An attack event analysis method, device, equipment and storage medium

Abstract

The embodiment of the application discloses an attack event analysis method, device, equipment and storage medium, the method comprises the following steps: obtaining event information of at least one attack event; applying the corresponding associated event filtering condition of the event type in the event information of each attack event to associate each attack event, and determine at least one associated event group; for each associated event group, the following operation is executed to determine the attack parameter set in each associated event group: determining a first attack scene of a first associated event group; the first associated event group is any one of the at least one associated event group; applying the corresponding merging condition of the first attack scene to merge at least two attack events in the first associated event group, obtaining the attack parameter set after merging, and analyzing the attack event by taking the attack parameter set after merging as attack information, so that the analysis result is more complete and accurate, and the safety of the information system is ensured.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device and storage medium for analyzing attack events. Background Technology

[0002] As computer networks expand and network attacks and intrusion methods become increasingly sophisticated, different stages of an attack may be carried out through different network nodes, leaving traces of the attack at each node. Although various hosts, applications, network devices, and security devices deployed in the network environment can record attack events occurring at different network nodes, the alarm information for a single attack event at a single network node cannot reflect the entire attack process. Furthermore, there is significant redundancy among the massive amounts of attack event alarm information across all network nodes, and analyzing every single alarm message would increase the workload considerably.

[0003] In related technologies, the focus is usually only on reducing the number of attack events. This approach only reduces the number of events. Although it can solve the problem of resource waste and low work efficiency of maintenance personnel caused by a large number of invalid or repeated attack events to a certain extent, it is difficult to accurately analyze more complete and accurate attack information and cannot effectively guarantee the security of information systems.

[0004] Therefore, it is crucial to correlate and merge attack events from a massive number of attack events across multiple network nodes in order to obtain more complete and accurate attack information, thereby effectively ensuring the security of information systems. Summary of the Invention

[0005] This application provides an attack event analysis method, apparatus, device, and storage medium to analyze more complete and accurate attack information from massive attack events, so as to effectively ensure the security of information systems.

[0006] In a first aspect, one embodiment of this application provides an attack event analysis method applied to an analysis device, which can be deployed locally, such as an electronic device, or deployed in the cloud, such as a server. The method includes at least the following steps:

[0007] Obtain event information for at least one attack event; wherein the event information is obtained by the security detection device performing security detection on at least one network node;

[0008] Associate at least one attack event under each event type to obtain at least one associated event group under each event type;

[0009] For each of the at least one associated event group corresponding to each event type, the following operations are performed to determine the attack parameter set in each associated event group:

[0010] A first attack scenario of the first associated event group is determined; the first associated event group is any one of the at least one associated event group;

[0011] At least two attack events in the first associated event group are merged by applying a merging condition corresponding to the first attack scenario, to obtain a merged attack parameter set; the merged attack parameter set is used to indicate that the at least one attack event is analyzed.

[0012] In a second aspect, an embodiment of the present application provides an attack event analysis device, which is applied to an analysis device, and the device comprises:

[0013] An acquisition unit is configured to acquire event information of at least one attack event; the event information is obtained by a security detection device performing security detection on at least one network node;

[0014] An association unit is configured to associate at least one attack event under each event type to obtain at least one associated event group under each event type;

[0015] A merging unit is configured to, for each of the at least one associated event group corresponding to each event type, perform the following operations to determine the attack parameter set in each associated event group: determine a first attack scenario of a first associated event group; the first associated event group is any one of the at least one associated event group; at least two attack events in the first associated event group are merged by applying a merging condition corresponding to the first attack scenario, to obtain a merged attack parameter set; the merged attack parameter set is used to indicate that the at least one attack event is analyzed.

[0016] In a third aspect, an embodiment of the present application provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor implements the steps of any of the above methods when executing the computer program.

[0017] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the steps of any of the above methods.

[0018] The embodiment of the application first acquires event information of at least one attack event obtained by performing security detection on at least one network node by a security detection device; secondly, since the event types of attack events generated by one attack behavior are the same, each attack event under the same event type is associated and grouped to obtain at least one associated event group under each event type. In addition, each attack event of the same event type also includes different event subtypes, etc., therefore, in order to perform finer granularity division, for each associated event group, an attack parameter set of the associated event group is determined. In the process of determining the attack parameter set, in order to improve accuracy, according to the corresponding relationship between the associated event group and the attack scene, the attack scene of each associated event group is determined, and at least two attack events in the associated event group are merged by applying the merging condition corresponding to the scene. In this way, the merged attack parameter set of each associated event group can be obtained. According to the characteristics of the attack process, it can be known that each attack event participating in the merging process of each parameter set comes from the same attack process, therefore, the combination of each parameter set can be used for attack event analysis, and the overall situation of the entire attack process can be described, so that the parameter set obtained as attack information is more complete and accurate from the overall network level, and can be applicable to multi-target attack scenes, and provides an analysis basis for subsequent joint defense disposal. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiments of the application. Obviously, the drawings to be introduced below are only some embodiments of the application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0020] Figure 1 The application scenario diagram of the attack event analysis method provided by an embodiment of the application;

[0021] Figure 2 The flowchart of the attack event analysis method provided by an embodiment of the application;

[0022] Figure 3 The flowchart of the merging process provided by an embodiment of the application;

[0023] Figure 4 The flowchart of the complete attack event analysis method provided by an embodiment of the application;

[0024] Figure 5 The structural diagram of the attack event analysis device provided by an embodiment of the application;

[0025] Figure 6 A structural schematic diagram of an analysis device is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0026] To make the objects, technical solutions and advantages of embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application.

[0027] To facilitate understanding, the terms involved in the embodiments of the present application are explained as follows:

[0028] (1) Network node: refers to a computer or other device connected to a network with an independent address and a data transmitting or receiving function to form a node. A network node is usually deployed with a device, which can be a workstation, a terminal device of a network user or a personal computer, and can also be a server, a printer, a network device or other devices connected to the network. In the embodiments of the present application, the network device can be a host, an application program, a network device or a security device.

