A network access security control system based on EBPF

Abstract

The present invention provides an EBPF-based network access security control system. It relates to the technical field of network access security control, and the system includes: acquiring network logs, inserting identity information into each network data packet according to the EBPF technology, and collecting business data; performing multi-perspective visual correlation analysis on network access to determine access data of each access terminal; performing a primary risk identification of the exposure surface to determine the port exposure score of each access terminal, executing a corresponding micro-isolation policy model in combination with the EBPF technology, performing a secondary risk identification on each access terminal, and obtaining a secondary risk identification result for each access terminal; performing abnormal marking and abnormal monitoring on each access terminal whose secondary risk identification result does not conform to the execution result of the micro-isolation policy model, executing a corresponding control strategy and isolating and blocking the access terminal; and improving the efficiency of data element circulation transactions, enhancing the security and feasibility of network access control, and effectively ensuring the security of data element circulation transactions.

Description

Technical Field

[0001] The present invention relates to the technical field of network access security control, and in particular to a network access security control system based on EBPF. Background Art

[0002] With the rapid development of the Internet, data elements are booming, data access sources are growing, and access needs are becoming increasingly complex. In addition, there are some illegal access situations in network access, so network security control is becoming increasingly difficult. EBPF technology is a kernel sandbox technology. The sandbox is used to isolate running programs to ensure the safe operation of the operating system. EBPF technology can execute sandbox programs in the operating system and is no longer limited to the network stack. It expands the application field and can isolate the access programs of each data access source by adding and unloading programs in user space, realizing complex network security control functions, thereby achieving the goal of both performance and functionality, and ensuring the security of data element circulation and transactions.

[0003] Therefore, the present invention provides a network security access control system based on EBPF. Summary of the Invention

[0004] The present invention provides a network access security control system based on EBPF, which is used to obtain network logs, insert identity information into each network data packet according to the EBPF technology, and collect business data; perform multi-perspective visual correlation analysis on network access to determine the access data of each access terminal; perform a primary risk identification of the exposure surface to determine the port exposure score of each access terminal, combine the EBPF technology to execute the corresponding micro-isolation policy mode, perform a secondary risk identification on each access terminal, and obtain the secondary risk identification result of each access terminal; perform abnormal marking and abnormal monitoring on each access terminal whose secondary risk identification result does not conform to the execution result of the micro-isolation policy mode, and execute corresponding management and control strategies and isolation and blocking disposal; it not only improves the efficiency of data element circulation transactions, enhances the security and feasibility of network access control, but also effectively guarantees the security of data element circulation transactions.

[0005] The present invention provides a network access security control system based on EBPF, comprising:

[0006] The data collection module is used to obtain network logs, insert identity information into each network data packet based on EBPF technology, and collect business data from the configuration management database and asset management system;

[0007] The multi-dimensional correlation module is used to perform multi-perspective visual correlation analysis on network access, analyze and process each access terminal according to the preset network access rules, and determine the access data of each access terminal;

[0008] The access control module is used to perform a primary risk identification of the exposure surface based on the access data of each access terminal, determine the port exposure score of each access terminal, and execute the corresponding micro-isolation policy mode in combination with EBPF technology. When it is determined that the execution of each micro-isolation policy mode is completed, a secondary risk identification is performed on each access terminal to obtain the secondary risk identification results of each access terminal;

[0009] The monitoring and blocking module is used to mark and monitor abnormalities for each access terminal whose secondary risk identification results do not conform to the execution results of the micro-isolation policy model, and to execute corresponding control strategies and isolation and blocking disposal based on the abnormal monitoring results.

[0010] According to the present invention, a network access security control system based on EBPF, a data collection module includes:

[0011] The data connection unit is used to monitor the workload of each access terminal in real time, collect network logs according to a preset network log collection method, and aggregate the connection relationship of each access terminal according to a preset data aggregation node to obtain a network connection relationship based on the network log;

[0012] Using EBPF technology, identity information is inserted into each network data packet, and the identity information is mapped with the IP address and service to obtain the labeled service connection relationship;

[0013] The business data collection unit is used to collect business data from the configuration management database and the asset management system according to the business connection relationship, and to perform data analysis and IP address decoupling processing on each network data packet based on the business label, and establish a mapping relationship from IP address to identity information.

[0014] According to the present invention, a network access security control system based on EBPF, a multi-dimensional association module includes:

[0015] The correlation analysis unit is used to set east-west network access correlation analysis for business assets based on preset analysis algorithms and preset analysis perspectives, and perform multi-perspective visual correlation analysis on network access at each access point. The multi-perspective visual correlation analysis includes: global business topology, global access analysis, business detail analysis, and workload detail analysis;

[0016] The access data unit is used to build a compliance access baseline based on business connection relationships, continuously optimize the compliance access baseline, and summarize the continuously optimized compliance access baseline as a preset network access rule;

[0017] When monitoring Nginx / web server access to the DB server, each access end is analyzed and processed according to the preset network access rules. When it is determined that the access complies with the preset network access rules, a compliant access connection is established, and the corresponding access end is allowed to perform multi-dimensional custom correlation analysis to determine the corresponding access data;

[0018] Otherwise, a violation connection flag is added and access to the data is prohibited.

[0019] According to the present invention, an EBPF-based network access security control system, an access control module, includes:

[0020] A risk identification unit is used to perform a primary risk identification of the exposure surface based on the access data of each access terminal and determine the port exposure surface score of each access terminal, where the port exposure surface score = the number of exposed ports × the number of access sources;

[0021] A trend determination unit is used to determine the actual exposure convergence trend of each access point based on the port exposure score of each access point determined in real time, and to implement the corresponding micro-segmentation policy mode by combining the calculated exposure convergence trend and EBPF technology;

[0022] The secondary risk identification unit is used to perform secondary risk identification on each access terminal after determining that each micro-isolation policy mode has been executed, and obtain the secondary risk identification results of each access terminal.

