Network attack discovery method and related device based on network space mapping

Abstract

The present invention discloses a network attack discovery method and related devices based on network space mapping, which relates to the field of information security technology and is invented to shorten the time window from the occurrence of an attack event to the detection of attack traces. The method includes: setting a space range to be mapped, wherein the space range to be mapped includes but is not limited to the full IP space, regional network segments, domain name lists, and scattered IP address lists; performing network mapping on the surviving targets in the space range to be mapped, and obtaining the interactive traffic characteristics and service fingerprint characteristics of the surviving targets; matching the interactive traffic characteristics and service fingerprint characteristics according to the prepared matching characteristics carrying traceability intelligence and threat type information, and obtaining the feature matching results of the surviving targets; and performing correlation evaluation on the feature matching results of the surviving targets to determine whether the surviving targets are feature-related. The present invention is suitable for occasions of network security defense.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a network attack discovery method and device based on cyberspace mapping, and a computing device. Background Art

[0002] Cyberspace mapping mainly refers to a method of using some technical methods to detect the node distribution and network relationship index in the global Internet space and construct a global Internet map.

[0003] The current mainstream threat detection and discovery based on real-life host and network sides, as well as APT threat assessment and discovery based on centralized analysis operations based on threat basic databases, are both threat discovery methods that tend to be passive and wait-and-see. In particular, they have a considerable lag defect. The threat is often not detected until an attack has already occurred, or even a certain period of time has passed. It is difficult to discover the attacker's network infrastructure assets in advance or as quickly as possible. Summary of the invention

[0004] In view of the above problems, the present invention provides a network attack discovery method and apparatus, and a computing device based on cyberspace mapping to shorten the time window from the occurrence of an attack event to the detection of attack traces.

[0005] According to one aspect of the present invention, a network attack discovery method based on network space mapping is provided, comprising:

[0006] Set the scope of the space to be mapped, where the scope of the space to be mapped includes but is not limited to the full IP space, regional network segment, domain name list and scattered IP address list;

[0007] Perform network mapping on the surviving targets in the spatial range to be mapped, and obtain the interactive traffic characteristics and service fingerprint characteristics of the surviving targets;

[0008] According to the prepared matching features carrying the tracing intelligence and the threat type information, the interactive traffic features and the service fingerprint features are matched to obtain the feature matching result of the surviving target;

[0009] Performing a correlation evaluation on the feature matching result of the surviving target to determine whether the surviving target is feature-related;

[0010] The step of performing correlation evaluation on the feature matching result of the surviving target to determine whether the surviving target is feature-correlated includes:

[0011] Query the multi-source intelligence of the hit target of the surviving target in the intelligence database, and compare it with the tracing intelligence defined in the interactive traffic characteristics or service fingerprint characteristics;

[0012] If the traceability information in the query result is consistent with the definition information, and there is no objection or no conclusion in the manual traceability analysis, then the evaluation target is feature-related;

[0013] If the conclusion of manual traceability analysis is consistent with the defined intelligence, but the intelligence database query has no traceability intelligence results or there are objections, then based on the principle that the reliability of manual analysis conclusions is higher than that of intelligence query results, the target hit is assessed to be feature-related.

[0014] In an optional manner, the interactive traffic characteristics include:

[0015] Writing time, which is the date and time when the interactive traffic feature is created or updated;

[0016] Simulated interaction packets are online packets and heartbeat packets sent by a specific Trojan family to the C2 server;

[0017] Interaction features are the features and assets in the interaction traffic between a specific Trojan family and the C2 server;

[0018] Source tracing intelligence, which is the name of the threat organization that can be traced back to the source;

[0019] Threat type, including the name of the malicious code family and attack method.

[0020] In an optional manner, the service fingerprint feature includes:

[0021] Writing time, which is the date and time when the interactive traffic feature is created or updated;

[0022] Fingerprint features, including middleware name and version number, port number, status code, echo content, digital certificate, content contained in the favicon icon, and asset features;

[0023] Source tracing intelligence, which is the name of the threat organization that can be traced back to the source;

[0024] Threat type, including the name of the malicious code family and attack method.

[0025] In an optional manner, performing network mapping on the surviving targets in the space range to be mapped further includes:

[0026] Sending an ICMP echo request to the IP address of the live target through a PING command, and monitoring the returned echo reply; if an echo reply is received, the live target is in a live state; and / or,

[0027] Send a TCP connection request to port 22 / 445 / 80 to determine whether a SYN-ACK response in the TCP three-way handshake of the survival target is received; if received, the port is open on the survival target, and it is further inferred that the survival target is in a survival state.

[0028] In an optional manner, after determining whether the surviving target is feature-related, the method further includes:

[0029] According to the Internet service provider, location, active DNS record, passive DNS record and Whois information of the surviving target, the latest network mapping information of the surviving target is stored in the database in time batches.

