Network threat analysis method and device, equipment and storage medium

Abstract

The invention relates to a network threat analysis method and device, equipment and a storage medium, and the method comprises the steps: firstly obtaining different types of target assets, building an asset association relationship between different assets, and then generating a threat link according to the asset association relationship and threat intelligence information, and finally, based on the vulnerability severity degree, the asset importance degree and the threat link of each target asset, determining a threat exposure surface analysis result. Visibly, according to the scheme, through association of multi-dimensional assets, network threats can be analyzed more deeply, so that threat management is finer; when the analysis result of each asset is determined, the potential threats are identified through the vulnerability severity of the assets, and the link complexity of each asset is reflected through the threat link, so that a more accurate threat exposure surface analysis result is generated, a worker can preferentially process the most urgent threat according to the analysis result of each asset, and the threat exposure surface analysis efficiency is improved. Therefore, the overall security of the network is improved.

Description

Technical Field

[0001] The present application relates to the field of threat analysis, and in particular to a network threat analysis method, apparatus, device and storage medium. Background Art

[0002] With the evolution of cyber attack behaviors and their rapid growth in organizations, continuous threat management has attracted great attention from the information security community. The current threat exposure management methods are mainly based on standardized threat intelligence, such as threat vulnerabilities, attack methods, etc., which have little information on the complex business relationships, business processes, key assets, etc. of the enterprise. Therefore, the management of potential threats is not in-depth and it is difficult to extract real threat information.

[0003] Therefore, how to accurately analyze network threats is a technical problem that technical personnel in this field need to solve. Summary of the invention

[0004] The present application provides a network threat analysis method, apparatus, device and storage medium to accurately analyze network threats.

[0005] In a first aspect, the present application provides a network threat analysis method, comprising:

[0006] Acquire different types of target assets;

[0007] Analyze different types of target assets and determine asset relationships;

[0008] Generate a threat chain based on the asset association relationship and threat intelligence information;

[0009] The threat exposure analysis results of each target asset are determined based on the vulnerability severity of each target asset, the asset importance and the threat link.

[0010] Optionally, generating a threat link according to the asset association relationship and threat intelligence information includes:

[0011] Find the initial application link through the path finding algorithm, the community detection algorithm, the asset association relationship and the threat intelligence information;

[0012] The validity of the initial application link is verified, and the initial application link that passes the validity verification is used as the threat link.

[0013] Optionally, searching for the initial application link by using a path search algorithm, a community detection algorithm, the asset association relationship and threat intelligence information includes:

[0014] Determine dangerous assets based on the threat intelligence information;

[0015] Finding a first initial application link corresponding to the dangerous asset through the asset association relationship and the path search algorithm; the first initial application link is an attack path between the dangerous asset and other assets;

[0016] Determine the asset community through the community detection algorithm and the asset association relationship;

[0017] The threat intelligence information is used to determine a dangerous community from each asset community, and a second initial application link corresponding to the dangerous community is generated; the second initial application link is an attack path between assets in the dangerous community.

[0018] Optionally, the acquiring of different types of target assets includes:

[0019] According to the asset detection range and detection strategy, different types of target assets are periodically acquired and stored in the graph database.

[0020] Optionally, the target assets include: domain name nodes, IP address nodes, gateway nodes, load balancer nodes, server nodes, process nodes and port nodes.

[0021] Optionally, determining the threat exposure analysis result of each target asset according to the vulnerability severity of each target asset, the asset importance and the threat link includes:

[0022] Match the known vulnerabilities in the vulnerability database with each target asset to find the known vulnerabilities that match the target asset; wherein the vulnerability severity of the target asset is the vulnerability severity of the matching known vulnerability;

[0023] The exposure score of each target asset is calculated based on the severity of the vulnerability of each target asset, the importance of the asset, and the link complexity of each target asset in the threat chain.

[0024] Optionally, after determining the threat exposure analysis result of each target asset according to the vulnerability severity of each target asset, the asset importance and the threat link, the method further includes:

[0025] Detect whether there are high-risk exposed assets; wherein the high-risk exposed assets are target assets whose exposure scores exceed the alarm threshold;

[0026] If so, an alarm message for the high-risk exposed asset is generated.

[0027] In a second aspect, the present application provides a network threat analysis device, comprising:

[0028] Acquisition module, used to acquire different types of target assets;

[0029] The analysis module is used to analyze different types of target assets and determine the asset association relationships;

[0030] A link generation module, used to generate a threat link according to the asset association relationship and threat intelligence information;

[0031] The result determination module is used to determine the threat exposure analysis result of each target asset according to the vulnerability severity of each target asset, the asset importance and the threat link.

[0032] In a third aspect, the present application provides an electronic device, including:

[0033] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of any of the above-mentioned network threat analysis methods through the computer program.

[0034] In a fourth aspect, the present application provides a computer storage medium, which stores computer executable instructions, and the computer executable instructions are used to execute the steps of the above-mentioned network threat analysis method of the present application.

