Situation awareness processing method, electronic equipment, medium and program product

Abstract

The present application relates to the technical field of situational awareness processing, and in particular to a situational awareness processing method, electronic equipment, medium and program product, the method comprising obtaining data to be processed, the data to be processed being the operation data corresponding to the device to be processed at different functional nodes; identifying the data features corresponding to each functional node from the data to be processed, and judging whether there is an abnormal functional node based on the preset threat features, the abnormal functional node being a functional node containing the preset threat features in the corresponding data features; identifying the abnormal node identifier corresponding to each abnormal functional node, and determining the node threat portrait corresponding to the abnormal functional node based on the abnormal node identifier and the preset threat features contained; constructing a security threat concept tree based on each abnormal functional node and the node threat portrait corresponding to each abnormal functional node, and feeding back the security threat concept tree according to the preset feedback frequency. The present application can improve the accuracy of determining security threats.

Description

Technical Field

[0001] The present application relates to the technical field of situational awareness processing, and in particular to a situational awareness processing method, electronic equipment, medium and program product. Background Art

[0002] Security threats refer to the damage caused by a person, object, time or concept to the confidentiality, integrity, availability or legitimacy of a data asset. Security threats are becoming increasingly serious. They not only come from external hacker attacks, virus or worm infections, but also from internal drive-by downloads and phishing attacks. For example, by forging emails, websites, etc., users are tricked into clicking on malicious links or downloading attachments, thereby obtaining sensitive information on the user side, such as account passwords, bank card information, etc.

[0003] Security threats can have a direct impact on the security of personal or organizational data assets, which may cause significant property or resource losses to users. Related technologies generally use manual classification and integration of various types of data, and then determine security threats based on the classification and integration results. However, due to the various manifestations of abnormal network behavior, for example, security threat data may come from network traffic, log files, user behavior, etc., when manually classifying and integrating large amounts of various types of data, the classification and integration results may be less accurate, which may lead to lower accuracy in determining security threats. Summary of the invention

[0004] In order to improve the accuracy of determining security threats, the present application provides a situational awareness processing method, electronic device, medium and program product.

[0005] In the first aspect, the present application provides a situation awareness processing method, which adopts the following technical solution:

[0006] A situation awareness processing method, comprising:

[0007] Acquire the data to be processed, where the data to be processed is the operation data corresponding to the device to be processed at different functional nodes;

[0008] Identify the data features corresponding to each function node from the data to be processed, and determine whether there is an abnormal function node based on the preset threat features, where the abnormal function node is a function node whose corresponding data features contain the preset threat features;

[0009] Identify the abnormal node identifier corresponding to each abnormal function node, and determine the node threat profile corresponding to the abnormal function node based on the abnormal node identifier and the included preset threat features;

[0010] Based on each abnormal function node and the node threat portrait corresponding to each abnormal function node, a security threat concept tree is constructed, and the security threat concept tree is fed back according to a preset feedback frequency.

[0011] By adopting the above technical solution, since different functional nodes generate different data when facing security threats, it is convenient to improve the diversity and comprehensiveness of data sources by obtaining the corresponding operating data at multiple functional nodes, so as to provide rich data support for subsequent data analysis and identification of security threats. Secondly, the functional nodes are filtered by preset threat characteristics to obtain abnormal functional nodes containing preset threat characteristics, which is convenient to reduce the amount of data in the data analysis process and can improve the pertinence and effectiveness of the data integration process. In addition, by constructing a node threat portrait corresponding to each abnormal functional node, and then constructing a security threat concept tree based on the node threat portrait, and providing feedback according to the preset feedback frequency, it is convenient to timely discover and display the correlation between each abnormal functional node, so as to provide more comprehensive and effective integrated data for the subsequent determination of security threats, and then to improve the accuracy of determining security threats.

[0012] In a possible implementation manner, after constructing the security threat concept tree, the method further includes:

[0013] Obtaining an operation log of each abnormal function node within a first preset time period, and identifying a plurality of operation features contained in each operation log;

[0014] Determine a preset simulation model corresponding to each abnormal function node according to the abnormal node identifier corresponding to each abnormal function node and the simulation mapping relationship, wherein the simulation mapping relationship is a corresponding relationship between the abnormal node identifier and the preset simulation model;

[0015] Based on multiple operation features corresponding to each abnormal function node and a preset simulation model, simulating the attack process of each abnormal function node within a second preset time period to obtain a simulated attack image of each abnormal function node;

[0016] The simulated attack image of each abnormal function node is superimposed on the security threat concept tree to form a visual concept tree.