[0030] In an optional manner, performing correlation evaluation on the feature matching result of the surviving target to determine whether the surviving target is feature-correlated further includes:

[0031] If neither the intelligence database query nor the manual analysis can produce traceability intelligence, further correlation line expansion is performed. If the intelligence query of the high-correlation line expansion result is consistent with the definition intelligence and there is no objection in the manual analysis, the target is evaluated as feature-related;

[0032] The calculation formula for comparing with the traceability intelligence defined in the interactive traffic characteristics or service fingerprint characteristics is:

[0033]

[0034] in, For two intelligence strings Similarity score of ; is the Levenshtein edit distance; is the string length function; is the time decay factor, is the attenuation rate, is the reference time, is the time when the intelligence was created or updated.

[0035] In an optional manner, after determining whether the surviving target is feature-related, the method further includes:

[0036] If the hit target and its high correlation extension result cannot obtain traceability intelligence in the intelligence database query and manual traceability analysis; but the threat type in the intelligence query result or manual threat analysis is consistent with the defined threat type, then the hit target is evaluated as suspected feature correlation;

[0037] If no direct or suspected correlation between the hit target and the defined feature can be confirmed, the hit target is evaluated as feature irrelevant or feature relevance is unknown.

[0038] In an optional manner, the method further includes:

[0039] If the hit target and its high correlation extension results cannot derive traceability intelligence and threat types in intelligence database query and manual analysis, the hit target is assessed as having unknown feature correlation.

[0040] According to another aspect of the present invention, a network attack discovery device based on network space mapping is provided, comprising:

[0041] A mapping space setting module is used to set the scope of the space to be mapped, wherein the scope of the space to be mapped includes but is not limited to the full IP space, regional network segment, domain name list and scattered IP address list;

[0042] A network mapping module, used to perform network mapping on the surviving targets in the spatial range to be mapped, and obtain the interactive traffic characteristics and service fingerprint characteristics of the surviving targets;

[0043] A feature matching module is used to match the interactive traffic features and service fingerprint features according to the prepared matching features carrying the traceability intelligence and threat type information, and obtain the feature matching result of the surviving target;

[0044] A relevance evaluation module is used to perform relevance evaluation on the feature matching results of the survival target to determine whether the survival target is feature-related; wherein, the relevance evaluation on the feature matching results of the survival target to determine whether the survival target is feature-related includes: querying the intelligence library for multi-source intelligence of the hit target of the survival target, and comparing it with the traceability intelligence defined in the interactive traffic characteristics or service fingerprint characteristics; if the traceability intelligence in the query result is consistent with the definition intelligence, and there is no objection or no conclusion in the manual traceability analysis and judgment conclusion, then the hit target is evaluated to be feature-related; if the manual traceability analysis and judgment conclusion is consistent with the definition intelligence, but the intelligence library query has no traceability intelligence result or there is an objection, then according to the principle that the reliability of the manual analysis conclusion is higher than the intelligence query result, the hit target is evaluated to be feature-related.

[0045] According to another aspect of the present invention, there is provided a computing device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0046] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the network attack discovery method based on cyberspace mapping described in any of the above embodiments.

[0047] According to the scheme provided by the present invention, the scope of the space to be mapped is set, wherein the scope of the space to be mapped includes but is not limited to the full IP space, regional network segments, domain name lists, and scattered IP address lists; network mapping is performed on the surviving targets in the scope of the space to be mapped to obtain the interactive traffic characteristics and service fingerprint characteristics of the surviving targets; the interactive traffic characteristics and service fingerprint characteristics are matched according to the matching characteristics carrying the traceability intelligence and threat type information prepared to obtain the feature matching results of the surviving targets; the feature matching results of the surviving targets are evaluated for relevance to determine whether the surviving targets are feature-related. The invention can actively detect and discover the latest infrastructure assets of known network threats in the entire network network space, empower the defender in time, and significantly shorten the time window from the occurrence of the attack event to the detection of the attack traces. The present invention initiates intensive mapping scans for the network space area where the attacker may deploy the network infrastructure, and matches the pre-prepared network characteristics in the process, so as to quickly discover the latest network assets of the known threats. It can significantly shorten the time window from the occurrence of the attack event to the detection of the attack traces, and it is even possible to pre-block the latest attack assets in the hands of the attacker before the attacker actually launches an attack on the target. By routinely maintaining the bilateral features of interactive traffic and service fingerprints, we can identify and capture multiple known APT organizations within a week after the attacker's new server goes online. The captured results can be used as timely high-value intelligence to link telemetry capabilities to monitor domestic victim traffic, or simultaneously provide guidance to on-site personnel on early prevention and evidence collection.

