is used to extract relevant fields and content during the script execution process based on the template configuration file and dynamically construct the discriminant feature information of the script; and when receiving a security event from the security system, clean the security event feature information based on the template configuration file and retain the relevant fields and content in the template configuration file;

[0020] And an automatic discrimination module is used to judge the similarity of two sets of feature information based on the comparison algorithm in the template configuration file. If the discrimination result is similar, the script execution result is considered to be blocked or alarmed, otherwise the script execution result is considered to be not intercepted.

[0021] A computer system includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, the steps of the method for automatically determining network security verification results based on dynamic templates are implemented.

[0022] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for automatically determining network security verification results based on dynamic templates.

[0023] Beneficial effects: The present invention uses the calibration technology of de-duplication merging and difference merging to identify key features for discrimination, and configures dynamic discrimination templates. It uses template configuration files to reduce the dimension of security event information, dynamically construct simulated attack event information, normalize pre-processing comparison information, and achieve accurate judgment of script execution results. Compared with the prior art, the present invention improves the accuracy of the script execution results of the CP-BAS system, avoids false positives and omissions caused by the method of adding four tuples to time, is compatible with the discrimination interference caused by the inconsistency of security event field names, field value types, and field contents of security systems and security equipment of different manufacturers and different types, ensures the correctness of the execution results of the CP-BAS system, and greatly improves the credibility of the evaluation results of the CP-BAS system for security systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a deployment diagram between the CP-BAS system and the security system.

[0025] Figure 2 The figure is a schematic diagram of the template configuration file calibration process in an embodiment of the present invention.

[0026] Figure 3 Schematic diagram of the automatic determination process of network security verification results in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings and specific embodiments.

[0028] To address the problems of inaccurate CP-BAS script execution results and inconsistent field names, field value types, and field value contents in security events of the security system, an embodiment of the present invention discloses a method for automatically distinguishing network security verification results based on dynamic templates. The method first executes the script to calibrate the template configuration file, and then uses the template configuration file for dynamic processing and distinction.

[0029] Figure 2 The template calibration process is illustrated. First, any number of scripts are executed in the CP-BAS system according to the type of simulated attack event, the maximum set of field names of various types of security events on the syslog interface are merged, and the fields with changed values ​​are merged to complete the calibration of the configuration file.

[0030] For example, based on the deduplication and merging of the full simulated attack type, the maximum full field of the security event is as follows.

[0031] {

[0032] "attack_classify_id":50000,

[0033] "attack_state":1,

[0034] "dev_id":"851C2481",

[0035] "module_type_name":"Service Detection",

[0036] "status_code":[ 200

[0038] ],

[0039] "event_desc":"WebShell backdoor scanning detection file name contains the file name contains shell",

[0040] "updated_at":1679986792,

[0041] "brief":"Quick website scanning detection",

[0042] "suffer_branch_id":14,

[0043] "suffer_country":"Unknown",

[0044] "alert_id":217980004,

[0045] "reliability":3,

[0046] "relation":

[0047] "{\"cond\":{\"attack_state\":\"${attack_state}\",\"attack_type\":\"${attack_type}\",\"dst_asset_id\":\"${suffer_asset_id}\",\"hole_id\":\"${hole_ids}\", \"module_type\":\"${module_type}\",\"src_ip\":\"${attack_ip}\",\"sub_attack_type\":\"${sub_attack_type}\"},\"from\":\"ngfw.security\",\"type\":\"es\"}",

[0048] "is_white":0,

[0049] "last_time":1679986865,

[0050] "x_forwarded_for":[],

[0051] "attack_type":2,

[0052] "sub_attack_type_name":"",

[0053] "suggest":"1. Upgrade the business system version to the latest version.\\n\\n2. Use the next-generation firewall to create a new security protection policy and enable the web application protection function."

[0054] "suffer_ip":"210.xx.xx.xxx",

[0055] "srcip":"210.xx.xx.xxx",

[0056] "tags":"WebShell backdoor scanning detection file name contains file name contains shell",

[0057] "damage": "Attackers can use scanning tools to obtain sensitive website information and security vulnerabilities.",

[0058] "multi_deal_status":0,

[0059] "event_evidence":"url path:210.xxx.xxx.xxx:10080 / lhlsec / webshell / xakep-shells / PHP / xxx.php.php status code:200",

[0060] "suffer_classify1_id_name":"Server",

[0061] "suffer_classify_id":10000,

[0062] "mining_stage":0,

[0063] "attack_classify1_id_name":"Unknown",

[0064] "attack_direction":1,

[0065] "log_ids":[ 2390551288662524000

[0067] ],

[0068] "hash_id":"4eaabdb70054dbb2f95749c6329d8d4e",

[0069] "engine":"Reconnaissance Detection Model Library",

[0070] "first_time":1679984560,

[0071] "attack_port":57634,

[0072]

[0073] "attack_type_name":"webshell scanning",

[0074] "linkage_status":0

[0075] }

[0076] By finding the difference between the field names with transformed values, in addition to the quadruple plus time, the event_evidence, url, and IOC fields are selected from the field values ​​of the transformed values ​​(indicators of intrusion IOC refer to data objects found on the network or device, which can be used as evidence of suspected system intrusion: for example, files that do not belong to the system directory or suspicious IP addresses. IOC is "hard evidence", that is, a post-indicator of damage). The value generated by each simulated attack event is different. The field is the content restored by the security equipment based on the attack traffic, which can determine the uniqueness of the event.

