Log analysis method and apparatus, terminal device, and storage medium

Abstract

The application discloses a log analysis method and device, terminal equipment and a storage medium, and relates to the technical field of log analysis. The log analysis method comprises the following steps: acquiring abnormal logs of a target system; generating a first abnormal topology graph according to the abnormal logs; clipping the first abnormal topology graph according to a preset attack behavior framework to obtain a second abnormal topology graph; and analyzing the second abnormal topology graph to determine a final attack chain for the target system. According to the application, a visual abnormal topology graph is generated according to abnormal logs, noise information is removed by clipping the abnormal topology graph, and then the final attack chain is obtained by analyzing the abnormal topology graph. In this way, the analysis data volume is reduced, the analysis accuracy is improved, and the problem that the analysis efficiency and quality are reduced when there is too much noise information is solved.

Description

Technical Field

[0001] This invention relates to the field of security technology, and in particular to a log analysis method, apparatus, terminal device, and storage medium. Background Technology

[0002] Today, hacker attack methods are becoming increasingly diverse and complex. Among them, Advanced Persistent Threats (APTs) have become a serious cyberattack method that threatens the data security of governments and enterprises due to their advanced technology, long duration, and high level of harm.

[0003] To analyze and track APTs, existing log analysis methods extract relevant fields from captured IoT honeypot logs, map attack behaviors to the ATT&CK framework to automate TTP extraction, generate several feature groups, and mine potential attack groups through hierarchical clustering, ultimately generating an attack tree for each attacker cluster. However, when using existing log analysis methods to analyze and track APTs, the presence of a large amount of noisy information filled in by attackers in the analyzed data leads to a decrease in analysis efficiency and quality. Summary of the Invention

[0004] The main objective of this invention is to provide a log analysis method, system, device, terminal equipment, and storage medium, aiming to solve the problem of decreased analysis efficiency and quality caused by noise information in log analysis data.

[0005] To achieve the above objectives, the present invention provides a log analysis method, the log analysis method comprising:

[0006] Obtain the exception logs of the target system;

[0007] A first anomaly topology graph is generated based on the anomaly log;

[0008] The first abnormal topology graph is cropped according to the preset attack behavior framework to obtain the second abnormal topology graph;

[0009] The second abnormal topology graph is analyzed to determine the final attack chain against the target system.

[0010] Optionally, the anomaly logs include host anomaly logs and traffic anomaly logs, and generating the first anomaly topology map based on the anomaly logs includes the following steps:

[0011] Read kernel-level data from the host anomaly log and the traffic anomaly log;

[0012] The processes and files corresponding to the kernel-level data are identified as basic nodes in a pre-created planar graph;

[0013] Read the log information about the basic node from the host anomaly log and the traffic anomaly log;

[0014] The data stream corresponding to the basic node is determined based on the log information;

[0015] The basic nodes and the corresponding data streams are combined into a behavior chain;

[0016] The behavioral chains are combined to generate the first anomaly topology graph.

[0017] Optionally, before the step of trimming the first abnormal topology map according to a preset attack behavior framework to obtain the second abnormal topology map, the method further includes:

[0018] Analyze the behavior chain in the first anomaly topology graph and identify the behavior corresponding to the behavior chain in the first anomaly topology graph.

[0019] The preset attack behavior framework is the ATT&CK framework, wherein the ATT&CK framework includes the TTP specification, and the step of trimming the first abnormal topology map according to the preset attack behavior framework to obtain the second abnormal topology map includes the following steps:

[0020] Match the behavior with the TTP specification;

[0021] If the behavior does not match the TTP specification, then the behavior chain of the first anomaly topology graph corresponding to the behavior is trimmed to obtain the second anomaly topology graph.

[0022] Optionally, analyzing the second abnormal topology graph to determine the final attack chain against the target system includes the following steps:

[0023] Calculate the behavior value of the behavior chain in the second anomaly topology graph;

[0024] The behavioral chains in the second abnormal topology graph whose behavioral values ​​are less than a first preset threshold are identified as alternative attack chains against the target system.

[0025] Calculate the attack value of the alternative attack chains;

[0026] The alternative attack chains whose attack value is greater than a second preset threshold are determined as the final attack chain against the target system.

[0027] Optionally, the base node includes a process node, and the step of calculating the behavior value of the behavior chain in the second anomaly topology graph includes:

[0028] Calculate the density between process nodes in the behavioral chain of the second anomaly topology graph;

[0029] Calculate the behavior value of the behavior chain in the second anomaly topology graph based on the density;

[0030] The step of calculating the attack value of the alternative attack chain includes:

[0031] The attack value of the alternative attack chain is calculated based on the preset attack level and attack stage.

[0032] Optionally, the base node includes a file node, and the step of calculating the density between process nodes in the behavioral chain of the second anomaly topology graph includes:

[0033] The density between process nodes in the behavioral chain of the second abnormal topology graph is calculated based on the number of process nodes, the number of file nodes, and the maximum in-degree of the base node in the behavioral chain of the second abnormal topology graph.