[0029] (2) Security detection device: a device for detecting the security of a network node and obtaining attack events generated in an attack process. In the embodiments of the present application, the security detection device can be a firewall, an intrusion detection system, a world wide web (WEB) application protection system or a security gateway.

[0030] (3) IP address: refers to a uniform address format provided by an internet protocol (IP) protocol, which allocates a logical address for each network and each host on the Internet to shield the difference of physical addresses. For convenience of description, IP in the embodiments of the present application means an IP address, for example, an attack IP refers to an IP address of an attack IP, and an attacked IP refers to an IP address of an attacked IP.

[0031] (4) Distributed denial of service (DDoS): a hacker uses a DDoS attack tool to control multiple machines to attack simultaneously to achieve the purpose of "hindering normal users from using services", thus forming a DDoS attack.

[0032] (5) SYN Flood attack: refers to an attack client in a short time to forge a large number of non-existent IP address, to the server constantly sending synchronization data (Synchronize, SYN) package, server reply confirmation package, and wait for the client's confirmation. Since the source address does not exist, the server needs to continue to resend until timeout, these fake SYN package will long time occupation of the unconnected queue, normal SYN request is discarded, resulting in target system running slowly, serious will cause network congestion and even system paralysis.

[0033] (6) UDP Flood attack: is a flow type DDoS attack. The common situation is to use a large number of user data packet protocol (user datagram protocol, UDP) small package impact domain name server (domain name server, DNS server) or Radius authentication server, streaming video server.

[0034] (7) NTP reflection attack: is a network time protocol (Network Time Protocol, NTP) based reflection attack.

[0035] (8) IRC botnet: is a kind of internet relay chat (internet relay chat, IRC) based botnet. Botnet through chat room, file sharing network infected computer with vulnerabilities.

[0036] (9) Http botnet: is a kind of hyper text transfer protocol (hyper text transfer protocol, HTTP) based botnet.

[0037] (10) message-digest algorithm (message-digest algorithm, MD5): is a widely used cryptographic hash function, can produce a 128 bit hash value, used to ensure the integrity of information transmission.

[0038] (11) attack parameters: here "attack" refers to the attack event under the scene of the parameter, its specific parameter type can include attack related parameters, such as attack port, but also can include the attack related parameters, such as the attack port here is not limited.

[0039] Any number of elements in the drawings are used for example and not limitation, and any naming is only used to distinguish, and does not have any limiting meaning.

[0040] In the process of implementation, with the expansion of computer network scale, the continuous upgrading of network attack and intrusion means, different stages of an attack process can be implemented through different network nodes. Although various hosts, applications, network devices and security devices deployed in the network environment can record attack events occurring at different network nodes, the alarm information of a single attack event cannot reflect the whole picture of the entire attack process, and a large amount of attack event alarm information has a lot of redundancy. If the alarm information of each attack event is analyzed, the workload is increased.

[0041] Network environment destruction events represented by DDoS attacks and virus propagation involve a large number of network nodes, and the attack events reported by different network nodes need to be processed securely to identify the influence range of a single attack process, so that more complete and accurate attack information can be sorted out from a large number of fragmented attack events, and effective and thorough defense measures can be taken to ensure information security.

[0042] In related technologies, usually only focus on reducing the number of attack events. This method only reduces the number, although it can solve the problem of resource waste and low work efficiency of operation and maintenance personnel caused by a large number of invalid or repeated attack events to a certain extent, but it cannot accurately analyze more complete and accurate attack information in order to effectively ensure the security of information system.

[0043] Therefore, the present application provides an attack event analysis method. In the method, first, each attack event is classified according to the event type in the event information of each attack event; second, at least one attack event under each event type is associated to obtain at least one associated event group under each event type; finally, for each associated event group, determine the attack scene of each associated event group, and apply the merging condition corresponding to the corresponding attack scene to merge at least two attack events in the corresponding associated event group to obtain the merged attack parameter set of each associated event group. The merged attack parameter set can be used to indicate the analysis of at least one attack event. Through the more fine-grained event merging logic, the present application embodiment analyzes more complete and accurate attack information in order to take effective and thorough defense measures to ensure the security of information system.

[0044] After introducing the design idea of the present application embodiment, the application scenarios to which the technical scheme of the present application embodiment can be applied will be briefly introduced. It should be noted that the following application scenarios are only used to illustrate the present application embodiment and are not limited. In the specific implementation, the technical scheme provided by the present application embodiment can be flexibly applied according to actual needs.

[0045] Reference Figure 1Fig. 1 is a schematic diagram of an application scenario of the attack event analysis method provided in the embodiments of the present application. The attack event analysis method in the embodiments of the present application can be applied to an analysis device, which can be deployed locally, for example, an electronic device, or deployed in the cloud, for example, a server. Optionally, the security detection device 11 performs security detection on at least one network node, obtains event information of at least one attack event, and sends the event information of the at least one attack event to the analysis device 12. The analysis device 12 applies the attack event analysis method in the embodiments of the present application, obtains a plurality of merged attack parameter sets (which can also be referred to as attack information), and sends the plurality of merged attack parameter sets to the terminal device 13 of an analyst, so that the analyst analyzes at least one attack event according to the plurality of merged attack parameter sets. Figure 1 The n network nodes are used for illustration.

[0046] Of course, the method provided in the embodiments of the present application is not limited to the application scenario shown in Fig. 1, but can also be applied to other possible application scenarios, which are not limited in the embodiments of the present application. The functions that can be achieved by the devices in the application scenario shown in Fig. 1 will be described together in subsequent method embodiments, and will not be described too much here. Figure 1 Of course, the method provided in the embodiments of the present application is not limited to the application scenario shown in Fig. 1, but can also be applied to other possible application scenarios, which are not limited in the embodiments of the present application. The functions that can be achieved by the devices in the application scenario shown in Fig. 1 will be described together in subsequent method embodiments, and will not be described too much here. Figure 1 The functions that can be achieved by the devices in the application scenario shown in Fig. 1 will be described together in subsequent method embodiments, and will not be described too much here.