[0077] Based on the above analysis, a corresponding configuration file can be created. Comparison blocks can be dynamically added to the configuration file. Each comparison block can be configured with information such as field correspondence, field value types, and comparison algorithms. The first field is the field name of the CP-BAS simulated attack event, and the second field is the field name of the corresponding security system security event. Using the || or | relationship, the configuration file can set one or more fields. The final calibration configuration file is shown below.

[0078] #Source IP address

[0079] [src_ip]

[0080] src_ip=${attack_ip}||${srcip}

[0081] # string or int, string is dotted decimal 127.0.0.1, int is unsigned integer 2130706433

[0082] format=int

[0083] #1 is the data comparison method, #2 is the Levenshtein

[0084] algorithm=1

[0085] #Destination IP address

[0086] [desc_ip]

[0087] desc_ip=${suffer_ip}||${descip}

[0088] # string or int, string is dotted decimal 127.0.0.1, int is unsigned integer 2130706433

[0089] format=int

[0090] #1 is the data comparison method, #2 is the Levenshtein

[0091] algorithm=1

[0092] #Source port

[0093] [src_port]

[0094] src_port=${attack_port}||${srcport}

[0095] format=int

[0096] #1 is the data comparison method, #2 is the Levenshtein

[0097] algorithm=1

[0098] #Destination port

[0099] [desc_port]

[0100] desc_port=${suffer_port}||${descport}

[0101] format=int

[0102] #1 is the data comparison method, #2 is the Levenshtein

[0103]

[0104] Secondly, according to the calibrated configuration file, the security events pushed by the security system are reduced in dimensionality and discriminant features are cleaned. The discriminant feature fields are obtained through structured cleaning, as shown in Table 1.

[0105] Table 1 Security system security event feature fields

[0106] Security system cleaning characteristics Field meaning first_time Time of the first attack last_time End time of the attack desc_ip Victim's IP address desc_port Attacked port src_ip Attacker IP address src_port Attacker Port event_evidence Restore the attacker's traffic message information url Attack URL ioc The attacker requests malicious IP and domain name information

[0107] Then, when the CP-BAS application executes the script, it dynamically constructs discriminant signature information for the simulated attack event based on the configuration file. Since the security system is a user-built system, the syslog output is fixed. Therefore, the only way to dynamically construct key signatures for the simulated attack event is to start from the CP-BAS application. During the execution of the CP-BAS simulator, as shown in the configuration file above, it must actively report the attacker simulator's IP address and port number, the time of the simulated attack, the restored traffic content of the simulated attack, the URL of the simulated attack, and the IOC signature information of the simulated attack. This dynamically constructed information is shown in Table 2.

[0108] Table 2 CP-BAS system simulated attack event feature fields

[0109] CP-BAS system dynamically constructs discriminant feature information The meaning of the fields exe_time Attacker simulator execution attack time desc_ip Attacked simulator IP desc_port Attacked simulator port src_ip Attacker simulator IP src_port Attacker Simulator Port play_evidence Attack behavior traffic details url URL of the victim's simulator ioc Malicious IP and domain names simulated by the attacker

[0110] Finally, the comparison algorithm in the configuration file is used to determine the similarity between the CP-BAS simulated attack event and the security system's security events. The first few features must be strictly matched. Typically, a data entry for the last three features will contain only one of these features, with the remaining two empty. As long as the matching result for the non-empty feature value is less than the threshold in the configuration file, it is considered a match. If the simulated attack event is recognized by the security system, the script's execution result will be a block or alarm. If the simulated attack event does not result in a similar security system security event, indicating that the script was not recognized by the security system, the script's execution result will be an unblocked state.

[0111] Table 3 Feature similarity comparison algorithm

[0112]

[0113] As shown in Table 3, in this embodiment, time, IP, and port numbers can be directly compared. Considering the differences in restored information when the CP-BAS system dynamically constructs attack signature information, Levenshtein distance is used to determine similarity. This similarity determination is performed in two steps. First, the data comparison features are strictly aligned. Then, a distance algorithm is used to match the features. The distance algorithm determines the final similarity result.

