Security protection method, system and device based on service line and storage medium

Abstract

The invention relates to a security protection method, system and device based on a service line and a storage medium, and belongs to the technical field of network security, the method comprises the following steps: obtaining access information at a monitoring point, the access information representing information required for accessing a monitored device; analyzing an access behavior corresponding to the access information, and determining a basic risk of the access behavior; the access behavior is traced according to the basic risk and the access information, an access line of the access behavior is determined, the access line comprises a relationship between a process and a thread generated in the access behavior process, and the relationship between the process and the thread is determined through a control register deployed on the monitored equipment; and determining a risk source of the access information and a protection instruction corresponding to the risk source according to the access line of the access behavior. The application has the effect of improving the network security protection capability of the terminal equipment.

Description

Technical Field

[0001] The present application relates to the technical field of network security, and in particular to a business line-based security protection method, system, device and storage medium. Background Art

[0002] Network security has become increasingly important in today's society. With the continuous changes in network attack methods, traditional manual network protection faces the contradiction between "dynamic" security risks and "static" defense systems. Relying on session interception of traditional security products (such as WAF, IPS) cannot effectively control the source of risks fundamentally, and relying on manual IP blocking methods to face automated attack scripts and random sudden attacks at all times, it is difficult to ensure security protection capabilities and blocking efficiency.

[0003] As network security threats become increasingly complex and diverse, traditional protection methods cannot meet network security needs. For example, current network threats use proxies to disguise as normal access. How to improve network security protection capabilities is a problem that needs to be solved. Summary of the invention

[0004] In order to improve the network security protection capabilities, the present application provides a business line-based security protection method, system, device and storage medium.

[0005] In a first aspect of the present application, a security protection method based on a business line is provided. The method comprises:

[0006] Obtain access information at the monitoring point, where the access information represents information required to access the monitored device;

[0007] Analyze the access behavior corresponding to the access information and determine the basic risk of the access behavior;

[0008] Trace the access behavior based on the basic risk and access information, and determine the access route of the access behavior. The access route includes the relationship between the process and thread generated during the access behavior. The relationship between the process and thread is determined by the control register deployed on the monitored device.

[0009] According to the access route of the access behavior, determine the risk source of the access information and the protection instructions corresponding to the risk source.

[0010] From the above technical scheme, it can be seen that access information is obtained by deploying monitoring points on the terminal device, and the basic risk of the access behavior is determined according to the access behavior corresponding to the access information. The access behavior is traced according to the basic risk to obtain the access line. Each node in the access line is obtained from the control register. The authenticity of the data is high, which lays the foundation for the judgment of the risk source. Then the risk source in the access line is obtained, and the protection instruction corresponding to the risk source is generated to achieve protection of the terminal device and improve the protection capability.

[0011] In a possible implementation, the access behavior corresponding to the access information is analyzed to determine the basic risk of the access behavior, including:

[0012] Obtain the access object and access risk table of the access behavior. The access risk table is used to reflect the risk of different access objects;

[0013] According to the access object and the access risk table, the basic risk of the access behavior is determined. The basic risk is used to reflect the importance of the access object.

[0014] In a possible implementation, before tracing the access behavior according to the basic risk and the access information and determining the access path of the access behavior, the method further includes:

[0015] When the basic risk is low, the access behavior is performed;

[0016] When the basic risk is medium or high, the access behavior is traced to determine the access route of the access behavior.

[0017] In a possible implementation, the access behavior is traced based on the basic risk and access information to determine the access route of the access behavior, including:

[0018] The initiating object of the access behavior and the historical behavior of the initiating object are obtained step by step, and the initiating object represents a process or a thread;

[0019] Determine whether there is access behavior in the historical behavior of the initiating object;

[0020] If not, the initiating object is marked as risky;

[0021] Determine the access route based on the correspondence between the initiating object and the access behavior as well as the risk tag.