[0034] Optionally, after the step of analyzing the second abnormal topology graph to determine the final attack chain against the target system, the method further includes:

[0035] When the attack value of the final attack chain exceeds a preset warning threshold, an attack warning is issued, and the final attack chain is reshaped to protect the target system.

[0036] This application also proposes a log analysis device, the log analysis device comprising:

[0037] The acquisition module is used to acquire the exception logs of the target system;

[0038] The generation module is used to generate a first anomaly topology map based on the anomaly log;

[0039] The trimming module is used to trim the first abnormal topology map according to a preset attack behavior framework to obtain a second abnormal topology map.

[0040] The analysis module is used to analyze the second abnormal topology graph to determine the final attack chain against the target system.

[0041] This application also proposes a terminal device, which includes a memory, a processor, and a log analysis program stored in the memory and executable on the processor. When the log analysis program is executed by the processor, it implements the steps of the log analysis method described above.

[0042] This application also proposes a computer-readable storage medium storing a log analysis program, which, when executed by a processor, implements the steps of the log analysis method described above.

[0043] The log analysis method, apparatus, terminal device, and storage medium proposed in this application acquire abnormal logs of a target system; generate a first abnormal topology map based on the abnormal logs; trim the first abnormal topology map according to a preset attack behavior framework to obtain a second abnormal topology map; and analyze the second abnormal topology map to determine the final attack chain against the target system. By generating a visualized abnormal topology map based on the abnormal logs, trimming it to remove noise information, and then analyzing the abnormal topology map to obtain the final attack chain, the analysis accuracy is improved while reducing the amount of data to be analyzed, solving the problem of decreased analysis efficiency and quality when there is too much noise information. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of the functional modules of the terminal device to which the log analysis device of this application belongs;

[0045] Figure 2 This is a flowchart illustrating a first exemplary embodiment of the log analysis method of this application;

[0046] Figure 3 This is a flowchart illustrating a second exemplary embodiment of the log analysis method of this application;

[0047] Figure 4 This is a flowchart illustrating a third exemplary embodiment of the log analysis method of this application;

[0048] Figure 5 This is a flowchart illustrating the fourth exemplary embodiment of the log analysis method of this application;

[0049] Figure 6 This is a flowchart illustrating a fifth exemplary embodiment of the log analysis method of this application;

[0050] Figure 7 This is an exemplary schematic diagram of the basic node identifiers involved in the log analysis method of this application;

[0051] Figure 8 This is an exemplary schematic diagram of the behavioral chain involved in the log analysis method of this application;

[0052] Figure 9 This is an exemplary schematic diagram of the first anomaly topology involved in the log analysis method of this application.

[0053] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0054] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. The main solution of this invention is: obtaining anomaly logs of the target system; generating a first anomaly topology map based on the anomaly logs; trimming the first anomaly topology map according to a preset attack behavior framework to obtain a second anomaly topology map; and analyzing the second anomaly topology map to determine the final attack chain against the target system.

[0055] Based on the proposed solution, a visualized anomaly topology graph is generated from the anomaly logs. This graph is then trimmed to remove noise information, and the final attack chain is obtained by analyzing the graph. This approach reduces the amount of data to be analyzed while improving the accuracy of the analysis, thus solving the problem of decreased efficiency and quality when there is too much noise.

[0056] Specifically, refer to Figure 1 , Figure 1 This diagram illustrates the functional modules of the terminal device to which the log analysis device belongs. The log analysis device can be independent of the terminal device, capable of performing log analysis and comparison, and can be implemented on the terminal device in hardware or software form. The terminal device can be a smart mobile terminal with data processing capabilities, such as a mobile phone or tablet computer, or a fixed terminal device or server with data processing capabilities.

[0057] In this embodiment, the terminal device to which the log analysis device belongs includes at least an output module 110, a processor 120, a memory 130, and a communication module 140.

[0058] The memory 130 stores the operating system and log analysis program. The log analysis device can store the following information in the memory 130: the acquired abnormal logs of the target system; a first abnormal topology map generated based on the abnormal logs; a second abnormal topology map obtained by trimming the first abnormal topology map according to a preset attack behavior framework; and the final attack chain against the target system obtained by analyzing the second abnormal topology map according to a preset attack chain analysis method. The output module 110 can be a display screen, etc. The communication module 140 can include a WIFI module, a mobile communication module, and a Bluetooth module, etc., and communicates with external devices or servers through the communication module 140.

