Threat detection rule verification method and device, equipment and storage medium
Through the automated threat detection rule verification method, using simulated test cases and system plug-in Agent, the inefficiency problem of threat detection rule verification in the existing technology is solved, which improves verification efficiency and accuracy, reduces costs, and enhances network security.
Patent Information
- Application Number
- CN202411300683.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-18
- Publication Date
- 2024-12-10
AI Technical Summary
In the prior art, threat detection rules verification relies on manual methods, and there are problems such as incomplete data coverage, high cost, false alarms and missed updates, resulting in low threat detection efficiency.
By collecting the operation log of the target machine, writing threat detection rules to be verified, and using simulated test cases to launch simulation attacks through the system plug-in Agent, determining the verification results of the rules based on the alarm situation, and realizing automated verification and rule updates.
It improves the verification efficiency and accuracy of threat detection rules, reduces verification costs, enhances the enterprise's network security level, and ensures timely detection of new attacks.
Smart Images
Figure CN119109676A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to a threat detection rule verification method, device, equipment and storage medium. Background Art
[0002] With the rapid development of information technology, the security of cyberspace has become a global focus, and the diversity and complexity of cybersecurity threats have also increased. In building a comprehensive, efficient and intelligent cybersecurity defense system, threat detection is the core defense mechanism, and its effectiveness directly determines the defense capability of the entire system.
[0003] In the prior art, the effectiveness of threat detection rules is usually verified manually. However, this method has some significant disadvantages, including: incomplete data coverage: the collected network data often cannot fully cover all threat detection rules. This is mainly due to the diversity and evolving characteristics of network threats. New attack methods may not yet be included in the collected data set, resulting in the inability to fully verify the effectiveness of these threat detection rules; high detection costs: in order to verify the threat detection rules as comprehensively as possible, it is necessary to collect larger-scale network data, which not only increases the cost of data collection, storage and processing, but also prolongs the detection cycle, making the entire verification process more time-consuming and resource-intensive; false positive and false negative problems: when using a large amount of data for verification, false positives or false negatives may occur due to factors such as data quality and rule accuracy, thereby wasting security resources, reducing system availability, and exposing the system to undetected security threats; update lag: due to the complexity of data collection and rule verification, emerging threats may not be detected and responded to in a timely manner, resulting in the threat detection rules losing their effectiveness in the face of new attacks, thereby increasing the risk of the system being attacked. Summary of the invention
[0004] The present invention provides a threat detection rule verification method, device, equipment and storage medium, which can improve the verification efficiency of threat detection rules and the accuracy of verification results, and reduce the verification cost of threat detection rules.
[0005] According to one aspect of the present invention, a threat detection rule verification method is provided, the method comprising:
[0006] Collecting the operation logs of the target machine in the network environment to be tested, and writing the threat detection rules to be verified in the target machine according to the operation logs;
[0007] Obtain multiple simulation test cases, and control the host to launch a simulation attack on the target machine through the system plug-in Agent in the host according to the multiple simulation test cases;
[0008] According to the alarm situation triggered by the threat detection rule in the target machine, a verification result corresponding to the threat detection rule is determined.
[0009] Optionally, the operation log of the target machine includes: a network log and a host log of the target machine;
[0010] Writing threat detection rules to be verified in the target machine according to the operation log, including:
[0011] Perform field extraction on the operation log of the target machine, and parse the logs in different formats into JSON format according to the field extraction results;
[0012] Based on the log parsing results, write threat detection rules to be verified in the target machine.
[0013] Optionally, determining a verification result corresponding to the threat detection rule according to an alarm condition triggered by the threat detection rule in the target machine includes:
[0014] Determining whether the threat detection rule is effective according to the alarm triggered by the threat detection rule in the target machine;
[0015] If so, it is determined that the threat detection rule verification is successful;
[0016] If not, then analyze the failure reason corresponding to the threat detection rule.
[0017] Optionally, analyzing the failure reason corresponding to the threat detection rule includes:
[0018] The attack features corresponding to the simulated test case are extracted, and the attack features are analyzed to obtain the failure reasons corresponding to the threat detection rules.
[0019] Optionally, after analyzing the failure cause corresponding to the threat detection rule, the method further includes:
[0020] The threat detection rule is updated according to the failure reason corresponding to the threat detection rule, and then the execution is returned to control the host to launch a simulated attack on the target machine according to the multiple simulated test cases through the system plug-in Agent in the host.