[0022] In a possible implementation, determining the risk source of access information and the protection instruction corresponding to the risk source according to the access route of the access behavior includes:

[0023] When there is a risk tag in the access line, the initiating object corresponding to the risk tag is used as the risk source;

[0024] Generate protection instructions corresponding to the risk source, and the protection instructions are used to intercept access behavior and / or output alarm information.

[0025] In a possible implementation, the monitoring point is deployed in the EBPF program on the monitored device.

[0026] In a possible implementation, the control register is the CR3 register.

[0027] In a second aspect of the present application, a security protection system based on a business line is provided. The system includes:

[0028] A data acquisition module, used to acquire access information at a monitoring point, where the access information represents information required to access the monitored device;

[0029] The risk judgment module is used to analyze the access behavior corresponding to the access information and determine the basic risk of the access behavior;

[0030] The access line tracing module is used to trace the access behavior according to the basic risk and access information, and determine the access line of the access behavior. The access line includes the relationship between the process and thread generated during the access behavior. The relationship between the process and thread is determined by the control register deployed on the monitored device;

[0031] The risk determination module is used to determine the risk source of access information and the protection instructions corresponding to the risk source according to the access route of the access behavior.

[0032] In a third aspect of the present application, an electronic device is provided, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method described above is implemented.

[0033] In a fourth aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method according to the first aspect of the present application is implemented.

[0034] In summary, the present application includes at least one beneficial technical effect:

[0035] Access information is obtained by deploying monitoring points on terminal devices. The basic risk of the access behavior is determined based on the access behavior corresponding to the access information. The access behavior is traced based on the basic risk to obtain the access line. Each node in the access line is obtained from the control register. The data has high authenticity, which lays the foundation for the judgment of the risk source. Then the risk source in the access line is obtained, and the protection instruction corresponding to the risk source is generated to achieve protection of the terminal device and improve the protection capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a schematic diagram of the operating environment of the business line-based security protection method provided in this application.

[0037] Figure 2 It is a flowchart of the business line-based security protection method provided in this application.

[0038] Figure 3 It is a structural diagram of the business line-based security protection system provided by this application.

[0039] Figure 4 It is a schematic diagram of the structure of the electronic device provided by this application.

[0040] In the figure, 100, operating environment; 110, monitoring device; 120, monitored device; 201, data acquisition module; 202, risk judgment module; 203, access line tracing module; 204, risk determination module; 301, CPU; 302, ROM; 303, RAM; 304, I / O interface; 305, input part; 306, output part; 307, storage part; 308, communication part; 309, drive; 310, removable media. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0042] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0043] At present, network security threats are constantly escalating. Advanced attack organizations usually use disguise, blinding, bypassing and other means to break through the defense line of enterprise systems, such as low-frequency blasting, white program utilization, encrypted communication, rootkit, low-level function call, embedded assembly, etc., which are difficult to deal with by traditional single-point tools. Among them, low-frequency blasting refers to the attacker's use of low-frequency methods to infiltrate and destroy the target system to evade detection and defense. Compared with traditional high-frequency attacks, low-frequency attacks are often more concealed, time-consuming, and cause more serious losses to the attacked. White program utilization refers to the attack technology that Trojans use legitimate programs to load themselves. For example, importing fake certificates makes it impossible for security software to intercept. Rootkit is a special malware whose function is to hide itself and the specified files, processes, network links and other information on the installation target. Rootkit achieves the purpose of hiding information by loading special drivers and modifying the system kernel. How to protect computers and computer networks from interference from malware is a problem that needs to be solved at present.