[0059] When the log analysis program in memory 130 is executed by the processor, it performs the following steps:

[0060] Furthermore, when the log analysis program in memory 130 is executed by the processor, it also performs the following steps:

[0061] Read kernel-level data from the host anomaly log and the traffic anomaly log;

[0062] The processes and files corresponding to the kernel-level data are identified as basic nodes in a pre-created planar graph;

[0063] Read the log information about the basic node from the host anomaly log and the traffic anomaly log;

[0064] The data stream corresponding to the basic node is determined based on the log information;

[0065] The basic nodes and the corresponding data streams are combined into a behavior chain;

[0066] The behavioral chains are combined to generate the first anomaly topology graph.

[0067] Furthermore, when the log analysis program in memory 130 is executed by the processor, it also performs the following steps:

[0068] Analyze the behavior chain in the first anomaly topology graph and identify the behavior corresponding to the behavior chain in the first anomaly topology graph.

[0069] Match the behavior with the TTP specification;

[0070] If the behavior does not match the TTP specification, then the behavior chain of the first anomaly topology graph corresponding to the behavior is trimmed to obtain the second anomaly topology graph.

[0071] Furthermore, when the log analysis program in memory 130 is executed by the processor, it also performs the following steps:

[0072] Calculate the behavior value of the behavior chain in the second anomaly topology graph;

[0073] The behavioral chains in the second abnormal topology graph whose behavioral values ​​are less than a first preset threshold are identified as alternative attack chains against the target system.

[0074] Calculate the attack value of the alternative attack chains;

[0075] The alternative attack chains whose attack value is greater than a second preset threshold are determined as the final attack chain against the target system.

[0076] Furthermore, when the log analysis program in memory 130 is executed by the processor, it also performs the following steps:

[0077] Calculate the density between process nodes in the behavioral chain of the second anomaly topology graph;

[0078] Calculate the behavior value of the behavior chain in the second anomaly topology graph based on the density;

[0079] The step of calculating the attack value of the alternative attack chain includes:

[0080] The attack value of the alternative attack chain is calculated based on the preset attack level and attack stage.

[0081] Furthermore, when the log analysis program in memory 130 is executed by the processor, it also performs the following steps:

[0082] The density between process nodes in the behavioral chain of the second abnormal topology graph is calculated based on the number of process nodes, the number of file nodes, and the maximum in-degree of the base node in the behavioral chain of the second abnormal topology graph.

[0083] Furthermore, when the log analysis program in memory 130 is executed by the processor, it also performs the following steps:

[0084] When the attack value of the final attack chain exceeds a preset warning threshold, an attack warning is issued, and the final attack chain is reshaped to protect the target system.

[0085] This embodiment, through the above-described scheme, specifically involves: acquiring the anomaly logs of the target system; generating a first anomaly topology map based on the anomaly logs; trimming the first anomaly topology map according to a preset attack behavior framework to obtain a second anomaly topology map; and analyzing the second anomaly topology map to determine the final attack chain against the target system. By generating a visualized anomaly topology map based on the anomaly logs, trimming it to remove noise, and then analyzing the anomaly topology map to obtain the final attack chain, the analysis accuracy is improved while reducing the amount of data to be analyzed, thus solving the problem of decreased analysis efficiency and quality when there is too much noise.

[0086] Reference Figure 2 The first embodiment of the log analysis method of the present invention provides a flowchart, wherein the log analysis method includes:

[0087] Step S10: Obtain the exception log of the target system;

[0088] Specifically, during operation, the target system monitors for abnormal events by recording anomaly logs, which are stored in corresponding log folders. Terminal devices locate the log folder containing the anomaly logs, open it, and read the logs, thus obtaining the target system's anomaly logs. These logs reflect all abnormal events prior to a failure or attack, providing material for developing defense strategies for the target system.

[0089] Step S20: Generate a first anomaly topology map based on the anomaly log;

[0090] The exception log records information about processes and files in the target system. Each process and file is identified as a basic node. Then, the data flow related to the basic node is further searched in the exception log. The data flow is represented by directional line segments, with the two ends of the line segments connecting to different basic nodes, reflecting the relationship of data reading, writing, or creation between basic nodes.

[0091] Then, the basic nodes and data flows are combined into behavior chains. Each behavior chain represents a corresponding behavior from start to finish. This behavior could be a normal occurrence during system operation, a hacker attack, or other behavior. Finally, several behavior chains are combined to generate a visualized first anomaly topology graph. This first anomaly topology graph fully covers all anomaly events in the target system's anomaly logs and reconstructs the behavior of each anomaly event.

[0092] Step S30: The first abnormal topology map is cropped according to the preset attack behavior framework to obtain the second abnormal topology map;

[0093] Specifically, the pre-defined attack behavior framework used for pruning the first anomaly topology graph is the ATT&CK framework, which reflects the attack behaviors at each stage of the attack lifecycle. Using the ATT&CK framework, behavioral chains unrelated to the attack behaviors can be identified from the first anomaly topology graph. These unrelated behavioral chains are then pruned to remove noise. The resulting subgraph is the second anomaly topology graph, where all behavioral chains conform to the ATT&CK framework's description of attack behaviors, thus representing potential attack behaviors.

