Trusted network management and control method and system based on finite-state machine

Abstract

The invention discloses a trusted network management and control method and system based on a finite-state machine. The method comprises the following steps: establishing a business workflow identification model based on a finite-state machine based on a legal credible business workflow of credible network behaviors; judging whether the to-be-detected network behavior is a trusted service or not by using a service workflow identification model based on a finite-state machine; and when it is detected that the to-be-detected network behavior is a non-trusted service, performing security blocking on the to-be-detected network behavior. Therefore, on the basis of construction of the service state machine and generation of the service workflow, automatic identification and intelligent management and control of the workflow implied by the service can be realized, the white service and the white flow which are tightly coupled with the service are realized, and the requirements of transparent security detection and defense of a full-service process are met; and intelligent detection of effective network attacks can be promoted.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a trusted network management and control method and system based on a finite state machine. Background Art

[0002] Cyberspace security is of vital importance. In the traditional network security field, network attacks are mainly detected by rules and pattern matching, which detects data that conforms to certain rules and patterns from traffic data and log data. However, with the rapid growth of network security data, the detection method based on rules and pattern matching is ineffective and it is difficult to detect complex attack events. The traditional security management center platform focuses on security operation and maintenance management, mainly presenting network management, performance management, fault management and security management. Its analysis methods and processing capabilities can no longer meet the needs of information security analysis and management in complex and heterogeneous large-scale network environments and massive data environments.

[0003] Based on this, a new solution is needed. Summary of the invention

[0004] According to one aspect of the present invention, a trusted network management and control method based on a finite state machine is provided, comprising the following steps:

[0005] Based on the legitimate and trusted business workflow of trusted network behavior, a business workflow identification model based on finite state machine is established;

[0006] Using a finite state machine-based business workflow identification model to determine whether the network behavior to be detected is a trusted business; and

[0007] When it is detected that the network behavior to be detected is an untrusted service, the network behavior to be detected is securely blocked.

[0008] According to another aspect of the present invention, a trusted network management and control system based on a finite state machine is provided, comprising:

[0009] A model building module is used to establish a business workflow identification model based on a finite state machine based on the legal and trusted business workflow of the trusted network behavior;

[0010] A trusted business identification module, used to determine whether the network behavior to be detected is a trusted business by using a business workflow identification model based on a finite state machine; and

[0011] The security blocking module is used to securely block the network behavior to be detected when it is detected that the network behavior to be detected is an untrusted business.

[0012] According to yet another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the trusted network management and control method based on a finite state machine as described above are implemented.

[0013] The implementation of the trusted network control method based on finite state machine provided by the present invention has the following beneficial effects: the present invention first establishes a business workflow identification model based on finite state machine based on the legitimate and trusted business workflow of the trusted network behavior; then, using the business workflow identification model based on finite state machine, it is determined whether the network behavior to be detected is a trusted business; when it is detected that the network behavior to be detected is an untrusted business, the network behavior to be detected is securely blocked; thus, based on the construction of the business state machine and the generation of the business workflow, it is possible to realize automatic identification and intelligent control of the workflow implicit in the business, realize white business and white traffic with tight coupling of the business, meet the needs of transparent security detection and defense of the entire business process, and further promote the intelligent detection of effective network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without creative work:

[0015] Figure 1 The figure is a flow chart of a trusted network management and control method based on a finite state machine provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0016] In order to facilitate understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Typical embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0017] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0018] In order to better understand the above-mentioned technical scheme, the above-mentioned technical scheme will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical scheme of the present application, rather than limitations on the technical scheme of the present application. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0019] Reference Figure 1 , Figure 1 FIG. 1 is a flow chart of a trusted network management and control method based on a finite state machine provided by an embodiment of the present invention. Figure 1 As shown, the trusted network management and control method based on a finite state machine provided by the present invention includes:

[0020] Step S1: Based on the legitimate and trusted business workflow of the trusted network behavior, a business workflow identification model based on a finite state machine is established.