[0044] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0045] Figure 1 It is a schematic diagram of the operating environment provided by the present application. The operating environment 100 includes multiple terminal devices. Data is transmitted between the multiple terminal devices through wireless communication or wired communication. In order to monitor abnormal behavior on the terminal devices and improve the terminal devices' ability to protect against abnormal behavior, a security protection method based on a business line is configured in any terminal device. The terminal device configured with the above method is called a monitoring device 110, and other devices are called monitored devices 120. It should be understood that the monitoring device 110 can not only monitor the monitored device 120, but also monitor itself. In order to further illustrate the operation process of the security protection method based on the business line, the embodiment of the present application provides a security protection method based on the business line. The main process of the above method is described as follows.

[0046] like Figure 2 As shown:

[0047] Step S101: obtaining access information at a monitoring point.

[0048] Specifically, the monitoring point is deployed in the eBPF program on any of the terminal devices, and the monitoring point is used to obtain access information of various accesses on the terminal device. The access information represents the information required to access the monitored device 120, such as user number, user password, user authority, access object, initiating object, etc.

[0049] eBPF (extended Berkeley Packet Filter) is a technology that can run user-written programs in the Linux kernel without modifying the kernel code or loading kernel modules. The eBPF program is written in C language and compiled into an object file, namely the eBPF bytecode file, by Clang. The above-mentioned Clang is a compiler that can compile the eBPF program. Then, an application needs to load the compiled eBPF bytecode into the kernel by calling the Linux kernel's system call. During the loading process, the kernel will verify the eBPF program to ensure that the eBPF program is safe.

[0050] By using eBPF, deep monitoring of terminal devices can be achieved. At the same time, eBPF is closer to the bottom layer and is not easily tampered with, preventing malware from bypassing monitoring points and providing a basis for the protection of terminal devices.

[0051] Step S102: Analyze the access behavior corresponding to the access information and determine the basic risk of the access behavior.

[0052] Specifically, the access object and access risk table of the access behavior are obtained, and the access risk table is used to reflect the risk of different access objects; according to the access object and the access risk table, the basic risk of the access behavior is determined, and the basic risk is used to reflect the importance of the access object.

[0053] The access risk table includes the access object and the importance of the access object. The more important the access object is, the higher the risk of the access object is. Conversely, the less important the access object is, the lower the risk of the access object is. The access risk table is set according to the value of the actual data on the terminal device. For example, if the access behavior is to read data A, then the access object of the access behavior is data A, but the content involved in data A is very important and can only be viewed by senior administrators. When a terminal device accesses data A, the basic risk of the access behavior is high risk, because once data A is leaked or tampered with, the loss caused is very large. For another example, if the access behavior is to modify data B, then the access object of the access behavior is data B, but the content involved in data B is generally important and can be modified by any company employee. When a terminal device accesses or modifies data B, the basic risk of the access behavior is medium risk, because the loss caused by the leakage or tampering of data B is relatively controllable. For another example, if the access behavior is to read C data, then the access object of the access behavior is C data, but the content of C data is not important and anyone can view it. When a terminal device accesses or modifies C data, the basic risk of the access behavior is low risk, because the loss caused by the leakage or tampering of C data is very small or no loss will occur.

[0054] Step S103: Trace the access behavior based on the basic risk and access information to determine the access route of the access behavior.

[0055] Specifically, the access line includes the relationship between the process and the thread generated in the process of performing the access behavior, and the relationship between the process and the thread is determined by the control register deployed on the monitored device 120. In the embodiment provided by the present application, the control register is a CR3 register. By using the CR3 register, on the one hand, the creation relationship between the process and the thread can be obtained by using the CR3 register containing the physical memory base address of the page directory table. On the other hand, the CR3 register belongs to the bottom layer coding and is not easily tampered with. The authenticity of the obtained data is higher, which provides a basis for tracing the access behavior.