[0017] By adopting the above technical solution, by analyzing the operating characteristics of the abnormal function nodes within the first preset time period, and based on the operating characteristics of each abnormal function node and the preset simulation model, the attack process is simulated and a simulated attack image is generated, that is, the attack process is visualized to more intuitively display the state and behavior of the abnormal function node when attacked, and then a visual concept tree is formed by image superposition. The visualization method helps relevant analysts to more comprehensively understand the security status of the equipment to be processed, and also provides strong support for subsequent decision-making and response.

[0018] In a possible implementation, superimposing the simulated attack image of each abnormal function node into the security threat concept tree includes:

[0019] From the simulated attack images of each abnormal function node in the second preset time period, obtain a target simulated attack image of each abnormal function node, each target simulated image being a simulated attack image corresponding to the corresponding abnormal function node at the last moment in the second preset time period;

[0020] The simulated attack image of each abnormal function node is determined as a display image, the target simulated attack image of each abnormal function node is determined as a cover image, and the display image and the corresponding cover image of each abnormal function node are superimposed on the security threat concept tree.

[0021] By adopting the above technical solution, by obtaining the target simulated attack image of each abnormal function node within the second preset time period, that is, the simulated attack image corresponding to the last moment, it is possible to focus on the key states in the attack process. Since these key states can often reveal the final result or the most serious result of the attack behavior, it is helpful for relevant visitors to quickly understand the final impact of the attack. In addition, the cover image, as a representative of each abnormal function node, can quickly attract the attention of relevant visitors, and the display image can provide a detailed attack process. The combination of the two makes it easier to understand the visual concept tree.

[0022] In a possible implementation, when there is an associated abnormal function node in the security threat concept tree, the method further includes:

[0023] Obtaining an associated simulated attack image corresponding to each associated abnormal function node, and identifying attack features in each associated simulated attack image;

[0024] Matching the attack features corresponding to each associated abnormal function node to determine a target abnormal group, wherein the target abnormal group includes at least two associated abnormal function nodes, and the matching value of the attack features between the at least two associated abnormal function nodes is higher than a preset matching value;

[0025] Alarm information is generated based on the target abnormal group, and the alarm information is fed back.

[0026] By adopting the above technical solution, by comparing the similarity of attack features between different abnormal function nodes, it is convenient to deeply analyze the correlation between abnormal function nodes and the similarity of attack behaviors, and determine the target abnormal group based on this. Once the target abnormal group is determined, there is no need to wait for the arrival of the preset feedback frequency, but feedback can be directly provided, so that relevant processing personnel can be aware of potential security threats in the first place and quickly take corresponding countermeasures, thereby reducing the risks and losses caused by security threats.

[0027] In a possible implementation, the generating of alarm information based on the target abnormal group includes:

[0028] Importing the security threat concept tree into a preset coordinate system, and determining the node coordinates of each associated abnormal function node in the target abnormal group;

[0029] Determine the influence range according to the coordinates of each node, and determine other function nodes included in the influence range as influencing function nodes;

[0030] Alarm information is generated according to the target abnormal group and the affected functional node.

[0031] By adopting the above technical solution, the corresponding impact range can be accurately determined according to the node coordinates of each associated abnormal functional node. In this way, it is easy to identify other functional nodes that may pose security threats. Finally, by incorporating other functional nodes included in the impact range into the generation process of alarm information, it can be ensured that the alarm information covers a wider range of security threats, thereby helping to avoid missing functional nodes that may pose security threats, and further facilitating the improvement of the comprehensiveness and accuracy of the alarm information.

[0032] In one possible implementation, the method further includes:

[0033] Identify the association relationship between the associated abnormal function nodes, which includes parallel relationship and parent-child relationship;

[0034] Sort the associated abnormal function nodes with a parent-child relationship to obtain an abnormal path, and determine a non-abnormal child node from the security threat concept tree according to the abnormal path;

[0035] A defense suggestion is generated according to the attack features corresponding to the associated abnormal function nodes having the parent-child relationship, and the defense suggestion and the non-abnormal child nodes are fed back.

[0036] By adopting the above technical solution, defense suggestions are generated according to the attack characteristics corresponding to the associated abnormal function nodes with parent-child relationships, which is highly targeted and practical. By feeding back the defense suggestions and the non-abnormal child nodes, it is convenient to improve the corresponding defense capabilities of the non-abnormal child nodes in a targeted manner, thereby facilitating reducing the probability of abnormalities occurring in the non-abnormal child nodes.

[0037] In a second aspect, the present application provides an electronic device, which adopts the following technical solution:

[0038] An electronic device, comprising:

[0039] at least one processor;

[0040] Memory;

[0041] At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the above situation awareness processing method.

