Threat path tracing method and device, equipment and medium

Abstract

The invention relates to the technical field of network security, and discloses a threat path tracing method, device, equipment and medium, the method comprises the following steps: obtaining security log information in a preset historical period, the security log information comprising source IP addresses and destination IP addresses corresponding to a plurality of threat traffic data; generating a first IP address set based on a source IP address and a destination IP address corresponding to each threat flow data, and determining a plurality of dangerous IP addresses and associated IP addresses corresponding to the dangerous IP addresses to generate an associated IP address list; determining frequent IP addresses in the associated IP address list and an association relationship between the frequent IP addresses; the node association graph is generated on the basis of the association relationship among the multiple frequent IP addresses, the node association graph is used for representing the path tracing of the threat traffic, and the node association graph capable of realizing the path tracing of the threat traffic is generated by performing association analysis on the IP addresses of the threat traffic; therefore, the security personnel can analyze the attack path of the threat traffic.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a threat path tracing method, device, equipment and medium. Background Art

[0002] With the development of network technology, the network is becoming more and more important to daily life and industrial production. At the same time, the attack paths of network threat traffic are becoming more and more complicated. In order to better prevent dangerous traffic, it is becoming more and more important to trace the access paths of dangerous traffic.

[0003] In the prior art, after intercepting threat traffic through a firewall and obtaining log information corresponding to the intercepted threat traffic data, the address information is often simply recorded, and the network attack path cannot be restored, resulting in professional technicians being unable to conduct in-depth analysis of the attack path of the threat traffic. Summary of the invention

[0004] In view of this, the present invention provides a threat path tracing method, device, equipment and medium to solve the problem that the network attack path cannot be traced, resulting in the inability of technical personnel to conduct in-depth analysis of threat traffic.

[0005] In a first aspect, the present invention provides a threat path tracing method, the method comprising:

[0006] Obtain security log information of a network security system in a preset historical period, wherein the security log information includes: a source IP address and a destination IP address corresponding to a plurality of threat traffic data;

[0007] Generate a first IP address set based on the source IP address and the destination IP address corresponding to each threat traffic data, and determine a plurality of dangerous IP addresses in the first IP address set;

[0008] Determine, based on the security log information, the associated IP addresses corresponding to each of the multiple dangerous IP addresses, and generate an associated IP address list;

[0009] Determine the frequent IP addresses in the associated IP address list and the association relationship between each frequent IP address;

[0010] A node association graph is generated based on the association relationship between the multiple frequent IP addresses, and the node association graph is used to characterize the path tracing of the threat traffic.

[0011] This method generates a first IP address set through the source IP address and destination IP address corresponding to the threat traffic data recorded in the security log, and determines the dangerous IP address therein, thereby generating an associated IP address list according to the associated IP address corresponding to each dangerous IP, and finally determines the frequent IP addresses and the association relationship between these frequent IP addresses, thereby finally generating a node association graph that can characterize the threat traffic path traceability, so that the staff can more intuitively understand the attack path of the threat traffic, which is convenient for relevant network security personnel to take timely and advance processing to ensure the security of network assets.

[0012] In an optional implementation, determining, based on the security log information, the associated IP addresses corresponding to each of the plurality of dangerous IP addresses, and generating an associated IP address list includes:

[0013] Determine, based on the security log information, when each dangerous IP address is a source IP address, the corresponding associated destination IP address, and when each dangerous IP address is a destination IP address, the corresponding associated source IP address;

[0014] Generate a corresponding first sub-table according to each dangerous IP address and the corresponding associated destination IP address, and generate a corresponding second sub-table according to each dangerous IP address and the corresponding associated source IP address;

[0015] A list of associated IP addresses is constructed according to the first sub-table and the second sub-table corresponding to each dangerous IP address.

[0016] In this embodiment, by generating a first sub-table and a second sub-table corresponding to each dangerous IP address according to the IP address corresponding to each dangerous IP address when it is used as the destination IP address and the source IP address, a list of associated IP addresses including multiple sub-tables can be generated to ensure the accuracy of the ultimately generated list of associated IP addresses, so as to facilitate the subsequent accurate determination of frequently occurring IP addresses and the corresponding association relationships.

[0017] In an optional implementation, the determining a plurality of dangerous IP addresses in the first IP address set includes:

[0018] Determine the public information corresponding to each IP address in the first IP address set;

[0019] Based on the public information corresponding to each IP address, a plurality of dangerous IP addresses in the first IP address set are determined.

[0020] In this implementation, dangerous IP addresses are determined through public information of each IP address in the first IP address set, which can more accurately determine dangerous IP addresses with risks and ensure the accuracy of dangerous address judgment.

[0021] In an optional implementation, the determining the frequent IP addresses in the associated IP address list and the association relationship between the frequent IP addresses includes:

[0022] By using a preset association rule mining algorithm, the frequent IP addresses in the associated IP address list and the corresponding association confidences between the frequent IP addresses in different association directions are determined;

[0023] The association relationship between the frequent IP addresses is determined according to the association direction and the corresponding association confidence.

[0024] In this implementation, a preset association rule mining algorithm is used to determine frequent IP addresses and the association confidence between each frequent IP address in different association directions, thereby more accurately determining the association relationship between frequent IP addresses and ensuring the accuracy of the subsequently generated node association graph.

[0025] In an optional implementation, before generating a node association graph based on the association relationship between the multiple frequent IP addresses, the method further includes:

[0026] An association relationship whose association confidence is less than a preset value is defined as a low association relationship, and the low association relationship between the frequent IP addresses is released.

[0027] This implementation method eliminates associations with low association confidence levels, thereby ensuring that the node association graph determined subsequently can better characterize the path tracing of threat traffic.

[0028] In an optional implementation, generating a node association graph based on the association relationship between the multiple frequent IP addresses includes:

[0029] Generate a node corresponding to each frequent IP address, and generate a directed edge between the corresponding nodes based on the association direction and the corresponding association confidence between the frequent IP addresses;

[0030] A node association graph is generated based on the nodes corresponding to the frequent IP addresses and the directed edges between the nodes.