[0056] When the above basic risk is low risk, the access behavior will not be traced to avoid excessive waste of computing resources due to risk monitoring. When the above basic risk is medium risk or high risk, the initiator object of the above access behavior and the historical behavior of the above initiator object will be obtained step by step. The above initiator object represents the above process or the above thread. It is judged whether the above access behavior exists in the historical behavior of the above initiator object. If the above access behavior exists, it is necessary to continue to obtain the upper-level initiator object and continue to judge. If the upper-level initiator object cannot be found during the judgment process, it means that there is no risk source in the access line of the access behavior. If during the judgment process, a certain initiator object in the access line has not generated the above access behavior, it means that the initiator object may have risks, and the initiator object is marked as risk. If it is impossible to determine or judge whether the initiator object has the above access behavior, it is still necessary to continue to obtain the upper-level initiator object and continue to judge. If it is determined that the initiator object has not had the above access behavior, the initiator object is marked as risk to form an access line.

[0057] In the embodiment provided in the present application, after a certain initiating object is marked as risk, there is no need to continue to judge the initiating object at the previous level. In other implementations, the complete access route of the access behavior can be judged, which is not limited here.

[0058] In a specific example, there is a terminal device A that generates process a1 and process b1 to perform a task, process a1 generates thread a11 and thread a12 to perform, process b1 generates thread b11 and thread b12 to perform, thread a11 performs an access behavior to access the first database, and thread b12 performs an access behavior to access the second database. When the access object is the first database, the basic risk corresponding to the access object is medium risk, and it is necessary to determine whether the initiating object thread a11 of the first database has accessed the first database. If so, it is further determined whether the initiating object process a1 of thread a11 has accessed the first database. If not, process a1 is marked as a risk, and the access line obtained is process a1→thread a11→first database, where process a1 includes a risk mark. When the access object is the second database, the basic risk corresponding to the access object is low risk, and there is no need to obtain the initiating object of the second database. In another embodiment, after risk marking of process a1, it is possible to continue to determine whether the initiating object of process a1, terminal device A, has accessed the first database. If so, the determination of the initiating object of terminal device A is continued. However, if the initiating object of terminal device A does not exist, the determination is terminated, and the access route obtained is terminal device A→process a1→thread a11→first database.

[0059] Step S104: Determine the risk source of the access information and the protection instruction corresponding to the risk source according to the access route of the access behavior.

[0060] Specifically, when the above-mentioned risk mark exists in the above-mentioned access line, the initiating object corresponding to the above-mentioned risk mark is used as the risk source; a protection instruction corresponding to the above-mentioned risk source is generated, and the above-mentioned protection instruction is used to intercept the above-mentioned access behavior and / or output alarm information.

[0061] This application sets monitoring points in the underlying code to trace and judge access behaviors, preventing malware from circumventing the terminal device's defense mechanism through white program exploitation, low-frequency blasting, etc., improving the terminal device's protection capabilities while also improving the data security of the terminal device. By real-time monitoring and responding to network threats, potential risks can be reduced, business continuity can be maintained, and sensitive information can be properly protected.

[0062] The present application embodiment provides a security protection system based on a business line, referring to Figure 3 , the security protection system based on business lines includes:

[0063] The data acquisition module 201 is used to acquire access information at the monitoring point, where the access information represents information required to access the monitored device 120;

[0064] The risk judgment module 202 is used to analyze the access behavior corresponding to the access information and determine the basic risk of the access behavior;

[0065] The access line tracing module 203 is used to trace the access behavior according to the basic risk and access information, and determine the access line of the access behavior. The access line includes the relationship between the process and the thread generated during the access behavior. The relationship between the process and the thread is determined by the control register deployed on the monitored device 120;

[0066] The risk determination module 204 is used to determine the risk source of the access information and the protection instruction corresponding to the risk source according to the access route of the access behavior.

[0067] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0068] The present application embodiment discloses an electronic device. Figure 4 , the electronic device includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 307 to the random access memory (RAM) 303. In the RAM 303, various programs and data required for system operation are also stored. The CPU 301, ROM 302 and RAM 303 are connected to each other through a bus. The input / output (I / O) interface 304 is also connected to the bus.