[0021] Optionally, after analyzing the failure cause corresponding to the threat detection rule, the method further includes:
[0022] Determine whether the failure reason corresponding to the threat detection rule is a missed report;
[0023] If so, the attack features corresponding to the simulated test cases are extracted, and the corresponding threat detection rules are rewritten according to the attack features. Then, the execution is returned to control the host to launch a simulated attack on the target machine according to the multiple simulated test cases through the system plug-in Agent in the host.
[0024] Optionally, the method comprises:
[0025] After detecting a new attack behavior, define the simulation test case corresponding to the new attack behavior in the system plug-in Agent;
[0026] Through the system plug-in Agent in the host, according to the simulated test case corresponding to the new attack behavior, the host is controlled to launch a simulated attack on the target machine;
[0027] According to the alarm situation triggered by the threat detection rule in the target machine, the verification result of the threat detection rule for the new attack behavior is determined.
[0028] According to another aspect of the present invention, a threat detection rule verification device is provided, the device comprising:
[0029] A log collection module is used to collect the operation logs of the target machine in the network environment to be tested, and write the threat detection rules to be verified in the target machine according to the operation logs;
[0030] A use case acquisition module is used to acquire multiple simulation test cases, and control the host to launch a simulation attack on the target machine according to the multiple simulation test cases through the system plug-in Agent in the host;
[0031] The verification module is used to determine the verification result corresponding to the threat detection rule according to the alarm situation triggered by the threat detection rule in the target machine.
[0032] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:
[0033] at least one processor; and
[0034] a memory communicatively connected to the at least one processor; wherein,
[0035] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the threat detection rule verification method described in any embodiment of the present invention.
[0036] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the threat detection rule verification method described in any embodiment of the present invention when executed.
[0037] The technical solution provided by the embodiment of the present invention collects the operation log of the target machine in the network environment to be tested, writes the threat detection rules to be verified in the target machine according to the operation log, obtains multiple simulation test cases, controls the host to launch a simulated attack on the target machine according to the multiple simulation test cases through the system plug-in Agent in the host, and determines the verification result corresponding to the threat detection rule according to the alarm situation triggered by the threat detection rule in the target machine. The technical means can make the simulation test cases cover a wide range of threat detection rules and improve the accuracy of the verification results. Compared with the existing technology that relies on manual verification, the automation of the threat detection rule verification method can be realized, the verification cost can be reduced, and the enterprise can be helped to quickly build a network threat detection environment, verify the effectiveness of the existing threat detection rules, greatly improve the verification efficiency of the rule effectiveness, and improve the enterprise network security level.
[0038] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0040] Figure 1 is a flowchart of a threat detection rule verification method provided according to an embodiment of the present invention;
[0041] Figure 2 is a flowchart of another threat detection rule verification method provided according to an embodiment of the present invention;
[0042] Figure 3 is a structural diagram of a threat detection rule verification device provided according to an embodiment of the present invention;
[0043] Figure 4 It is a structural schematic diagram of an electronic device for implementing the threat detection rule verification method according to an embodiment of the present invention. DETAILED DESCRIPTION
[0044] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0045] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0046] Figure 1 A flowchart of a threat detection rule verification method provided in an embodiment of the present invention. This embodiment can be applied to verifying the validity of network threat detection rules. The method can be executed by a threat detection rule verification device. The threat detection rule verification device can be implemented in the form of hardware and / or software. The threat detection rule verification device can be configured in an electronic device.
[0047] like Figure 1 As shown, the method includes:
[0048] Step 110: Collect the operation log of the target machine in the network environment to be tested, and compile the threat detection rules to be verified in the target machine according to the operation log.
[0049] In this embodiment, specifically, the operation logs of the target machine in the network environment to be tested can be collected, including network logs and host logs. After the operation logs are collected, the network threats that the target machine may suffer can be identified based on the feature extraction results of the operation logs, and the threat detection rules to be verified in the target machine can be written.
[0050] Step 120: Obtain multiple simulation test cases, and control the host to launch a simulation attack on the target machine through the system plug-in Agent in the host according to the multiple simulation test cases.
[0051] In this step, simulation test cases related to network intrusion and attack can be collected. The simulation test cases are mainly used to define the steps and commands for executing simulated attacks. They can be classified according to the MITRE ATT&CK (MITRE Advanced Tactics Techniques and Common Knowledge) framework to facilitate the subsequent verification of threat detection rules for different attack methods.