[0023] According to the present invention, a network access security control system based on EBPF is provided, wherein the monitoring and blocking module includes:

[0024] Anomaly monitoring unit, used to perform black feature attack detection based on threat signatures and white feature anomaly detection based on service baselines on each access terminal marked as abnormal;

[0025] When black feature attack detection based on threat signatures determines that there is a threat, or when white feature anomaly detection based on business baselines detects a baseline deviation that violates normal business, the system executes the corresponding alarm level alarm data based on the fully definable anomaly detection model, monitors and analyzes the operation anomaly, determines the abnormal event type based on the preset event rules, and executes the corresponding event alarm data;

[0026] A false alarm elimination unit is used to simulate and calculate the alarm data of the corresponding alarm level and the corresponding event alarm data, adjust the relevant options of the event rules based on the comparison value and calculation value analysis of the data hitting the event rules, and eliminate a set of specific access sources, access purposes, access services and access characteristics to avoid false alarms of normal business access behavior;

[0027] The anomaly control unit is used to classify the anomaly monitoring results based on practical experience and determine the attack characteristics of each anomaly monitoring result.

[0028] According to the present invention, a network access security control system based on EBPF, a monitoring and blocking module further includes:

[0029] The event alarm control unit is used to identify attack sources and compromised assets based on the attack characteristics of each abnormal monitoring result. It also implements corresponding refined policy management for each abnormal monitoring result based on policy rules and policy scope. The control policies include: convergence exposure, island isolation, and global ban.

[0030] The attack source handling unit is used to perform one-click isolation or blocking of the attack source and compromised assets based on the preset isolation group for managed workloads and the preset blacklist policy template for unmanaged workloads.

[0031] According to the present invention, an EBPF-based network access security control system, an EBPF network data packet module, includes:

[0032] The network data packet capture unit is used to initialize the network card device, create physical memory space as a buffer area for network data packets, and establish a mapping relationship between data and corresponding buffer areas;

[0033] When the network card device receives a network data packet, it stores each network data packet in the corresponding data buffer area according to the mapping relationship between the data and the corresponding buffer area, and notifies the processor to read the corresponding data through a hardware interrupt to perform a packet receiving operation;

[0034] When it is determined that the packet receiving operation is completed, the network data packet that has been received is intercepted, transmitted to the XDP program for analysis and processing, and the corresponding network data packet direction is executed, wherein the network data packet direction includes: transmission to the upper layer protocol stack of the kernel, network data packet discarding, network data packet transmission to the upper layer protocol stack of the kernel, and network data packet redirection;

[0035] The network data packet analysis unit is used to detect the legitimacy of the network data packets in the XDP program according to the preset map and preset analysis rules, and when the network data packets are determined to be illegal, the network data packets are discarded;

[0036] Perform IP data analysis on the network data packets that are determined to be legal, extract the IP data packets, and insert the ID data for processing, wherein the IP data packets include: source IP address, destination IP address, service type, protocol type and IP data packet length;

[0037] Extract the protocol type from the IP data packet, release the network data packets whose protocol type is not within the analysis target protocol range, and transmit the remaining network data packets according to the source IP address;

[0038] The network data packet transmission unit is used to transmit the network data packet according to the preset map. When it is detected that the map rule file is updated, a new network data packet is transmitted to update the preset map rule.

[0039] Perform transmission tests on network data packets, obtain network data packets corresponding to access traffic within a preset time period, and perform data cleaning to remove invalid data packets from the network data packets;

[0040] Extract features from the remaining network data packets, and when the feature similarity of the remaining network data packets is greater than a preset similarity, merge the corresponding remaining network data packets;

[0041] Based on the difficulty of extracting each feature and the weight of each feature's impact on whether the access traffic is normal, a feature score is calculated for each feature, and the top n1 features with the highest feature scores are selected for data transmission test analysis.

[0042] An iterative processing unit is used to construct a network transmission model and perform parameter initialization processing, determine the corresponding state distribution probability and state transition probability according to the access traffic state, and determine the occurrence probability of the top n1 features in the score, and iterate the network transmission model;

[0043] Obtaining a detection rate and a false alarm rate of the iteratively processed network transmission model; when both the detection rate and the false alarm rate meet preset data transmission requirements, determining that the iteratively processed network transmission model accurately identifies normal access traffic and abnormal access traffic; and outputting the iteratively processed network transmission model for application in actual network data packet transmission;

[0044] The network data packet storage unit is used to store the transmitted network data packets according to the preset storage template, and at the same time, store the updated map data;

[0045] The network data packet display unit is used to obtain the original network data packet according to the XDP program, and perform corresponding data packet analysis and processing according to the user's access to the network data packet requirements, output the analysis and processing results to the management plane and display the data.

[0046] According to the present invention, an EBPF-based network access security control system, an iterative processing unit is used to:

[0047] ; Wherein, F is the network transmission model; N01(ai1, Aj1) is the number of access traffic states at the corresponding moment that change to traffic state Aj1 when the i1th feature ai1 changes; bi1 is the probability of observing the i1th feature when the corresponding traffic state Aj1 appears; cj1 is the number of occurrences of the corresponding traffic state Aj1; c2 is the total number of occurrences of each traffic state; S is the preset number of iterative processing times of the network transmission model; n1 is the number of features with the first n1 selected feature scores; m1 is the number of traffic state types that may appear in the access traffic during network transmission; is the network transmission function; 1 is the state transition probability function; A02 is the state distribution probability function; A03 is the initial state probability function.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] By obtaining network logs, identity information is inserted into each network data packet based on EBPF technology to collect business data; multi-perspective visual correlation analysis is performed on network access to determine the access data of each access terminal; a primary risk identification of the exposed surface is performed to determine the port exposure score of each access terminal, and the corresponding micro-isolation policy model is executed in combination with EBPF technology to perform secondary risk identification on each access terminal and obtain the secondary risk identification results of each access terminal; each access terminal whose secondary risk identification results do not conform to the execution results of the micro-isolation policy model is marked and monitored for abnormalities, and the corresponding management and control strategies and isolation and blocking measures are implemented; this not only improves the efficiency of data element circulation transactions, enhances the security and feasibility of network access control, but also ensures the security of data element circulation transactions.