[0047] To further illustrate the technical solutions provided in the embodiments of the present application, the following will be described in detail in combination with the accompanying drawings and specific embodiments. Although the method provided in the embodiments of the present application includes the following method operation steps, more or fewer operation steps can be included in the method based on conventional or non-creative labor. The execution order of the steps is not limited to the execution order provided in the embodiments of the present application.

[0048] The technical solutions provided in the embodiments of the present application will be described in combination with the application scenario shown in Fig. 1. Figure 1 The technical solutions provided in the embodiments of the present application will be described in combination with the application scenario shown in Fig. 1.

[0049] With reference to Fig. 1, Figure 2 The embodiments of the present application provide an attack event analysis method, which includes the following steps:

[0050] S201: An analysis device obtains event information of at least one attack event.

[0051] The event information is obtained by a security detection device performing security detection on at least one network node.

[0052] S202: The analysis device associates at least one attack event under each event type to obtain at least one associated event group under each event type.

[0053] S203: The analysis device determines, for each of the at least one associated event group corresponding to each event type, a set of attack parameters in each associated event group by performing the following operations:

[0054] S203-1: The analysis device determines a first attack scenario of a first associated event group.

[0055] The first associated event group is any one of the at least one associated event group.

[0056] S203-2: The analysis device applies a first merging condition corresponding to the first attack scenario to at least two attack events in the first associated event group to perform merging processing, and obtains a merged set of attack parameters.

[0057] The merged set of attack parameters is used to indicate that at least one attack event is analyzed.

[0058] In the embodiments of the present application, first, event information of at least one attack event obtained by a security detection device performing security detection on at least one network node is obtained. Second, because attack events generated by one attack behavior have the same event type, attack events of the same event type are associated and grouped to obtain at least one associated event group for each event type. In addition, each attack event of the same event type includes different event subtypes, and the like. Therefore, in order to perform more fine-grained division, a set of attack parameters of each associated event group is determined. In the process of determining the set of attack parameters, in order to improve accuracy, an attack scenario of each associated event group is determined according to the corresponding relationship between the associated event group and the attack scenario, and a merging condition corresponding to the scenario is applied to merge at least two attack events in the associated event group. In this way, a merged set of attack parameters of each associated event group can be obtained. According to the characteristics of the attack process, each attack event participating in the merging process of each parameter set comes from the same attack process. Therefore, the combination of each parameter set can be used for attack event analysis, and the overall situation of the entire attack process can be described. From the network overall level, the obtained parameter set as attack information is more complete and accurate, and can be applied to a multi-target attack scenario, and provides an analysis basis for subsequent joint defense and disposal.

[0059] S201, the security detection device periodically or in real time detects at least one network node, and when an attack process occurs, logs of at least one attack event generated by the attack process are collected. The security detection device collects the logs of the at least one attack event according to a set interface format to obtain event information of the at least one attack event. The security detection device sends the event information of the at least one attack event detected to the analysis device.

[0060] For example, the event information of one attack event can include one or more of the following characteristic field parameters: attack event type, event subtype, attack IP, attacked IP, attack port, attacked port, network protocol, and other attack-related element information. Optionally, the attack event type can include DDoS attack, malicious file attack, botnet attack, phishing email attack, and brute force attack.

[0061] Optionally, the event information of each attack event can further include a time when the security detection device detects the attack event. In this embodiment, generally, the attack events participating in analysis belong to the same set time period T, which can be, for example, 1 hour. For example, the attack events participating in analysis are N, the smallest detection time of the N detection times is T1, and the largest detection time is T N , the N detection times participating in analysis need to satisfy T N -T1<T.

[0062] In one implementation, the security detection device directly obtains attack events in the set time period T and sends them to the analysis device. In another implementation, the security detection device sends the obtained attack events to the analysis device, and the analysis device screens out attack events belonging to the same set time period for analysis. This is only an example and does not form a specific limitation.

[0063] For DDoS attack, the event subtypes include SYN Flood attack, UDP Flood attack, and NTP reflection attack; for malicious file attack, the event subtypes include backdoor program and virus program; for botnet attack, the event subtypes include IRC bot program, HTTP bot program, and remote control Trojan; for phishing attack, the event subtypes include spear-phishing email, link phishing email, and attachment phishing email; for brute force attack, the event subtypes include single-purpose password brute force, multi-purpose password brute force, and reverse password brute force.

[0064] The event type of the attack events generated in each attack process is the same. Optionally, 100 attack events are obtained by the analysis device, including 30 DDoS attacks, 22 malicious file attacks, 18 botnet attacks, 20 phishing email attacks, and 10 brute force attacks. Taking the 30 DDoS attacks as an example, although the attack events generated in each DDoS attack process are DDoS attack events, it is important to determine which DDoS attack events belong to the same DDoS attack process for complete and accurate analysis of the attack process.

[0065] The same attack process is recorded by multiple network nodes to generate multiple attack events. Therefore, in the same attack process (the event types of the generated attack events are the same), the same characteristic field parameters are usually present in the event information of each attack event. Therefore, the analysis device correlates at least one attack event under each event type to obtain at least one correlated event group under each event type.

[0066] Optionally, the step of obtaining at least one correlated event group under each event type can be implemented in the following manner:

[0067] For at least one attack event under each event type, the following operations are performed to determine at least one correlated event group under each event type: applying a first correlated event screening condition corresponding to the attack event of the first event type, correlating at least one attack event under the first event type, and determining at least one correlated event group under the first event type.

[0068] The first event type is any one of the at least one event type. Optionally, the first correlated event screening condition includes an event subtype, a network protocol, and a target parameter. If the first event type is a DDoS attack or a brute force attack, the target parameter is an attack IP; if the first event type is a malicious file attack, the target parameter is a file MD5; if the first event type is a botnet attack, the target parameter is a combination of an attack IP and a botnet name; and if the first event type is a phishing email attack, the target parameter is an email name.