[0042] In a third aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0043] A computer-readable storage medium includes: a computer program that can be loaded by a processor and execute the above situation awareness processing method.

[0044] In a fourth aspect, the present application provides a computer program product, which adopts the following technical solution:

[0045] A computer program product comprises a computer program, wherein when the computer program is executed by a processor, the situation awareness processing method is implemented.

[0046] In summary, the present application includes at least one of the following beneficial technical effects:

[0047] Since different functional nodes generate different data when facing security threats, obtaining the corresponding operating data at multiple functional nodes is convenient for improving the diversity and comprehensiveness of data sources, thereby facilitating the provision of rich data support for subsequent data analysis and identification of security threats. Secondly, the functional nodes are filtered through preset threat features to obtain abnormal functional nodes containing preset threat features, which is convenient for reducing the amount of data in the data analysis process and can improve the pertinence and effectiveness of the data integration process. In addition, by constructing a node threat portrait corresponding to each abnormal functional node, and then constructing a security threat concept tree based on the node threat portrait, and providing feedback according to the preset feedback frequency, it is convenient to timely discover and display the correlation between each abnormal functional node, so as to provide more comprehensive and effective integrated data for the subsequent determination of security threats, thereby facilitating the improvement of the accuracy of determining security threats.

[0048] By analyzing the operational characteristics of the abnormal function nodes within the first preset time period, and based on the operational characteristics of each abnormal function node and the preset simulation model, the attack process is simulated and a simulated attack image is generated, that is, the attack process is visualized to more intuitively display the state and behavior of the abnormal function nodes when attacked, and then a visual concept tree is formed by image superposition. The visualization method helps relevant analysts to more comprehensively grasp the security status of the equipment to be processed, and also provides strong support for subsequent decision-making and response. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a flow chart of a situation awareness processing method in an embodiment of the present application;

[0050] Figure 2 It is a schematic diagram of a construction process of a security threat concept tree in an embodiment of the present application;

[0051] Figure 3 This is a schematic diagram of an abnormal path in an embodiment of the present application;

[0052] Figure 4 It is a structural schematic diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The following is combined with Figure 1-4 This application is described in further detail.

[0054] After reading this specification, those skilled in the art may make non-creative modifications to this embodiment as needed, but such modifications are protected by patent law as long as they are within the scope of the claims of this application.

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0056] Specifically, the embodiment of the present application provides a situational awareness processing method, which is executed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present application.

[0057] refer to Figure 1 , Figure 1 : is a flow chart of a situation awareness processing method in an embodiment of the present application, the method includes steps S110 to S140, wherein:

[0058] Step S110: Acquire the data to be processed, where the data to be processed is the corresponding operation data of the device to be processed at different functional nodes.

[0059] Specifically, situational awareness processing is a technology that can monitor, analyze and understand the status, activities and trends of various factors in a specific environment or system. Situational awareness processing technology is crucial to the security, stability and efficiency of the system or equipment. The device to be processed can be a network security device. Network security equipment is the first line of defense for network security. It can detect and analyze network traffic in real time to timely discover and respond to various network attacks and threats, such as firewalls, intrusion detection devices, intrusion prevention devices, Web application firewalls, etc.; it can also be a data center and a cloud computing platform. Situational awareness processing technology can help data centers and cloud computing platforms monitor the operating status and security status of the system in real time. The specific device to be processed is not specifically limited in the embodiments of this application, as long as the device to be processed needs to be monitored for risks.

[0060] Since a device is often composed of multiple different functional modules or components, each functional module or component is responsible for different functions or tasks, the device to be processed corresponds to multiple functional nodes. The data generated by each functional node during normal operation is the operating data. The data to be processed includes the specific device to be processed and the operating data generated by different functional nodes of the device to be processed during operation. Since different devices to be processed can realize different functions, the number of functional nodes contained in different devices to be processed is also different.

[0061] Step S120: Identify the data features corresponding to each functional node from the data to be processed, and determine whether there is an abnormal functional node based on the preset threat features. The abnormal functional node is a functional node whose corresponding data features contain the preset threat features.

[0062] Specifically, for any functional node, data feature extraction is to extract key information that can represent its operating status and performance from the operating data of the functional node. Data features include but are not limited to statistical features, timing features, behavioral features, association features, etc., among which statistical features are calculated for the statistics of the operating data corresponding to the current functional node, such as mean, standard deviation, maximum value, etc., to reflect the distribution and changes of the operating data; timing features can extract time-related features, such as periodicity, trend, etc.; behavioral features can be used to analyze the behavioral patterns of functional nodes, such as access frequency, response time, error rate, etc.; association features are used to consider the association relationship between functional nodes, such as data transmission volume, request frequency, etc.