[0021] Specifically, in one embodiment of the present invention, by forming a corresponding mapping relationship between the activities (or behaviors) of network entities, including but not limited to business operations, services and information flows, and business workflows, the business workflow identification model based on a finite state machine can be used to achieve the purpose of security management and control of business workflows. Therefore, step S1 includes:

[0022] Step S11: Map the legal and trusted business to a legal and trusted business workflow;

[0023] Step S12: Identify the mechanism flow and structural characteristics of the legal and trusted business workflow through an adaptive algorithm, and build a trusted business behavior state machine;

[0024] Step S13: extract features from the trusted business behavior state machine and establish the finite state machine-based business workflow identification model, wherein the finite state machine-based business workflow identification model includes a security domain entity set, a security event set, and a security policy set.

[0025] Specifically, in one embodiment of the present invention, the business workflow refers to the business workflow of the real entity, that is, the human-machine interface management system, which implements the human-oriented workflow. The business information flow of the network entity is manifested in the mapping of the operation behavior of the real entity and the business information flow of the network behavior, which constructs the workflow of the computer network world, that is, the workflow of the network information system itself, and has its own operating rules.

[0026] Specifically, in one embodiment of the present invention, for a workflow with known internal mechanism and structure, a trusted business behavior state machine can be constructed by identifying the mechanism flow and structure characteristics through regular expression matching. The trusted business behavior state machine includes an entity set, a state set, and a service set.

[0027] Furthermore, entity sets provide data and device support for state-based migration strategies, including:

[0028] Security domain entity set: B = (IS, IO), where IS represents security domain entities including people, hosts, programs and security devices; IO represents security domain objects including hosts, files and security devices, where entities can access resources and objects accept access or provide services; their relationship is:

[0029] Security event set: represented by E, which is the triggering condition of the policy, E = (ed, es), where ed represents the triggering condition and es represents the constraint condition;

[0030] System policy set P = (F, E, O, L), F indicates the security domain to which the policy belongs, O is the policy operation set, which includes normal operation no and abnormal operation eo, where no and eo can be expressed as a tuple of security device operation and security device (q, w); L is the matching rule of the policy; a policy in P can be expressed as: p k =(f, e k , o k , l k ), (f:F, e k ∈E,o k ∈O,l k ∈L); where: f o :F×E×L→O.

[0031] Furthermore, the state set records in detail the entire life cycle of the policy from generation to application and final expiration, and describes the entire process of system state migration, including:

[0032] System state S: represents the state of the system at a certain moment S = (E, P, D); where E and P are as described above, and D represents the set of linkage devices in the system;

[0033] System operation status S′: System operation status S′=(E′, P′, D′), which indicates the operation status of the system at a certain point in time; where E′ is all security events during system operation; P′ is the operation strategy set; D′ is the set of linkage device operation sequences that have been implemented during system operation; from the definition, we can see that:

[0034] Furthermore, the system service set includes five components, namely, the policy builder, the correctness detector, the completeness monitor, the consistency detector, and the redundancy detector. The policy builder is responsible for generating system policies. When a new security event occurs, the policy builder generates a policy corresponding to this security event according to certain rules. The remaining four components are responsible for policy verification. The correctness detector verifies the correctness of the newly generated policy through the barrel principle; the completeness detector verifies whether the current policy set of the system is complete by traversing all events; the consistency detector verifies the system policy set and the running policy set respectively by traversing the directed graph, and detects whether the network security policy is consistent under different conditions; the redundancy detector is used to detect whether there is a policy failure redundancy or repeated redundancy, and jointly provide support for the generation, verification and state migration of system linkage policies.