[0069] The following components are connected to the I / O interface 304: an input section 305 including a keyboard, a mouse, etc.; an output section 306 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 307 including a hard disk, etc.; and a communication section 308 including a network interface card such as a local area network (LAN) card, a modem, etc. The communication section 308 performs communication processing via a network such as the Internet. A drive 309 is also connected to the I / O interface 304 as needed. A removable medium 310, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 309 as needed so that a computer program read therefrom is installed into the storage section 307 as needed.

[0070] In particular, according to an embodiment of the present application, the above reference flow chart Figure 2 The described process can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a machine-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part 308, and / or installed from a removable medium 310. When the computer program is executed by a central processing unit (CPU) 301, the above-mentioned functions defined in the device of the present application are executed.

[0071] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination of the above.

[0072] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned application concept. For example, the above features are replaced with (but not limited to) technical features with similar functions applied in the present application.

Claims

1. A security protection method based on a business line, characterized in that: include: Acquire access information at a monitoring point, wherein the access information indicates information required to access a monitored device; Analyze the access behavior corresponding to the access information to determine the basic risk of the access behavior; Tracing the access behavior according to the basic risk and the access information to determine the access route of the access behavior, wherein the access route includes the relationship between the process and the thread generated during the access behavior, and the relationship between the process and the thread is determined by the control register deployed on the monitored device; According to the access route of the access behavior, the risk source of the access information and the protection instruction corresponding to the risk source are determined.

2. The business line-based security protection method according to claim 1, characterized in that: The analyzing the access behavior corresponding to the access information to determine the basic risk of the access behavior includes: Obtaining an access object and an access risk table of the access behavior, wherein the access risk table is used to reflect the risk of different access objects; The basic risk of the access behavior is determined according to the access object and the access risk table, and the basic risk is used to reflect the importance of the access object.

3. The business line-based security protection method according to claim 1, characterized in that: Before tracing the access behavior according to the basic risk and the access information to determine the access route of the access behavior, the method further includes: When the basic risk is low risk, executing the access behavior; When the basic risk is medium risk or high risk, the access behavior is traced to determine the access route of the access behavior.

4. The business line-based security protection method according to claim 3 is characterized in that: The tracing the access behavior according to the basic risk and the access information to determine the access route of the access behavior includes: Acquire the initiating object of the access behavior and the historical behavior of the initiating object step by step, wherein the initiating object represents the process or the thread; Determining whether the access behavior exists in the historical behavior of the initiating object; If not, the initiating object is marked as risk; An access route is determined according to the correspondence between the initiating object and the access behavior and the risk tag.

5. The business line-based security protection method according to claim 4, characterized in that: The determining, according to the access route of the access behavior, the risk source of the access information and the protection instruction corresponding to the risk source includes: When the risk mark exists in the access line, taking the initiating object corresponding to the risk mark as the risk source; Generate a protection instruction corresponding to the risk source, wherein the protection instruction is used to intercept the access behavior and / or output warning information.

6. The business line-based security protection method according to claim 1, characterized in that: The monitoring point is deployed in the EBPF program on the monitored device.

7. The business line-based security protection method according to claim 1, characterized in that: The control register is the CR3 register.

8. A security protection system based on a business line, characterized in that: include: A data acquisition module, used to acquire access information at a monitoring point, wherein the access information indicates information required to access a monitored device; A risk judgment module, used to analyze the access behavior corresponding to the access information and determine the basic risk of the access behavior; An access line tracing module, used to trace the access behavior according to the basic risk and the access information, and determine the access line of the access behavior, wherein the access line includes the relationship between the process and the thread generated in the process of performing the access behavior, and the relationship between the process and the thread is determined by the control register deployed on the monitored device; The risk determination module is used to determine the risk source of the access information and the protection instruction corresponding to the risk source according to the access line of the access behavior.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored which can be loaded by a processor and execute the method as claimed in any one of claims 1 to 7.

Images