[0063] The preset threat features can be determined by relevant staff based on historical threat data and uploaded to the electronic device. The preset threat features can be abnormal access patterns, signs of data leakage, malicious code activities, etc. The specific preset threat features are not specifically limited in the embodiments of this application and can be regularly updated by relevant staff based on actual needs. After identifying the data features corresponding to each functional node, each data feature is compared with the preset threat features. When the preset threat features appear in the data features, the corresponding functional node is determined to be an abnormal functional node.

[0064] Step S130: Identify the abnormal node identifier corresponding to each abnormal function node, and determine the node threat portrait corresponding to the abnormal function node based on the abnormal node identifier and the included preset threat features.

[0065] Specifically, the abnormal node identifier can be a preset character or a preset mark, as long as it can distinguish the abnormal function node from the non-abnormal function node, and the specific abnormal node identifier is not specifically limited in the embodiment of the present application. After the abnormal function node is determined, the source, purpose, propagation method, etc. of the preset threat feature corresponding to the abnormal function node are determined according to the preset threat feature and the preset basic information mapping relationship corresponding to the abnormal function node. The preset basic information mapping relationship contains the preset basic information corresponding to each preset threat feature. The node threat portrait of the abnormal function node is constructed according to the preset basic information corresponding to the abnormal function node. The node threat portrait can be used to comprehensively describe the abnormal function node. The node threat portrait can be in the form of text description, chart, visual interface, etc. The specific form is not specifically limited in the embodiment of the present application, as long as it can be easily understood and viewed by relevant staff. Since the node threat portrait is determined based on the operating data corresponding to the abnormal function node, the node threat portrait corresponding to the abnormal function node may also change with the update of the operating data, that is, the node threat portrait may need to be continuously updated.

[0066] Step S140: construct a security threat concept tree based on each abnormal function node and the node threat portrait corresponding to each abnormal function node, and feedback the security threat concept tree according to a preset feedback frequency.

[0067] Specifically, the security threat concept tree contains all abnormal function nodes of the device to be processed, and the node threat image corresponding to each abnormal function node. Since different abnormal function nodes may have an association relationship, before constructing the security threat concept tree based on multiple abnormal function nodes, the position of each abnormal function node in the security threat concept tree can be determined according to the preset hierarchical relationship, wherein the preset hierarchical relationship can be determined by relevant staff based on the existing security threat knowledge base and expert experience and then uploaded to the electronic device. After determining the node position of each abnormal function node, the corresponding node threat portrait is added to the corresponding node position, and then the tree structure is formed by connecting each abnormal function node.

[0068] The preset feedback frequency is regular feedback, for example, feedback once an hour, once a day, once a week, etc. The specific feedback frequency is not specifically limited in the embodiment of the present application. The successfully constructed security threat concept tree can be fed back to the terminal device of the relevant staff according to the preset feedback frequency.

[0069] For the embodiments of the present application, since different functional nodes generate different data when facing security threats, it is convenient to improve the diversity and comprehensiveness of data sources by obtaining the corresponding operating data at multiple functional nodes, so as to provide rich data support for subsequent data analysis and identification of security threats. Secondly, the functional nodes are filtered by preset threat characteristics to obtain abnormal functional nodes containing preset threat characteristics, which is convenient to reduce the amount of data in the data analysis process and can improve the pertinence and effectiveness of the data integration process. In addition, by constructing a node threat portrait corresponding to each abnormal functional node, and then constructing a security threat concept tree based on the node threat portrait, and providing feedback according to the preset feedback frequency, it is convenient to timely discover and display the correlation between each abnormal functional node, so as to provide more comprehensive and effective integrated data for the subsequent determination of security threats, and then it is convenient to improve the accuracy of determining security threats.

[0070] Furthermore, after constructing the security threat concept tree, steps S1 to S4 are also included, such as Figure 2 As shown, where:

[0071] Step S1: Obtain the operation log of each abnormal function node within a first preset time period, and identify multiple operation features contained in each operation log.