[0069] Referring to Table 1, Table 1 shows the correspondence between the attack event type and the associated event screening condition. When the first event type is DDoS attack, the first associated event screening condition is that the event subtype, network protocol, and attack IP are all the same. When the first event type is malicious file attack, the first associated event screening condition is that the event subtype, network protocol, and attack IP are all the same. When the first event type is bot attack, the first associated event screening condition is that the event subtype, network protocol, attack IP, and bot name are all the same. When the first event type is phishing email attack, the first associated event screening condition is that the event subtype, network protocol, and email name are all the same. When the first event type is brute force attack, the first associated event screening condition is that the event subtype, network protocol, and attack IP are all the same.

[0070] Table 1: Correspondence between attack event type and associated event screening condition

[0071] Attack event type Associated event filtering condition DDoS attack Event subtype, network protocol, attack IP Malicious file Event subtype, network protocol, file MD5 Botnet Event subtype, network protocol, attack IP, botnet name Phishing email Event subtype, network protocol, email name Brute force cracking Event subtype, network protocol, attack IP

[0072] Such a design can obtain at least one associated event group under each event type. For example, 30 DDoS attacks can be divided into 4 associated event groups, 22 malicious file attacks can be divided into 3 associated event groups, 18 bot attacks can be divided into 2 associated event groups, 20 phishing email attacks can be divided into 4 associated event groups, and 10 brute force attacks can be divided into 3 associated event groups.

[0073] Referring to S203, the analysis device determines the attack parameter set in each associated event group corresponding to each event type. Taking one associated event group (the first associated event group) as an example, the determination process of the attack parameter set in the associated event group is described. Optionally, the process can be implemented through steps S203-1 and S203-2.

[0074] S203-1: The analysis device determines the first attack scene of the first associated event group.

[0075] Among them, the multi-target attack scene of the attack event can be divided into the following types:

[0076] The first type is multi-IP attack, which attacks multiple IPs in the same region (referred to as the same domain, such as the same unit or the same website).

[0077] The second type is multi-port attack, which attacks multiple ports of the same host.

[0078] The third type is multi-account attack, which attacks multiple accounts of the same host or website.

[0079] Fourth: multi-mailbox attack, attack on multiple mailboxes.

[0080] Optionally, Table 2 is a correspondence table of attack event types, multi-target attack scenarios and attack parameters provided by an embodiment of the present application.

[0081] Table 2 Attack event type, multi-target attack scenario and attack parameter correspondence table

[0082]

[0083] In this example, the attack parameters all include attack-related parameters, such as attacked IP, attacked port, attacked mailbox and attacked account. In actual application, if the multi-target attack scenario corresponding to the type of some attack event includes attack-related parameters, such as attack XXX, this is only an example and does not form a specific limitation.

[0084] The first association event group is any one of the at least one association event group. Optionally, the analysis device determines the first attack scene of the first association event group according to the first event information of the first association event group. The first event information includes event information of at least two attack events in the first association event group.

[0085] In an embodiment, if there are non-unique first attack parameters in the first event information, the first attack scene is determined to be the attack scene associated with the first attack parameters. The first attack parameters include attacked IP or attacked mailbox, and the attack scene associated with the first attack parameters is a multi-IP attack scene or a multi-mailbox attack scene. In this example, the first attack parameters include attacked IP or attacked mailbox, and the attack scene associated with the first attack parameters is a multi-IP attack scene or a multi-mailbox attack scene. That is, if there are non-unique IP in the first event information, the first attack scene of the first association event group is determined to be a multi-IP attack scene; if there are non-unique mailboxes in the first event information, the first attack scene of the first association event group is determined to be a multi-mailbox attack scene.

[0086] In another embodiment, if the first attack parameter is an attacked IP, the analysis method further includes the following cases:

[0087] When the attack event type in the first associated event group is a DDoS type or a malicious file type, if there is a unique first attacked IP in the first event information and there are non-unique first attacked ports, it is determined that the first attack scene is a multi-port attack scene; when the attack event type in the first associated event group is a brute force type, if there is a unique first attacked IP in the first event information and there are non-unique attacked accounts, it is determined that the first attack scene is a multi-account attack scene.

[0088] For example, taking a DDoS attack event as an example, if the attacked IP of attack event A in the first associated event group is 106.38.14.230, the attacked IP of attack event B is 106.38.14.230, and the attacked IP of attack event C is 106.38.14.231, the attack scene of the first associated event group is a multi-IP attack scene. If the attacked IP of attack event A, attack event B and attack event C in the first associated event group is 106.38.14.230, the attacked port of attack event A is 80, the attacked port of attack event B is 8080, and the attacked port of attack event C is 80, the attack scene of the first associated event group is a multi-port attack scene.

[0089] S203-2 is involved, each attack scene corresponds to a merging condition, the merging condition of the multi-IP attack is the attacked IP merging condition, the merging condition of the multi-port attack is the attacked port merging condition, the merging condition of the multi-mailbox attack is the attacked mailbox merging condition, and the merging condition of the multi-account attack is the attacked account IP merging condition.

[0090] Referring to Table 3, Table 3 is a correspondence table of multi-target attack scenes and merging conditions provided by the embodiment of the application.

[0091] Table 3: Correspondence of multi-target attack scenes and merging conditions

[0092] Multi-target attack scenario Merge condition Multi-IP attack Attacked IP Multi-port attack Attacked port Multi-mailbox attack Attacked mailbox Multi-account attack Attacked account

[0093] Taking any one attack scene (first attack scene) as an example, the process of applying the first merging condition corresponding to the first attack scene by the analysis device to perform merging processing on at least two attack events in the first associated event group to obtain a merged attack parameter set is described through steps A1-A3.

[0094] A1: If the first attack parameter set and the second attack parameter set have a subset relationship, it is determined that the merged attack parameter set is the attack parameter set corresponding to the parent set event in the first event and the second event.