[0052] In a specific embodiment, a host can be pre-deployed in the network environment to be tested and a system plug-in Agent can be installed. The system plug-in Agent can control the host to launch a simulated attack on the target machine according to the execution steps and commands defined in the simulated test cases based on multiple simulated test cases issued.
[0053] Optionally, the host may initiate simulated attacks on the target machine at preset time intervals in a timed task manner, so as to continuously verify the effectiveness of the threat detection rules.
[0054] The system plug-in Agent is a software component used to perform specific tasks, collect information, manage resources, or interact with other system components in various systems (such as operating systems, applications, monitoring systems, network management systems, etc.). These plug-ins are usually designed to be modular to facilitate the expansion of system functions while maintaining the stability and maintainability of the system's core architecture.
[0055] Step 130: Determine a verification result corresponding to the threat detection rule according to an alarm condition triggered by the threat detection rule in the target machine.
[0056] In this embodiment, after the host launches a simulated attack on the target machine, it can determine whether the threat detection rule is valid based on the alarm triggered by the threat detection rule in the target machine; if so, it is determined that the threat detection rule is successfully verified; if not, the failure reason corresponding to the threat detection rule is analyzed.
[0057] The technical solution provided by the embodiment of the present invention collects the operation log of the target machine in the network environment to be tested, writes the threat detection rules to be verified in the target machine according to the operation log, obtains multiple simulation test cases, controls the host to launch a simulated attack on the target machine according to the multiple simulation test cases through the system plug-in Agent in the host, and determines the verification result corresponding to the threat detection rule according to the alarm situation triggered by the threat detection rule in the target machine. The technical means can make the simulation test cases cover a wide range of threat detection rules and improve the accuracy of the verification results. Compared with the existing technology that relies on manual verification, the automation of the threat detection rule verification method can be realized, the verification cost can be reduced, and the enterprise can be helped to quickly build a network threat detection environment, verify the effectiveness of the existing threat detection rules, greatly improve the verification efficiency of the rule effectiveness, and improve the enterprise network security level.
[0058] Figure 2 A flowchart of another threat detection rule verification method provided by an embodiment of the present invention, such as Figure 2 As shown, the method includes:
[0059] Step 210: Collect the operation logs of the target machine in the network environment to be tested, perform field extraction on the operation logs of the target machine, and parse the logs in different formats into JSON format according to the field extraction results.
[0060] In this embodiment, specifically, after the operation log of the target machine is collected, field extraction can be performed on the operation log of the target machine according to a preset field type, and then the operation logs in different formats can be uniformly parsed into a JSON format according to the field extraction result.
[0061] Step 220: Write threat detection rules to be verified in the target machine according to the log parsing results.
[0062] In this step, after the operation logs in different formats are uniformly parsed into JSON format, threat detection rules can be written based on the log parsing results based on the Flink detection engine.
[0063] Step 230: Obtain multiple simulation test cases, and control the host to launch a simulation attack on the target machine through the system plug-in Agent in the host according to the multiple simulation test cases.
[0064] Step 240 , judging whether the threat detection rule is valid according to the alarm triggered by the threat detection rule in the target machine, if so, executing step 250 , if not, executing step 260 .
[0065] Step 250: Determine whether the threat detection rule verification is successful.
[0066] Step 260: extract attack features corresponding to the simulation test case, and analyze the attack features to obtain failure causes corresponding to the threat detection rule.
[0067] In this embodiment, for failed threat detection rules, the attack features or attack behaviors corresponding to the simulated test cases can be automatically extracted, and the attack features or attack behaviors can be analyzed, and the failure reasons corresponding to the threat detection rules can be determined according to the analysis results.
[0068] Step 270: Update the threat detection rule according to the failure reason corresponding to the threat detection rule.
[0069] In this step, after the threat detection rule is updated, the process returns to step 230 to control the host to initiate a simulated attack on the target machine according to the multiple simulated test cases through the system plug-in Agent in the host.
[0070] In one implementation of the present embodiment, after obtaining the failure cause, it can be determined whether the failure cause corresponding to the threat detection rule is a missed report (i.e., whether the threat detection rule does not cover the attack behavior, or whether a threat detection rule already exists, but the corresponding alarm is not triggered due to changes in the attack characteristics, etc.); if so, the attack characteristics corresponding to the simulated test case are extracted, and the corresponding threat detection rule is rewritten according to the attack characteristics, and then the execution is returned to control the host to initiate a simulated attack on the target machine according to the multiple simulated test cases through the system plug-in Agent in the host until the threat detection rule can trigger an alarm, thereby ensuring the effectiveness of the threat detection rule.