[0035] The above-mentioned technical scheme provided by the embodiment of the present application has the following advantages compared with the prior art: the network threat analysis scheme provided by the embodiment of the present application first needs to obtain different types of target assets and establish asset association relationships between different assets, and then generate threat links based on the asset association relationships and threat intelligence information, and finally determine the threat exposure analysis results based on the vulnerability severity, asset importance and threat links of each target asset; it can be seen that this scheme can analyze network threats more deeply and make threat management more refined through the association of multi-dimensional assets; when determining the analysis results of each asset, potential threats are identified through the severity of the vulnerability of the asset, and the link complexity of each asset is reflected through the threat link, thereby generating a more accurate threat exposure analysis result, so that the staff can give priority to the most urgent threats according to the analysis results of each asset, thereby improving the overall security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0038] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0039] Figure 1 A schematic diagram of a network threat analysis method flow provided in an embodiment of the present application;

[0040] Figure 2 A flowchart of another network threat analysis method provided in an embodiment of the present application;

[0041] Figure 3 A schematic diagram of another network threat analysis method provided in an embodiment of the present application;

[0042] Figure 4 A schematic diagram of the structure of a network threat analysis device provided in an embodiment of the present application;

[0043] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0045] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0046] This implementation provides a network threat analysis method, device, equipment and storage medium. This solution is mainly used in the network security management of enterprises or organizations, such as IT (Internet Technology) departments, security operation centers, etc., for network security activities such as threat detection, risk assessment and emergency response, to achieve accurate analysis of network threats.

[0047] See also Figure 1 , Figure 1 A schematic diagram of a network threat analysis method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0048] S101. Acquire different types of target assets;

[0049] In this embodiment, it is first necessary to obtain different types of target assets, including comprehensive assets such as traditional IT assets, cloud resources, IoT (Internet of Things) devices, etc. When obtaining target assets, network assets can be actively detected through the deployed distributed detection nodes using multiple protocols, such as: HTTP (Hypertext Transfer Protocol) / HTTPS (Hypertext Transfer Protocol Secure), DNS (Domain Name System), ICMP (Internet Control Message Protocol), etc.; passive traffic analysis technology can also be used to extract asset information from network traffic; cloud platform API (Application Programming Interface) can also be regularly queried to obtain the latest cloud resource configuration information to obtain asset information.

[0050] After obtaining the original asset data through the above different methods, it is necessary to clean, standardize and preliminarily classify the collected original asset data to obtain different target assets. It should be noted that the target assets are obtained periodically so that the assets can be updated in time after changes to generate the most accurate threat exposure analysis results.

[0051] Specifically, the target assets in this embodiment may include: domain name nodes, IP (Internet Protocol) address nodes, gateway nodes, load balancer nodes, server nodes, process nodes and port nodes, etc. Among them, the gateway nodes include WAF (Web Application Firewall, website application-level intrusion prevention system) gateway and API gateway. After obtaining the above target assets, they can be stored in a graph database. Among them, the graph database (GraphDatabase) is a new type of NoSQL database based on graph theory. Its data storage structure and data query method are based on graph theory. This embodiment uses a graph database to store and manage asset relationships, which can make complex multi-dimensional relationships efficiently stored, queried and visualized, and provide a more in-depth description of the company's business relationships, business processes and other information, and more sophisticated threat management. Hidden threats and risks can be discovered, and the effect of risk assessment and threat warning can be improved.

[0052] S102. Analyze different types of target assets to determine asset association relationships;

[0053] It should be noted that traditional threat analysis systems often only focus on single-dimensional asset management. This approach does not provide in-depth management of potential threats and makes it difficult to extract real threat information. In this solution, after acquiring different types of target assets, multi-dimensional asset associations can be achieved, providing more comprehensive asset management.

[0054] In this embodiment, the query language of the graph database (such as Cypher) can be used to determine the asset association relationship. Here, the process of determining the asset association relationship is described by taking the following statement as an example:

[0055] Statement 1: Matching existing relationships

[0056] Plain Text

[0057] MATCH(d:Domain)-[:RESOLVES_TO]->(ip:IP)<-[:PROTECTS]-(w:WAF)

[0058] Among them, statement 1 indicates to find a domain name (Domain), which is resolved to an IP address (IP), and this IP address is protected by the Web Application Firewall (WAF). By running this statement, you can establish the asset association relationship between domain name-IP address-Web Application Firewall.

[0059] Statement 2: Optional matching

[0060] Plain Text

[0061] OPTIONAL MATCH(ip)<-[:BALANCES]-(lb:LoadBalancer)

[0062] OPTIONAL MATCH(ip)<-[:HOSTED_ON]-(s:Server)

[0063] Among them, the first statement in statement 2 is used to check whether the IP address is managed by the load balancer (LoadBalancer). If so, an asset association relationship between the IP address and the load balancer is established; the second statement in statement 2 is used to check whether the IP address is hosted on a server (Server). If so, an asset association relationship between the IP address and the server is awarded.