[0114] Based on the same inventive concept, an embodiment of the present invention discloses an automatic discrimination system for network security verification results based on dynamic templates, including: a template configuration module, used to execute the script according to the type of simulated attack event, deduplicate and merge the full field names of security events of the security system, find differences and merge the field names with transformed values, and create a dynamic discrimination template configuration file; a feature extraction module, used to extract relevant fields and content during the script execution process according to the template configuration file, and dynamically construct the discrimination feature information of the script; and when receiving a security event of the security system, clean the security event feature information according to the template configuration file, and retain the relevant fields and content in the template configuration file; and an automatic discrimination module, used to judge the similarity of two sets of feature information according to the comparison algorithm in the template configuration file. If the discrimination result is similar, the script execution result is considered to be blocked or alarmed, otherwise the script execution result is considered to be not intercepted.

[0115] Based on the same inventive concept, an embodiment of the present invention discloses a computer system, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, the steps of the method for automatically determining network security verification results based on dynamic templates are implemented.

[0116] Based on the same inventive concept, an embodiment of the present invention discloses a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the method for automatically distinguishing network security verification results based on dynamic templates.

Claims

1. A method for automatically distinguishing network security verification results based on dynamic templates, characterized in that: The steps include: Execute the script according to the type of simulated attack event, remove duplicated and merge all field names of the security event of the security system, find out the differences and merge the field names with transformed values, and create a dynamic discrimination template configuration file. The template configuration file is configured with the correspondence between the source IP address, destination IP address, source port, destination port, time, traffic characteristics, URL address and IOC information in the simulated attack event and the security event field names of the security system, as well as the field value type and comparison algorithm; Extract relevant fields and content during script execution based on template configuration files, and dynamically construct discriminant feature information for the script; When receiving a security event from the security system, clean the security event feature information according to the template configuration file and retain the relevant fields and content in the template configuration file; The similarity of the two sets of feature information is determined based on the comparison algorithm in the template configuration file. If the judgment result is similar, the script execution result is considered to be blocking or alarming, otherwise the script execution result is considered to be not intercepted.

2. The method for automatically distinguishing network security verification results based on dynamic templates according to claim 1, characterized in that: The comparison algorithms in the template configuration file include a data comparison method and an edit distance algorithm, and support setting a similarity judgment threshold.

3. The method for automatically distinguishing network security verification results based on dynamic templates according to claim 1, characterized in that: In the template configuration file, a field name in a simulated attack event corresponds to one or more security event field names of security systems, and multiple field names are separated by agreed symbols.

4. The method for automatically distinguishing network security verification results based on dynamic templates according to claim 1, characterized in that: For fields representing source IP addresses and destination IP addresses, the value types are divided into dotted decimal type and integer type; for fields representing source port, destination port, and time, the value type is integer type; for fields representing traffic characteristics, the value types are divided into those that do not require restoration response messages and those that do require restoration response messages; for fields representing URL addresses and IOC information, the value types are divided into those that do not require protocol types and those that require protocol types.

5. The method for automatically distinguishing network security verification results based on dynamic templates according to claim 1, characterized in that: The similarity calculation method of two sets of feature information is: if one of the source IP address, destination IP address, source port, destination port and time of the two sets of feature information does not match, they are not similar. After they are completely matched, the traffic characteristics, URL address and IOC information are matched. If the non-empty feature information meets the set matching threshold, they are considered similar.

6. A network security verification result automatic identification system based on dynamic templates, characterized in that: include: The template configuration module is used to execute the script according to the type of simulated attack event, remove overlaps and merge the full field names of the security event of the security system, find differences and merge the field names with transformed values, and create a dynamic discrimination template configuration file. The template configuration file is configured with the correspondence between the source IP address, destination IP address, source port, destination port, time, traffic characteristics, URL address and IOC information in the simulated attack event and the security event field names of the security system, as well as the field value type and comparison algorithm; The feature extraction module is used to extract relevant fields and content during the script execution process based on the template configuration file and dynamically construct the discriminant feature information of the script; and when receiving a security event from the security system, clean the security event feature information based on the template configuration file and retain the relevant fields and content in the template configuration file; And an automatic discrimination module is used to judge the similarity of two sets of feature information based on the comparison algorithm in the template configuration file. If the discrimination result is similar, the script execution result is considered to be blocked or alarmed, otherwise the script execution result is considered to be not intercepted.

7. The automatic identification system for network security verification results based on dynamic templates according to claim 6 is characterized in that: The comparison algorithms in the template configuration file include a data comparison method and an edit distance algorithm, and support setting a similarity judgment threshold.

8. The automatic identification system for network security verification results based on dynamic templates according to claim 6 is characterized in that: The similarity calculation method of two sets of feature information is: if one of the source IP address, destination IP address, source port, destination port and time of the two sets of feature information does not match, they are not similar. After they are completely matched, the traffic characteristics, URL address and IOC information are matched. If the non-empty feature information meets the set matching threshold, they are considered similar.

9. A computer system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the computer program is loaded into the processor, the steps of the method for automatically distinguishing network security verification results based on dynamic templates according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method for automatically determining network security verification results based on dynamic templates according to any one of claims 1 to 5 are implemented.

Images