[0095] In one case, the first associated event group includes two attack events; in another case, the first associated event group includes more than two attack events. In order to apply to both cases, the first event herein is the original attack event obtained or the attack event obtained after any merging operation, and the second event is the original attack event obtained or the attack event obtained after any merging operation.

[0096] The first attack parameter set is a parameter set corresponding to the first merging condition in the event information of the first event, and the second attack parameter set is a parameter set corresponding to the first merging condition in the second event. If the first merging condition is an attacked IP merging condition, the first attack parameter set is a first IP set (in this example, each element in the first IP set is an attacked IP in the event information of the first event), and the second attack parameter set is a second IP set (in this example, each element in the second IP set is an attacked IP in the second event). If the first merging condition is an attacked port merging condition, the first attack parameter set is a first port set, and the second attack parameter set is a second port set. If the first merging condition is an attacked mailbox merging condition, the first attack parameter set is a first mailbox set, and the second attack parameter set is a second mailbox set. If the first merging condition is an attacked account merging condition, the first attack parameter set is a first account set, and the second attack parameter set is a second account set.

[0097] Taking a multi-IP attack scenario as an example of the first attack scenario, if the first attack parameter set and the second attack parameter set have a subset relationship, the merging result retains the parent set event and discards the subset event, and the merged attack parameter set is determined as the attack parameter set corresponding to the parent set event in the first event and the second event. For example, the first IP set of attack event A is {106.38.14.230, 106.38.14.231}, and the second IP set of attack event B is {106.38.14.231}. The merged attack parameter set is the attack parameter set corresponding to the parent set event A, that is, {106.38.14.230, 106.38.14.231}.

[0098] A2: If the first attack parameter set and the second attack parameter set of the second event do not have a subset relationship, and the first attack parameter set and the second attack parameter set have an intersection relationship, the merged attack parameter set is determined as the intersection of the first attack parameter set and the second attack parameter set.

[0099] For example, the first IP set of attack event A is {106.38.14.230, 106.38.14.231}, the second IP set of attack event B is {106.38.14.231, 106.38.14.232}, the two sets do not have subset relationship, and have intersection relationship, then the merged attack parameter set is the intersection of the first IP set and the second IP set, that is {106.38.14.230, 106.38.14.231, 106.38.14.232}.

[0100] A3: If the first attack parameter set and the second attack parameter set do not have subset relationship, and the first attack parameter set and the second attack parameter set do not have intersection relationship, and the first event and the second event have same domain relationship, then the merged attack parameter set is the union of the first attack parameter set and the second attack parameter set.

[0101] For example, the first IP set of attack event A is {106.38.14.230, 106.38.14.231}, the second IP set of attack event B is {106.38.14.232}, the two sets do not have subset relationship, and do not have intersection relationship, but the first event and the second event have same domain relationship (in the multi-IP attack scenario, the same domain relationship can be the same network segment range), that is, the first IP set and the second IP set belong to the same network segment range, such as the network segment range of a unit is 106.38.14.10-106.38.14.255, then the merged attack parameter set is the union of the first IP set and the second IP set, that is {106.38.14.230, 106.38.14.231, 106.38.14.232}.

[0102] In actual application process, there are also cases that cannot be merged, see step A4:

[0103] A4: If the first attack parameter set and the second attack parameter set do not have subset relationship, and the first attack parameter set and the second attack parameter set do not have intersection relationship, and the first event and the second event do not have same domain relationship, then no merging is performed.

[0104] For example, the first IP set of attack event A is {106.38.14.230, 106.38.14.231}, the second IP set of attack event B is {106.38.14.232}, the first IP set and the second IP set do not have subset relationship, and do not have intersection relationship, and attack event A and attack event B do not belong to the same unit network segment, then no merging is performed, and the original attack event and the corresponding event information are retained.

[0105] In the embodiments of the present application, if the first associated event group includes two attack events, the first event and the second event are both original attack events; if the first associated event group includes more than two attack events, one of the first event and the second event can be a merged event. In actual implementation, the two attack events can be merged first, and then the merged event is merged with other attack events.

[0106] The above embodiments are the merging process for any one associated event group. The same operation is performed for other associated event groups, and then the merged attack parameter set of each associated event group can be determined.

[0107] Optionally, it can be determined that the two events participating in the merging operation come from the same attack process. For example, an associated event group includes five attack events A, B, C, D and E, A and B are merged to obtain G1, G1 and B are merged to obtain G2, G2 and C cannot be merged, and G2 and C are included; G2 and D are merged to obtain G3, G3 and E are merged to obtain G4, and it can be determined that the merged attack parameter set is the set corresponding to G4 and the parameters of C. In this example, it can be determined that the five attack events come from two attack processes, wherein A, B, D and E come from the same attack process, and C comes from another attack process.

[0108] In the above embodiments, the first attack parameter set is taken as an IP set as an example. In this example, the same domain relationship is the same network range. In addition, when the first attack parameter set is a set of attacked ports, the same domain relationship is the same host IP; when the first attack parameter set is a set of attacked mailboxes, the same domain relationship is the same mailbox suffix; and when the first attack parameter set is a set of attacked accounts, the same domain relationship is the same host IP or the same uniform resource locator (URL) address.

[0109] In the above embodiments, at least two associated events in an associated event group are taken as an example for description. In actual application, there can be a situation that an event does not belong to any other attack event in the same associated event group. For this situation, it can be determined that it comes from an attack behavior different from other groups in the merging process.

[0110] Figure 3 A schematic diagram of a merging process is shown, Figure 3 In the above embodiments, the two events participating in the merging operation are taken as attack event A and attack event B as examples, and the target scenario is taken as a multi-IP attack scenario as an example.

[0111] S301: The analysis device acquires a first IP set of the attack event A and a second IP set of the attack event B.

[0112] Here, referring to the representation of step A1, the attack event A here can be the first event in step A1, and the attack event B here can be the second event in step A1. Each element in the first IP set here is a respective attacked IP in the event information of the attack event A, and each element in the second IP set is a respective attacked IP in the event information of the attack event B.