[0031] This implementation generates directed edges through the corresponding association directions and association confidences between frequent IP addresses, thereby connecting the nodes corresponding to the frequent IP addresses, thereby generating a node association graph that accurately represents the association relationship and ensuring the display effect of the node association graph.

[0032] In an optional embodiment, the method further includes:

[0033] The influence weight of each node corresponding to each frequent IP address in the node association graph is determined by a preset link analysis algorithm; the influence weight is used to characterize the degree of participation of the corresponding frequent IP address in the threat traffic behavior.

[0034] This implementation method can determine the relatively important nodes in the node association diagram by determining the influence weight of the nodes corresponding to each frequent IP address, so that the staff can understand the degree of involvement of each frequent IP address in the threatening traffic behavior, so as to facilitate timely corresponding processing and achieve effective network protection.

[0035] In a second aspect, the present invention provides a threat path tracing device, the device comprising:

[0036] A log information acquisition module is used to obtain security log information of the network security system in a preset historical period, wherein the security log information includes: a source IP address and a destination IP address corresponding to a plurality of threat flow data;

[0037] A dangerous address determination module, used to generate a first IP address set based on a source IP address and a destination IP address corresponding to each threat traffic data, and determine a plurality of dangerous IP addresses in the first IP address set;

[0038] An address list generating module, used for determining the associated IP addresses corresponding to each of the plurality of dangerous IP addresses according to the security log information, and generating an associated IP address list;

[0039] The association relationship determination module is used to determine the frequent IP addresses in the associated IP address list and the association relationship between each frequent IP address

[0040] An association graph generation module is used to generate a node association graph based on the association relationship between the multiple frequent IP addresses, and the node association graph is used to characterize the path tracing of the threat traffic. In a third aspect, the present invention provides a computer device, including: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the threat path tracing method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0041] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the threat path tracing method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 is a flowchart of a threat path tracing method according to an embodiment of the present invention;

[0044] Figure 2 is a flowchart of another threat path tracing method according to an embodiment of the present invention;

[0045] Figure 3 is a schematic diagram of node inbound and outbound links according to an embodiment of the present invention;

[0046] Figure 4 is a schematic diagram of a process for calculating a PR value based on a transition probability matrix according to an embodiment of the present invention;

[0047] Figure 5 is a structural block diagram of a threat path tracing device according to an embodiment of the present invention;

[0048] Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0050] With the development of network technology, the network is becoming more and more important to daily life and industrial production. At the same time, the attack paths of network threat traffic are becoming more and more complicated. In order to better prevent dangerous traffic, it is becoming more and more important to trace the access paths of dangerous traffic.

[0051] In the prior art, after intercepting threat traffic through a firewall and obtaining log information corresponding to the intercepted threat traffic data, the address information is often simply recorded, and the network attack path cannot be restored, resulting in professional technicians being unable to conduct in-depth analysis of the attack path of the threat traffic.

[0052] To this end, an embodiment of the present invention provides a threat path tracing method, which generates a first IP address set through the source IP address and destination IP address corresponding to the threat traffic data recorded in the security log, and determines the dangerous IP address therein, thereby generating an associated IP address list according to the associated IP addresses corresponding to each dangerous IP, and finally determining the frequent IP addresses and the association relationship between these frequent IP addresses, thereby finally generating a node association graph that can characterize the threat traffic path tracing, so that the staff can more intuitively understand the attack path of the threat traffic, which is convenient for relevant network security personnel to carry out timely advance processing and ensure the security of network assets.

[0053] According to an embodiment of the present invention, a threat path tracing method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0054] In this embodiment, a threat path tracing method is provided, which can be used in the above network security protection process. Figure 1 is a flow chart of a threat path tracing method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0055] Step S101, obtaining security log information of a network security system in a preset historical period, the security log information including: source IP addresses and destination IP addresses corresponding to a plurality of threat traffic data.

[0056] It can be understood that the network security system can intercept threat traffic data, which includes the source IP address corresponding to the sender of the traffic and the IP address corresponding to the receiver of the traffic data. Usually, the network security system will store the specific information corresponding to the intercepted traffic data in the security log, specifically, it can be stored in the UTM security log. In the security log, the source IP address, destination IP address, threat occurrence time, threat type, source port, destination port, threat level, execution action and other information corresponding to each threat traffic are recorded. Network security staff can learn about the specific threat traffic information in the security log, and can also call the traffic information therein to analyze the threat traffic, that is, to obtain the security log information within a preset historical period, specifically, it can be the security log information within the last week or the last month. Exemplarily, the specific format of the dangerous traffic data in the security log information can be, threat traffic data 1, source IP address A, destination IP address B, and so on, each threat traffic data contains its corresponding source IP address and destination IP address.

[0057] Step S102: Generate a first IP address set based on the source IP address and the destination IP address corresponding to each threat traffic data, and determine a plurality of dangerous IP addresses in the first IP address set.

[0058] After obtaining the security log information of the preset historical period, the source IP address and destination IP address corresponding to each threat traffic data in the security log are counted, and the repeated IP addresses after counting are deduplicated to obtain an IP address set, namely the first IP address set. For example, threat traffic data 1, source IP address A, destination IP address B; threat traffic data 2, source IP address A, destination IP address C; threat traffic data 3, source IP address D, destination IP address A, taking these three threat traffic data as an example, the corresponding IP addresses in the first IP address set are {A, B, C, D}. Among these IP addresses, multiple dangerous IP addresses can be determined by preset judgment rules, such as determining dangerous IP addresses based on the prefix of the IP address, or determining dangerous IP addresses based on the historical records used to record dangerous IP addresses in the network security system, or determining multiple dangerous IP addresses based on other preset rules. The specific method of determining dangerous IP addresses can be set according to actual conditions or staff experience, and is not limited here.

[0059] Step S103: determining the associated IP addresses corresponding to each of the plurality of dangerous IP addresses according to the security log information, and generating an associated IP address list.

[0060] After the dangerous IP address is determined, since the security log information records the source IP address and threat IP address of each threat traffic data, the associated IP address corresponding to each threat IP address can be determined based on the correspondence between these source IP addresses and threat IP addresses, thereby generating an associated IP address list.