[0050] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0051] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0053] Figure 1The figure is a schematic diagram of the structure of a network access security control system based on EBPF provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0055] like Figure 1 As shown, an embodiment of the present invention provides a network access security control system based on EBPF, including:

[0056] The data collection module is used to obtain network logs, insert identity information into each network data packet based on EBPF technology, and collect business data from the configuration management database and asset management system;

[0057] The multi-dimensional correlation module is used to perform multi-perspective visual correlation analysis on network access, analyze and process each access terminal according to the preset network access rules, and determine the access data of each access terminal;

[0058] The access control module is used to perform a primary risk identification of the exposure surface based on the access data of each access terminal, determine the port exposure score of each access terminal, and execute the corresponding micro-isolation policy mode in combination with EBPF technology. When it is determined that the execution of each micro-isolation policy mode is completed, a secondary risk identification is performed on each access terminal to obtain the secondary risk identification results of each access terminal;

[0059] The monitoring and blocking module is used to mark and monitor abnormalities for each access terminal whose secondary risk identification results do not conform to the execution results of the micro-isolation policy model, and to execute corresponding control strategies and isolation and blocking disposal based on the abnormal monitoring results.

[0060] In this embodiment, the network log refers to a record of events generated by the workload during operation, including: date, connection time, connection address, service, source, and destination.

[0061] In this embodiment, EBPF technology refers to a kernel sandbox technology that enables developers to complete complex operations in kernel mode that could only be completed in user mode in the past, thereby expanding the scope of use and performance.

[0062] In this embodiment, a kernel sandbox environment is created by using EBPF technology to isolate protected services and achieve finer-grained control over service access.

[0063] In this embodiment, a network data packet refers to a basic unit for information transmission in a network.

[0064] In this embodiment, identity information refers to an ID, such as the function or application layer of a workload in a business module, which is used to represent specific visitor information, such as visitor identity and visitor signature status, to distinguish different access requests from the same IP.

[0065] In this embodiment, the configuration management database refers to a database configured in the organization's IT infrastructure to manage system resources and their usage logic. It is determined by the operation and maintenance personnel and is mainly used to improve operational decisions. The management content of the configuration management database often includes: workload, IP, ID, source, port and application.

[0066] In this embodiment, business data collection refers to collecting data used to manage business, such as location data, environment data, workgroup data, application data, IP address data, and ID identity data.

[0067] In this embodiment, the multi-perspective visual association analysis refers to global business topology, global access analysis, business detail analysis, and workload detail analysis.

[0068] In this embodiment, the preset network access rules refer to access rules composed of a summary of continuously tuned compliance access baselines, which are used to determine whether an access connection is compliant.

[0069] In this embodiment, the access end refers to a port used to access network data, such as a workload, a device used by a user to access data, and an application used to access data.

[0070] In this embodiment, the primary risk identification of the exposure surface refers to the initial identification and determination of the exposure risk of the exposure surface for risk measurement.

[0071] In this embodiment, the exposed surface refers to equipment, systems, or information that is exposed to the attacker's line of sight and can be used for intrusion.

[0072] In this embodiment, the port exposure score of each access terminal refers to the maximum number of connection relationships that the access terminal can use to establish, and is used to quantify the risk assessment indicator of the exposure surface of the workload. The larger the port exposure score, the greater the risk of the corresponding access terminal.

[0073] In this embodiment, the micro-isolation policy pattern refers to a policy for converging exposure surfaces and for managing exposure surface risks.

[0074] In this embodiment, secondary risk identification refers to identifying and determining the exposure risk of the exposed surface after the micro-isolation policy mode is applied.

[0075] In this embodiment, the control strategy and isolation and ban disposal refer to the operations of convergent exposure, island isolation and global ban of attack sources and compromised assets to ensure the security of network access.

[0076] In this embodiment, network access security control is performed through EBPF technology to ensure the security and integrity of data, thereby ensuring the security of data element circulation transactions; data element circulation transactions involve data collection, data storage, data management and data transactions.

[0077] In this embodiment, ensuring the security of data element transactions is conducive to achieving the interoperability and sharing of data resources on different platforms, promoting data standardization, improving resource utilization efficiency, ensuring data transaction security, and promoting digital transformation and intelligent development.

[0078] The beneficial effects of the above technical solution are: by obtaining network logs, inserting identity information into each network data packet according to the EBPF technology, and collecting business data; performing multi-perspective visual correlation analysis on network access to determine the access data of each access terminal; performing a primary risk identification of the exposure surface to determine the port exposure score of each access terminal, combining the EBPF technology to execute the corresponding micro-isolation policy model, performing a secondary risk identification on each access terminal, and obtaining the secondary risk identification results of each access terminal; performing abnormal marking and abnormal monitoring on each access terminal whose secondary risk identification results do not conform to the execution results of the micro-isolation policy model, and executing corresponding management and control strategies and isolation and blocking disposal; it not only improves the efficiency of data element circulation transactions, enhances the security and feasibility of network access control, but also effectively ensures the security of data element circulation transactions.