[0064] Statement 3: Create a new relationship

[0065] Plain Text

[0066] CREATE(d)-[:PROTECTED_BY]->(w)

[0067] CREATE(d)-[:SERVED_BY]->(lb)

[0068] CREATE(d)-[:HOSTED_ON]->(s)

[0069] Among them, three new relations are created in statement three:

[0070] 1. The PROTECTED_BY asset association relationship between Domain and WAF indicates that the domain name is protected by a specific WAF.

[0071] 2. The SERVED_BY asset association between Domain and LoadBalancer indicates that the domain name is served by a specific load balancer.

[0072] 3. The HOSTED_ON asset association relationship between Domain and Server indicates that the domain name is hosted on a certain server.

[0073] Through the above statement, the association relationship between the target assets can be established, such as: the network infrastructure includes the domain name example.com, which resolves to the IP address 192.0.2.1, which is protected by the WAF and may be hosted by the load balancer and server. By running this query, a multi-layer relationship graph related to example.com in the graph database can be established to generate the association relationship between assets. This graph structure helps to understand the threat exposure of the entire network. For example, if there is a problem with the WAF or load balancer configuration, the affected domain names and IP addresses can be quickly identified through the asset association relationship, and corresponding measures can be taken. In addition, this solution manages each asset and asset association relationship based on the graph database, and can clearly display all assets and their relationships through a graphical structure, helping security teams to detect and respond to threats more effectively.

[0074] S103, generating a threat link based on the asset association relationship and threat intelligence information;

[0075] In this embodiment, the threat intelligence information refers to threats or dangers that have been discovered or will appear in the future, including vulnerability information, attack behaviors, attack methods, etc. The threat link refers to an application link that may be exploited by attackers, and key nodes are also marked in the threat link, such as load balancers, API gateways, etc. Therefore, when this solution generates a threat link based on asset associations and threat intelligence information, it specifically identifies dangerous assets in the target assets based on the threat intelligence information, and then searches for attack paths between other assets and the target assets. This path is the threat link that may be exploited by attackers. That is: this solution conducts a deep correlation analysis between the target assets in the network and the threat intelligence information to find threat links that may be exploited by attackers, thereby identifying potential security risks and achieving early warning and threat prevention.

[0076] S104. Determine the threat exposure analysis result of each target asset based on the vulnerability severity, asset importance and threat link of each target asset.

[0077] In this embodiment, the threat exposure analysis result is used to reflect the possibility of each target asset and link being attacked externally, thereby evaluating the potential risks in the network. The threat exposure analysis result can be a score, a level, etc., which are not specifically limited here. The analysis result can help the security team determine which assets and links are most vulnerable to attacks and give priority to these high-risk areas.

[0078] It can be understood that the present application can determine the threat exposure analysis results based on graph algorithms and security rules. The factors affecting the analysis results are vulnerability severity, asset importance and threat links, among which: vulnerability severity refers to the severity of known vulnerabilities that match the target assets. The CVSS (Common Vulnerability Scoring System) score is usually used to quantify the threat level of the vulnerability. The higher the vulnerability severity of the target asset, the higher the exposure score; asset importance refers to the importance of each asset, which can be determined based on the role of the asset in the network and the business impact. The higher the asset importance of the target asset, the higher the exposure score; threat link: refers to the link complexity of the target asset in the threat link. The complexity of the link can indicate the number and type of relationships between the target asset and other assets. More relationships usually mean more complex attack paths. Therefore, the higher the link complexity of the target asset in the threat link, the higher the exposure score.

[0079] In summary, it can be seen that the network threat analysis method provided in the embodiment of the present application can analyze network threats more deeply through the association of multi-dimensional assets, making threat management more refined; when determining the analysis results of each asset, potential threats are identified by the severity of the asset's vulnerabilities, and the link complexity of each asset is reflected through the threat link, thereby generating a more accurate threat exposure analysis result, so that staff can prioritize the most urgent threats based on the analysis results of each asset, thereby improving the overall security of the network.

[0080] Based on the above method embodiment, when acquiring different types of target assets, this embodiment periodically acquires different types of target assets according to the asset detection range and detection strategy, and stores them in the graph database.

[0081] It should be noted that in order to obtain different types of target assets, the system administrator first needs to configure the initial asset detection range and detection strategy, and the system automatically performs continuous asset detection and data collection according to the asset detection range and detection strategy. In this embodiment, only domain name nodes, IP address nodes, gateway nodes, load balancer nodes, server nodes, process nodes and port nodes are used as examples for explanation.