[0048] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0050] Figure 1 The schematic diagram shows the process of the network attack discovery method based on network space mapping according to the embodiment of the present invention. Figure 1 ;

[0051] Figure 2 The schematic diagram shows the process of the network attack discovery method based on network space mapping according to the embodiment of the present invention. Figure 2 ;

[0052] Figure 3 A schematic diagram of a network attack discovery device based on network space mapping according to an embodiment of the present invention is shown;

[0053] Figure 4 A schematic diagram of the structure of a computing device according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0054] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0055] Figure 1 A flow chart of a network attack discovery method based on cyberspace mapping according to an embodiment of the present invention is shown. The present invention is based on the technical capabilities of cyberspace mapping, and within a specified network mapping space target range (such as the full IPv4 space, a batch of subset network segments, or a batch of domain name lists, etc.), it collects the possible interactive traffic and detailed content of service fingerprints of each service port of the surviving target at a high frequency, and uses the prepared matching features carrying traceability intelligence and threat type information to query the mapping repository to observe whether a hit is possible. Finally, through a predetermined relevance evaluation strategy, it determines whether the hit target is related to the intelligence information of the prepared features, and can quickly and timely synchronize intelligence data of the hit results evaluated as feature-related to the threat intelligence consumer. Specifically, if Figure 1 As shown, the following steps are included:

[0056] Step S11, setting the space range to be mapped, wherein the space range to be mapped includes but is not limited to the full IP space, regional network segments, domain name list and scattered IP address list.

[0057] In this embodiment, the full IP space refers to the range of all IP addresses that can be allocated and have been allocated on the current Internet, usually based on the IPv4 or IPv6 protocol, covering all possible IP addresses in the world. A regional network segment refers to the range of IP addresses allocated within a specific geographic region, country or organization. Regional network segments can be divided based on geographic location, Internet service provider (ISP) or the needs of a specific organization. A domain name list is a unique identifier for a website, server, etc. A scattered IP address list refers to a set of IP addresses that are not continuous and do not constitute a complete network segment.

[0058] For example, for a regional network segment, collect the IP address range of a certain area's network service provider, set the regional network segment as the mapping range, scan and analyze the network segment through network mapping tools, and obtain information such as surviving hosts, service types, and security vulnerabilities in the network segment. For another example, for a domain name list, collect the domain name list of the target organization or website, set the domain name list as the mapping range, scan and analyze these domain names through network mapping tools, and obtain information such as the IP address, domain name resolution, service type, and security configuration of the target website or service.

[0059] Step S12, performing network mapping on the surviving targets in the spatial range to be mapped, and obtaining the interactive traffic characteristics and service fingerprint characteristics of the surviving targets.

[0060] In this embodiment, the surviving targets in the spatial range to be surveyed are determined. The surviving targets can be IP addresses, domain names, or other network entities. The network surveying and mapping tools are configured based on the surveying and mapping requirements, the surveying and mapping tools are deployed in the target network environment, and the surveying and mapping tasks are started. The network traffic of the surviving targets is automatically captured, and the interactive traffic features and service fingerprint features are extracted from the captured network traffic. Among them, the interactive traffic features include data packet size, transmission protocol, transmission frequency, etc.; the service fingerprint features include service type, version number, open port, etc. The above-mentioned extracted features are further analyzed to identify the network behavior patterns, service types, and potential threats of the surviving targets.

[0061] In an optional manner, the interactive traffic characteristics include:

[0062] Writing time, which is the date and time when the interactive traffic feature is created or updated;

[0063] Simulated interaction packets are online packets and heartbeat packets sent by a specific Trojan family to the C2 server;

[0064] Interaction features are the features and assets in the interaction traffic between a specific Trojan family and the C2 server;

[0065] Source tracing intelligence, which is the name of the threat organization that can be traced back to the source;

[0066] Threat type, including the name of the malicious code family and attack method.

[0067] In this embodiment, the writing time is also referred to as "recording time" or "analysis time", which refers to the date and time when the interactive traffic feature is created or updated. The simulated interactive package refers to the online package and heartbeat package between a specific Trojan family and the C2 (command and control) server, which contains key information about the Trojan and the C2 server to establish a connection, maintain a connection, and send or receive instructions. By analyzing the simulated interactive package, the behavior pattern, communication protocol, and possible malicious operations of a specific Trojan family can be analyzed. The interactive features include a series of unique features such as data packet format, protocol details, encryption method, transmission frequency, etc. in the interactive traffic between a specific Trojan family and the C2 server, as well as asset information (such as IP address, domain name, port number, etc.) involved in these interactive processes, which are used to identify, classify and track the network activities of a specific Trojan family, and at the same time evaluate its potential threat to the target assets. Tracing intelligence refers to intelligence information that can be associated with the name of a specific threat organization, which is used to evaluate its motivation, capabilities, and possible follow-up actions, so as to formulate a more effective defense strategy. Threat types include malicious code family names (such as WannaCry, NotPetya, etc.) and attack methods (such as DDoS attacks, ransomware, phishing attacks, etc.).

[0068] In an optional manner, the service fingerprint feature includes:

[0069] Writing time, which is the date and time when the interactive traffic feature is created or updated;

[0070] Fingerprint features, including middleware name and version number, port number, status code, echo content, digital certificate, content contained in the favicon icon, and asset features;

[0071] Source tracing intelligence, which is the name of the threat organization that can be traced back to the source;

[0072] Threat type, including the name of the malicious code family and attack method.