[0113] S302: The analysis device determines whether there is a subset relationship between the first IP set and the second IP set. If yes, S303 is performed; otherwise, S304 is performed.

[0114] S303: The analysis device retains the parent set event, discards the subset event, and determines the merged attack parameter set as the IP set corresponding to the parent set event.

[0115] S304: The analysis device determines whether there is an intersection relationship between the first IP set and the second IP set. If yes, S305 is performed; otherwise, S306 is performed.

[0116] S305: The analysis device determines the merged attack parameter set as the intersection of the first IP set and the second IP set.

[0117] S306: The analysis device determines whether there is a same domain relationship between the attack event A and the attack event B. If yes, S307 is performed; otherwise, S308 is performed.

[0118] S307: The analysis device determines the merged attack parameter set as the union of the first IP set and the second IP set.

[0119] S308: The analysis device does not perform the merging operation on the attack event A and the attack event B.

[0120] Optionally, the two attack events performing the merging operation come from the same attack process.

[0121] Embodiments of the present application adopt different merging conditions for the attack event A and the attack event B in different cases, so as to more accurately determine whether the attack event A and the attack event B come from the same attack process.

[0122] In order to make the technical solutions of the present application more perfect, Figure 4 a flowchart of a completed attack event analysis method is shown.

[0123] S401: The analysis device acquires event information of at least one attack event.

[0124] S402: The analysis device associates at least one attack event under each event type to obtain at least one associated event group under each event type.

[0125] S402-1: For at least one attack event under each event type, the analysis device performs the following operations to determine at least one associated event group under each event type: applies a first associated event filtering condition corresponding to the attack event of the first event type, associates at least one attack event under the first event type, and determines at least one associated event group under the first event type; wherein the first event type is any one of the at least one event type, and each associated event group includes at least two attack events.

[0126] S403: The analysis device determines the attack parameter set in each associated event group in each associated event group under each event type by performing the following operations:

[0127] S403-1: The analysis device determines the first attack scenario of the first associated event group:

[0128] S403-1-1: If there is not a unique first attacked IP in the first event information, the analysis device determines that the first attack scenario is a multi-IP attack scenario.

[0129] S403-1-2: If there is not a unique first attacked mailbox in the first event information, the analysis device determines that the first attack scenario is a multi-mailbox attack scenario.

[0130] S403-1-3: When the attack event type in the first associated event group is DDoS type or malicious file type, if there is a unique first attacked IP in the first event information and there is not a unique first attacked port, the analysis device determines that the first attack scenario is a multi-port attack scenario.

[0131] S403-1-4: When the attack event type in the first associated event group is brute force type, if there is a unique first attacked IP in the first event information and there is not a unique attacked account, the analysis device determines that the first attack scenario is a multi-account attack scenario.

[0132] S403-2: The analysis device applies a first merging condition corresponding to the first attack scenario to merge at least two attack events in the first associated event group to obtain a merged attack parameter set.

[0133] S403-2-1: If the first attack parameter set and the second attack parameter set have a subset relationship, the analysis device determines that the merged attack parameter set is the attack parameter set corresponding to the parent set event in the first event and the second event.

[0134] S403-2-2: If the first attack parameter set and the second attack parameter set of the second event do not have a subset relationship, and the first attack parameter set and the second attack parameter set have an intersection relationship, the analysis device determines that the merged attack parameter set is the intersection of the first attack parameter set and the second attack parameter set.

[0135] S403-2-3: If the first attack parameter set and the second attack parameter set do not have a subset relationship, and the first attack parameter set and the second attack parameter set do not have an intersection relationship, and the first event and the second event have a same domain relationship, the analysis device determines that the merged attack parameter set is the union of the first attack parameter set and the second attack parameter set.

[0136] S403-2-4: If the first attack parameter set and the second attack parameter set do not have a subset relationship, and the first attack parameter set and the second attack parameter set do not have an intersection relationship, and the first event and the second event do not have a same domain relationship, the analysis device does not perform merging processing.

[0137] S404: The analysis device determines that the two events participating in the merging operation come from the same attack process.

[0138] Compared with the simple merging of multiple attack events in the related art, the embodiments of the present application perform associated event screening grouping on each attack event from the influence range of the attack process, further analyze the multi-target attack scene of different attack event types, and give the merging relationship and division method of the possible several attack events by comparing the characteristic field parameters of the associated events. Finally, based on different multi-target attack scenes and merging conditions, the merging operation process of the associated event group is given. The generated merged event and the merged attack parameter set can completely describe the key information of an attack process implemented at multiple network nodes, and provide a basis for subsequent multi-network node linkage disposal of various attack events, and are suitable for more complex attack scenes.

[0139] It should be noted that the data examples in the embodiments of the present application are for illustration only and do not form specific limitations.

[0140] As shown in Figure 5 Based on the same inventive concept as the analysis method of the attack event described above, the embodiments of the present application also provide an analysis device for attack event. The device includes an acquisition unit 51, an association unit 52 and a merging unit 53.

[0141] The acquisition unit 51 is configured to acquire event information of at least one attack event; wherein the event information is obtained by a security detection device performing security detection on at least one network node;

[0142] The association unit 52 is configured to associate at least one attack event under each event type to obtain at least one associated event group under each event type;

[0143] The merging unit 53 is configured to determine a set of attack parameters in each associated event group by performing the following operations on each associated event group in the at least one associated event group corresponding to each event type: determining a first attack scene of a first associated event group, wherein the first associated event group is any one of the at least one associated event group; performing merging processing on at least two attack events in the first associated event group according to a merging condition corresponding to the first attack scene to obtain a set of merged attack parameters, wherein the set of merged attack parameters is used to indicate that the at least one attack event is analyzed.

[0144] In an optional implementation, the merging unit 53 is specifically configured to:

[0145] determine the first attack scene of the first associated event group according to first event information of the first associated event group, wherein the first event information includes event information of the at least two attack events in the first associated event group.