[0082] Specifically, the asset detection range includes the target IP range and domain name list. The target IP range refers to the enterprise public network IP segment, and the domain name list includes known enterprise domain names. The detection strategy refers to the frequency of detecting different target assets to ensure the accuracy of the target assets. For example, the detection frequency of domain names and IP addresses can be set as: a full scan every 24 hours and an incremental scan every 6 hours, thereby filtering invalid domain names and IP addresses to ensure data accuracy. In this embodiment, the discovery and collection of target assets mainly includes the following processes:

[0083] 1. Domain name and IP detection process

[0084] In this embodiment, a DNS (Domain Name System) server can be used to detect domain names and IP addresses. Specifically, the IP address corresponding to each domain name and the domain name corresponding to each IP address are obtained in sequence through the DNS protocol. The query type can be: A, AAAA, CNAME, MX records. The DNS server can be a public DNS (such as 8.8.8.8) and an enterprise's internal DNS, which is not specifically limited here. In addition, after obtaining the domain name and IP address, the domain name and IP address can be stored in a graph database, a Domain node and an IP node can be created, and a RESOLVES_TO relationship between the Domain node and the IP node can be established.

[0085] 2. CDN (Content Delivery Network) detection

[0086] In this embodiment, the geographical distribution characteristics of CDN can be used to determine whether to use CDN by comparing the parsing results of different geographical locations. Specifically, when performing CDN detection, it is first necessary to determine the test points located in different locations. Here, at least 5 test points distributed in different geographical locations are selected as an example for explanation; after determining the test points, each domain name is pinged through different test points. If more than 80% of the test points return different IP addresses, it is determined that the domain name uses CDN, and the HAS_CDN attribute is added to the Domain node that uses CDN in the graph database.

[0087] 3. WAF and API Gateway Detection

[0088] It is understandable that different WAF and API gateway products usually leave features in HTTP responses. Therefore, this embodiment determines the gateway type by sending a specific HTTP request to the IP address and analyzing the response information. The request can be any one of GET, POST, and OPTIONS; the request header contains specific fields such as X-Forwarded-For; after obtaining the response information, the gateway type is determined by checking the Server, X-Powered-By and other header fields. After obtaining the detection results, it is necessary to create different types of gateway nodes in the graph database, such as WAF or APIGateway nodes, and establish a PROTECTS relationship with the corresponding IP node.

[0089] 4. Load Balance (LB) Detection

[0090] Specifically, since multiple instances behind the load balancer may generate different TCP (Transmission Control Protocol) timestamp sequences, this embodiment makes multiple TCP connections to the same IP address and analyzes the TCP timestamp; the number of connections can be customized, and this embodiment sets the number of connections to at least 50 times; when analyzing the TCP timestamp, if the timestamps are different, the load balancer is not used. A LoadBalancer node is created in the graph database, and a BALANCES relationship is established with the IP node using the load balancer.

[0091] 5. ECS (Elastic Compute Service, cloud service) server information collection

[0092] This embodiment mainly obtains the configuration, status and other information of the server through the authorized cloud service API interface and the internal asset management system; the API interface is called according to the SDK (Software Development Kit) provided by the cloud service provider, and the query frequency can be set to update every 6 hours. Different server nodes are created in the graph database according to the collected server nodes, and the configuration information is stored as the attributes of the server node.

[0093] 6. Application service and process information collection

[0094] In order to collect application service and process information, a lightweight agent can be deployed to the ECS server. The agent can be used to regularly collect information about processes, open ports, and jar packages running on the server. The collection frequency can be set to once every 5 minutes. The collection items include process name, PID (Process Identifier), port, and jar (Java Archive, software package file format) package path. A Process node is created in the graph database, and a RUNS_ON relationship is established between the Process node and the corresponding Server node. A Port node is created in the graph database, and a LISTENS_ON relationship is established between the Port node and the Process node.

[0095] From the above process, it can be seen that this solution can integrate data from multiple sources such as network detection, host agent, configuration management database, etc., so as to obtain multi-dimensional target assets. This method can analyze network threats more deeply and make threat management more refined; in addition, this solution can also dynamically adjust the detection strategy according to known asset information, thereby improving the efficiency and accuracy of new asset discovery and ensuring more accurate analysis results.

[0096] See also Figure 2 , Figure 2 A flowchart of another network threat analysis method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0097] S201. Periodically acquire different types of target assets according to the asset detection range and detection strategy, and store them in a graph database;

[0098] S202, analyzing different types of target assets to determine asset association relationships;

[0099] S203, searching for the initial application link through a path search algorithm, a community detection algorithm, asset association relationships, and threat intelligence information;

[0100] S204, verify the validity of the initial application link, and use the initial application link that passes the validity verification as a threat link;

[0101] S205. Determine the threat exposure analysis result of each target asset based on the vulnerability severity, asset importance and threat link of each target asset.