[0061] For example, the following threat traffic data are recorded in the security log information: threat traffic data 1, source IP address A, destination IP address B; threat traffic data 2, source IP address A, destination IP address C; threat traffic data 3, source IP address D, destination IP address A. Assuming that the dangerous IP address is A, its corresponding associated IP addresses are B, C, and D, where B and C are the corresponding destination IP addresses when A is the source IP address, and D is the corresponding source IP address when A is the destination IP address. These IP addresses can be summed with A to form a group of sublists. By analogy, the sublists corresponding to multiple IP addresses are obtained, and these sublists are used together to form an associated IP address list.

[0062] Specifically, the sublists in the associated IP address list can be divided according to whether the dangerous IP address is the source IP address or the destination IP address, and multiple sublists corresponding to each dangerous IP address are obtained. Taking A as an example, when A is the source IP address, its corresponding sublist 1 is B and C, when A is the source IP address, its corresponding sublist 2 is D, and so on, which will not be repeated here.

[0063] Step S104: determining the frequent IP addresses in the associated IP address list and the association relationship between the frequent IP addresses.

[0064] After determining the associated IP address list, since it includes multiple sub-tables corresponding to different dangerous IP addresses, the frequent IP addresses and the association between the frequent IP addresses can be determined according to the frequency of occurrence of different IP addresses in different sub-tables and the association when they appear in the same sub-table at the same time. For example, the specific frequent IP addresses and the association between the frequent IP addresses can be determined by a preset association analysis algorithm.

[0065] For example, assuming that the frequent IP addresses are determined to be A and B, the correlation analysis method can be used to determine, for each sub-table in the associated IP address list, the possibility of IP address B appearing when IP address A appears, or the possibility of IP address B appearing when IP address B appears, that is, the correlation between IP address A and IP address B.

[0066] Specifically, the Apriori algorithm may be used to determine specific frequent IP addresses and the associations between specific frequent IP addresses.

[0067] Step S105: Generate a node association graph based on the association relationship between multiple frequent IP addresses, and the node association graph is used to characterize the path tracing of threat traffic.

[0068] After determining the frequent IP addresses in the associated IP address list, these frequent IP addresses can be determined as nodes, and the frequent IP addresses with strong associations between these frequent IP addresses can be connected to obtain specific, for two frequent IP addresses, the association between the two has directionality, taking frequent IP address A and frequent IP address B as an example, there is an association between A and B, and there is also an association between B and A. Therefore, when connecting the frequent IP address A, it can be connected through directed edges, and these directed edges can represent the traffic path of the threat traffic. The stronger the association, the more likely the corresponding directed edge is the path of the real threat traffic.

[0069] The threat path tracing method provided in this embodiment generates a first IP address set through the source IP address and destination IP address corresponding to the threat traffic data recorded in the security log, and determines the dangerous IP address therein, thereby generating an associated IP address list according to the associated IP addresses corresponding to each dangerous IP, and finally determines the frequent IP addresses and the association relationship between these frequent IP addresses, thereby finally generating a node association graph that can characterize the threat traffic path tracing, so that the staff can more intuitively understand the attack path of the threat traffic, which is convenient for relevant network security personnel to take timely advance processing and ensure the security of network assets.

[0070] According to an embodiment of the present invention, another threat path tracing method embodiment is provided, which can be used in the above network security protection process. Figure 2 FIG. 4 is a flowchart of another threat path tracing method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0071] Step S201, obtaining security log information of the network security system in a preset historical period, the security log information including: source IP addresses and destination IP addresses corresponding to multiple threat traffic data. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0072] Step S202: Generate a first IP address set based on the source IP address and the destination IP address corresponding to each threat traffic data, and determine a plurality of dangerous IP addresses in the first IP address set.

[0073] Specifically, in step S202, a plurality of dangerous IP addresses in the first IP address set are determined, including:

[0074] Determine the public information corresponding to each IP address in the first IP address set;

[0075] Based on the public information corresponding to each IP address, a plurality of dangerous IP addresses in the first IP address set are determined.

[0076] It can be understood that after obtaining the first IP address set, each IP address can be understood as a website. For these websites, the corresponding public information can be found. The website public information can include whether its past access behavior is dangerous, or whether its website contains dangerous information. The staff can mark each IP address in the first IP address set through the public information of these websites, and mark the dangerous IP addresses with dangerous labels.

[0077] Step S203: determining the associated IP addresses corresponding to each of the plurality of dangerous IP addresses according to the security log information, and generating an associated IP address list.

[0078] Specifically, in the above step S203, it includes:

[0079] Step S2031, according to the security log information, determining the corresponding associated destination IP address when each dangerous IP address is the source IP address, and the corresponding associated source IP address when each dangerous IP address is the destination IP address.

[0080] For example, it is assumed that the threat flow data recorded in the security log information is as shown in Table 1 below:

[0081] Table 1

[0082] Threat traffic data Source IP address Destination IP address 1 A B 2 A C 3 D B 4 E A 5 C D 6 F C 7 G D

[0083] Through such security log information, the first IP address set obtained is {A, B, C, E, F, G}. Assuming that the dangerous IP addresses are A, C, and D, taking A as an example, when it is used as the source IP address, the corresponding associated destination IP address is B and C; when it is used as the destination IP address, the corresponding associated source IP address is E, and so on. The process of determining the associated source IP address and the associated destination IP address of other dangerous IP addresses will not be repeated here.

[0084] Step S2032: Generate a corresponding first sub-table according to each dangerous IP address and the corresponding associated destination IP address, and generate a corresponding second sub-table according to each dangerous IP address and the corresponding associated source IP address.