[0073] In this embodiment, the middleware name and version number identify the middleware and its version used by the service. The port number is the port that the service listens on. The status code is a code used in protocols such as HTTP to indicate the service response status, such as 200 for success, 404 for resource not found, etc. The echo content is the response content of the service to a specific request, including returned debugging information, version number or sensitive data, etc. Digital certificates are used to verify the identity and encryption strength of the service. Although the content contained in the favicon icon is not directly related to security, the hash value or content of the favicon icon can be used as a unique identifier for the service. Asset features include information associated with the service, such as IP address, domain name, geographic location, etc., which can locate and analyze the location and role of the service in the network.

[0074] In an optional manner, performing network mapping on the surviving targets in the space range to be mapped further includes:

[0075] Sending an ICMP echo request to the IP address of the live target through a PING command, and monitoring the returned echo reply; if an echo reply is received, the live target is in a live state; and / or,

[0076] Send a TCP connection request to port 22 / 445 / 80 to determine whether a SYN-ACK response in the TCP three-way handshake of the survival target is received; if received, the port is open on the survival target, and it is further inferred that the survival target is in a survival state.

[0077] For example, enter the ping <target IP address> command through Windows CMD or Linux / Unix terminal to send an ICMP echo request to the target IP address and listen for the returned echo reply. If an echo reply is received, it means that the target host is online and alive.

[0078] Use network scanning tools (such as Nmap, ScanPort, etc.) or write custom scripts to specify the target IP address and port number (such as 22 / 445 / 80) to be scanned. Send a TCP connection request to the specified port and wait for the target host's response. If a SYN-ACK response is received in the TCP three-way handshake, it means that the port is open on the target host, and it can be inferred that the target host is alive (because a non-alive host will not respond to a TCP connection request).

[0079] In an optional manner, after determining whether the surviving target is feature-related, the method further includes:

[0080] According to the Internet service provider, location, active DNS record, passive DNS record and Whois information of the surviving target, the latest network mapping information of the surviving target is stored in the database in time batches.

[0081] In this embodiment, by collecting various information of the surviving target (ISP, location, DNS records, Whois information, etc.), a comprehensive target portrait can be constructed. By storing information in time batches, the real-time and accuracy of the data can be ensured, and it is easy to track the changes in the target's network status. Among them, the ISP and location information obtains the ISP and location information of the target IP through the IP address query API or database. Active DNS records use DNS query tools (such as dig, nslookup, etc.) to obtain A, AAAA, MX, NS and other records of the target domain name. Passive DNS records use Passive DNS to collect DNS resolution records of the target domain name in the past period of time (including historical IP addresses, resolution time, etc.). Whois information obtains the registration information of the target domain name (including registrant, registration time, expiration time, etc.) through Whois query.

[0082] Step S13, matching the interactive traffic features and service fingerprint features according to the prepared matching features carrying source tracing intelligence and threat type information, to obtain a feature matching result of the surviving target.

[0083] In this embodiment, by matching known traceability intelligence and threat types, abnormal or malicious network behaviors can be quickly identified and response time can be reduced. Combining interactive traffic characteristics and service fingerprint characteristics, it not only focuses on a single network behavior or service, but also conducts comprehensive matching analysis from multiple dimensions to form a more comprehensive security protection system, which can more accurately locate surviving targets and their behavioral characteristics.

[0084] For example, extract information such as IP address, port number, protocol type, data packet content, etc. from the interactive traffic features, and extract information such as middleware name and version number, port status, echo content, digital certificate, etc. from the service fingerprint features. Compare the extracted interactive traffic features and service fingerprint features with the information in the source tracing intelligence library and threat type library. Fuzzy matching, exact matching, or similarity-based matching algorithms can be used to obtain matching source tracing intelligence, threat types, and corresponding survival target information. The specific matching algorithm is not limited in this article.

[0085] Step S14, performing correlation evaluation on the feature matching result of the surviving target to determine whether the surviving target is feature-related.

[0086] For example, a series of evaluation criteria covering multiple dimensions are defined based on threat intelligence and behavioral features, such as IP address, port number, protocol type, data packet content, service fingerprint, and corresponding matching threshold, weight, etc. The matching results of surviving targets are collected from the feature matching process, including which threat intelligence or behavioral patterns are matched and the details of the match.

[0087] According to the defined evaluation criteria, the relevance between the surviving target and each threat intelligence or behavior pattern is calculated. The calculation can be performed using weighted summation, fuzzy logic, machine learning, etc., which are not limited in this article. If the relevance exceeds the threshold, the surviving target is judged to be feature-related; otherwise, it is judged to be irrelevant or of low relevance.

[0088] In an optional manner, performing correlation evaluation on the feature matching result of the surviving target to determine whether the surviving target is feature-correlated further includes:

[0089] Query the multi-source intelligence of the hit target of the surviving target in the intelligence database, and compare it with the tracing intelligence defined in the interactive traffic characteristics or service fingerprint characteristics;

[0090] If the traceability information in the query result is consistent with the definition information, and there is no objection or no conclusion in the manual traceability analysis, then the evaluation target is feature-related;

[0091] If the conclusion of manual traceability analysis is consistent with the defined intelligence, but the intelligence database query has no traceability intelligence results or there are objections, then based on the principle that the reliability of manual analysis conclusions is higher than that of intelligence query results, the target hit is assessed to be feature-related.