[0102] In this embodiment, a graph algorithm is applied to perform deep association analysis to determine the initial application link. The graph algorithm used in this embodiment includes a path finding algorithm and a community detection algorithm. The specific process of S203 may be: determining dangerous assets based on threat intelligence information; finding the first initial application link corresponding to the dangerous assets through asset association relationships and a path finding algorithm; the first initial application link is the attack path between the dangerous assets and other assets. Determine the asset community through the community detection algorithm and asset association relationships; determine the dangerous community from each asset community using threat intelligence information, and generate a second initial application link corresponding to the dangerous community; the second initial application link is the attack path between assets in the dangerous community.

[0103] Specifically, the path finding algorithm in this embodiment is the Dijkstra shortest path algorithm. The Dijkstra shortest path algorithm can be used to calculate the shortest path between each node in the network, so as to discover possible direct or indirect connections between assets. After the dangerous assets are determined based on the threat intelligence information, the Dijkstra shortest path algorithm can be used to find the short path between the dangerous assets and other assets. The short path is the attack path where other assets are threatened, that is, the first initial application link; the community detection algorithm in this embodiment is the Louvain community detection algorithm. The Louvain community detection algorithm can be used to identify different communities in the network. After the dangerous assets are determined based on the threat intelligence information, it can be determined whether the dangerous assets can affect other assets in the entire community. If so, the community will become a dangerous community. The attack path between assets in the dangerous community is the second initial application link, and the second initial application link is composed of the first initial application link and the second initial application link.

[0104] For example, suppose that in an enterprise network, there are multiple servers, databases, workstations, IoT devices, etc. Each device and system node is connected through different links and protocols.

[0105] The following operations are performed specifically when obtaining the initial application link:

[0106] 1. If the server node is determined to have a vulnerability based on threat intelligence information, the server node is a dangerous asset. The Dijkstra shortest path algorithm is used to start from the dangerous node and find the shortest path to the critical database server. The shortest path is the first initial application link. On the first initial application link, it is also marked whether each node on this link has a known vulnerability or is marked as a potential threat target; the threat target is a target that may be attacked, such as: in the link from the server node to the critical database server, the critical database server is the threat target.

[0107] 2. First, the Louvain algorithm is used to detect the potential community structure in the entire network. If the dangerous asset is determined to be a server node through threat intelligence information, it is determined whether the server node can affect other assets in its community. If so, the community is set as a dangerous community. The attack path between assets in the dangerous community is the second initial application link. For the identified dangerous community, security protection measures will be taken as a priority.

[0108] It should be noted that depth limitation is required in both the path finding process and the community detection process, that is, setting the maximum number of hops for path finding. This method can ensure that the analysis focus is placed on nodes within a reasonable range, prevent the generation of unnecessary long paths and complex associations, and thus improve detection efficiency and accuracy of results. In this embodiment, the maximum number of hops can be set to 6.

[0109] Further, the initial application link in this embodiment is a link that has not been verified for validity. In order to ensure the accuracy of the link, this solution needs to verify the validity of the initial application link, and the initial application link that has passed the validity verification will be treated as a threat link for subsequent processing. When verifying the link in this embodiment, the accuracy of the link is verified by active detection or passive monitoring; wherein, the active detection method refers to: sending HTTP requests or simulating attack traffic to each node of the link, checking the response status code and response time, ensuring the validity of the link, and if the HTTP request times out or returns an error status code, the link is determined to be abnormal; the passive monitoring method refers to: deploying monitoring on key network nodes, capturing TCP packets passing through the link, analyzing the source address, destination address and other packet information in the data packet to verify the existence and integrity of the link, and if the TCP packet cannot capture the expected traffic data, the link is determined to be abnormal. If the initial application link is not determined to be a link abnormality, the initial application link is a threat link that has passed the validity verification; if the initial application link is determined to be a link abnormality, the system will mark the link as "pending confirmation" and automatically trigger a manual review task to remind the security team to conduct further inspections on the link to confirm whether the link is abnormal.

[0110] It should be noted that although the threat link has passed the validity verification, in order to ensure the accuracy and security of each threat link, a verification cycle can also be set. The system automatically verifies each threat link in each cycle, thereby filtering invalid links. When setting the verification cycle, you can also customize the settings according to the importance of the link, such as setting the verification cycle for important links to be verified once every hour, and setting the verification cycle for unimportant links to be verified once a day.

[0111] In summary, after this solution creates a threat link, the operation and maintenance team can use the threat link to optimize application performance and troubleshoot, monitor and analyze potential threats in the network in real time, discover and fix possible vulnerabilities in advance, and reduce the risk of attacks. In addition, this solution can ensure that the security team can respond to potential threats in a timely manner by effectively verifying and managing threat links in the network.