[0094] Step S40: Analyze the second abnormal topology graph to determine the final attack chain against the target system.

[0095] Specifically, the terminal device calculates the density between process nodes in the behavior chain of the second abnormal topology graph, and then calculates the behavior value of the behavior chain based on the density. The behavior value represents the density between nodes in the entire behavior chain; the greater the density, the smaller the behavior value. Then, behavior chains with behavior values ​​less than a first preset threshold are identified as candidate attack chains.

[0096] Furthermore, the terminal device substitutes two preset parameters, attack level and attack stage, into a preset attack value calculation formula to calculate the attack value of the candidate attack chain. The attack value describes the severity of the attack during the complete attack phase. Then, the candidate attack chain with an attack value greater than a second preset threshold is determined as the final attack chain. The determination of the final attack chain provides a basis for the target system to formulate targeted defense strategies.

[0097] This embodiment, through the above-described scheme, specifically involves acquiring the anomaly logs of the target system; generating a first anomaly topology map based on the anomaly logs; trimming the first anomaly topology map according to a preset attack behavior framework to obtain a second anomaly topology map; and analyzing the second anomaly topology map to determine the final attack chain against the target system. This embodiment generates a visualized anomaly topology map based on the anomaly logs, trims it to remove noise, and then analyzes the trimmed anomaly topology map to obtain the final attack chain. This reduces the amount of data to be analyzed while improving the accuracy of the analysis, solving the problem of decreased analysis efficiency and quality when there is too much noise.

[0098] Furthermore, refer to Figure 3 The second embodiment of the log analysis method of the present invention provides a flowchart, based on the above. Figure 2 In the illustrated embodiment, the anomaly logs include host anomaly logs and traffic anomaly logs, and the step of generating a first anomaly topology map based on the anomaly logs further includes:

[0099] Step S201: Read kernel-level data from the host anomaly log and the traffic anomaly log;

[0100] Specifically, the terminal device reads data from the host anomaly log and traffic anomaly log, filters the data, retains data related to the operating system kernel (i.e., kernel-level data), and discards non-kernel-level data. The kernel-level data contains important operation records related to the operating system kernel, which allows analysis of attacks that significantly impact the operating system kernel.

[0101] Step S202: Identify the processes and files corresponding to the kernel-level data as basic nodes in a pre-created planar graph;

[0102] Specifically, each process and file corresponding to kernel-level data is identified as a process node and a file node in a pre-created planar graph, respectively. These two types of nodes are collectively referred to as base nodes. The attributes of each base node include: node identifier, the type identifier corresponding to the node, and the information corresponding to the node. The node identifier is a unique identifier for the base node, used to describe the specific point; there are two types of type identifiers for the node: P for the type identifier corresponding to process nodes and F for the type identifier corresponding to file nodes; the information corresponding to the node is the information of the process or file to which the node corresponds, such as the process name or file size.

[0103] For example, such as Figure 5As shown, P1 is a process node of process 1 in the planar graph, and F1 is a file node of file A in the planar graph. F1 has point attributes: IDA, F, {file size and other attributes of file A1}; P1 also has point attributes: ID1, P, {process name and other attributes of process P1}.

[0104] Step S203: Read the log information about the basic node from the host anomaly log and the traffic anomaly log;

[0105] Specifically, the terminal device searches for log information in the host anomaly log and the traffic anomaly log based on the unique ID of the basic node. When the log information is found, the terminal device reads it. The log information records data flow data about the basic node. A basic node's log information may contain several items; for example, a file node may be read or written by several processes.

[0106] Step S204: Determine the data stream corresponding to the basic node based on the log information;

[0107] Specifically, after reading the log information of the basic nodes, data write or read operations are analyzed from the log information to determine the data flow between the basic nodes, including the start point, end point, and direction of the data flow. For example... Figure 7 As shown, the data in file A corresponding to file node F1 is written by process 2. That is to say, after process 2 writes data to file A, the data in file A is read by process 1. Therefore, process 2 also corresponds to a process node P2, and there is a data flow between P2 and F1, and between F1 and P1.

[0108] Step S205: Combine the basic node and the corresponding data stream into a behavior chain;

[0109] Specifically, the data flow between two base nodes is represented by a directed line segment, such as... Figure 7 As shown, the starting point of a line segment connects to the base node where the data is being read or written, and the ending point of the line segment connects to the base node where the data is being read or written. For example, if the data in file A corresponding to file node F1 is written by process 2, then the data flow between P2 and F1 is represented by a line segment starting from P2 and pointing to F1; if the data in file A corresponding to file node F1 is read by process 1, then the data flow between F1 and P1 is represented by a line segment starting from F1 and pointing to P1.

[0110] Step S206: Combine the behavior chains to generate the first abnormal topology graph.