[0085] Similarly, taking the dangerous IP address A in the above example, its corresponding associated destination IP addresses are B and C, so its corresponding IP address in the first subtable is [A, B, C], and its corresponding associated destination IP address is E, so its corresponding IP address in the first subtable is [A, E]. In some cases, after obtaining multiple subtables corresponding to multiple dangerous IP addresses, if there are completely identical subtables in these subtables, deduplication processing can be performed to avoid the existence of completely identical subtable information, which affects the subsequent determination of frequent IP addresses and associated relationships. In some cases, if some dangerous IP addresses do not exist as source IP addresses or destination IP addresses, there is no need to determine the corresponding first subtable or second subtable.

[0086] Step S2033: construct a list of associated IP addresses according to the first sub-table and the second sub-table corresponding to each dangerous IP address.

[0087] After obtaining the first subtable and the second subtable corresponding to each dangerous IP address, these subtables can be combined to obtain a list of associated IP addresses. Taking the dangerous IP addresses mentioned in the above example as an example, the first subtable corresponding to dangerous IP address A is: [A, B, C], and the second subtable is: [A, E]; the first subtable corresponding to dangerous IP address C is: [C, D], and the second subtable is: [A, C, F]; for dangerous IP address D, the corresponding first subtable is: [D, B], so it does not exist in the first subtable, and the second subtable corresponding to the dangerous IP address is: [D, C, G].

[0088] The first sub-table and the second sub-table of these different dangerous IP addresses are combined to form a list of associated IP addresses. For example, the list of associated IP addresses may be shown in Table 2 below:

[0089] Table 2

[0090] IP Address Table IP address 1 A, B, C 2 A.E 3 C.D 4 A, C, F 5 D. B 6 D, C, G

[0091] Step S204: determining the frequent IP addresses in the associated IP address list and the association relationship between the frequent IP addresses.

[0092] Specifically, in the above step S204, it includes:

[0093] Step S2041, determining the frequent IP addresses in the associated IP address list and the corresponding association confidences between the frequent IP addresses in different association directions through a preset association rule mining algorithm.

[0094] When determining frequent IP addresses and specific association relationships, the frequently appearing IP addresses in the IP address list and the specific association relationships can be associated using an existing association rule mining algorithm. For example, the association analysis can be performed using an Apriori algorithm.

[0095] In the process of determining the association relationship, it is first necessary to determine the frequent IP addresses. Assume that the specific information of the associated IP address list is shown in Table 3 below:

[0096] Table 3

[0097] IP Address Table IP address 1 1.1,1.2,1.3,1.4,1.5 2 1.2,1.3,1.4,1.6 3 1.1,1.3,1.5,1.7 4 1.2,1.4,1.5,1.8 5 1.1,1.3,1.4,1.5,1.9

[0098] Among them, 1.1, 1.2, 1.3... in the IP address can be regarded as the abbreviation of the IP address, such as 1.1 can represent 192.168.1.1, which is only used here to assist understanding. When determining frequent IP addresses, you first need to determine the support of each IP address in each table and the preset support threshold. Support refers to a set of items, that is, the frequency of a certain IP address appearing in all tables. For example, if the item set {1.1} appears 3 times in all address tables, its support is 3 / 5=0.6. Suppose we set the minimum support threshold to 0.6 (i.e. 60%), which means that any frequent item set needs to appear in at least 2 IP address tables.

[0099] First, frequent itemsets need to be constructed. When determining frequent itemsets through the Apriori algorithm, multiple rounds of frequent itemsets construction are required, starting with the construction of frequent 1-itemsets.

[0100] Calculate the support of each single IP address as follows:

[0101] 1.1:3 / 5=0.6;1.2:3 / 5=0.6;1.3:4 / 5=0.8;1.4:4 / 5=0.8;1.5:4 / 5=0.8;1.6:1 / 5=0.2;1.7:1 / 5=0.2;1.8:1 / 5=0.2;1.9:1 / 5=0.2. The preset support threshold is 0.6, then the frequent 1-item set is: {1.1,1.2,1.3,1.4,1.5}.

[0102] Next, we need to determine the 2-itemsets and generate candidate 2-itemsets from the frequent 1-itemsets, namely {1.1,1.2}, {1.1,1.3}, {1.1,1.4}, {1.1,1.5}, {1.2,1.3}, {1.2,1.4}, {1.2,1.5}, {1.3,1.4}, {1.3,1.5}, {1.4,1.5}, and calculate their support, that is, the frequency with which the corresponding two elements in each itemset appear at the same time.

[0103] Specifically, {1.1,1.2}:1 / 5=0.2; {1.1,1.3}:3 / 5=0.6; {1.1,1.4}:2 / 5=0.4; {1.1,1.5}:3 / 5=0.6; {1.2,1.3}:2 / 5=0.4; {1.2,1.4}:3 / 5=0.6; {1.2,1.5}:2 / 5=0.4; {1.3,1.4}:3 / 5=0.6; {1.3,1.5}:3 / 5=0.6; {1.4,1.5}:3 / 5=0.6. Similarly, setting the support threshold to 0.6, the frequent 2-itemsets are: {1.1,1.3},{1.1,1.5},{1.3,1.5},{1.2,1.4},{1.3,1.4},{1.4,1.5}.

[0104] Next, we need to define the minimum confidence threshold. Assume that we choose the minimum confidence as 0.8 (i.e. 80%). Generate association rules from frequent item sets. For example, starting from the frequent 2-item set {1.1, 1.3}, the corresponding association relationship is {1.1}|{1.3}, where (1.1->1.3): 3 / 3=1, that is, the association confidence of 1.3 relative to 1.1 is 1. The calculation method of association confidence can be understood as the support of {1.1, 1.3} over the support of {1.1}, that is, the frequency of 1.1 and 1.3 appearing in the table at the same time closes the frequency of 1.1 appearing, and so on. The specific confidence between IP addresses in each frequent 2-item set is as follows:

[0105] {1.1,1.3}->{1.1}|{1.3}, confidence (1.1->1.3): 3 / 3 = 1, confidence (1.3->1.1): 3 / 4 = 0.75;

[0106] {1.1,1.5}->{1.1}|{1.5}, confidence (1.1->1.5): 3 / 3 = 1, confidence (1.5->1.1): 3 / 4 = 0.75;

[0107] {1.3,1.5}->{1.3}|{1.5}, confidence (1.3->1.5):3 / 4=0.75, confidence (1.5->1.3):3 / 4=0.75;

[0108] {1.2,1.4}->{1.2}|{1.4}, confidence (1.2->1.4): 3 / 3 = 1, confidence (1.4->1.2): 3 / 4 = 0.75;

[0109] {1.3,1.4}->{1.3}|{1.4}, confidence (1.3->1.4):3 / 4=0.75, confidence (1.4->1.3):3 / 4=0.75;

[0110] {1.4,1.5}->{1.4}|{1.5}, confidence level (1.4->1.5):3 / 4=0.75, confidence level (1.5->1.4):3 / 4=0.75.