[0112] See also Figure 3 , Figure 3 A flowchart of another network threat analysis method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0113] S301. Periodically acquire different types of target assets according to the asset detection range and detection strategy, and store them in a graph database;

[0114] S302, analyzing different types of target assets to determine asset association relationships;

[0115] S303, searching for the initial application link through a path search algorithm, a community detection algorithm, asset association relationships, and threat intelligence information;

[0116] S304, verify the validity of the initial application link, and use the initial application link that passes the validity verification as a threat link;

[0117] S305, matching the known vulnerabilities in the vulnerability database with each target asset, and searching for known vulnerabilities that match the target asset; wherein the vulnerability severity of the target asset is the vulnerability severity of the matching known vulnerability;

[0118] S306, calculating the exposure score of each target asset according to the vulnerability severity of each target asset, the asset importance, and the link complexity of each target asset in the threat link;

[0119] S307. Detect whether there are high-risk exposed assets; high-risk exposed assets are target assets whose exposure scores exceed the alarm threshold;

[0120] If yes, execute S308 to generate warning information of high-risk exposed assets; if yes, continue to execute S307 after a predetermined time interval.

[0121] It should be noted that in traditional methods, assets and security risks are often managed separately, while this solution innovatively directly links asset information with security risks such as vulnerabilities, providing a more intuitive security situation awareness.

[0122] In this embodiment, known vulnerabilities in the CVE (Common Vulnerability and Exposures) database can be used to match each asset. In this way, it can be determined whether an asset is vulnerable to a specific vulnerability. Among them, the CVE database is specifically the NVD (National Vulnerability Database) vulnerability database, which is a widely used vulnerability database that contains a large amount of known security vulnerability information. This information usually includes vulnerability descriptions, affected products and versions, repair suggestions, etc.; matched assets include servers, processes, etc. In order to ensure the accuracy of the data, the system will obtain the latest known vulnerabilities from the NVD vulnerability database at a fixed period for resource matching. In this embodiment, the fixed period can be set to daily. Here, the association process of known vulnerabilities and assets is explained by taking the following statements as an example:

[0123] Plain Text

[0124] MATCH(s:Server)-[:RUNS]->(p:Process)

[0125] WHERE p.name='apache'AND p.version='2.4.49'

[0126] MATCH(v:Vulnerability)

[0127] WHERE v.affected_software CONTAINS′apache:2.4.49′

[0128] CREATE(s)-[:HAS_VULNERABILITY]->(v)

[0129] The statement MATCH(s:Server)-[:RUNS]->(p:Process) is used to search for all server nodes running the specified process in the graph database. Server represents the server node, Process represents the process node, and the :RUNS relationship represents the process running on the server.

[0130] The statement WHERE p.name = 'apache' AND p.version = '2.4.49' is used to filter out processes running a specific version (such as apache 2.4.49).

[0131] Use the statement MATCH(v:Vulnerability) to search for all vulnerability nodes in the graph database. The Vulnerability node contains detailed information about known vulnerabilities.

[0132] The statement WHERE v.affected_software CONTAINS'apache:2.4.49' filters out all vulnerabilities that affect Apache 2.4.49.

[0133] A new relationship is created through the statement CREATE(s)-[:HAS_VULNERABILITY]->(v), indicating that a specific vulnerability exists in the server node, that is, the server node has a matching relationship with a specific vulnerability.

[0134] Through the above query, the system can associate enterprise assets with known security vulnerabilities, thereby helping security teams identify and manage potential security threats. This approach can improve the efficiency of vulnerability management and help enterprises better protect their IT assets.

[0135] When this embodiment calculates the exposure score of each target asset through S306, based on the structure of the graph database, graph algorithms (such as path analysis, connectivity calculation, etc.) and predefined security rules are used to calculate the comprehensive exposure score of each asset. Graph algorithms can help analyze the connection relationships and dependencies between assets, while security rules determine which factors have the greatest impact on the exposure based on specific business needs and security policies. The factors selected in this embodiment include vulnerability severity, asset importance, and link complexity. The exposure score can range from 0 to 100, where 100 indicates the highest risk. The exposure score can help security teams quickly identify high-risk assets.

[0136] For example: set the overall score to 100, set the vulnerability severity score to 30, set the asset importance score to 35, and set the link complexity score to 35; suppose that in a certain network, there are assets A, B, and C, among which: asset A is a core server with high importance; asset B is a database server with several known vulnerabilities; asset C is a peripheral workstation with complex connections but low importance.

[0137] It can be seen that since asset A is a core role and has a high importance, the exposure score of asset A may be mainly driven by its high importance, followed by vulnerabilities and link complexity. For example, if the vulnerability severity score of asset A is 15, the asset importance score is set to 35, and the link complexity score is set to 15, then the exposure score of asset A is 65 points; similarly, asset B has vulnerabilities, so the exposure score of asset B may be affected by the high severity of the vulnerabilities, such as: the vulnerability severity score of asset B is 30, the asset importance score is set to 25, and the link complexity score is set to 20, then the exposure score of asset B is 75 points; asset C has complex connections, so the exposure score of asset C may be affected by the link complexity, such as: the vulnerability severity score of asset C is 10, the asset importance score is set to 15, and the link complexity score is set to 35, then the exposure score of asset C is 60 points.