[0111] When all data in the host anomaly log and the traffic anomaly log have been processed and formed into several behavior chains, the terminal device will combine the behavior chains and present all the behavior chains in a non-overlapping manner in the planar diagram, thereby generating a first anomaly topology diagram. The anomaly log is visualized through the first anomaly topology diagram, which fully presents the various behaviors reflected in the anomaly log.

[0112] like Figure 8 As shown, this includes three complete actions: P4->P5->P6 (e.g., process 4 creates process 5, and process 5 creates process 6); P2->F1->P1->P3->F2 (e.g., process 2 writes data to file 1, the data in file 1 is read by process 1, process 1 creates process 3 after reading the data, and process 3 writes data to file 2); P7->F1->P1->P3->F2 (e.g., process 7 writes data to file 1, the data in file 1 is read by process 1, process 1 creates process 3 after reading the data, and process 3 writes data to file 2. That is, file 1 is simultaneously written to by two processes).

[0113] This embodiment, through the above-described scheme, specifically reads kernel-level data from the host anomaly log and the traffic anomaly log; identifies the processes and files corresponding to the kernel-level data as basic nodes in a pre-created planar graph; reads log information about the basic nodes from the host anomaly log and the traffic anomaly log; determines the data flow corresponding to the basic node based on the log information; combines the basic node and the corresponding data flow into a behavior chain; and combines the behavior chains to generate the first anomaly topology graph. This embodiment reads data information from the anomaly log, transforms it into behavior flows between basic nodes, and combines them into corresponding behavior chains in the form of points and line segments on the planar graph. Finally, it combines the behavior chains into the first anomaly topology graph. Thus, the events in the anomaly log are transformed into a visualized topology graph. The final generated first anomaly topology graph not only comprehensively covers all anomaly events in the anomaly log but also restores the complete behavior of each anomaly event.

[0114] Furthermore, refer to Figure 4 The third embodiment of the log analysis method of the present invention provides a flowchart, based on the above. Figure 2 In the embodiment shown, before step S30, which involves trimming the first abnormal topology map according to a preset attack behavior framework to obtain the second abnormal topology map, the following steps are also included:

[0115] Step S300: Analyze the behavior chain in the first abnormal topology graph and identify the behavior corresponding to the behavior chain in the first abnormal topology graph;

[0116] Specifically, the terminal device first randomly selects a behavior chain in the first anomaly topology graph. Based on the data flow direction of this behavior chain, it finds its starting point. If there are multiple starting points in the chain, all of them are identified. After finding several starting points, several behavior chains are found based on these starting points. The behavior corresponding to each behavior chain is obtained based on the attributes of the nodes in the behavior chain and the data flow. Since each behavior chain represents an anomaly behavior, all behavior chains found through a starting point represent all anomalies beginning with that starting point.

[0117] The preset attack behavior framework is the ATT&CK framework, wherein the ATT&CK framework includes the TTP specification. Step S30, obtaining the second abnormal topology map by trimming the first abnormal topology map according to the preset attack behavior framework, further includes:

[0118] Match the behavior with the TTP specification;

[0119] Specifically, the ATT&CK framework is an existing attack behavior framework covering all aspects of the attack lifecycle, used to enumerate and classify post-compromise tactics, techniques, and processes (TTPs) for attacks targeting the Microsoft Windows operating system. The TTP specification categorizes attacker behavior into seven tactics: initial compromise, establishing a foothold, insider probing, internal network expansion, privilege escalation, persistence, and data theft. The TTP specification provides a mapping between these behaviors and APT attacks. By matching the behaviors corresponding to the behavioral chains in the first topology graph obtained from the above steps with the TTP specification, it can be determined whether the behaviors against the target system reflected in the first topology graph conform to the description of attack behaviors in the TTP specification.

[0120] If the behavior does not match the TTP specification, then the behavior chain of the first anomaly topology graph corresponding to the behavior is trimmed to obtain the second anomaly topology graph.

[0121] Specifically, if the behaviors corresponding to the behavioral chains in the first topology graph obtained from the above steps do not match the TTP specification, it means that the behavior is not an attack targeting the target system and will not pose a threat to the target system. Then, the terminal device will prune the mismatched behavioral chains in the first abnormal topology graph. This process continues until all behavioral chains in the first abnormal topology graph that do not conform to the TTP specification's description of attack behaviors have been pruned, resulting in a subgraph called the second abnormal topology graph. In other words, all behavioral chains in the second abnormal topology graph reflect attack behaviors under the ATT&CK framework.

[0122] This embodiment, through the above-described scheme, specifically analyzes the behavioral chains in the first abnormal topology graph to identify the behaviors corresponding to the behavioral chains in the first abnormal topology graph; matches the behaviors with the TTP specification; if the behavior does not match the TTP specification, the behavioral chains in the first abnormal topology graph corresponding to the behavior are pruned to obtain the second abnormal topology graph. This embodiment analyzes and identifies behaviors in the behavioral chains, matches the behaviors represented by the behavioral chains with the TTP specification under the ATT&CK framework, identifies non-attack behaviors, and then prunes the behavioral chains corresponding to the non-attack behaviors to obtain a subgraph of the first abnormal topology graph as the second abnormal topology graph. The behavioral chains contained in the second abnormal topology graph all reflect attack behaviors, thereby reducing redundant analysis of non-attack behaviors in subsequent steps and achieving the effect of removing noise information.