[0092] In an optional manner, performing correlation evaluation on the feature matching result of the surviving target to determine whether the surviving target is feature-correlated further includes:

[0093] If neither the intelligence database query nor the manual analysis can produce traceability intelligence, further correlation line expansion is performed. If the intelligence query of the high-correlation line expansion result is consistent with the definition intelligence and there is no objection in the manual analysis, the target is evaluated as feature-related;

[0094] The calculation formula for comparing with the traceability intelligence defined in the interactive traffic characteristics or service fingerprint characteristics is:

[0095]

[0096] in, For two intelligence strings Similarity score of ; is the Levenshtein edit distance; is the string length function; is the time decay factor, is the attenuation rate, is the reference time, is the time when the intelligence was created or updated.

[0097] In this embodiment, the intelligence database query and manual analysis are combined to achieve fusion analysis of multi-source intelligence. At the same time, the uncertainty of the intelligence database query results and the subjectivity of manual analysis are taken into consideration. The flexibility of the evaluation process can be enhanced by setting priorities and associated extension lines.

[0098] Specifically, according to the identification of the surviving target (such as IP address, domain name, etc.), the intelligence database is quickly searched to obtain multi-source intelligence including the hit target, especially intelligence information related to tracing. The tracing intelligence is compared one by one with the tracing intelligence defined in the interactive traffic characteristics or service fingerprint characteristics.

[0099] The calculation formula for comparing with the traceability intelligence defined in the interactive traffic characteristics or service fingerprint characteristics is:

[0100]

[0101] in, For two intelligence strings Similarity score of ; is the Levenshtein edit distance; is the string length function; is the time decay factor, is the attenuation rate, is the reference time, The creation time or update time of the intelligence. If the similarity score is high (close to 1), it means that the traceability intelligence in the query result is very similar to the definition intelligence in content, and the intelligence is relatively new due to the small impact of the time decay factor. If the similarity score is low (close to 0), it means that the difference between the two intelligence strings is large, or the intelligence is outdated. s1 can be a description of a cyber attack event, and s2 can be historical intelligence related to the event stored in the intelligence library.

[0102] If there are objections to the intelligence database query results or no conclusion can be drawn, the manual tracing and judgment process is initiated, and judgment is made according to the preset evaluation rules based on the results of the intelligence database query and manual judgment. Among them, if both support that the hit target is feature-related, it is directly evaluated as target-related. If there is an inconsistency or it cannot be judged, a decision is made based on the principle that the reliability of the manual judgment conclusion is higher than the intelligence query result. If no conclusion can be drawn, further correlation line analysis is performed. Among them, correlation line analysis refers to the use of correlation analysis technology to perform line analysis on surviving targets to find other targets or intelligence with high correlation. If the line analysis results support that the hit target is feature-related, and there is no objection to the manual judgment, it is evaluated as target-related.

[0103] In an optional manner, after determining whether the surviving target is feature-related, the method further includes:

[0104] If the hit target and its high correlation extension result cannot obtain traceability intelligence in the intelligence database query and manual traceability analysis; but the threat type in the intelligence query result or manual threat analysis is consistent with the defined threat type, then the hit target is evaluated as suspected feature correlation;

[0105] If no direct or suspected correlation between the hit target and the defined feature can be confirmed, the hit target is evaluated as feature irrelevant or feature relevance is unknown.

[0106] In this embodiment, the evaluation results of hitting the target are further refined by introducing suspected feature correlation. When the intelligence database query and manual analysis cannot directly confirm the target relevance, the flexibility of the evaluation process is enhanced through an evaluation path based on threat type consistency. Regardless of direct correlation, suspected correlation or irrelevance, there are clear evaluation standards and processes.

[0107] For example, during the intelligence database query and manual traceability analysis process, a surviving target C was found, and its high correlation extension results also failed to provide clear traceability intelligence. However, in the intelligence query results, target C was marked as possibly affected by a certain type of cyber attack, and this attack type completely matched one of the defined threat types. At the same time, the manual threat analysis team also came to a similar conclusion, believing that the threat scenario faced by target C was highly similar to the description in the defined threat type. The evaluation team believes that although it is impossible to directly confirm the direct correlation between target C and the defined features, the threat type it faces is consistent with the defined threat type.

[0108] In an optional manner, the method further includes:

[0109] If the hit target and its high correlation extension results cannot derive traceability intelligence and threat types in intelligence database query and manual analysis, the hit target is assessed as having unknown feature correlation.

[0110] In this embodiment, even if the steps of intelligence database query, manual analysis and correlation line extension fail to obtain clear conclusions, reasonable evaluation results can be given. In the case of unknown feature relevance, it is not mandatory to give a clear conclusion of relevance or irrelevance, but to make a judgment based on the limitations of current information.

[0111] To facilitate understanding of the solution provided by the present invention, Figure 4 As shown:

[0112] Step S100: Set the scope of the space to be mapped, including the full IPv4 space, a specific area network segment, a domain name list, a dispersed IP address list, etc.