[0079] The embodiment of the present invention provides a network access security control system based on EBPF, and a data collection module, including:

[0080] The data connection unit is used to monitor the workload of each access terminal in real time, collect network logs according to a preset network log collection method, and aggregate the connection relationship of each access terminal according to a preset data aggregation node to obtain a network connection relationship based on the network log;

[0081] Using EBPF technology, identity information is inserted into each network data packet, and the identity information is mapped with the IP address and service to obtain the labeled service connection relationship;

[0082] The business data collection unit is used to collect business data from the configuration management database and the asset management system according to the business connection relationship, and to perform data analysis and IP address decoupling processing on each network data packet based on the business label, and establish a mapping relationship from IP address to identity information.

[0083] In this embodiment, the workload of each access terminal refers to the amount of computing resources and the equipment that completes the access task, such as the running application or program of the computer used to access data.

[0084] In this embodiment, by configuring blacklists and whitelists in a sandbox environment, unauthorized access from specific sources is allowed. For example, when the access terminal is on the blacklist, access is directly denied; when the access terminal is on the whitelist, access is directly allowed; and blacklist checks are performed on the access terminal first.

[0085] In this embodiment, the preset network log collection method refers to the near-station network log collection method. By deploying a user-state light agent on the host side, the connection relationship network occupies low resources, the connection relationship storage resource occupancy is low, and full connection is achieved, effectively obtaining host traffic and identifying business information through label identification.

[0086] In this embodiment, the preset data aggregation node refers to a node that analyzes and processes the data of various workloads in a unified manner, which facilitates management and application.

[0087] In this embodiment, the network connection relationship is based on the network log, such as access time, source, service and purpose.

[0088] In this embodiment, the service connection relationship with labels includes, for example, the first access time, the end access time, the source, the destination, the service, and the number of accesses.

[0089] In this embodiment, a mapping relationship between IP addresses and identity information is established. For example, the business data is analyzed and processed, and the IP addresses are replaced one by one with the corresponding mapped identity information data, so as to facilitate the transition from the basic equipment layer to the identity layer based on the accurate identification of business access identities.

[0090] The beneficial effect of the above technical solution is: by obtaining the network connection relationship based on the network log, mapping the identity information with the IP address and the business, and establishing a mapping relationship from the IP address to the identity information, the mapping upgrade from the IP address to the ID identity information is effectively realized, which is conducive to realizing network access security control.

[0091] The embodiment of the present invention provides a network access security control system based on EBPF, a multi-dimensional association module, including:

[0092] The correlation analysis unit is used to set east-west network access correlation analysis for business assets based on preset analysis algorithms and preset analysis perspectives, and perform multi-perspective visual correlation analysis on network access at each access point. The multi-perspective visual correlation analysis includes: global business topology, global access analysis, business detail analysis, and workload detail analysis;

[0093] The access data unit is used to build a compliance access baseline based on business connection relationships, continuously optimize the compliance access baseline, and summarize the continuously optimized compliance access baseline as a preset network access rule;

[0094] When monitoring Nginx / web server access to the DB server, each access end is analyzed and processed according to the preset network access rules. When it is determined that the access complies with the preset network access rules, a compliant access connection is established, and the corresponding access end is allowed to perform multi-dimensional custom correlation analysis to determine the corresponding access data;

[0095] Otherwise, a violation connection flag is added and access to the data is prohibited.

[0096] In this embodiment, the preset analysis algorithm refers to an algorithm that performs analysis based on access relationships and access behaviors, for example, performing statistical analysis based on connection relationships, blocking relationships, pre-blocking relationships, the number of established relationships, and the number of accesses.

[0097] In this embodiment, the preset analysis perspectives include: a global analysis perspective, a business analysis perspective, and a workload analysis perspective.

[0098] In this embodiment, the compliance access baseline refers to access-related settings learned based on the service access connection relationship, such as policy coverage within and outside the scope and IP address object policy coverage.

[0099] In this embodiment, the Nginx server refers to a lightweight Web server used for reverse proxy.

[0100] In this embodiment, the DB server refers to a database server.

[0101] In this embodiment, the illegal connection identifier refers to an identifier added when data access does not comply with preset network access rules, and is used to prohibit access to data.

[0102] In this embodiment, the multi-view visual association analysis can customize analysis indicators, customize analysis scope, and customize multi-dimensional data association analysis.

[0103] The beneficial effect of the above technical solution is: by performing multi-perspective visual correlation analysis on network access, the access data of each access terminal can be effectively analyzed, which is used for subsequent analysis to determine whether there are security issues in network access, which is conducive to achieving network access security control and meets multi-dimensional customized analysis needs.

[0104] The embodiment of the present invention provides a network access security control system based on EBPF, and an access control module, including:

[0105] A risk identification unit is used to perform a primary risk identification of the exposure surface based on the access data of each access terminal and determine the port exposure surface score of each access terminal, where the port exposure surface score = the number of exposed ports × the number of access sources;

[0106] A trend determination unit is used to determine the actual exposure convergence trend of each access point based on the port exposure score of each access point determined in real time, and to implement the corresponding micro-segmentation policy mode by combining the calculated exposure convergence trend and EBPF technology;

[0107] The secondary risk identification unit is used to perform secondary risk identification on each access terminal after determining that each micro-isolation policy mode has been executed, and obtain the secondary risk identification results of each access terminal.

[0108] In this embodiment, the port exposure score of each access terminal is determined, where the port exposure score = the number of exposed ports × the number of access sources. For example, for access terminal a1, the number of exposed ports is 1 and the number of access sources is 5, then the port exposure score of access terminal a1 is 5.

[0109] In this embodiment, the corresponding micro-isolation policy mode is executed. For example, when the exposure surface convergence trend is 1, the micro-isolation policy mode is not executed; when the exposure surface convergence trend is 0.8, the basic micro-isolation policy mode is executed; when the exposure surface convergence trend is 0, the strict micro-isolation policy mode is executed.

[0110] In this embodiment, the micro-isolation policy mode includes inter-group policy and intra-group policy. For example, when the exposure surface convergence trend is 0, a strict micro-isolation policy mode is executed, that is, the intra-group policy and inter-group policy are executed to perform full-range protection on specific ports of specific roles.