[0146] In an optional implementation, the first event information includes one or more of an attacked IP, an attacked port, an attacked mailbox, and an attacked account.

[0147] In an optional implementation, the merging unit 53 is specifically configured to:

[0148] if there is a first attack parameter that is not unique in the first event information, the first attack scene is determined as an attack scene associated with the first attack parameter.

[0149] The first attack parameter includes an attacked IP or an attacked mailbox, and the attack scene associated with the first attack parameter is a multi-IP attack scene or a multi-mailbox attack scene.

[0150] In an optional implementation, the first attack parameter is an attacked IP, and the merging unit 53 is specifically configured to:

[0151] When the attack event type in the first associated event group is a DDoS type or a malicious file type, if there is a unique first attacked IP and there is a first attacked port that is not unique in the first event information, the first attack scene is determined as a multi-port attack scene.

[0152] When the attack event type in the first associated event group is a brute force type, if there is a unique first attacked IP and there is an attacked account that is not unique in the first event information, the first attack scene is determined as a multi-account attack scene.

[0153] In an alternative implementation, the merging unit 53 is specifically configured to:

[0154] if the first attack parameter set and the second attack parameter set have a subset relationship, determining the merged attack parameter set as the attack parameter set corresponding to the parent event of the first event and the second event;

[0155] if the first attack parameter set and the second attack parameter set of the second event do not have a subset relationship, and the first attack parameter set and the second attack parameter set have an intersection relationship, determining the merged attack parameter set as the intersection of the first attack parameter set and the second attack parameter set;

[0156] if the first attack parameter set and the second attack parameter set do not have a subset relationship, and the first attack parameter set and the second attack parameter set do not have an intersection relationship, and the first event and the second event have a same-domain relationship, determining the merged attack parameter set as the union of the first attack parameter set and the second attack parameter set;

[0157] wherein the first event is an original attack event obtained or an attack event obtained after any merging operation, and the second event is an original attack event obtained or an attack event obtained after any merging operation; the first attack parameter set is a parameter set corresponding to the first merging condition in the event information of the first event, and the second attack parameter set is a parameter set corresponding to the first merging condition in the second event.

[0158] In an alternative implementation, the merging unit 53 is specifically configured to:

[0159] if the first attack parameter set and the second attack parameter set do not have a subset relationship, and the first attack parameter set and the second attack parameter set do not have an intersection relationship, and the first event and the second event do not have a same-domain relationship, not performing merging processing.

[0160] In an alternative implementation, the apparatus further comprises a determining unit configured to:

[0161] determine that the two events participating in the merging operation are from the same attack process.

[0162] In an alternative implementation, the first attack parameter set comprises a set of attacked IPs, a set of attacked ports, a set of attacked mailboxes, or a set of attacked accounts;

[0163] when the first attack parameter set is a set of attacked IPs, the same-domain relationship is the same network range;

[0164] when the first attack parameter set is a set of attacked ports, the same-domain relationship is the same host IP;

[0165] When the first attack parameter set is the set of attacked mailboxes, the same domain relationship is that the mailboxes have the same suffix.

[0166] When the first attack parameter set is the set of attacked accounts, the same domain relationship is that the accounts have the same host IP or the same URL address.

[0167] In an optional implementation, the association unit 52 is specifically configured to:

[0168] For at least one attack event under each event type, the following operations are performed to determine at least one associated event group under each event type:

[0169] The first associated event filtering condition corresponding to the attack event of the first event type is applied to associate the at least one attack event under the first event type to determine at least one associated event group under the first event type; the first event type is any one of the at least one event type, and each associated event group includes at least two attack events.

[0170] In an optional implementation, the first associated event filtering condition includes an event sub-type, a network protocol, and a target parameter.

[0171] If the first event type is a DDoS attack or a brute-force attack, the target parameter is an attack IP.

[0172] If the first event type is a malicious file attack, the target parameter is a file MD5.

[0173] If the first event type is a bot attack, the target parameter is a combination of an attack IP and a bot name.

[0174] If the first event type is a phishing email attack, the target parameter is an email name.

[0175] The attack event analysis device provided in the embodiments of the present application and the attack event analysis method described above adopt the same inventive concept and can achieve the same beneficial effects, and thus will not be described again.

[0176] Based on the same inventive concept as the attack event analysis method described above, the embodiments of the present application further provide an analysis device, which can be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), a server, or the like. As shown in FIG. 6, the analysis device can include a processor 601 and a memory 602. Figure 6

[0177] ​The processor 601 can be a general purpose processor, such as a central processing unit (CPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, which can implement or execute the methods, steps and logical block diagrams disclosed in the embodiments of the present application. The general purpose processor can be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present application can be directly embodied as completed by a hardware processor, or completed by a combination of hardware and software modules in the processor.

[0178] The memory 602 is a non-volatile computer readable storage medium, which can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory can include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card type memory, random access memory (RAM), static random access memory (SRAM), programmable read only memory (PROM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. The memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by a computer, but is not limited to this. The memory 602 in the embodiments of the present application can also be a circuit or any other device capable of realizing the storage function, used to store program instructions and / or data.

[0179] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction related hardware, and the foregoing program can be stored in a computer readable storage medium, and the program performs the steps of the above-mentioned method embodiments when executed; the computer storage medium can be any available medium or data storage device that can be accessed by a computer, including but not limited to: mobile storage devices, random access memory (RAM), magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state disk (SSD), etc.), and various media that can store program codes.

[0180] Alternatively, the above-mentioned units of the present application can be stored in a computer readable storage medium if they are implemented in the form of software functional modules and sold or used as independent products. Based on such understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the embodiments of the method of the present application. The foregoing storage medium includes: mobile storage devices, random access memory (RAM), magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state disk (SSD)), and various media that can store program codes.