[0113] Step S200: Detect all targets within the set mapping space and determine their current survival status. Survival detection can be performed by using system commands or software tools such as PING, or by accessing common ports such as 22 / 445 / 80 to determine whether they are open to assist in determining the survival status.

[0114] Step S301: When using a matching discovery strategy based on interactive traffic features, it is necessary to prepare simulated interactive packets in the interactive traffic features. The contents of these simulated interactive packets can be online packets and heartbeat packets sent by a specific Trojan family to the C2 server. The simulated interaction process with the target may involve a single interaction (such as an online process) or multiple interactions in multi-stage communications.

[0115] Step S401: When using the matching discovery strategy based on interactive traffic features, key interactive features in the interactive traffic features need to be prepared. These features are used to match the traffic content captured in the subsequent simulated interaction process, including the unique feature fields and digital certificate features in the traffic packets when a specific Trojan family interacts with the C2 server. The matching range of the interactive features should completely cover the entire process of the interaction.

[0116] Step S501: Send simulated interaction packets to all ports of all targets within the set surveying space. In order to cope with network failures, packet loss, etc., multiple rounds of transmission can be set to ensure data accuracy.

[0117] Step S601: After sending the simulated interaction packet, observe the traffic data content during the interaction with the other party's port service to determine whether it can hit the prepared interaction feature.

[0118] Step S701: If a certain interactive traffic data of the target port service can hit the interactive feature, a subsequent correlation evaluation is performed to further analyze the potential threat of the target.

[0119] Step S801: If all the port services of the target have no traffic data feedback, or all the interactive traffic data cannot hit the interactive features, the current state of the target is evaluated as feature irrelevant, that is, under the current detection conditions, no specific threat features related to the target are found.

[0120] Step S302: When using a matching discovery strategy based on service fingerprint features, a service fingerprint feature set needs to be prepared. The core content of the service fingerprint feature includes the combination of field features such as port number, middleware name (such as Apache, Nginx, LiteSpeed, etc.) and its version number, response header, status code, echo content, favicon icon, digital certificate information, etc.

[0121] Step S402: Perform a regular scan of all ports of all targets within the set surveying space without interactive strategies. The extracted service fingerprint should cover all possible fields in the above service fingerprint features. During the scanning process, it is necessary to quickly identify and deeply analyze common network protocols, extract all field contents as detailed as possible, and combine the Internet service provider, location, active DNS records, passive DNS records, Whois and other related information to store the final information content results in the database in time batches.

[0122] Step S502: Based on the prepared service fingerprint feature set, the latest stored service fingerprint data is matched in the database to find potential target feature matching items.

[0123] Step S702: If a service fingerprint of the target measured can hit the service fingerprint feature set, a subsequent correlation evaluation is performed to deeply analyze the threat nature and potential risks of the target.

[0124] Step S802: If all service fingerprints measured for the target cannot hit the service fingerprint feature set, the current state of the target is evaluated as feature irrelevant, that is, under the current detection conditions, no specific threat feature related to the target service fingerprint is found.

[0125] Step S901: Based on the actual performance of the system and network, determine the frequency of re-execution of the entire loop process from step S100 to ensure the continuity and effectiveness of mapping and threat discovery.

[0126] According to the scheme provided by the present invention, the scope of the space to be mapped is set, wherein the scope of the space to be mapped includes but is not limited to the full IP space, regional network segments, domain name lists, and scattered IP address lists; network mapping is performed on the surviving targets in the scope of the space to be mapped to obtain the interactive traffic characteristics and service fingerprint characteristics of the surviving targets; the interactive traffic characteristics and service fingerprint characteristics are matched according to the matching characteristics carrying the traceability intelligence and threat type information prepared to obtain the feature matching results of the surviving targets; the feature matching results of the surviving targets are evaluated for relevance to determine whether the surviving targets are feature-related. The invention can actively detect and discover the latest infrastructure assets of known network threats in the entire network network space, empower the defender in time, and significantly shorten the time window from the occurrence of the attack event to the detection of the attack traces. The present invention initiates intensive mapping scans for the network space area where the attacker may deploy the network infrastructure, and matches the pre-prepared network characteristics in the process, so as to quickly discover the latest network assets of the known threats. It can significantly shorten the time window from the occurrence of the attack event to the detection of the attack traces, and it is even possible to pre-block the latest attack assets in the hands of the attacker before the attacker actually launches an attack on the target. By routinely maintaining the bilateral features of interactive traffic and service fingerprints, we can identify and capture multiple known APT organizations within a week after the attacker's new server goes online. The captured results can be used as timely high-value intelligence to link telemetry capabilities to monitor domestic victim traffic, or simultaneously provide guidance to on-site personnel on early prevention and evidence collection.