[0111] The IP addresses involved in these frequent 2-item sets are frequent IP addresses.

[0112] Step S2042: determining the association relationship between the frequent IP addresses according to the association direction and the corresponding association confidence.

[0113] According to the association directions between these frequent IP addresses and the association confidences under each association direction, the association relationships between the frequent IP addresses are determined, which can also be regarded as specific association rules. These association relationships include specific association directions and specific association confidences. Next, a node association graph can be generated based on the specific association relationships.

[0114] Specifically, before generating a node association graph based on the association relationship between the multiple frequent IP addresses, the method further includes:

[0115] The association relationship with an association confidence less than a preset value is defined as a low association relationship, and the low association relationship between each frequent IP address is removed.

[0116] Taking the IP addresses determined in the above example as an example, assuming that the preset value is 0.8, the association relationship with an association confidence less than 0.8 is determined as a low association relationship, as follows:

[0117] {1.1,1.3}->{1.1}|{1.3}, confidence (1.3->1.1): 3 / 4 = 0.75;

[0118] {1.1,1.5}->{1.1}|{1.5}, confidence (1.5->1.1): 3 / 4 = 0.75;

[0119] {1.3,1.5}->{1.3}|{1.5}, confidence (1.3->1.5):3 / 4=0.75, confidence (1.5->1.3):3 / 4=0.75;

[0120] {1.2,1.4}->{1.2}|{1.4}, confidence (1.4->1.2): 3 / 4 = 0.75;

[0121] {1.3,1.4}->{1.3}|{1.4}, confidence (1.3->1.4):3 / 4=0.75, confidence (1.4->1.3):3 / 4=0.75;

[0122] {1.4,1.5}->{1.4}|{1.5}, confidence level (1.4->1.5):3 / 4=0.75, confidence level (1.5->1.4):3 / 4=0.75.

[0123] The corresponding association relationships mentioned above are low association relationships. After deleting them, the remaining association relationships are as follows:

[0124] {1.1,1.3}->{1.1}|{1.3}, confidence (1.1->1.3): 3 / 3 = 1;

[0125] {1.1,1.5}->{1.1}|{1.5}, confidence (1.1->1.5): 3 / 3 = 1;

[0126] {1.2,1.4}->{1.2}|{1.4}, confidence level (1.2->1.4): 3 / 3=1.

[0127] Step S205: Generate a node association graph based on the association relationship between multiple frequent IP addresses, where the node association graph is used to characterize the path tracing of threat traffic.

[0128] Specifically, in the above step S205, a node association graph is generated based on the association relationship between multiple frequent IP addresses, including:

[0129] Generate nodes corresponding to each frequent IP address, and generate directed edges between corresponding nodes based on the association direction and corresponding association confidence between each frequent IP address;

[0130] A node association graph is generated based on the nodes corresponding to each frequent IP address and the directed edges between the nodes.

[0131] As shown in the above example, the frequent IP addresses are: 1.1, 1.3, 1.4, 1.5. Therefore, nodes corresponding to these four frequent IP addresses are created, and directed edges corresponding to these nodes are generated according to the specific association direction, such as {1.1, 1.3}->{1.1}|{1.3} (confidence 1.0), that is, the confidence corresponding to the directed edge from the node 1.1 to the node corresponding to 1.3 is 1.0. Similarly, the directed edges between the nodes are generated to obtain the node association graph. The confidence corresponding to the directed edges between the nodes in the node association graph can indicate that when the traffic data corresponding to the IP address corresponding to a node is threat traffic data, the possibility that the previous node corresponding to the directed edge is the source of the threat traffic data. The greater the corresponding confidence, the more likely the IP address corresponding to the previous node is the source of the threat traffic data. The staff can analyze the source of the threat traffic data corresponding to each node based on the edge relationship between the specific associated nodes.

[0132] Step S206, determining the influence weight of each node corresponding to each frequent IP address in the node association graph through a preset link analysis algorithm; the influence weight is used to characterize the degree of participation of the corresponding frequent IP address in the threat traffic behavior.

[0133] After determining the specific node association graph, the influence weight corresponding to each node can be determined by a preset link analysis algorithm. For example, PageRank can be used to determine the influence weight corresponding to each specific node. Specifically, the main basis for determining the influence weight is the number of inbound links and outbound links corresponding to each node, that is, for each node, the number of directed edges pointing to it, and the number of directed edges pointing to other nodes. The specific calculation method will not be repeated here.

[0134] After determining the corresponding influence weights of each node, the staff can be further assisted in making the following judgments:

[0135] Identify key nodes: The PageRank algorithm can help identify the most important nodes in the traceability graph. In security traceability, these nodes may be key IP addresses in the attack path or core participants in the attack incident. By calculating the PageRank value of the node, the most influential and critical nodes can be identified, which may require priority attention or further investigation.

[0136] Discover hidden connections: The traceability graph can show direct IP address connections, while the PageRank algorithm can discover important connections hidden in complex network structures. For example, even if there is no direct communication record between certain IP addresses, they may be indirectly connected through common intermediate nodes or common patterns. PageRank can help reveal these indirect, potential connections.

[0137] Measuring the influence of a node:

[0138] Security traceability not only focuses on the connection relationship between nodes, but also needs to consider the influence and importance of nodes. The PageRank algorithm iteratively calculates the importance of nodes and assigns weights based on the connection status of nodes and the importance of connected nodes. This method helps to quantify the influence of nodes in the attack path or network, thereby optimizing security analysis and response strategies.