[0111] In this embodiment, secondary risk identification is performed. For example, the port exposure score of access terminal a1 is 5, and the port exposure score after executing the corresponding micro-isolation policy mode is 4, and the exposure convergence trend is 0.8.

[0112] The beneficial effects of the above technical solution are: by conducting a primary risk identification of the exposure surface of the access data of each access terminal and determining the port exposure surface score of each access terminal, it is conducive to quantifying the risk level of the exposure surface and laying a data foundation for subsequent security control; executing the corresponding micro-isolation policy mode and obtaining the secondary risk identification results of each access terminal are conducive to achieving risk management of the exposure surface and ensuring the security of network access.

[0113] The embodiment of the present invention provides a network access security control system based on EBPF, a monitoring and blocking module, including:

[0114] Anomaly monitoring unit, used to perform black feature attack detection based on threat signatures and white feature anomaly detection based on service baselines on each access terminal marked as abnormal;

[0115] When black feature attack detection based on threat signatures determines that there is a threat, or when white feature anomaly detection based on business baselines detects a baseline deviation that violates normal business, the system executes the corresponding alarm level alarm data based on the fully definable anomaly detection model, monitors and analyzes the operation anomaly, determines the abnormal event type based on the preset event rules, and executes the corresponding event alarm data;

[0116] A false alarm elimination unit is used to simulate and calculate the alarm data of the corresponding alarm level and the corresponding event alarm data, adjust the relevant options of the event rules based on the comparison value and calculation value analysis of the data hitting the event rules, and eliminate a set of specific access sources, access purposes, access services and access characteristics to avoid false alarms of normal business access behavior;

[0117] The anomaly control unit is used to classify the anomaly monitoring results based on practical experience and determine the attack characteristics of each anomaly monitoring result.

[0118] In this embodiment, each access end marked as abnormal is subjected to black feature attack detection based on threat signatures and white feature anomaly detection based on business baselines. For example, black feature attack detection disguised as normal access behavior and white feature anomaly detection where the number of access behaviors deviates significantly from the normal number of access behaviors are detected.

[0119] In this embodiment, the fully definable anomaly detection model refers to a model that performs anomaly detection on input data according to a preset algorithm and outputs corresponding alarm data. For example, the data type, data range, and data connection relationship of data a1 are input into the anomaly detection model, and based on statistical comparative analysis of event type and event time, it is determined that an anomaly exists, and the alarm data b1 of data a1 is output.

[0120] In this embodiment, the alarm data of the corresponding alarm level is executed. For example, at alarm level c1, the alarm data is recorded in the alarm list; at alarm level c2, the alarm data is recorded in the alarm list and a home page notification is made; at alarm level c3, the alarm data is recorded in the alarm list and a home page notification and an email notification are made.

[0121] In this embodiment, the abnormal event types include, for example, illegal access, illegal remote control access, address scanning, vulnerability attack, and DDoS attack.

[0122] In this embodiment, the event rule, for example, address scanning, is that if the number of address scans per unit time does not exceed 10 times, the event is determined to be normal; otherwise, the event is determined to be abnormal.

[0123] In this embodiment, a group of specific access sources, access purposes, access services and access characteristics are excluded, that is, an access whitelist is set. For example, the specific access source d1 has 15 address scans per unit event, but this is a normal business access behavior. Therefore, the specific access source d1 is excluded to avoid false positives of normal business access behavior.

[0124] The beneficial effects of the above technical solution are: by monitoring and analyzing operational anomalies, determining the type of abnormal events, and executing corresponding event alarm data, it is beneficial to intuitively view abnormal events and implement corresponding security controls to ensure network access security; excluding a set of specific access sources, access purposes, access services, and access characteristics is beneficial to avoid false alarms of normal business access behaviors and ensure the normal operation of network access.

[0125] The embodiment of the present invention provides a network access security control system based on EBPF, a monitoring and blocking module, and further includes:

[0126] The event alarm control unit is used to identify attack sources and compromised assets based on the attack characteristics of each abnormal monitoring result. It also implements corresponding refined policy management for each abnormal monitoring result based on policy rules and policy scope. The control policies include: convergence exposure, island isolation, and global ban.

[0127] The attack source handling unit is used to perform one-click isolation or blocking of the attack source and compromised assets based on the preset isolation group for managed workloads and the preset blacklist policy template for unmanaged workloads.

[0128] In this embodiment, the attack characteristics of the abnormal monitoring results include, for example, the number of attacks, the attack frequency, and the attack duration.

[0129] In this embodiment, refined policy management refers to convergence exposure, island isolation and global ban operations performed according to policy rules and policy scope, and can be used simultaneously, for example, convergence exposure is performed on the abnormal monitoring result a1, and convergence exposure, island isolation and global ban operations are performed on the abnormal monitoring result.

[0130] In this embodiment, isolation groups are preset for managed workloads. For example, workload b1 is moved into the preset isolation group when it is determined that an attack event occurs, and is removed from the isolation group after the attack is processed.

[0131] In this embodiment, a blacklist policy template is preset for unmanaged workloads. For example, if an attack occurs on unmanaged workload c1 with IP address d1, the corresponding IP address d1 will be added to the blacklist, prohibiting workload c1 from accessing data. The ban time is determined by the attack characteristics and can be 24 hours or permanent.

[0132] In this embodiment, the blacklist may be provided by a unified service bus USB. The unified service bus USB refers to an application platform for processing service intercommunication and management between systems, and is used to achieve cross-system, cross-protocol, and cross-network service capability intercommunication.

[0133] The beneficial effects of the above technical solution are: by identifying the attack source and the compromised assets, presetting the isolation group and the blacklist, it effectively realizes the one-click isolation or blocking of the attack source and the compromised assets, thereby improving the security of network access.