[0127] Figure 3 The schematic diagram of the framework of the network attack discovery device based on network space mapping according to an embodiment of the present invention is shown. The network attack discovery device based on network space mapping includes:

[0128] The mapping space setting module 31 is used to set the scope of the space to be mapped, wherein the scope of the space to be mapped includes but is not limited to the full IP space, regional network segment, domain name list and scattered IP address list;

[0129] A network mapping module 32 is used to perform network mapping on the surviving targets in the spatial range to be mapped, and obtain the interactive traffic characteristics and service fingerprint characteristics of the surviving targets;

[0130] A feature matching module 33 is used to match the interactive traffic feature and the service fingerprint feature according to the prepared matching feature carrying the traceability intelligence and threat type information, and obtain the feature matching result of the surviving target;

[0131] The relevance evaluation module 34 is used to perform relevance evaluation on the feature matching results of the survival target to determine whether the survival target is feature-related; wherein, the relevance evaluation on the feature matching results of the survival target to determine whether the survival target is feature-related includes: querying the multi-source intelligence of the hit target of the survival target in the intelligence library, and comparing it with the traceability intelligence defined in the interactive traffic characteristics or service fingerprint characteristics; if the traceability intelligence in the query result is consistent with the definition intelligence, and there is no objection or no conclusion in the manual traceability analysis and judgment conclusion, then the hit target is evaluated to be feature-related; if the manual traceability analysis and judgment conclusion is consistent with the definition intelligence, but the intelligence library query has no traceability intelligence result or there is an objection, then according to the principle that the reliability of the manual analysis conclusion is higher than the intelligence query result, the hit target is evaluated to be feature-related.

[0132] The network attack discovery device based on network space mapping of this embodiment can implement the network attack discovery method based on network space mapping described in any of the aforementioned embodiments. The implementation principles and beneficial effects thereof are basically the same and will not be repeated here.

[0133] Figure 4 The schematic diagram of the structure of the computing device embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the computing device.

[0134] like Figure 4 As shown, the computing device may include: a processor 42 , a communications interface 44 , a memory 46 , and a communications bus 48 .

[0135] The processor 42, the communication interface 44, and the memory 46 communicate with each other via the communication bus 48. The communication interface 44 is used to communicate with other devices such as a client or other server network elements. The processor 42 is used to execute the program 49, which can specifically execute the relevant steps in the above-mentioned network attack discovery method embodiment based on network space mapping.

[0136] Specifically, the program 49 may include program codes including computer operation instructions.

[0137] The processor 42 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiment of the present invention. The one or more processors included in the computing device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0138] The memory 46 is used to store the program 49. The memory 46 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0139] According to the scheme provided by the present invention, the scope of the space to be mapped is set, wherein the scope of the space to be mapped includes but is not limited to the full IP space, regional network segments, domain name lists, and scattered IP address lists; network mapping is performed on the surviving targets in the scope of the space to be mapped to obtain the interactive traffic characteristics and service fingerprint characteristics of the surviving targets; the interactive traffic characteristics and service fingerprint characteristics are matched according to the matching characteristics carrying the traceability intelligence and threat type information prepared to obtain the feature matching results of the surviving targets; the feature matching results of the surviving targets are evaluated for relevance to determine whether the surviving targets are feature-related. The invention can actively detect and discover the latest infrastructure assets of known network threats in the entire network network space, empower the defender in time, and significantly shorten the time window from the occurrence of the attack event to the detection of the attack traces. The present invention initiates intensive mapping scans for the network space area where the attacker may deploy the network infrastructure, and matches the pre-prepared network characteristics in the process, so as to quickly discover the latest network assets of the known threats. It can significantly shorten the time window from the occurrence of the attack event to the detection of the attack traces, and it is even possible to pre-block the latest attack assets in the hands of the attacker before the attacker actually launches an attack on the target. By routinely maintaining the bilateral features of interactive traffic and service fingerprints, we can identify and capture multiple known APT organizations within a week after the attacker's new server goes online. The captured results can be used as timely high-value intelligence to link telemetry capabilities to monitor domestic victim traffic, or simultaneously provide guidance to on-site personnel on early prevention and evidence collection.

[0140] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and further may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature that provides the same, equivalent or similar purpose. In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and to form different embodiments. For example, in the following claims, any one of the claimed embodiments may be used in any combination. The present invention may be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In a unit claim that lists several means, several of these means may be embodied by the same hardware item. The steps in the above embodiments should not be understood as limiting the execution order unless otherwise specified.