[0035] Specifically, in one embodiment of the present invention, by extracting features from a trusted business behavior state machine, a business workflow identification model based on a finite state machine is formed, which includes a security domain entity set, a security event set, and a security policy set. The business workflow model based on a finite state machine expresses the temporal and spatial characteristics of the relationships and attributes between entities, thereby effectively representing the dynamic changes in network security knowledge. Specifically, time and space characteristics are added to the relationships and entity attributes, such as the knowledge that a system has vulnerabilities, and the time interval in which the vulnerabilities exist is added, so that the actual security situation of the system can be represented in more detail. Network attacks may occur through different IP (interconnection protocol between networks) addresses, etc., and characteristics such as IP addresses in attack events are used as spatial characteristics in network security knowledge. The business workflow model based on a finite state machine can represent the dynamic changes in network security knowledge by describing the time and space characteristics.

[0036] Furthermore, in one embodiment of the present invention, during the operation of the system, there are two possibilities for security policy changes: one is normal business changes, with configuration errors, such as conflicting policies, empty policies, etc.; the other is malicious changes by internal and external personnel, such as opening high-risk ports or unauthorized access rights. Both of these situations will bring security risks and put the defender at a disadvantage. Effective security policy optimization and review can fully discover these policy risks and improve the effects of exposure convergence, boundary protection, and regional control. Therefore, after step S13, it also includes:

[0037] Step S14, detecting whether there is an incomplete state in the system;

[0038] Step S15: When there is an incomplete state in the system, construct a new security policy;

[0039] Step S16: Verify the correctness, consistency and redundancy of the new security policy;

[0040] Step S17: After the new security policy passes the correctness verification, consistency verification and redundancy verification, the new security policy is added to the security policy set.

[0041] Specifically, in one embodiment of the present invention, based on the policy verification of the depth-first traversal of the directed graph, the correctness, completeness, consistency and redundancy of the security policy are monitored and verified. The directed acyclic graph of the policy rules in the sub-security domain of the corresponding system can be traversed and the root node and leaf node of the directed acyclic graph can be clarified, and the security domain status and trigger conditions must also be clarified. The directed acyclic graph of the sub-security domain of the system is traversed in depth first to complete the analysis of the correctness, completeness, consistency and redundancy of the security policy in this sub-security domain. It is determined whether the path issued by the same state node of the directed acyclic graph contains leaf nodes that do not meet the threshold to determine whether the policy correctness is met, and whether there are conflicting or triggering conditions that occupy the same security device on each path to determine whether the consistency principle is met. For multiple output states derived from repeated trigger conditions, if they are the same, the redundancy principle is violated. If the corresponding trigger adjustment cannot have a corresponding security device, there is effectiveness redundancy; if they are different, it also violates the consistency principle.

[0042] Specifically, in one embodiment of the present invention, a security policy completeness check is performed in step S14, that is, it is checked whether a corresponding policy p can always be found in the system policy set P for any security event e in each security domain. If not, the completeness is not met.

[0043] Specifically, in one embodiment of the present invention, after an incomplete state is detected in the system, a new strategy is needed. In step S15, a trigger condition is generated for the security event e, feature extraction is performed, and the extracted features are converted into a standard format to correspond to the corresponding rule l in the rule base, and a security domain identification is performed, and finally the operation o on the device is assigned, thereby constructing a security policy p = (f, e, o, l) corresponding to the security event e. For example, when a "DoS attack" event occurs (recorded as event e), the system extracts features from event e, then performs data standardization processing, matches policy rules according to rule l in the rule base, and then attaches the security domain identification f to this policy to generate a new policy p, which can be expressed as: Assigned to the identified security domain.

[0044] Specifically, in one embodiment of the present invention, the new strategy formed in step S15 is also subject to correctness verification to confirm whether it is correct and effective; it is checked through consistency verification to see whether it conflicts with existing strategies; and finally, it is checked through redundancy verification to see whether there is an identical strategy for dealing with this event in the original strategy set. Only after passing the above three tests can the new strategy be added to the system strategy set.

[0045] Furthermore, in one embodiment of the present invention, the correctness detection refers to the validity test of the generation strategy, for which two parameters and the lower limit of safety (unsave) and the upper limit of risk (uprisk) are set, and two variables save and risk are set, which represent the safety factor and the risk factor respectively:

[0046] definition:

[0047] save≥unsave∪risk≤uprisk,

[0048] Then the current policy set P is correct.