[0134] An embodiment of the present invention provides an EBPF-based network access security control system, an EBPF network data packet module, including:

[0135] The network data packet capture unit is used to initialize the network card device, create physical memory space as a buffer area for network data packets, and establish a mapping relationship between data and corresponding buffer areas;

[0136] When the network card device receives a network data packet, it stores each network data packet in the corresponding data buffer area according to the mapping relationship between the data and the corresponding buffer area, and notifies the processor to read the corresponding data through a hardware interrupt to perform a packet receiving operation;

[0137] When it is determined that the packet receiving operation is completed, the network data packet that has been received is intercepted, transmitted to the XDP program for analysis and processing, and the corresponding network data packet direction is executed, wherein the network data packet direction includes: transmission to the upper layer protocol stack of the kernel, network data packet discarding, network data packet transmission to the upper layer protocol stack of the kernel, and network data packet redirection;

[0138] The network data packet analysis unit is used to detect the legitimacy of the network data packets in the XDP program according to the preset map and preset analysis rules, and when the network data packets are determined to be illegal, the network data packets are discarded;

[0139] Perform IP data analysis on the network data packets that are determined to be legal, extract the IP data packets, and insert the ID data for processing, wherein the IP data packets include: source IP address, destination IP address, service type, protocol type and IP data packet length;

[0140] Extract the protocol type from the IP data packet, release the network data packets whose protocol type is not within the analysis target protocol range, and transmit the remaining network data packets according to the source IP address;

[0141] The network data packet transmission unit is used to transmit the network data packet according to the preset map. When it is detected that the map rule file is updated, a new network data packet is transmitted to update the preset map rule.

[0142] Perform transmission tests on network data packets, obtain network data packets corresponding to access traffic within a preset time period, and perform data cleaning to remove invalid data packets from the network data packets;

[0143] Extract features from the remaining network data packets, and when the feature similarity of the remaining network data packets is greater than a preset similarity, merge the corresponding remaining network data packets;

[0144] Based on the difficulty of extracting each feature and the weight of each feature's impact on whether the access traffic is normal, a feature score is calculated for each feature, and the top n1 features with the highest feature scores are selected for data transmission test analysis.

[0145] An iterative processing unit is used to construct a network transmission model and perform parameter initialization processing, determine the corresponding state distribution probability and state transition probability according to the access traffic state, and determine the occurrence probability of the top n1 features in the score, and iterate the network transmission model;

[0146] Obtaining a detection rate and a false alarm rate of the iteratively processed network transmission model; when both the detection rate and the false alarm rate meet preset data transmission requirements, determining that the iteratively processed network transmission model accurately identifies normal access traffic and abnormal access traffic; and outputting the iteratively processed network transmission model for application in actual network data packet transmission;

[0147] The network data packet storage unit is used to store the transmitted network data packets according to the preset storage template, and at the same time, store the updated map data;

[0148] The network data packet display unit is used to obtain the original network data packet according to the XDP program, and perform corresponding data packet analysis and processing according to the user's access to the network data packet requirements, output the analysis and processing results to the management plane and display the data.

[0149] In this embodiment, the network data packet consists of a header and data, and has a layered structure, starting from the link layer and going up to the network layer, transport layer and application layer. For example, the data packet of the link layer consists of: the MAC frame header and the data part of the MAC frame; the data packet of the network layer consists of: the IP header and the data part of the IP datagram.

[0150] In this embodiment, a physical memory space is created as a buffer area for network data packets, and a mapping relationship between data and the corresponding buffer area is established. For example, a physical memory space a1 is created as a buffer area for network data packets, and a mapping relationship between data and the corresponding buffer area is established. Class b1 network data packets are stored in the c1 area of ​​the physical memory space a1, and class b2 network data packets are stored in the c2 area of ​​the physical memory space a1.

[0151] In this embodiment, the packet receiving operation refers to a hardware interrupt notifying the processor to read corresponding data, wherein the network card executes a hard interrupt function, and the CPU executes a soft interrupt function to copy data from the data buffer area and transmit it to the kernel protocol stack.

[0152] In this embodiment, XDP refers to a kernel-mode, high-performance, programmable BPF packet processing platform that can provide processing capabilities for network data packets; the XDP program is an EBPF program that can directly obtain network data packets from the receiving buffer area and modify and make corresponding decisions to achieve efficient network data packet processing.

[0153] In this embodiment, a preset map and preset analysis rules are used to determine the legitimacy of a data packet. The map is implemented in the kernel through a hash table and is used for data reading or writing. The map technology can achieve efficient data transmission between the EBPF program and the user space.

[0154] In this embodiment, the network data packets in the XDP program are checked for legitimacy based on a preset map and preset analysis rules. For example, the legitimacy of the data packet is determined by comparing and analyzing the data packet pointer offset and the end of the data packet, and the legitimacy of the data packet is determined by extracting the IP data packet to determine whether it is the IP protocol.

[0155] In this embodiment, IP data parsing is performed to determine the source of the access request from the access end. For example, if the IP data parsing determines that the source of the access request is an external request, black and white list filtering and micro-isolation policy mode processing are performed.

[0156] In this embodiment, IP data is parsed, IP data packets are extracted, and ID data is inserted for processing. When unauthorized access is enabled, signature checks are performed only on ID data, and subsequent authorization checks are passed directly. When unauthorized access is not enabled, authorization checks on IP data and ID data are performed.

[0157] In this embodiment, signature checking refers to making a legal judgment on user access and determining whether the user access is a forged access request.

[0158] In this embodiment, the network data packet transmission process needs to consider the security and stability of data transmission, and at the same time, it needs to ensure data transmission efficiency, and data transmission does not affect system performance. Therefore, the network data packet transmission process requires data transmission testing.