[0181] The above embodiments are only used to introduce the technical solutions of the present application in detail, but the above embodiments are only used to help understand the method of the embodiments of the present application, and should not be understood as limiting the embodiments of the present application. Changes or replacements that can be easily thought of by those skilled in the art should be covered within the protection scope of the embodiments of the present application.

Claims

1. A method for analyzing attack events, characterized in that, include: Obtain event information for at least one attack event; wherein the event information is obtained by a security detection device performing security detection on at least one network node; Associate at least one attack event under each event type to obtain at least one associated event group under each event type; For each associated event group within at least one associated event group corresponding to each event type, perform the following operations to determine the set of attack parameters for each associated event group: Determine a first attack scenario for a first associated event group; wherein, the first associated event group is any one of the at least one associated event groups; Applying the first merging condition corresponding to the first attack scenario, at least two attack events in the first associated event group are merged to obtain a merged attack parameter set; wherein, the merged attack parameter set is used to indicate the analysis of the at least one attack event.

2. The method according to claim 1, characterized in that, The determination of the first attack scenario for the first associated event group includes: Based on the first event information of the first associated event group, a first attack scenario of the first associated event group is determined; wherein, the first event information includes event information of at least two attack events in the first associated event group.

3. The method according to claim 2, characterized in that, The step of determining the first attack scenario of the first associated event group based on the first event information of the first associated event group includes: If there is a non-unique first attack parameter in the first event information, then the first attack scenario is determined to be an attack scenario associated with the first attack parameter. The first attack parameter includes the attacked IP or the attacked email address, and the attack scenario associated with the first attack parameter is a multi-IP attack scenario or a multi-email attack scenario.

4. The method according to claim 3, characterized in that, The first attack parameter is the attacked IP address, and the method further includes: When the attack event type in the first associated event group is DDoS or malicious file, if there is a unique first attacked IP in the first event information and there is a non-unique first attacked port, then the first attack scenario is determined to be a multi-port attack scenario. When the attack event type in the first associated event group is a brute-force attack type, if there is a unique first attacked IP in the first event information, and there are non-unique attacked accounts, then the first attack scenario is determined to be a multi-account attack scenario.

5. The method according to any one of claims 1 to 4, characterized in that, The first merging condition corresponding to the first attack scenario is applied to merge at least two attack events in the first associated event group to obtain a merged set of attack parameters, including: If the first set of attack parameters and the second set of attack parameters have a subset relationship, then the merged set of attack parameters is determined to be the set of attack parameters corresponding to the parent event in the first event and the second event. If the first attack parameter set and the second attack parameter set of the second event do not have a subset relationship, and the first attack parameter set and the second attack parameter set have an intersection relationship, then the merged attack parameter set is determined to be the intersection of the first attack parameter set and the second attack parameter set; If the first attack parameter set and the second attack parameter set do not have a subset relationship, and the first attack parameter set and the second attack parameter set do not have an intersection relationship, and the first event and the second event have a co-domain relationship, then the merged attack parameter set is determined to be the union of the first attack parameter set and the second attack parameter set; Wherein, the first event is the original attack event obtained or the attack event obtained after any merge operation, the second event is the original attack event obtained or the attack event obtained after any merge operation; the first attack parameter set is the parameter set in the event information of the first event that corresponds to the first merge condition, and the second attack parameter set is the parameter set in the second event that corresponds to the first merge condition.

6. The method according to claim 5, characterized in that, The method further includes: If the first attack parameter set and the second attack parameter set do not have a subset relationship, and the first attack parameter set and the second attack parameter set do not have an intersection relationship, and the first event and the second event do not have a co-domain relationship, then no merging process will be performed.

7. The method according to claim 5, characterized in that, The method further includes: It was determined that the two events involved in the merge operation originated from the same attack process.

8. The method according to claim 5, characterized in that, The first set of attack parameters includes a set of attacked IPs, a set of attacked ports, a set of attacked emails, or a set of attacked accounts; When the first set of attack parameters is the set of attacked IPs, the same domain relationship means the network scope is the same; When the first set of attack parameters is the set of attacked ports, the same domain relationship means that the host IPs are the same; When the first set of attack parameters is the set of attacked email addresses, the same domain relationship means that the email addresses have the same suffix. When the first set of attack parameters is the set of attacked accounts, the same domain relationship means that the host IP is the same or the URL address is the same.

9. The method according to any one of claims 1 to 4, characterized in that, The association of at least one attack event under each event type to obtain at least one associated event group under each event type includes: For at least one attack event under each event type, perform the following operations to identify at least one associated event group under each event type: By applying the first associated event filtering conditions corresponding to the attack events of the first event type, at least one attack event under the first event type is associated to determine at least one associated event group under the first event type; wherein, the first event type is any one of the at least one event types, and each associated event group includes at least two attack events.

10. The method according to claim 9, characterized in that, The first associated event filtering criteria include that the event subtype, network protocol, and target parameters are all the same; If the first event type is a DDoS attack or brute-force attack, then the target parameter is the attacking IP address; If the first event type is a malicious file attack, then the target parameter is the file MD5 hash; If the first event type is a botnet attack, then the target parameter is a combination of the attacking IP and the botnet name; If the first event type is a phishing email attack, then the target parameter is the email name.

11. An attack event analysis device, characterized in that, include: The acquisition unit is configured to: acquire event information of at least one attack event; wherein the event information is obtained by a security detection device performing security detection on at least one network node; The association unit is used to: associate at least one attack event under each event type to obtain at least one associated event group under each event type; The merging unit is configured to: for each associated event group in at least one associated event group corresponding to each event type, perform the following operations to determine the attack parameter set in each associated event group: determine a first attack scenario for a first associated event group; wherein the first associated event group is any one of the at least one associated event groups; apply the merging condition corresponding to the first attack scenario to merge at least two attack events in the first associated event group to obtain a merged attack parameter set; wherein the merged attack parameter set is used to indicate the analysis of the at least one attack event.

12. An attack event analysis device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When executed by a processor, the computer program instructions implement the steps of the method according to any one of claims 1 to 10.

Images