[0138] After the above steps, this solution can generate a comprehensive exposure score for each asset, which security teams can use to prioritize the most pressing threats and improve the overall security of the network.

[0139] Furthermore, this solution can also pre-set a monitoring rule, which is used to detect high-risk exposures. The monitoring rule can determine which nodes need to be monitored based on the node attributes in the graph database (such as exposure scores). The monitoring rule needs to set an alarm threshold and an inspection frequency. The alarm threshold is used to detect high-risk assets and alarm target assets whose exposure scores exceed the alarm threshold; if the alarm threshold is set to 70 points, and the exposure score of asset A is 65 points, the exposure score of asset B is 75 points, and the exposure score of asset C is 60 points, then asset B needs to be alarmed; the inspection frequency is used to ensure that all high-risk exposures are captured in a timely manner, such as: setting a query every 5 minutes to check whether there are assets with an exposure score exceeding 80.

[0140] Specifically, this embodiment can use the subscription function of the graph database to monitor the changes of each asset node and relationship. When the node or relationship in the graph database changes, the corresponding processing logic will be automatically triggered to calculate the exposure score of each asset. If the exposure score exceeds the alarm threshold, the alarm mechanism will be automatically triggered to notify the security team or automatically take preventive measures to ensure that when the system detects risk exposure, an alarm message is immediately issued. The alarm message specifically includes the name, type and exposure score of the asset. For example, if the exposure score of an important server node or database node increases due to configuration errors or vulnerabilities, this solution can detect it at the first time and issue an alarm in time to help the security team respond quickly, thereby realizing security monitoring of the enterprise's internal network. Therefore, this solution has the advantages of real-time, high efficiency and scalability. Among them, real-time means that this solution realizes real-time monitoring and rapid response of key nodes through the subscription function of the graph database; high efficiency means that this solution reduces the need for manual inspection through an automated monitoring and alarm system to ensure that any high-risk exposure can be discovered in time. Scalability means that this solution can adapt to different security needs by configuring different monitoring rules and alarm thresholds.

[0141] Furthermore, this solution can also use a graph visualization library (such as D3.js) to render graph data and generate an interactive application chain diagram, where the layout algorithm is a force-directed graph layout, and the interactive functions include zooming, dragging, clicking to expand, etc.; this solution can also aggregate analysis results and regularly generate security exposure reports, and the reporting cycle can be pre-set, such as: a full report once a week and a summary report once a day; the content of the report specifically includes: a list of high-risk assets, newly discovered potential threats, overall exposure trends, etc.

[0142] Through the above detailed implementation steps, the system can effectively associate various data sources, build a complete application-level link, and apply it to security continuous threat exposure management. This method can timely discover the external network attack surface and provide the security team with comprehensive visualization and analysis tools, thereby improving the ability to respond to potential security threats. In addition, this solution can also intuitively display asset relationships and threat links through graph visualization technology. Users can view asset relationships and threat links through the Web interface or API, and use interactive query functions to deeply study the security status of specific assets or links and customize views, thereby helping the security team to quickly identify potential threat exposures and significantly reduce the manual work of the security team in asset combing and risk assessment; through this solution, users are provided with a dynamic, comprehensive and in-depth view to help users better understand and manage their security continuous threat exposure. Provide data-driven decision-making basis for security investment and resource allocation.

[0143] See also Figure 4 , Figure 4A schematic diagram of the structure of a network threat analysis device provided in an embodiment of the present application, the device specifically comprises:

[0144] An acquisition module 11 is used to acquire different types of target assets;

[0145] An analysis module 12 is used to analyze different types of target assets and determine asset association relationships;

[0146] A link generation module 13, used to generate a threat link according to the asset association relationship and threat intelligence information;

[0147] The result determination module 14 is used to determine the threat exposure analysis result of each target asset according to the vulnerability severity of each target asset, the asset importance and the threat link.

[0148] As an optional embodiment, the link generation module includes:

[0149] A link search unit, used to search for an initial application link through a path search algorithm, a community detection algorithm, the asset association relationship and threat intelligence information;

[0150] The verification unit is used to verify the validity of the initial application link and use the initial application link that passes the validity verification as the threat link.

[0151] As an optional embodiment, the link search unit includes:

[0152] A first determination subunit, configured to determine dangerous assets based on the threat intelligence information;

[0153] A first link search subunit is used to search for a first initial application link corresponding to the dangerous asset through the asset association relationship and the path search algorithm; the first initial application link is an attack path between the dangerous asset and other assets;

[0154] A second determination subunit is used to determine the asset community through the community detection algorithm and the asset association relationship;

[0155] The second link search subunit is used to determine a dangerous community from each asset community using the threat intelligence information, and generate a second initial application link corresponding to the dangerous community; the second initial application link is an attack path between assets in the dangerous community.

[0156] As an optional embodiment, the acquisition module is specifically used to periodically acquire different types of target assets according to the asset detection range and detection strategy, and store them in the graph database. The target assets include: domain name nodes, IP address nodes, gateway nodes, load balancer nodes, server nodes, process nodes and port nodes.