[0072] Specifically, the first preset time period can be 3 minutes or 5 minutes before the function node is determined to be an abnormal function node. The specific duration is not specifically limited in the embodiment of the present application and can be set by relevant technical personnel. The operation log can be intercepted from the system log according to the first preset time period. The operation log contains all the operation data of the corresponding abnormal function node in the first preset time period. The operation feature is used to describe the operation data. According to the operation feature, it is convenient to determine the behavior of the abnormal function node in the first preset time period. When identifying the operation feature from the operation log, the operation log can be analyzed one by one according to the preset feature extraction rules to determine the operation features contained in each operation log. The operation features include but are not limited to the operation type, operation time, operation object and operation result. Finally, multiple operation features corresponding to each abnormal function node can be obtained.

[0073] Step S2: Determine the preset simulation model corresponding to each abnormal function node according to the abnormal node identifier corresponding to each abnormal function node and the simulation mapping relationship, where the simulation mapping relationship is the corresponding relationship between the abnormal node identifier and the preset simulation model.

[0074] Specifically, since different functional nodes can realize different functions, and similarly, each abnormal functional node can realize different functions, therefore, the preset simulation models corresponding to different abnormal functional nodes are also different, and different preset simulation models contain different simulation function components. The preset simulation model corresponding to each abnormal functional node can be determined from the simulation mapping relationship through the abnormal node identification, and the simulation mapping relationship contains preset simulation models corresponding to different abnormal node identifications. The specific content of the simulation mapping relationship is not specifically limited in the embodiment of the present application, and can be determined by relevant staff based on historical experience data and then uploaded to the electronic device. According to the preset simulation model corresponding to each abnormal functional node, the operation of the corresponding abnormal functional node can be simulated.

[0075] The preset simulation model corresponding to each abnormal function node is used for simulation operation, instead of replacing the simulation components on the basis of the same preset standard simulation model and then determining the preset simulation model corresponding to each abnormal function node. This reduces the number of replacement and adjustment of simulation components and facilitates improving the efficiency of simulation operation.

[0076] Step S3: Based on the multiple operation features corresponding to each abnormal function node and the preset simulation model, the attack process of each abnormal function node within the second preset time period is simulated to obtain a simulated attack image of each abnormal function node.

[0077] Specifically, multiple operation features are bound to corresponding preset simulation models, that is, the corresponding preset simulation model is controlled to perform simulated operations based on multiple operation features, so as to restore the actual operation status of the abnormal function node. The second preset time period is a period of time after the current moment. The duration corresponding to the second preset time period can be 3 minutes or 5 minutes. The specific duration is not specifically limited in the embodiment of the present application and can be set by relevant technical personnel. The simulated attack image is an image corresponding to the simulated operation behavior corresponding to the second preset time period, that is, the simulated attack image can reflect the simulated operation behavior of the corresponding abnormal function node within the second preset time period.

[0078] Step S4: superimpose the simulated attack image of each abnormal function node into the security threat concept tree to form a visual concept tree.

[0079] Specifically, the node position of the corresponding abnormal function node in the security threat concept tree is located according to the node identifier corresponding to the abnormal function node, and then the corresponding simulated attack image is superimposed through AR technology. The formed visual concept tree contains each abnormal function node and the simulated attack image corresponding to each abnormal function node.

[0080] Furthermore, in order to improve the observability of the visual concept tree, the simulated attack image of each abnormal function node is superimposed on the security threat concept tree, which may specifically include:

[0081] From the simulated attack images of each abnormal function node within the second preset time period, obtain a target simulated attack image of each abnormal function node, each target simulated image being a simulated attack image corresponding to the corresponding abnormal function node at the last moment in the second preset time period; determine the simulated attack image of each abnormal function node as a display image, determine the target simulated attack image of each abnormal function node as a cover image, and superimpose the display image and the corresponding cover image of each abnormal function node into the security threat concept tree.

[0082] Specifically, according to the image frame extraction technology, the image frame corresponding to the last moment is extracted from the simulated attack image corresponding to the second preset time period, and it is determined as the target simulated attack image. When determining the target simulated attack image from the simulated attack image, the simulated attack image can be first sorted according to the time sequence, and the timestamp of each image frame is recorded, and the image frame corresponding to the latest timestamp is determined as the target simulated attack image. The method of determining the target simulated attack image is not specifically limited in the embodiment of the present application, as long as the target simulated attack image can be determined from the simulated attack image corresponding to the second preset time period. The simulated attack image corresponding to each abnormal function node is divided into a display image and a cover image, which is convenient for more intuitive display of the simulated attack image, wherein the display image is consistent with the simulated attack image, which is the operation process of simulating the abnormal function node in the second preset time period, and the cover image is the target simulated attack image, that is, the simulated image displayed at the last moment of the second preset time period. The display image and the cover image are superimposed on the security threat concept tree. When the mouse of the relevant visitor is detected to hover over the cover image, the display image corresponding to the cover image is automatically played. If the mouse of the relevant visitor is not detected to hover, only the cover image is displayed, which helps to improve the experience of the relevant visitor. As a representative of each abnormal function node, the cover image can quickly attract the attention of the relevant visitor, and the display image can provide a detailed attack process. The combination of the two makes it easier to understand the visual concept tree. In addition, the visualization method helps the relevant visitor to more comprehensively grasp the security status of the equipment to be processed, and also provides strong support for subsequent decision-making and response.