[0159] In this embodiment, when the feature similarity of the remaining network data packets is greater than the preset similarity, for example, the feature similarity of network data packet b1 and network data packet b2 is greater than the preset similarity, network data packet b1 and network data packet b2 are merged.

[0160] In this embodiment, a feature score is calculated for each feature based on its extraction difficulty and the weight of its impact on the normality of access traffic. For example, the ID feature has an extraction difficulty of 0.1 and an impact weight of 0.3; the source address feature has an extraction difficulty of 0.3 and an impact weight of 0.2; and the service feature has an extraction difficulty of 0.2 and an impact weight of 0.1.

[0161] In this embodiment, when the detection rate and the false alarm rate both meet the preset data transmission requirements, where the detection rate = the number of detected attacks / the total number of attacks, and the false alarm rate = (the total number of alarms - the number of correct alarms) / the total number of alarms, for example, when the detection rate is higher than 0.8 and the false alarm rate is lower than 0.1, it is determined that the iteratively processed network transmission model accurately identifies normal access traffic and abnormal access traffic, and the iteratively processed network transmission model is output and applied to actual network data packet transmission.

[0162] In this embodiment, the analysis and processing results are output to the management plane and data is displayed, such as original data packet display, data packet analysis result display, data packet merging display, and data packet direction display.

[0163] The beneficial effects of the above technical solution are: by capturing, analyzing, transmitting, iteratively processing, storing and displaying network data packets, it is possible to efficiently insert identity information into network data packets, further improving the security of network behavior access control, and at the same time, improving network access processing efficiency and data element circulation and transaction efficiency.

[0164] An embodiment of the present invention provides an EBPF-based network access security control system, an iterative processing unit, configured to:

[0165] ; Wherein, F is the network transmission model; N01(ai1, Aj1) is the number of access traffic states at the corresponding moment that change to traffic state Aj1 when the i1th feature ai1 changes; bi1 is the probability of observing the i1th feature when the corresponding traffic state Aj1 appears; cj1 is the number of occurrences of the corresponding traffic state Aj1; c2 is the total number of occurrences of each traffic state; S is the preset number of iterative processing times of the network transmission model; n1 is the number of features with the first n1 selected feature scores; m1 is the number of traffic state types that may appear in the access traffic during network transmission; is the network transmission function; 1 is the state transition probability function; A02 is the state distribution probability function; A03 is the initial state probability function.

[0166] In this embodiment, the traffic state, for example, is divided into four categories according to the port exposure score of the access traffic: when the port exposure score is 0-10, the traffic state is normal; when the port exposure score is 11-30, the traffic state is pre-attack; when the port exposure score is 31-50, the traffic state is attack; when the port exposure score is higher than 50, the traffic state is compromised; the pre-attack, attack, and compromised states are all abnormal states.

[0167] In this embodiment, the top n1 features with the highest feature scores are selected, for example, features of ID, IP address, source address, destination address, service, source port, and destination port.

[0168] In this embodiment, the sum of the initial state probability functions of the network transmission model is no greater than 1.

[0169] The beneficial effect of the above technical solution is: by determining the corresponding state distribution probability and state transition probability according to the access traffic status, and determining the probability of occurrence of the features before the score n1, the network transmission model is iteratively processed, which is conducive to accurately identifying the network access status, ensuring the security of network access, and protecting the security of data element circulation transactions.

[0170] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A network access security control system based on EBPF, characterized in that: include: The data collection module is used to obtain network logs, insert identity information into each network data packet based on EBPF technology, and collect business data from the configuration management database and asset management system; The multi-dimensional correlation module is used to perform multi-perspective visual correlation analysis on network access, analyze and process each access terminal according to the preset network access rules, and determine the access data of each access terminal; The access control module is used to perform a primary risk identification of the exposure surface based on the access data of each access terminal, determine the port exposure score of each access terminal, and execute the corresponding micro-isolation policy mode in combination with EBPF technology. When it is determined that the execution of each micro-isolation policy mode is completed, a secondary risk identification is performed on each access terminal to obtain the secondary risk identification results of each access terminal; The monitoring and blocking module is used to mark and monitor abnormalities for each access terminal whose secondary risk identification results do not conform to the micro-isolation policy model execution results, and to implement corresponding control policies and isolation and blocking measures based on the abnormal monitoring results; Access control module, including: A risk identification unit is used to perform a primary risk identification of the exposure surface based on the access data of each access terminal and determine the port exposure surface score of each access terminal, where the port exposure surface score = the number of exposed ports × the number of access sources; A trend determination unit is used to determine the actual exposure convergence trend of each access point based on the port exposure score of each access point determined in real time, and to implement the corresponding micro-segmentation policy mode by combining the calculated exposure convergence trend and EBPF technology; The secondary risk identification unit is used to perform secondary risk identification on each access terminal after determining that each micro-isolation policy mode has been executed, and obtain the secondary risk identification results of each access terminal.

2. The network access security control system based on EBPF according to claim 1, characterized in that: Data collection module, including: The data connection unit is used to monitor the workload of each access terminal in real time, collect network logs according to a preset network log collection method, and aggregate the connection relationship of each access terminal according to a preset data aggregation node to obtain a network connection relationship based on the network log; Using EBPF technology, identity information is inserted into each network data packet, and the identity information is mapped with the IP address and service to obtain the labeled service connection relationship; The business data collection unit is used to collect business data from the configuration management database and the asset management system according to the business connection relationship, and to perform data analysis and IP address decoupling processing on each network data packet based on the business label, and establish a mapping relationship from IP address to identity information.