[0123] Furthermore, refer to Figure 5 The fourth embodiment of the log analysis method of the present invention provides a flowchart, based on the above. Figure 2 In the embodiment shown, the step of analyzing the second abnormal topology graph to determine the final attack chain against the target system further includes:

[0124] Step S401: Calculate the behavior value of the behavior chain in the second anomaly topology graph;

[0125] Although all the behavioral chains in the second topology graph reflect potential attack behaviors, the attack behaviors also vary in severity. This step will determine the importance of the corresponding attack behaviors by calculating the behavior values ​​of the behavioral chains in the second abnormal topology graph.

[0126] Specifically, if a behavior chain has only one process node, then the behavior value of that behavior chain is determined to be 1. If a behavior chain has multiple process nodes, then starting from the initial process node of the behavior chain, the density between each process node and other process nodes is calculated sequentially. The behavior value of this behavior chain is determined as the average density of all density values ​​in the behavior chain multiplied by (the ratio of the total number of process nodes in the behavior chain to the total number of basic nodes in the behavior chain). Therefore, the behavior value characterizes the density between basic nodes in the entire chain; the greater the density, the smaller the behavior value.

[0127] The density between two process nodes (e.g., process node i and process node j) is:

[0128] If process node i directly points to process node j, that is, process node i and process node j are directly connected, then the tightness between process node i and process node j is 1.

[0129] If process node i indirectly points to process node j, that is, process node i is connected to process node j through other base nodes, then the tightness between process node i and process node j is (the number of all file nodes between process node i and process node j + 1) + (the number of all process nodes between process node i and process node j / the maximum in-degree among all base nodes between process node i and process node j), where the number of all process nodes between process node i and process node j includes process node i and process node j.

[0130] For example, in the complete action chain P2->F1->P1->P3->F2, starting from P2, the density between P2 and P1 is calculated as follows: (the number of all file nodes between P2 and P1 1+1) + (the number of all process nodes between P2 and P1 2 / the maximum in-degree value among all basic nodes between P2 and P1 2) = 2+1 = 3.

[0131] The density between P2 and P3 = (the number of all F nodes between P2 and P3, 1 + 1) + (the number of all P nodes between P2 and P3, 3 / the maximum in-degree among all nodes between P2 and P3, 2) = 2 + 1.5 = 3.5;

[0132] Calculate the tightness between P1 and P3 = 1 (because P1 directly points to P3).

[0133] The behavior value of the behavior chain (P2->F1->P1->P3->F2) is the average of all densities in the behavior chain, 2.5 * (the ratio of the total number of process nodes in the behavior chain, 3, to the total number of basic nodes in the behavior chain, 5, 0.6) = 1.5.

[0134] Step S402: Determine the behavior chain in the second abnormal topology graph whose behavior value is less than the first preset threshold as the alternative attack chain for the target system;

[0135] After calculating the behavior values ​​of all behavior chains in the second anomaly topology graph, attack behaviors that pose a more direct threat to the target system can be filtered out by comparing these behavior values. Specifically, each behavior value is compared with a first preset threshold. If a behavior value is smaller than the first preset threshold, it indicates that the behavior chain corresponding to that behavior value may pose a more direct threat to the target system. Therefore, this behavior chain is identified as a candidate attack chain for the target system. For example, if the first preset threshold is 2 and the behavior value of a certain behavior chain is 1.5, then this behavior chain can be identified as a candidate attack chain.

[0136] Step S403: Calculate the attack value of the alternative attack chain;

[0137] After identifying the potential attack chains, it is necessary to further assess the severity of the harm each potential attack chain poses to the target system. Specifically, the terminal device calculates the attack value of the potential attack chains based on preset attack levels and attack stages. The attack levels need to be preset, and the attack stages include seven phases: initial breach, establishing a foothold, internal reconnaissance, internal network propagation, privilege escalation, persistence, and data theft.

[0138] The formula for calculating attack value is:

[0139] Among them, W k W represents the weight of the k-th stage. k =7+k / 7, where k ranges from 1 to 7, representing the attack phases as follows: initial breach, establishing foothold, internal probing, internal network diffusion, privilege escalation, persistence, and data theft. T k This represents the attack level at which an attack occurs in the k-th stage of an alternative attack chain. This level is determined according to preset attack level rules.

[0140] For example, the attack level rules for the initial assault phase are pre-defined as shown in Table 1 (the attack level rules are different for each phase):

[0141] Table 1

[0142] (0,3) 10 (3,5) 8 … … (m, preset threshold) 2

[0143] If the behavior value of a certain behavior chain is 2.85, then the T1 of that behavior chain in the initial attack phase is 10.