[0139] Exploring the propagation and expansion of attack paths: The PageRank algorithm is not only applicable to a single traceability graph, but can also analyze the propagation and expansion of attacks in complex attack paths. By applying PageRank to the entire attack network, the main propagation paths of the attack and the nodes with the greatest impact can be identified, helping the security team understand the global impact and spread of the attack.

[0140] Support decision-making and response: The traceability graph analysis results combined with the PageRank algorithm can provide security teams with deeper insights and support more effective decision-making and response measures. For example, resources can be allocated preferentially or defensive measures can be taken based on the nodes ranked by PageRank to minimize the impact and spread of security incidents.

[0141] The graph relationship of IP traceability paths has been constructed based on association rules and PageRank algorithm, which can visualize the association relationship of risky IPs. After selecting the IP of the specified target, you can use the constructed traceability path graph relationship to obtain all IPs related to it and the paths between IPs. These paths can help users more intuitively understand the association relationship between dangerous IPs and other IPs, so as to conduct more in-depth security analysis.

[0142] When viewing the IP details page of a specified target, users can obtain threat event statistics and threat event details related to the IP, which helps users fully understand the security threats involved in a specific IP and helps users make corresponding security protection measures.

[0143] The threat path tracing method provided by the embodiment of the present invention generates a first IP address set through the source IP address and destination IP address corresponding to the threat traffic data recorded in the security log, and determines the dangerous IP address therein, thereby generating an associated IP address list according to the associated IP addresses corresponding to each dangerous IP, and finally determines the frequent IP addresses and the association relationship between these frequent IP addresses, thereby finally generating a node association graph that can characterize the threat traffic path tracing, so that the staff can more intuitively understand the attack path of the threat traffic, which is convenient for relevant network security personnel to carry out timely advance processing and ensure the security of network assets.

[0144] In order to assist in understanding the specific analysis process of association rules in the embodiment of the present invention, the association rule mining algorithm is specifically explained through the following content: First, the obtained related IP list is modeled with association rules; the Apriori algorithm (association rule mining algorithm) is used, and its basic information is as follows.

[0145] 1. Basic concepts: Association rule mining allows us to discover the relationship between items in a data set. It has many application scenarios in our lives. "Shopping basket analysis" is a common scenario. This scenario can discover the relationship between goods and goods from consumer transaction records, and then bring more sales through product bundling or related recommendations.

[0146] Take a supermarket shopping example. Table 4 below is a list of items purchased by several customers:

[0147] Table 4

[0148] Order Number Purchased goods 1 Milk, bread, diapers 2 Coke, bread, diapers, beer 3 Milk, diapers, beer, eggs 4 Bread, milk, diapers, beer 5 Bread, milk, diapers, cola

[0149] 2. Support:

[0150] Support is a percentage, which refers to the ratio between the number of times a certain product combination appears and the total number of times.

[0151] In this example, we can see that "milk" appears 4 times, so the support of "milk" in these 5 orders is 4 / 5=0.8.

[0152] Similarly, "milk + bread" appeared 3 times, so the support degree of "milk + bread" in these 5 orders is 3 / 5=0.6.

[0153] 3. Confidence:

[0154] It refers to the probability that you will buy product B after you buy product A.

[0155] Confidence (milk→beer) = 2 / 4 = 0.5, which means if you buy milk, how likely you are to buy beer.

[0156] Confidence (beer→milk) = 2 / 3 = 0.67, which means if you buy beer, how likely you are to buy milk.

[0157] Confidence is a conditional concept, which means the probability of B occurring when A occurs.

[0158] 4. Improvement:

[0159] When we make product recommendations, we focus on the degree of lift, because the degree of lift represents the degree to which "the appearance of product A increases the probability of the appearance of product B."

[0160] Lift (A→B) = Confidence (A→B) / Support (B).

[0161] This formula is used to measure whether the occurrence of A will increase the probability of B appearing.

[0162] So there are three possibilities for improvement:

[0163] Improvement (A→B)>1: indicates improvement;

[0164] Lift (A→B) = 1: indicates no improvement or decline;

[0165] Lift (A→B) < 1: indicates a decrease.

[0166] The degree of improvement is not set in the present method embodiment, but it can be determined whether to set it according to the actual situation and the specific application scenario, which is not limited here.

[0167] 5. Frequent Itemsets:

[0168] If the support of an itemset X is greater than or equal to the specified minimum support threshold, then the itemset X is called a frequent itemset.

[0169] In the process of executing the Apriori algorithm, we first use IDs to represent the products in the above case. The product IDs of milk, bread, diapers, cola, beer, and eggs are set to 1-6 respectively. The above data table can be changed to Table 5:

[0170] Table 5

[0171] Order Number Purchased goods 1 4、2、3、5 2 4、2、3、5 3 1、3、5、6 4 2、1、3、5 5 2、1、3、4

[0172] The Apriori algorithm is actually the process of finding frequent itemsets. Frequent itemsets are itemsets whose support is greater than or equal to the minimum support threshold. Therefore, items with support less than the minimum value are infrequent itemsets, and items with support greater than or equal to the minimum support are frequent itemsets.

[0173] Suppose I randomly assign the minimum support to be 50%, which is 0.5. First, we calculate the support of a single item, that is, the support of K=1 item, as shown in Table 6:

[0174]

[0175]

[0176] Because the minimum support is 0.5, you can see that items 4 and 6 do not meet the minimum support and do not belong to the frequent itemset. Therefore, the frequent itemset after filtering the items becomes:

[0177] Product Item Set Support 1 3 / 5 2 4 / 5 3 1 5 4 / 5

[0178] On this basis, we combine the products in pairs and obtain the support of k = 2 items, as shown in Table 7:

[0179] Table 7

[0180] Product Item Set Support 1，2 2 / 5 1，3 3 / 5 1，5 2 / 5 2，3 4 / 5 2，5 3 / 5 3，5 4 / 5

[0181] Then filter out the product combinations with support less than the minimum value, and we can get Table 8:

[0182] Table 8

[0183]

[0184]

[0185] The recursive process of the Apriori algorithm is:

[0186] 1. K = 1, calculate the support of K itemsets;

[0187] 2. Filter out item sets with less than the minimum support;

[0188] 3. If the item set is empty, the result corresponding to the K-1 item set is the final result, otherwise K=K+1, and repeat steps 1-3.