[0157] As an optional embodiment, the result determination module includes:

[0158] A vulnerability search unit is used to match known vulnerabilities in the vulnerability database with each target asset, and search for known vulnerabilities that match the target asset; wherein the vulnerability severity of the target asset is the vulnerability severity of the matching known vulnerability;

[0159] The score calculation unit is used to calculate the exposure score of each target asset according to the vulnerability severity of each target asset, the asset importance, and the link complexity of each target asset in the threat link.

[0160] As an optional embodiment, the device further includes:

[0161] A detection module is used to detect whether there are high-risk exposed assets; wherein the high-risk exposed assets are target assets whose exposure score exceeds the alarm threshold; if so, the alarm module is triggered;

[0162] The alarm module is used to generate alarm information for the high-risk exposed assets.

[0163] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0164] See also Figure 5 , Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, the electronic device specifically includes:

[0165] A processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. The processor 21 executes the steps of the network threat analysis method described in any of the above method embodiments through the computer program.

[0166] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0167] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 22 is at least used to store the following computer program 221, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps in the network threat analysis method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 22 may also include an operating system 222 and data 223, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 222 may include Windows, Unix, Linux, etc.

[0168] In some embodiments, the electronic device may further include a display screen 23 , an input / output interface 24 , a communication interface 25 , a sensor 26 , a power source 27 , and a communication bus 28 .

[0169] certainly, Figure 5 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Figure 5 More or fewer components than shown, or combinations of certain components.

[0170] In another exemplary embodiment, a computer storage medium is also provided, and when the program instructions are executed by a processor, the steps of the network threat analysis method described in any of the above method embodiments are implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0171] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0172] It should be understood that the terms used in the text are only for the purpose of describing specific example embodiments, and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used in the text may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0173] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A network threat analysis method, characterized in that: include: Acquire different types of target assets; Analyze different types of target assets and determine asset relationships; Generate a threat chain based on the asset association relationship and threat intelligence information; The threat exposure analysis results of each target asset are determined based on the vulnerability severity of each target asset, the asset importance and the threat link.

2. The network threat analysis method according to claim 1, characterized in that: Generating a threat link according to the asset association relationship and threat intelligence information includes: Find the initial application link through the path finding algorithm, the community detection algorithm, the asset association relationship and the threat intelligence information; The validity of the initial application link is verified, and the initial application link that passes the validity verification is used as the threat link.

3. The network threat analysis method according to claim 2, characterized in that: The searching of the initial application link by using the path search algorithm, the community detection algorithm, the asset association relationship and the threat intelligence information includes: Determine dangerous assets based on the threat intelligence information; Finding a first initial application link corresponding to the dangerous asset through the asset association relationship and the path search algorithm; the first initial application link is an attack path between the dangerous asset and other assets; Determine the asset community through the community detection algorithm and the asset association relationship; The threat intelligence information is used to determine a dangerous community from each asset community, and a second initial application link corresponding to the dangerous community is generated; the second initial application link is an attack path between assets in the dangerous community.

4. The network threat analysis method according to claim 1, characterized in that: The acquisition of different types of target assets includes: According to the asset detection range and detection strategy, different types of target assets are periodically acquired and stored in the graph database.

5. The network threat analysis method according to claim 1, characterized in that: The target assets include: domain name nodes, IP address nodes, gateway nodes, load balancer nodes, server nodes, process nodes and port nodes.

6. The network threat analysis method according to any one of claims 1 to 5, characterized in that: The threat exposure analysis result of each target asset is determined according to the vulnerability severity of each target asset, the asset importance and the threat link, including: Match the known vulnerabilities in the vulnerability database with each target asset to find the known vulnerabilities that match the target asset; wherein the vulnerability severity of the target asset is the vulnerability severity of the matching known vulnerability; The exposure score of each target asset is calculated based on the severity of the vulnerability of each target asset, the importance of the asset, and the link complexity of each target asset in the threat chain.

7. The network threat analysis method according to claim 6, characterized in that: After determining the threat exposure analysis result of each target asset according to the vulnerability severity of each target asset, the asset importance and the threat link, the method further includes: Detect whether there are high-risk exposed assets; wherein the high-risk exposed assets are target assets whose exposure scores exceed the alarm threshold; If so, an alarm message for the high-risk exposed asset is generated.

8. A network threat analysis device, characterized in that: include: Acquisition module, used to acquire different types of target assets; The analysis module is used to analyze different types of target assets and determine the asset association relationships; A link generation module, used to generate a threat link according to the asset association relationship and threat intelligence information; The result determination module is used to determine the threat exposure analysis result of each target asset according to the vulnerability severity of each target asset, the asset importance and the threat link.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the network threat analysis method according to any one of claims 1 to 7 through the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the network threat analysis method described in any one of claims 1 to 7 of the present application.

Images