[0071] In one implementation of this embodiment, the method includes: after detecting a new attack behavior, defining a simulation test case corresponding to the new attack behavior in the system plug-in Agent; through the system plug-in Agent in the host, according to the simulation test case corresponding to the new attack behavior, controlling the host to launch a simulated attack on the target machine; according to the alarm triggered by the threat detection rule in the target machine, determining the verification result of the threat detection rule for the new attack behavior.
[0072] The advantage of this setting is that the simulation test cases can cover the newly added attack types, thereby improving the timeliness of the threat detection rule verification results.
[0073] The technical solution provided by the embodiment of the present invention collects the operation log of the target machine in the network environment to be tested, extracts fields from the operation log of the target machine, parses the logs of different formats into JSON format according to the field extraction results, writes the threat detection rules to be verified in the target machine according to the log parsing results, obtains multiple simulation test cases, controls the host to launch a simulated attack on the target machine according to the multiple simulation test cases through the system plug-in Agent in the host, and judges whether the threat detection rule is valid according to the alarm triggered by the threat detection rule in the target machine. If so, it is determined that the threat detection rule verification is successful. If not, the attack features corresponding to the simulation test case are extracted, the attack features are analyzed to obtain the failure cause, the threat detection rule is updated, and then the technical means for returning to execute the operation of the host launching a simulated attack on the target machine can improve the verification efficiency of the threat detection rule and the accuracy of the verification result, and reduce the verification cost of the threat detection rule.
[0074] Figure 3 A schematic diagram of a threat detection rule verification device provided by an embodiment of the present invention is provided. The device is applied to an electronic device, such as Figure 3 As shown, the device includes: a log collection module 310, a use case acquisition module 320 and a verification module 330.
[0075] The log collection module 310 is used to collect the operation logs of the target machine in the network environment to be tested, and compile the threat detection rules to be verified in the target machine according to the operation logs;
[0076] A use case acquisition module 320 is used to acquire multiple simulation test cases, and control the host to launch a simulation attack on the target machine according to the multiple simulation test cases through the system plug-in Agent in the host;
[0077] The verification module 330 is used to determine the verification result corresponding to the threat detection rule according to the alarm situation triggered by the threat detection rule in the target machine.
[0078] The technical solution provided by the embodiment of the present invention collects the operation log of the target machine in the network environment to be tested, writes the threat detection rules to be verified in the target machine according to the operation log, obtains multiple simulation test cases, controls the host to launch a simulated attack on the target machine according to the multiple simulation test cases through the system plug-in Agent in the host, and determines the verification result corresponding to the threat detection rule according to the alarm situation triggered by the threat detection rule in the target machine. The technical means can make the simulation test cases cover a wide range of threat detection rules and improve the accuracy of the verification results. Compared with the existing technology that relies on manual verification, the automation of the threat detection rule verification method can be realized, the verification cost can be reduced, and the enterprise can be helped to quickly build a network threat detection environment, verify the effectiveness of the existing threat detection rules, greatly improve the verification efficiency of the rule effectiveness, and improve the enterprise network security level.
[0079] Based on the above embodiment, the operation log of the target machine includes: a network log and a host log of the target machine.
[0080] The log collection module 310 includes:
[0081] The log parsing unit is used to extract fields from the operation log of the target machine, and parse the logs of different formats into JSON format according to the field extraction results; and write the threat detection rules to be verified in the target machine according to the log parsing results.
[0082] The verification module 330 includes:
[0083] A judgment unit, configured to judge whether the threat detection rule is valid according to the alarm triggered by the threat detection rule in the target machine; if so, determine that the threat detection rule is successfully verified; if not, analyze the failure reason corresponding to the threat detection rule;
[0084] A failure cause analysis unit, used to extract attack features corresponding to the simulated test case, and analyze the attack features to obtain the failure cause corresponding to the threat detection rule;
[0085] A detection rule updating unit, configured to update the threat detection rule according to the failure reason corresponding to the threat detection rule, and then return to execute the operation of controlling the host to launch a simulated attack on the target machine according to the plurality of simulated test cases through the system plug-in Agent in the host;
[0086] The false negative processing unit is used to determine whether the failure reason corresponding to the threat detection rule is a false negative; if so, the attack feature corresponding to the simulated test case is extracted, and the corresponding threat detection rule is rewritten according to the attack feature, and then the execution is returned to control the host to launch a simulated attack on the target machine according to the multiple simulated test cases through the system plug-in Agent in the host.