[0083] Furthermore, in order to reduce the risk and loss caused by security threats, when there is an associated abnormal function node in the security threat concept tree, it also includes:

[0084] Obtain an associated simulated attack image corresponding to each associated abnormal function node, and identify the attack features in each associated simulated attack image; match the attack features corresponding to each associated abnormal function node to determine a target abnormal group, wherein the target abnormal group contains at least two associated abnormal function nodes, and the matching value of the attack features between at least two associated abnormal function nodes is higher than a preset matching value; generate alarm information based on the target abnormal group, and feed back the alarm information.

[0085] Specifically, abnormal function nodes with an associated relationship are referred to as associated abnormal function nodes, and different associated abnormal function nodes may not have an associated relationship. For example, abnormal function node a1 and abnormal function node a2 have an associated relationship, and abnormal function node a1 and abnormal function node a2 can both be referred to as associated abnormal function nodes. Abnormal function node b1 and abnormal function node b2 have an associated relationship, and abnormal function node b1 and abnormal function node b2 can also be referred to as associated abnormal function nodes, but there is no associated relationship between abnormal function node a1 and abnormal function node b1.

[0086] Since there is an association relationship between the associated abnormal function nodes, when there is a security threat at a certain associated abnormal function node, that is, when there is an attack behavior, it is possible to first determine whether the other associated abnormal function nodes with the associated relationship also have the same or similar attack behaviors. For example, the attack feature 1 corresponding to the abnormal function node a1 and the attack feature 2 corresponding to the abnormal function node a2 can be identified. When the matching value between the attack feature 1 and the attack feature 2 is higher than the preset matching value, it indicates that the abnormal function nodes a1 and the abnormal function nodes a2 have the same or similar attack behaviors. At this time, the abnormal function nodes a1 and the abnormal function nodes a2 can be directly determined as the target abnormal group. Once the target abnormal group is determined, there is no need to wait for the preset feedback frequency to arrive, but feedback can be directly provided so that the relevant processing personnel can be informed of the potential security threats in the first place and quickly take corresponding countermeasures.

[0087] The associated abnormal function nodes with an associated relationship may not have the same or similar attack behaviors. For example, there is an associated relationship between the abnormal function node b1 and the abnormal function node b2, but because the matching degree between the attack feature 3 corresponding to the abnormal function node b1 and the attack feature 4 corresponding to the abnormal function node b2 is not higher than the preset matching value, the abnormal function node b1 and the abnormal function node b2 cannot constitute the target abnormal group. The preset matching value can be 85% or 95%, and the specific matching value is not specifically limited in the embodiments of the present application.

[0088] The attack feature in the simulated attack image corresponding to each associated abnormal function node degree is a feature that can characterize the attack behavior. The specific form is not specifically limited in the embodiments of the present application. The attack features corresponding to different attack behaviors can be determined through the behavior feature mapping relationship. The behavior feature mapping relationship contains attack features corresponding to different attack behaviors. The specific content can be adjusted by relevant technical personnel according to actual needs and is not specifically limited in the embodiments of the present application.

[0089] Furthermore, in order to improve the comprehensiveness and accuracy of the alarm information, the alarm information is generated based on the target abnormal group, including:

[0090] Import the security threat concept tree into the preset coordinate system to determine the node coordinates of each associated abnormal function node in the target abnormal group; determine the impact range based on each node coordinate, and determine other function nodes included in the impact range as impact function nodes; generate alarm information based on the target abnormal group and the impact function node.

[0091] Specifically, the preset coordinate system is a two-dimensional coordinate system, and the security threat concept tree is imported into the preset coordinate system, that is, each function node in the security threat concept tree is mapped to the preset coordinate system to obtain the node coordinates of each function node in the preset coordinate system. The node coordinates corresponding to each associated abnormal function node in the target abnormal group are obtained from multiple node coordinates, and the influence range corresponding to the target abnormal group is determined by connecting the node coordinates of each associated abnormal function node in the target abnormal group. The influence range may only include all associated abnormal function nodes in the corresponding target abnormal group, or may include other function nodes in addition to all associated abnormal function nodes in the corresponding target abnormal group. At this time, other function nodes other than all associated abnormal function nodes in the corresponding target abnormal group are determined as influence function nodes, and the influence function nodes may be abnormal function nodes or non-abnormal function nodes. In this way, it is easy to identify other function nodes that may have security threats. Finally, by incorporating other function nodes included in the influence range into the generation process of alarm information, it can be ensured that the alarm information covers a wider range of security threats, thereby helping to avoid missing function nodes that may have security threats.