3. The network access security control system based on EBPF according to claim 1, characterized in that: Multidimensional association module, including: The correlation analysis unit is used to set east-west network access correlation analysis for business assets based on preset analysis algorithms and preset analysis perspectives, and perform multi-perspective visual correlation analysis on network access at each access point. The multi-perspective visual correlation analysis includes: global business topology, global access analysis, business detail analysis, and workload detail analysis; The access data unit is used to build a compliance access baseline based on business connection relationships, continuously optimize the compliance access baseline, and summarize the continuously optimized compliance access baseline as a preset network access rule; When monitoring Nginx / web server access to the DB server, each access end is analyzed and processed according to the preset network access rules. When it is determined that the access complies with the preset network access rules, a compliant access connection is established, and the corresponding access end is allowed to perform multi-dimensional custom correlation analysis to determine the corresponding access data; Otherwise, a violation connection flag is added and access to the data is prohibited.

4. The network access security control system based on EBPF according to claim 1, characterized in that: Monitoring and banning modules, including: Anomaly monitoring unit, used to perform black feature attack detection based on threat signatures and white feature anomaly detection based on service baselines on each access terminal marked as abnormal; When black feature attack detection based on threat signatures determines that there is a threat, or when white feature anomaly detection based on business baselines detects a baseline deviation that violates normal business, the system executes the corresponding alarm level alarm data based on the fully definable anomaly detection model, monitors and analyzes the operation anomaly, determines the abnormal event type based on the preset event rules, and executes the corresponding event alarm data; A false alarm elimination unit is used to simulate and calculate the alarm data of the corresponding alarm level and the corresponding event alarm data, adjust the relevant options of the event rules based on the comparison value and calculation value analysis of the data hitting the event rules, and eliminate a set of specific access sources, access purposes, access services and access characteristics to avoid false alarms of normal business access behavior; The anomaly control unit is used to classify the anomaly monitoring results based on practical experience and determine the attack characteristics of each anomaly monitoring result.

5. The network access security control system based on EBPF according to claim 4, characterized in that: The monitoring and ban module also includes: The event alarm control unit is used to identify attack sources and compromised assets based on the attack characteristics of each abnormal monitoring result. It also implements corresponding refined policy management for each abnormal monitoring result based on policy rules and policy scope. The control policies include: convergence exposure, island isolation, and global ban. The attack source handling unit is used to perform one-click isolation or blocking of the attack source and compromised assets based on the preset isolation group for managed workloads and the preset blacklist policy template for unmanaged workloads.

6. The network access security control system based on EBPF according to claim 1, characterized in that: Also includes: EBPF network packet module, including: The network data packet capture unit is used to initialize the network card device, create physical memory space as a buffer area for network data packets, and establish a mapping relationship between data and corresponding buffer areas; When the network card device receives a network data packet, it stores each network data packet in the corresponding data buffer area according to the mapping relationship between the data and the corresponding buffer area, and notifies the processor to read the corresponding data through a hardware interrupt to perform a packet receiving operation; When it is determined that the packet receiving operation is completed, the network data packet that has been received is intercepted, transmitted to the XDP program for analysis and processing, and the corresponding network data packet direction is executed, wherein the network data packet direction includes: transmission to the upper layer protocol stack of the kernel, network data packet discarding, network data packet transmission to the upper layer protocol stack of the kernel, and network data packet redirection; The network data packet analysis unit is used to detect the legitimacy of the network data packets in the XDP program according to the preset map and preset analysis rules, and when the network data packets are determined to be illegal, the network data packets are discarded; Perform IP data analysis on the network data packets that are determined to be legal, extract the IP data packets, and insert the ID data for processing, wherein the IP data packets include: source IP address, destination IP address, service type, protocol type and IP data packet length; Extract the protocol type from the IP data packet, release the network data packets whose protocol type is not within the analysis target protocol range, and transmit the remaining network data packets according to the source IP address; The network data packet transmission unit is used to transmit the network data packet according to the preset map. When it is detected that the map rule file is updated, a new network data packet is transmitted to update the preset map rule. Perform transmission tests on network data packets, obtain network data packets corresponding to access traffic within a preset time period, and perform data cleaning to remove invalid data packets from the network data packets; Extract features from the remaining network data packets, and when the feature similarity of the remaining network data packets is greater than a preset similarity, merge the corresponding remaining network data packets; Based on the difficulty of extracting each feature and the weight of each feature's impact on whether the access traffic is normal, a feature score is calculated for each feature, and the top n1 features with the highest feature scores are selected for data transmission test analysis. An iterative processing unit is used to construct a network transmission model and perform parameter initialization processing, determine the corresponding state distribution probability and state transition probability according to the access traffic state, and determine the occurrence probability of the top n1 features in the score, and iterate the network transmission model; Obtaining a detection rate and a false alarm rate of the iteratively processed network transmission model; when both the detection rate and the false alarm rate meet preset data transmission requirements, determining that the iteratively processed network transmission model accurately identifies normal access traffic and abnormal access traffic; and outputting the iteratively processed network transmission model for application in actual network data packet transmission; The network data packet storage unit is used to store the transmitted network data packets according to the preset storage template, and at the same time, store the updated map data; The network data packet display unit is used to obtain the original network data packet according to the XDP program, and perform corresponding data packet analysis and processing according to the user's access to the network data packet requirements, output the analysis and processing results to the management plane and display the data.

7. The network access security control system based on EBPF according to claim 6, characterized in that: Iterative processing unit, used to: ; Wherein, F is the network transmission model; N01(ai1, Aj1) is the number of access traffic states at the corresponding moment that change to traffic state Aj1 when the i1th feature ai1 changes; bi1 is the probability of observing the i1th feature when the corresponding traffic state Aj1 appears; cj1 is the number of occurrences of the corresponding traffic state Aj1; c2 is the total number of occurrences of each traffic state; S is the preset number of iterative processing times of the network transmission model; n1 is the number of features with the first n1 selected feature scores; m1 is the number of traffic state types that may appear in the access traffic during network transmission; is the network transmission function; A01 is the state transition probability function; A02 is the state distribution probability function; A03 is the initial state probability function.

Images