[0087] The device also includes:
[0088] The new attack processing module is used to define the simulation test cases corresponding to the new attack behaviors in the system plug-in Agent after detecting the new attack behaviors; through the system plug-in Agent in the host, according to the simulation test cases corresponding to the new attack behaviors, control the host to launch a simulated attack on the target machine; according to the alarm triggered by the threat detection rules in the target machine, determine the verification result of the threat detection rules for the new attack behaviors.
[0089] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not fully described in the embodiments of the present invention, please refer to the methods provided by all the above embodiments of the present invention.
[0090] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.
[0091] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0092] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0093] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the threat detection rule verification method.
[0094] In some embodiments, the threat detection rule verification method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the threat detection rule verification method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the threat detection rule verification method in any other appropriate manner (e.g., by means of firmware).
[0095] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0096] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.
[0097] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0098] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).
[0099] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0100] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.
[0101] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.
[0102] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims
1. A threat detection rule verification method, characterized in that: The method comprises: Collecting the operation logs of the target machine in the network environment to be tested, and writing the threat detection rules to be verified in the target machine according to the operation logs; Obtain multiple simulation test cases, and control the host to launch a simulation attack on the target machine through the system plug-in Agent in the host according to the multiple simulation test cases; According to the alarm situation triggered by the threat detection rule in the target machine, a verification result corresponding to the threat detection rule is determined.
2. The method according to claim 1, characterized in that The operation log of the target machine includes: the network log and the host log of the target machine; Writing threat detection rules to be verified in the target machine according to the operation log, including: Perform field extraction on the operation log of the target machine, and parse the logs in different formats into JSON format according to the field extraction results; Based on the log parsing results, write threat detection rules to be verified in the target machine.
3. The method according to claim 1, characterized in that: Determining a verification result corresponding to the threat detection rule according to an alarm condition triggered by the threat detection rule in the target machine includes: Determining whether the threat detection rule is effective according to the alarm triggered by the threat detection rule in the target machine; If so, it is determined that the threat detection rule verification is successful; If not, then analyze the failure reason corresponding to the threat detection rule.
4. The method according to claim 3, characterized in that: Analyze the failure reasons corresponding to the threat detection rules, including: The attack features corresponding to the simulated test case are extracted, and the attack features are analyzed to obtain the failure reasons corresponding to the threat detection rules.
5. The method according to claim 3, characterized in that: After analyzing the failure reasons corresponding to the threat detection rules, the method further includes: The threat detection rule is updated according to the failure reason corresponding to the threat detection rule, and then the execution is returned to control the host to launch a simulated attack on the target machine according to the multiple simulated test cases through the system plug-in Agent in the host.
6. The method according to claim 1, characterized in that After analyzing the failure reasons corresponding to the threat detection rules, the method further includes: Determine whether the failure reason corresponding to the threat detection rule is a missed report; If so, the attack features corresponding to the simulated test cases are extracted, and the corresponding threat detection rules are rewritten according to the attack features. Then, the execution is returned to control the host to launch a simulated attack on the target machine according to the multiple simulated test cases through the system plug-in Agent in the host.
7. The method according to claim 1, characterized in that The method comprises: After detecting a new attack behavior, define the simulation test case corresponding to the new attack behavior in the system plug-in Agent; Through the system plug-in Agent in the host, according to the simulated test case corresponding to the new attack behavior, the host is controlled to launch a simulated attack on the target machine; According to the alarm situation triggered by the threat detection rule in the target machine, the verification result of the threat detection rule for the new attack behavior is determined.
8. A threat detection rule verification device, characterized in that: The device comprises: A log collection module is used to collect the operation logs of the target machine in the network environment to be tested, and write the threat detection rules to be verified in the target machine according to the operation logs; A use case acquisition module is used to acquire multiple simulation test cases, and control the host to launch a simulation attack on the target machine according to the multiple simulation test cases through the system plug-in Agent in the host; The verification module is used to determine the verification result corresponding to the threat detection rule according to the alarm situation triggered by the threat detection rule in the target machine.
9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the threat detection rule verification method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the threat detection rule verification method according to any one of claims 1 to 7 when executed.