[0049] definition: From the above, we can know that q i The action of policy p is (i=1, 2, 3...I); Bj is the execution object of the policy, (j=1, 2, 3...J), and Ck identifies the various security attributes contained in Bj: integrity, confidentiality, access category, controllability, (k=1, 2, 3, 4).

[0050] Definition: αi represents the i-th type q i The protection factor for the jth Bj (0≤αi≤1), the larger the protection factor, the better the i-th q i The better the protection effect; βj represents the sensitivity factor of the j-th Bj to the k-th Ck (0≤βj≤1), and the larger its value is, the more important the k-th attribute is.

[0051] Let γ ik Indicates q i The safety factor for all policy objects Ck, because we need to find q i The i-th action is the safest for the above four properties, so:

[0052]

[0053] In order to find q i The safety factor γi of all actions for all four Bj attributes, so the minimum value corresponding to the four attributes is selected ik As the final safety factor, we get:

[0054]

[0055] Therefore, all execution actions q in strategy p are obtained i The confidence factors of the four identification attributes of all policy targets Bj are:

[0056]

[0057] γ represents the comprehensive security performance of strategy p, and its value falls within (0, 1). The larger the value, the higher the security. , the current strategy is correct.

[0058] Furthermore, in one embodiment of the present invention, the inconsistency of policies is often caused by the consistency conflict between the updated security policy and other existing security policies in the system during the process of adding or modifying the policy; another reason is that before the effect of the security policy on handling a certain type of security incident is clear, alternative policies often appear, and there will be inconsistencies between the policy and its alternative policies. Therefore, the interference of alternative policies should be excluded when verifying the policy knowledge base. The consistency verification is divided into two aspects, namely, the detection of the system policy set P and the operation policy set P'.

[0059] The system policy set consistency is as follows:

[0060] theorem: satisfy

[0061]

[0062] Then the policy set P is consistent.

[0063] Definition: If the current consistent operation state is S′1, the corresponding operation strategy set The corresponding operation set O′ now executes the strategy p i , so that the system state transitions to: and:

[0064]

[0065] Then, the running state S' of the network security system based on the state transition network becomes inconsistent.

[0066] Furthermore, in one embodiment of the present invention, when the system is running or updating, problems such as the effectiveness and duplication of the original strategy will inevitably occur. In order to ensure the efficiency of the system, the redundancy of the security strategy is verified and the redundant strategy is deleted.

[0067] definition: Then the strategy set P has duplication and redundancy.

[0068] Step S2: using a finite state machine-based business workflow recognition model to determine whether the network behavior to be detected is a trusted business.

[0069] Specifically, in one embodiment of the present invention, the finite state machine-based business workflow recognition model generated in step S1 is used to determine the network behavior to be detected by the security policy corresponding to the security event when the network behavior to be detected triggers a security event. Therefore, step S2 includes:

[0070] Step S21, mapping the network behavior to be detected to the business workflow to be detected;

[0071] Step S22: Identify the mechanism flow and structural features of the business workflow to be detected by an adaptive algorithm, and construct a state machine for the business behavior to be detected;

[0072] Step S23, determine whether the state migration of the business behavior state machine to be detected triggers a security event in the security event set. When a security event is triggered, determine whether the state migration process complies with the security policy corresponding to the security event. If not, determine that the network behavior to be detected is an untrusted network behavior.

[0073] Step S3: When it is detected that the network behavior to be detected is an untrusted service, the network behavior to be detected is securely blocked.

[0074] Specifically, in one embodiment of the present invention, step S3 includes:

[0075] Step S31, evaluating the risk level of the network attack threat to the system by the network behavior to be detected through an improved static Bayesian attack graph and a dynamic Bayesian attack graph;

[0076] Step S32, obtaining the maximum probability attack path of the network behavior to be detected;

[0077] Step S33: Automatically block the attack path with the highest probability through routing and policy.