[0092] Furthermore, in order to reduce the probability of abnormalities occurring in non-abnormal subnodes, the method provided by the present application further includes:

[0093] Identify the association relationship between associated abnormal function nodes, which includes parallel relationship and parent-child relationship; sort the associated abnormal function nodes with parent-child relationship to obtain abnormal path, and determine the non-abnormal child nodes from the security threat concept tree according to the abnormal path; generate defense suggestions according to the attack characteristics corresponding to the associated abnormal function nodes with parent-child relationship, and feedback the defense suggestions and non-abnormal child nodes.

[0094] Specifically, the non-abnormal child node is a subordinate node of the associated abnormal function node, that is, the non-abnormal child node and the associated abnormal function node have a parent-child relationship, such as Figure 3As shown, the association relationship between the associated abnormal function node A and the associated abnormal function node B is a parallel relationship, and the association relationship between the associated abnormal function node O and the associated abnormal function node B is a parent-child relationship. The method of identifying the association relationship between the associated abnormal function nodes can be through a hierarchical structure analysis method, a connecting line or pointer analysis method, and a deep information comparison method. The specific identification method is not specifically limited in the embodiment of the present application. When the deep information comparison method is used to identify the association relationship between the associated abnormal function nodes, the depth of each associated abnormal function node can be determined from the security threat concept tree. By comparing the depths between two associated abnormal function nodes, it can be determined whether there is a parent-child relationship between them. Usually, the depth of a child node is greater than the depth of its parent node.

[0095] After determining the associated abnormal function nodes with parent-child relationships, the nodes are sorted to obtain the abnormal path, for example, Figure 3 The association relationship between the associated abnormal function node O and the associated abnormal function node B is a parent-child relationship, and the association relationship between the associated abnormal function node B and the associated abnormal function node C is a parent-child relationship. After sorting the associated abnormal function node O, the associated abnormal function node B and the associated abnormal function node C, the abnormal path obtained is the associated abnormal function node O-associated abnormal function node B-associated abnormal function node C.

[0096] Import the determined abnormal path into the security threat concept tree to determine the non-abnormal child node corresponding to the abnormal path, such as Figure 3 As for the function node E in the abnormal path, since there is no abnormal situation in the function node E, that is, there is no attack behavior at the function node E, it is not included in the abnormal path when determining the abnormal path. However, the non-abnormal child node E belongs to the lower-level function node of the abnormal path, and the probability of abnormal situation occurring in the function node is relatively high. In order to avoid greater losses, after determining the non-abnormal child node, the defense operation corresponding to the attack feature can be determined according to the attack features and defense mapping relationship corresponding to each associated abnormal function node in the abnormal path, wherein the defense mapping relationship includes defense operations corresponding to different attack features, and the specific content is not specifically limited in the embodiments of the present application.

[0097] The defense operations corresponding to each attack feature jointly generate defense suggestions. By feeding back the defense suggestions and the non-abnormal sub-nodes, it is convenient to improve the corresponding defense capabilities of the non-abnormal sub-nodes in a targeted manner, thereby reducing the probability of abnormalities occurring in the non-abnormal sub-nodes.

[0098] An electronic device is provided in an embodiment of the present application, such as Figure 4 As shown, Figure 4The electronic device 400 shown includes: a processor 401 and a memory 403. The processor 401 and the memory 403 are connected, such as through a bus 402. Optionally, the electronic device 400 may also include a transceiver 404. It should be noted that in actual applications, the transceiver 404 is not limited to one, and the structure of the electronic device 400 does not constitute a limitation on the embodiments of the present application.

[0099] Processor 401 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 401 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0100] The bus 402 may include a path to transmit information between the above components. The bus 402 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 402 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 The fact that only one line is used in the diagram does not mean that there is only one bus or only one type of bus.

[0101] The memory 403 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0102] The memory 403 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 401. The processor 401 is used to execute the application code stored in the memory 403 to implement the contents shown in the above method embodiment.