Claims

1. A network attack discovery method based on network space mapping, characterized in that: include: Setting the scope of the space to be mapped, wherein the scope of the space to be mapped includes the full IP space, regional network segments, domain name list, and dispersed IP address list; Perform network mapping on the surviving targets in the spatial range to be mapped, and obtain the interactive traffic characteristics and service fingerprint characteristics of the surviving targets; According to the prepared matching features carrying the tracing intelligence and the threat type information, the interactive traffic features and the service fingerprint features are matched to obtain the feature matching result of the surviving target; Performing a correlation evaluation on the feature matching result of the surviving target to determine whether the surviving target is feature-related; The step of performing correlation evaluation on the feature matching result of the surviving target to determine whether the surviving target is feature-correlated includes: Query the multi-source intelligence of the hit target of the surviving target in the intelligence database, and compare it with the tracing intelligence defined in the interactive traffic characteristics or service fingerprint characteristics; If the traceability information in the query result is consistent with the definition information, and there is no objection or no conclusion in the manual traceability analysis, then the evaluation target is feature-related; If the manual source tracing conclusion is consistent with the defined intelligence, but the intelligence database query has no source tracing intelligence results or there are objections, then based on the principle that the reliability of manual source tracing conclusions is higher than that of intelligence query results, the target is evaluated as feature-related; The interactive traffic characteristics include: Writing time, which is the date and time when the interactive traffic feature is created or updated; Simulated interaction packets are online packets and heartbeat packets sent by a specific Trojan family to the C2 server; Interaction features are the features and assets in the interaction traffic between a specific Trojan family and the C2 server; Source tracing intelligence, which is the name of the threat organization that can be traced back to the source; Threat type, including the name of the malicious code family and attack method; The service fingerprint features include: Writing time, which is the date and time when the interactive traffic feature is created or updated; Fingerprint features, including middleware name and version number, port number, status code, echo content, digital certificate, content contained in the favicon icon, and asset features; Source tracing intelligence, which is the name of the threat organization that can be traced back to the source; Threat type, including the name of the malicious code family and attack method.

2. The network attack discovery method based on network space mapping according to claim 1 is characterized in that: The network mapping of the surviving targets in the space to be mapped includes: Sending an ICMP echo request to the IP address of the live target through a PING command, and monitoring the returned echo reply; if an echo reply is received, the live target is in a live state; and / or, Send a TCP connection request to port 22 / 445 / 80 to determine whether a SYN-ACK response in the TCP three-way handshake of the survival target is received; if received, the port is open on the survival target, and it is further inferred that the survival target is in a survival state.

3. The network attack discovery method based on network space mapping according to claim 2 is characterized in that: After determining whether the surviving target is feature-related, the method further includes: According to the Internet service provider, location, active DNS record, passive DNS record and Whois information of the surviving target, the latest network mapping information of the surviving target is stored in the database in time batches.

4. The network attack discovery method based on network space mapping according to claim 1 is characterized in that: The performing correlation evaluation on the feature matching result of the surviving target to determine whether the surviving target is feature-correlated further comprises: If the intelligence database query and manual analysis cannot obtain the traceability intelligence, then further correlation line expansion is performed. If the intelligence query of the high-correlation line expansion result is consistent with the definition intelligence and there is no objection in the manual analysis, then the target is evaluated as feature-related; The calculation formula for comparing with the traceability intelligence defined in the interactive traffic characteristics or service fingerprint characteristics is: ； in, For two intelligence strings Similarity score of ; is the Levenshtein edit distance; is the string length function; is the time decay factor, is the attenuation rate, is the reference time, is the time when the intelligence was created or updated.

5. The network attack discovery method based on network space mapping according to claim 4 is characterized in that: After determining whether the surviving target is feature-related, the method further includes: If the hit target and its high correlation extension result cannot obtain traceability intelligence in the intelligence database query and manual traceability analysis; but the threat type in the intelligence query result or manual threat analysis is consistent with the defined threat type, then the hit target is evaluated as suspected feature correlation; If no direct or suspected correlation between the hit target and the defined feature can be confirmed, the hit target is evaluated as feature irrelevant or feature relevance is unknown.

6. The network attack discovery method based on network space mapping according to claim 5 is characterized in that: The method further comprises: If the hit target and its high correlation extension results cannot derive traceability intelligence and threat types in intelligence database query and manual analysis, the hit target is assessed as having unknown feature correlation.

7. A network attack discovery device based on network space mapping, characterized in that: Used to execute the network attack discovery method based on cyberspace mapping as claimed in claim 1, the network attack discovery device comprises: A mapping space setting module is used to set the scope of the space to be mapped, wherein the scope of the space to be mapped includes the full IP space, regional network segments, domain name list and scattered IP address list; A network mapping module, used to perform network mapping on the surviving targets in the spatial range to be mapped, and obtain the interactive traffic characteristics and service fingerprint characteristics of the surviving targets; A feature matching module is used to match the interactive traffic features and service fingerprint features according to the prepared matching features carrying the traceability intelligence and threat type information, and obtain the feature matching result of the surviving target; A relevance evaluation module is used to perform relevance evaluation on the feature matching results of the survival target to determine whether the survival target is feature-related; wherein, the relevance evaluation on the feature matching results of the survival target to determine whether the survival target is feature-related includes: querying the intelligence library for multi-source intelligence of the hit target of the survival target, and comparing it with the traceability intelligence defined in the interactive traffic characteristics or service fingerprint characteristics; if the traceability intelligence in the query result is consistent with the definition intelligence, and there is no objection or no conclusion in the manual traceability analysis and judgment conclusion, then the hit target is evaluated to be feature-related; if the manual traceability analysis and judgment conclusion is consistent with the definition intelligence, but the intelligence library query has no traceability intelligence result or there is an objection, then according to the principle that the reliability of the manual analysis conclusion is higher than the intelligence query result, the hit target is evaluated to be feature-related.

8. A computing device comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the network attack discovery method based on cyberspace mapping as described in any one of claims 1-6 above.

Images