[0078] Specifically, in one embodiment of the present invention, by constructing a Bayesian network to quantitatively characterize the risk of network attacks, the purpose of evaluating the threat of network attacks can be achieved and the risk level of network attack threats can be determined. Therefore, it is necessary to generate an improved static Bayesian attack graph and a dynamic Bayesian attack graph through the following steps:

[0079] Identify node configuration and link relationships in the network system;

[0080] Use vulnerability scanners to scan network systems and discover system and service vulnerabilities;

[0081] Based on the identified node configuration and link relationship as well as the scanned system vulnerabilities and service vulnerabilities, an attack graph generation algorithm is used to generate a basic attack graph that does not include risk probability;

[0082] Calculate the success probability of each atomic attack in the basic attack graph, and then combine the Bayesian network and the causal relationship of multi-step atomic attacks to infer and calculate the conditional probability and the prior reachability probability of the conditional nodes to obtain a static Bayesian attack graph to evaluate static security risks;

[0083] When there are repeated exploits of vulnerabilities in the static Bayesian attack graph, the success probability and prior reachability probability of the corresponding atomic attack are modified to obtain an improved static Bayesian attack graph to evaluate static security risks.

[0084] According to the network security events that occur, the reachability probabilities of all affected nodes are dynamically updated, and their posterior reachability probabilities are calculated to obtain a dynamic Bayesian attack graph to evaluate dynamic security risks.

[0085] Specifically, in the present invention, the constituent elements of the Bayesian attack graph include the resource node state and the causal relationship between nodes. Therefore, first, the state attributes of the resources existing in the network system are identified through the resource information and expert knowledge of the network system, and the state transition and dependency between the resources are confirmed. In the process of constructing the Bayesian attack graph, the node needs to calculate the conditional probability in the state transition process to deduce the subsequent state. By introducing vulnerability detection, the vulnerability loopholes of the entire network system are detected. At the same time, the availability of the vulnerability loopholes is measured and calculated. In addition, the conditional probability of calculating the subsequent state is improved by combining the dependency relationship between the parent and child nodes, so that the attack graph can more accurately and effectively reflect the actual state transition of each resource in the network system. On the basis of the constructed Bayesian attack graph, the vulnerability availability is quantitatively measured, and the reachable probability is calculated according to the business workflow migration state, the reachable situation of each node state is obtained, and the overall reachable probability of each node state is calculated. Based on this, the forward state is reversely searched by the final state, thereby deriving the attack path with the maximum probability.

[0086] Furthermore, in one embodiment of the present invention, when an attacker attacks a vulnerability, he or she will consider the vulnerability value based on the exploitability and impact of the vulnerability. Therefore, in order to quantify the vulnerability value, the vulnerability score Score representing the vulnerability value is first calculated, and the calculation formula is:

[0087]

[0088] ISC=1-((1-C)(1-I)(1-A))

[0089] Exp=8.22AV·AC·PR·UI (1)

[0090] Impact represents the vulnerability impact factor, Exp represents the vulnerability exploit factor, ISC represents the intermediate variable, the constant 10 represents the maximum value of Score is 10, and the values ​​of other constant coefficients are set according to the security policy.

[0091] Furthermore, in one embodiment of the present invention, when an attacker launches an attack on a network node, he will not only consider the value of the node vulnerability, but also the cost of attacking the node and the benefits after the attack is completed. The cost and benefit of the attack will not affect the original state transfer properties between nodes, but will affect the attacker's choice of attack nodes. A rational attacker will choose a node with low attack cost and high benefit. When launching an attack, the attacker will invest necessary costs such as human resources, material resources, and attack costs. For the atomic attack Ai, cost(Ai) is used to represent the cost consumed by the attack, that is, the attack cost. The attack cost can be quantified using the scores of the four indicators SI, SP, Or, and IR. The calculation formula is:

[0092] cost(Ai) := 1-((1-SI)(1-SP)(1-Or)(1-IR)) (3)

[0093] For a certain atomic attack Ai, when the attacker completes the attack on the node through the attack, the profit that can be obtained is called the attack profit, which is represented by income(Ai). The attack profit can be set by policy, information leakage is 0.3-0.55, fortune registration is 0.55-0.7, authentication bypass: 0.7-0.8, limited access: 0.85-0.95, and full authority is 1.0.