[0189] When determining frequent item sets through the Apriori algorithm, it is possible to repeat the recursion multiple times to determine the support of 3-item sets or even 4-item sets. In the present method embodiment, since only the support corresponding to 2-item sets needs to be determined, the subsequent support calculation process of other k-item sets will not be repeated. In some cases, in order to determine a more accurate association relationship, for the present method embodiment, a higher item set method can also be used to determine the association rules. However, since there are often more IP addresses, when a higher item set is used, a larger amount of computing resources and computing events will be consumed. Therefore, it is more preferred to use a 2-item set method to determine the association rules.

[0190] After determining the 2-item set corresponding to k equals 2, it is necessary to determine the specific association rules. For example, in the above example, the commodity item sets {1, 3}, {2, 3}, {2, 5} and {3, 5}, among which {1, 3} has association rules 1->3 and 3->1. Association rule 1->3 means that when commodity 1 appears, the possibility of commodity 3 appearing at the same time is calculated as follows: the support corresponding to the simultaneous appearance of commodities 1 and 3 is compared with the support of commodity 1, which is 3 / 5 to 3 / 5, or 1. On the contrary, 3->1 means that when commodity 3 appears, the possibility of commodity 1 appearing at the same time is calculated as follows: the support corresponding to the simultaneous appearance of commodities 1 and 3 is compared with the support of commodity 3, which is 3 / 5 to 1, or 3 / 5. By analogy, the association rules between different commodities are determined. After determining the confidence corresponding to each association rule, it can be screened by the preset threshold to obtain association rules with relatively strong correlation.

[0191] To assist in understanding the preset link analysis algorithm in step S6 in the above method embodiment, the following example may be used to assist in understanding.

[0192] The preset link analysis algorithm can be a PageRank algorithm, which is usually used to rank web pages, calculate the importance of websites, and optimize search engine search results. The PR value is a factor that represents its importance. The central idea is that in a node graph, the more in-links a node receives from other nodes, the more important the node is. When a high-quality node points to (out-links) a node, it means that the pointed node is important, and the node is the frequent IP address mentioned in the above method embodiment. It mainly analyzes the number of outlinks and inlinks corresponding to each node to determine the specific PR value, that is, the impact weight. For example, Figure 3 FIG. 1 is a schematic diagram of node inbound links and outbound links, in which node A has two inbound links and two outbound links.

[0193] When calculating the PR value of each node, the specific calculation formula is as follows:

[0194]

[0195] Among them, PR(Ti): PR value of other nodes (pointing to node a), L(Ti): number of outbound links of other nodes (pointing to node a), i: number of cycles. The main process of the algorithm is to give each node a PR value (hereinafter PR value refers to PageRank value). The (voting) algorithm is continuously iterated until a stable distribution is reached, and the importance of each node is determined according to the PR value at this time.

[0196] With the above Figure 3 Take the node graph shown in the figure as an example, where the PR value corresponding to each iteration is shown in Table 9:

[0197] Table 9

[0198]

[0199] The initialized PR value is 1 / N=1 / 4. Taking node C as an example, when i=1, the corresponding PR value calculation process is as follows. The PR value calculation method corresponding to other nodes is similar and will not be repeated here.

[0200]

[0201] In another calculation method, in order to improve the calculation efficiency, the above can be represented by the transition probability matrix, namely the Markov matrix. Figure 3 The node graph shown is as follows:

[0202]

[0203] Taking the first column as an example, the probability that A will jump to B or C is 1 / 2, and the probability that D will jump to A is 1. The list of matrices shows the chain. Through matrix expression, the PR value can be quickly calculated. The specific calculation method is: PR(a) = M*V, where M is the matrix corresponding to the node graph, and V is the current PR value of each node. The specific calculation method is as follows Figure 4 As shown, Figure 4 The figure is a schematic diagram of a process of calculating a PR value based on a transition probability matrix according to an embodiment of the present invention.

[0204] First, the PR value of each node is initialized to 1 / 4. After the first iteration, the PR value corresponding to the current node is multiplied by the transfer probability matrix, and the PR values ​​corresponding to the four nodes A, B, C, and D are 3 / 8, 1 / 8, 3 / 8, and 1 / 8 respectively.

[0205] Both calculation methods use the PageRank algorithm to determine the specific PR value. The only difference is in the calculation method. The specific calculation method can be selected based on the actual situation.

[0206] In this embodiment, a threat path tracing device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0207] This embodiment provides a threat path tracing device, such as Figure 5 As shown, including:

[0208] The log information acquisition module 401 is used to acquire security log information of the network security system in a preset historical period, the security log information including: source IP addresses and destination IP addresses corresponding to multiple threat traffic data;

[0209] The dangerous address determination module 402 is used to generate a first IP address set based on the source IP address and the destination IP address corresponding to each threat traffic data, and determine a plurality of dangerous IP addresses in the first IP address set;

[0210] The address list generating module 403 is used to determine the associated IP addresses corresponding to each of the multiple dangerous IP addresses according to the security log information, and generate an associated IP address list;

[0211] The association relationship determination module 404 is used to determine the frequent IP addresses in the associated IP address list and the association relationship between each frequent IP address;

[0212] The association graph generation module 405 is used to generate a node association graph based on the association relationship between multiple frequent IP addresses, and the node association graph is used to characterize the path tracing of threat traffic.

[0213] In some optional implementations, the address list generating module 403, when determining the associated IP addresses corresponding to each of the plurality of dangerous IP addresses according to the security log information and generating the associated IP address list, includes:

[0214] According to the security log information, determine the corresponding associated destination IP address when each dangerous IP address is the source IP address, and the corresponding associated source IP address when each dangerous IP address is the destination IP address;

[0215] Generate a corresponding first sub-table according to each dangerous IP address and the corresponding associated destination IP address, and generate a corresponding second sub-table according to each dangerous IP address and the corresponding associated source IP address;

[0216] A list of associated IP addresses is constructed according to the first sub-table and the second sub-table corresponding to each dangerous IP address.