[0144] Step S404: The candidate attack chain whose attack value is greater than the second preset threshold is determined as the final attack chain against the target system.

[0145] After calculating the attack values ​​of all candidate attack chains in the second anomaly topology graph, attack behaviors that cause serious harm to the target system can be filtered out by comparing the attack values. Specifically, all attack values ​​are compared one by one with a second preset threshold. If an attack value is larger than the second preset threshold, it indicates that the behavior chain corresponding to that attack value may cause serious harm to the target system. Therefore, this behavior chain is determined as the final attack chain against the target system. Assuming the second preset threshold is 30 and the behavior value of a certain behavior chain is 40, then this behavior chain can be determined as the final attack chain.

[0146] This embodiment, through the above scheme, specifically calculates the density between process nodes of the behavioral chain in the second abnormal topology graph; calculates the behavioral value of the behavioral chain in the second abnormal topology graph based on the density; the step of calculating the attack value of the candidate attack chain includes: calculating the attack value of the candidate attack chain according to a preset attack level and attack stage. This embodiment determines candidate attack chains by calculating the behavioral values ​​of the behavioral chains in the second abnormal topology graph, and then further determines the final attack chain by calculating the attack values ​​of the candidate attack chains. The attack value can characterize the attack consequences at the complete attack stage from the perspective of complete attack behavior, ensuring the accuracy of the final analysis.

[0147] Furthermore, refer to Figure 6 The fifth embodiment of the log analysis method of the present invention provides a flowchart, based on the above. Figure 2 In the embodiment shown, after analyzing the second abnormal topology graph to determine the final attack chain against the target system, step S40 further includes:

[0148] Step S50: When the attack value of the final attack chain exceeds a preset warning threshold, an attack warning is issued, and the final attack chain is reshaped to protect the target system.

[0149] After identifying all final attack chains in the second anomaly topology graph, corresponding defense strategies are formulated for the target system based on these final attack chains. The terminal device has a pre-set warning threshold. When the attack value of the final attack chain exceeds this threshold, a system alarm is triggered, alerting administrators to respond and take appropriate defensive actions to protect the target system from attack. Additionally, the terminal device will reshape the final attack chain according to a preset program. For example, it may elevate the privileges of various operations involved in the final attack chain to intercept the hacker's attack, or transfer important files in the final attack chain to other secure storage areas to protect the target system's important files from attack.

[0150] This embodiment, through the above-described scheme, specifically issues an attack warning when the attack value of the final attack chain exceeds a preset warning threshold, and reshapes the final attack chain to protect the target system. This embodiment further differentiates the severity of the final attack chain using the preset warning threshold. If the attack value of the final attack chain exceeds the warning threshold, indicating that the target system faces a serious attack threat, an alarm is triggered, and the attack chain is reshaped to promptly protect the target system from attack.

[0151] Furthermore, embodiments of this application also propose a log analysis device, the log analysis device comprising:

[0152] The acquisition module is used to acquire the exception logs of the target system;

[0153] The generation module is used to generate a first anomaly topology map based on the anomaly log;

[0154] The trimming module is used to trim the first abnormal topology map according to a preset attack behavior framework to obtain a second abnormal topology map.

[0155] The analysis module is used to analyze the second abnormal topology graph to determine the final attack chain against the target system.

[0156] The principle and implementation process of log analysis in this embodiment are explained in the above embodiments and will not be repeated here.

[0157] Furthermore, this application also proposes a terminal device, which includes a memory, a processor, and a log analysis program stored in the memory and executable on the processor. When the log analysis program is executed by the processor, it implements the steps of the log analysis method described above.

[0158] Since this log analysis program employs all the technical solutions of all the aforementioned embodiments when executed by the processor, it possesses at least all the beneficial effects brought about by all the technical solutions of all the aforementioned embodiments, which will not be elaborated upon here.

[0159] Furthermore, embodiments of this application also propose a computer-readable storage medium storing a log analysis program, which, when executed by a processor, implements the steps of the log analysis method described above.

[0160] Since this log analysis program employs all the technical solutions of all the aforementioned embodiments when executed by the processor, it possesses at least all the beneficial effects brought about by all the technical solutions of all the aforementioned embodiments, which will not be elaborated upon here.

[0161] Compared to existing technologies, the log analysis method, apparatus, terminal device, and storage medium proposed in this application obtain abnormal logs of a target system; generate a first abnormal topology map based on the abnormal logs; trim the first abnormal topology map according to a preset attack behavior framework to obtain a second abnormal topology map; and analyze the second abnormal topology map to determine the final attack chain against the target system. By generating a visualized abnormal topology map based on the abnormal logs, trimming it to remove noise information, and then analyzing the abnormal topology map to obtain the final attack chain, the analysis accuracy is improved while reducing the amount of data to be analyzed, solving the problem of decreased analysis efficiency and quality when there is too much noise information.