[0103] The electronic devices include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs, desktop computers, etc. It can also be a server, etc. Figure 4 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0104] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0105] The embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the method in any of the above embodiments. Since different functional nodes generate different data when facing security threats, it is convenient to improve the diversity and comprehensiveness of data sources by obtaining the corresponding operation data at multiple functional nodes, so as to provide rich data support for subsequent data analysis and identification of security threats. Secondly, the functional nodes are filtered by preset threat features to obtain abnormal functional nodes containing preset threat features, which is convenient to reduce the amount of data in the data analysis process, and can improve the pertinence and effectiveness in the data integration process. In addition, by constructing a node threat portrait corresponding to each abnormal functional node, and then constructing a security threat concept tree based on the node threat portrait, and providing feedback according to the preset feedback frequency, it is convenient to timely discover and display the correlation between each abnormal functional node, so as to provide more comprehensive and effective integrated data for subsequent determination of security threats, and then to improve the accuracy of determining security threats.

[0106] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0107] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A situation awareness processing method, characterized in that: include: Acquire the data to be processed, where the data to be processed is the operation data corresponding to the device to be processed at different functional nodes; Identify the data features corresponding to each function node from the data to be processed, and determine whether there is an abnormal function node based on the preset threat features, where the abnormal function node is a function node whose corresponding data features contain the preset threat features; Identify the abnormal node identifier corresponding to each abnormal function node, and determine the node threat profile corresponding to the abnormal function node based on the abnormal node identifier and the included preset threat features; Based on each abnormal function node and the node threat portrait corresponding to each abnormal function node, a security threat concept tree is constructed, and the security threat concept tree is fed back according to a preset feedback frequency; After constructing the security threat concept tree, the method further includes: Obtaining an operation log of each abnormal function node within a first preset time period, and identifying a plurality of operation features contained in each operation log; Determine a preset simulation model corresponding to each abnormal function node according to the abnormal node identifier corresponding to each abnormal function node and the simulation mapping relationship, wherein the simulation mapping relationship is a corresponding relationship between the abnormal node identifier and the preset simulation model; Based on multiple operation features corresponding to each abnormal function node and a preset simulation model, simulating the attack process of each abnormal function node within a second preset time period to obtain a simulated attack image of each abnormal function node; The simulated attack image of each abnormal function node is superimposed on the security threat concept tree to form a visual concept tree.

2. A situation awareness processing method according to claim 1, characterized in that: The step of superimposing the simulated attack image of each abnormal function node into the security threat concept tree includes: From the simulated attack images of each abnormal function node in the second preset time period, obtain a target simulated attack image of each abnormal function node, each target simulated image being a simulated attack image corresponding to the corresponding abnormal function node at the last moment in the second preset time period; The simulated attack image of each abnormal function node is determined as a display image, the target simulated attack image of each abnormal function node is determined as a cover image, and the display image and the corresponding cover image of each abnormal function node are superimposed on the security threat concept tree.

3. A situation awareness processing method according to claim 1, characterized in that: When there is an associated abnormal function node in the security threat concept tree, it also includes: Obtaining an associated simulated attack image corresponding to each associated abnormal function node, and identifying attack features in each associated simulated attack image; Matching the attack features corresponding to each associated abnormal function node to determine a target abnormal group, wherein the target abnormal group includes at least two associated abnormal function nodes, and the matching value of the attack features between the at least two associated abnormal function nodes is higher than a preset matching value; Alarm information is generated based on the target abnormal group, and the alarm information is fed back.

4. A situation awareness processing method according to claim 3, characterized in that: The generating of alarm information based on the target abnormal group includes: Importing the security threat concept tree into a preset coordinate system, and determining the node coordinates of each associated abnormal function node in the target abnormal group; Determine the influence range according to the coordinates of each node, and determine other function nodes included in the influence range as influencing function nodes; Alarm information is generated according to the target abnormal group and the affected functional node.

5. A situation awareness processing method according to claim 3, characterized in that: Also includes: Identify the association relationship between the associated abnormal function nodes, which includes parallel relationship and parent-child relationship; Sort the associated abnormal function nodes with a parent-child relationship to obtain an abnormal path, and determine a non-abnormal child node from the security threat concept tree according to the abnormal path; A defense suggestion is generated according to the attack features corresponding to the associated abnormal function nodes having the parent-child relationship, and the defense suggestion and the non-abnormal child nodes are fed back.

6. An electronic device, characterized in that: The electronic device includes: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute a situational awareness processing method according to any one of claims 1-5.

7. A computer-readable storage medium, characterized in that: include: A computer program is stored which can be loaded by a processor and executes a situation awareness processing method as described in any one of claims 1 to 5.

8. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the steps of a situation awareness processing method according to any one of claims 1 to 5.

Images