[0217] In some optional implementations, the dangerous address determination module 402, when determining a plurality of dangerous IP addresses in the first IP address set, includes:

[0218] Determine the public information corresponding to each IP address in the first IP address set;

[0219] Based on the public information corresponding to each IP address, a plurality of dangerous IP addresses in the first IP address set are determined.

[0220] In some optional implementations, the association relationship determination module 404, when determining the frequent IP addresses in the associated IP address list and the association relationship between each frequent IP address, includes:

[0221] By using a preset association rule mining algorithm, the frequent IP addresses in the associated IP address list and the corresponding association confidences between the frequent IP addresses in different association directions are determined;

[0222] The association relationship between each frequent IP address is determined according to the association direction and the corresponding association confidence.

[0223] In some optional implementations, before generating a node association graph based on the association relationships between multiple frequent IP addresses, the association determination module 404 is also used to define an association relationship with an association confidence less than a preset value as a low association relationship, and to release the low association relationship between each frequent IP address.

[0224] In some optional implementations, the association graph generation module 405, when generating a node association graph based on the association relationship between multiple frequent IP addresses, includes:

[0225] Generate nodes corresponding to each frequent IP address, and generate directed edges between corresponding nodes based on the association direction and corresponding association confidence between each frequent IP address;

[0226] A node association graph is generated based on the nodes corresponding to each frequent IP address and the directed edges between the nodes.

[0227] In some optional implementations, the association graph generation module 405 is also used to determine the influence weight of each node corresponding to each frequent IP address in the node association graph through a preset link analysis algorithm; the influence weight is used to characterize the degree of participation of the corresponding frequent IP address in the threat traffic behavior.

[0228] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0229] The threat path tracing device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0230] The embodiment of the present invention also provides a computer device having the above Figure 5 Threat path tracing device shown.

[0231] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6A processor 10 is taken as an example.

[0232] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0233] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0234] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0235] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0236] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0237] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0238] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0239] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A threat path tracing method, It is characterized in that The method comprises: Obtain security log information of a network security system in a preset historical period, wherein the security log information includes: a source IP address and a destination IP address corresponding to a plurality of threat traffic data; Generate a first IP address set based on the source IP address and the destination IP address corresponding to each threat traffic data, and determine a plurality of dangerous IP addresses in the first IP address set; Determine, based on the security log information, the associated IP addresses corresponding to each of the multiple dangerous IP addresses, and generate an associated IP address list; Determine the frequent IP addresses in the associated IP address list and the association relationship between each frequent IP address; A node association graph is generated based on the association relationship between the multiple frequent IP addresses, and the node association graph is used to characterize the path tracing of the threat traffic.

2. The method according to claim 1, It is characterized in that The step of determining, based on the security log information, the associated IP addresses corresponding to each of the plurality of dangerous IP addresses, and generating an associated IP address list includes: Determine, based on the security log information, when each dangerous IP address is a source IP address, the corresponding associated destination IP address, and when each dangerous IP address is a destination IP address, the corresponding associated source IP address; Generate a corresponding first sub-table according to each dangerous IP address and the corresponding associated destination IP address, and generate a corresponding second sub-table according to each dangerous IP address and the corresponding associated source IP address; A list of associated IP addresses is constructed according to the first sub-table and the second sub-table corresponding to each dangerous IP address.

3. The method according to claim 1, It is characterized in that The determining of a plurality of dangerous IP addresses in the first IP address set includes: Determine the public information corresponding to each IP address in the first IP address set; Based on the public information corresponding to each IP address, a plurality of dangerous IP addresses in the first IP address set are determined.

4. The method according to claim 2, It is characterized in that The determining of the frequent IP addresses in the associated IP address list and the association relationship between the frequent IP addresses includes: By using a preset association rule mining algorithm, the frequent IP addresses in the associated IP address list and the corresponding association confidences between the frequent IP addresses in different association directions are determined; The association relationship between the frequent IP addresses is determined according to the association direction and the corresponding association confidence.

5. The method according to claim 4, It is characterized in that Before generating a node association graph based on the association relationship between the multiple frequent IP addresses, the method further includes: An association relationship whose association confidence is less than a preset value is defined as a low association relationship, and the low association relationship between the frequent IP addresses is released.

6. The method according to claim 4, It is characterized in that The generating a node association graph based on the association relationship between the multiple frequent IP addresses includes: Generate a node corresponding to each frequent IP address, and generate a directed edge between the corresponding nodes based on the association direction and the corresponding association confidence between the frequent IP addresses; A node association graph is generated based on the nodes corresponding to the frequent IP addresses and the directed edges between the nodes.

7. The method according to claim 1, It is characterized in that The method further comprises: The influence weight of each node corresponding to each frequent IP address in the node association graph is determined by a preset link analysis algorithm; the influence weight is used to characterize the degree of participation of the corresponding frequent IP address in the threat traffic behavior.

8. A threat path tracing device, It is characterized in that The device comprises: A log information acquisition module is used to obtain security log information of the network security system in a preset historical period, wherein the security log information includes: a source IP address and a destination IP address corresponding to a plurality of threat flow data; A dangerous address determination module, used to generate a first IP address set based on a source IP address and a destination IP address corresponding to each threat traffic data, and determine a plurality of dangerous IP addresses in the first IP address set; An address list generating module, used for determining the associated IP addresses corresponding to each of the plurality of dangerous IP addresses according to the security log information, and generating an associated IP address list; An association relationship determination module, used to determine the frequent IP addresses in the associated IP address list and the association relationship between each frequent IP address; The association graph generation module is used to generate a node association graph based on the association relationship between the multiple frequent IP addresses, and the node association graph is used to characterize the path tracing of the threat traffic.

9. A computer device, It is characterized in that include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the threat path tracing method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the threat path tracing method according to any one of claims 1 to 7.

Images