[0162] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0163] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0164] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, controlled terminal, or network device, etc.) to execute the methods of each embodiment of this application.

[0165] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A log analysis method, characterized in that, The log analysis method includes the following steps: Obtain the exception logs of the target system; A first anomaly topology graph is generated based on the anomaly log; Analyze the behavior chain in the first anomaly topology graph and identify the behavior corresponding to the behavior chain in the first anomaly topology graph. A second abnormal topology graph is obtained by trimming the first abnormal topology graph according to a preset attack behavior framework. The preset attack behavior framework is the ATT&CK framework, which includes the TTP specification. Specifically, the framework includes: matching the behavior with the TTP specification to determine whether the behavior against the target system reflected in the first topology graph conforms to the description of attack behavior in the TTP specification; if the behavior does not match the TTP specification, the behavior chain of the first abnormal topology graph corresponding to the behavior is trimmed to obtain the second abnormal topology graph. Analyzing the second abnormal topology graph to determine the final attack chain against the target system includes: calculating the behavior value of the behavior chain in the second abnormal topology graph, specifically including calculating the density between process nodes of the behavior chain in the second abnormal topology graph; and calculating the behavior value of the behavior chain in the second abnormal topology graph based on the density. The behavioral chains in the second abnormal topology graph whose behavioral values ​​are less than a first preset threshold are identified as alternative attack chains against the target system. Calculating the attack value of the alternative attack chain specifically includes: calculating the attack value of the alternative attack chain based on a preset attack level and attack stage; The alternative attack chains whose attack value is greater than a second preset threshold are determined as the final attack chain against the target system.

2. The log analysis method as described in claim 1, characterized in that, The anomaly logs include host anomaly logs and traffic anomaly logs, wherein the basic nodes include process nodes, and generating the first anomaly topology map based on the anomaly logs includes the following steps: Read kernel-level data from the host anomaly log and the traffic anomaly log; The processes and files corresponding to the kernel-level data are identified as basic nodes in a pre-created planar graph; Read the log information about the basic node from the host anomaly log and the traffic anomaly log; The data stream corresponding to the basic node is determined based on the log information; The basic nodes and the corresponding data streams are combined into a behavior chain; The behavioral chains are combined to generate the first anomaly topology graph.

3. The log analysis method as described in claim 1, characterized in that, in, The basic nodes include file nodes, and the step of calculating the density between process nodes in the behavioral chain of the second anomaly topology graph includes: The density between process nodes in the behavioral chain of the second abnormal topology graph is calculated based on the number of process nodes, the number of file nodes, and the maximum in-degree of the base node in the behavioral chain of the second abnormal topology graph.

4. The log analysis method as described in claim 1, characterized in that, After the step of analyzing the second abnormal topology graph to determine the final attack chain against the target system, the method further includes: When the attack value of the final attack chain exceeds a preset warning threshold, an attack warning is issued and the final attack chain is reshaped.

5. A log analysis device, characterized in that, The log analysis device includes: The acquisition module is used to acquire the exception logs of the target system; The generation module is used to generate a first anomaly topology map based on the anomaly log; The generation module is also used to analyze the behavior chain in the first abnormal topology graph and identify the behavior corresponding to the behavior chain in the first abnormal topology graph. The trimming module is used to trim the first abnormal topology graph according to a preset attack behavior framework to obtain a second abnormal topology graph. The preset attack behavior framework is the ATT&CK framework, wherein the ATT&CK framework includes the TTP specification. Specifically, it includes: matching the behavior with the TTP specification to determine whether the behavior against the target system reflected in the first topology graph conforms to the description of attack behavior in the TTP specification; if the behavior does not match the TTP specification, then trimming the behavior chain of the first abnormal topology graph corresponding to the behavior to obtain the second abnormal topology graph. The analysis module is used to analyze the second abnormal topology graph to determine the final attack chain against the target system, including: calculating the behavior value of the behavior chain in the second abnormal topology graph, specifically including calculating the density between process nodes of the behavior chain in the second abnormal topology graph; calculating the behavior value of the behavior chain in the second abnormal topology graph based on the density; determining the behavior chain in the second abnormal topology graph whose behavior value is less than a first preset threshold as a candidate attack chain against the target system; calculating the attack value of the candidate attack chain, specifically including: calculating the attack value of the candidate attack chain based on a preset attack level and attack stage; determining the candidate attack chain whose attack value is greater than a second preset threshold as the final attack chain against the target system.

6. A terminal device, characterized in that, The terminal device includes a memory, a processor, and a log analysis program stored in the memory and executable on the processor. When the log analysis program is executed by the processor, it implements the steps of the log analysis method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a log analysis program, which, when executed by a processor, implements the steps of the log analysis method as described in any one of claims 1-4.

Images