[0094] Furthermore, in one embodiment of the present invention, the probability of an attacker launching an attack on its child nodes at the current attribute node can be calculated by comprehensively quantifying the node vulnerability value, attack cost, and benefit, that is, the probability of a certain atomic attack, with a value range of [0,1]. When the attack probability is 0, it means that the attack has no benefit for the attacker, and the attacker will not launch an attack; when the attack probability is 1, it means that the benefit that can be obtained from the attack is far greater than the cost, and the attacker will definitely launch an attack: The probability that the attacker completes an atomic attack Aj through the vulnerability vi is called the atomic attack probability, which is represented by P(Aj) and is calculated as:

[0095] Furthermore, in one embodiment of the present invention, in the attack graph, the attribute node is not independent, and whether it can be occupied is also affected by its parent node, so it is necessary to calculate the conditional probability of the node in the entire attack graph. The conditional probability represents the possibility of a certain attribute node being attacked under the influence of its parent node. For the attribute node Sj, the conditional probability is represented by P(Sj|Par(Sj)), where Par(Sj) represents the parent node set of Sj. Depending on the difference of dj, the calculation formula of the conditional probability is shown as follows:

[0096] 1) When dj=AND, we have:

[0097]

[0098] 2) When dj=OR, we have:

[0099]

[0100] Furthermore, in one embodiment of the present invention, the network is not static, and any change in network security elements will affect the static reachability probability. When the attacker's attack intention is known (i.e., Starget = 1), the reachability probability of the attribute nodes in the entire attack graph may change accordingly. Therefore, in order to quantify the network risk according to the attacker's intention, it is necessary to update the reachability probability of other nodes in combination with the known target attribute nodes. The attribute node set S = {Si|i = 1, 2, ..., n} in the Bayesian attack graph is divided into a target node set:

[0101] Supdate = {Sj∈S|Sj=0} and the node set to be updated Starget = S - Supdate.

[0102] The dynamic reachability probability represents the probability of dynamically updating the reachability probability of the update set node Sb (Sb∈Supdate) after the target node is known to be Sa (Sa∈Starget), which is expressed as P2(Sb|Starget) and is calculated as follows:

[0103]

[0104] in:

[0105] The present invention integrates the relationship between system resource attributes and vulnerability exploitation, and constructs a Bayesian attack graph in the form of state nodes and directed transition probabilities, which not only takes into account the dependencies between nodes, but also introduces measurement standards to perform mathematical calculations on the vulnerability exploitation rate. At the same time, in order to intuitively and clearly describe the current threat situation of the system, the overall security risk situation is represented in the form of vulnerability exploitability, state reachability probability, and maximum probability attack path, which can provide a basis and support for the formulation and implementation of the defender's subsequent dynamic attack surface transfer strategy.

[0106] Specifically, in one embodiment of the present invention, the step of obtaining the maximum probability attack path includes:

[0107] Define network attack graph based on attack graph theory;

[0108] Obtain the network connection matrix by detecting the attacker's permission status at the current time node;

[0109] Get the vulnerabilities, attack effects and attack conditions used by the attacker;

[0110] According to the predefined attack criteria, each attribute of the vulnerability existing in the network system is assigned a value;

[0111] Detect the probability of an attacker successfully exploiting a vulnerability to invade, the probability of an attacker obtaining high permissions, and the probability of achieving the attack intention, so as to determine the attacker's maximum probability attack path.

[0112] The present invention also provides a trusted network management and control system based on a finite state machine, comprising:

[0113] A model building module is used to establish a business workflow identification model based on a finite state machine based on the legal and trusted business workflow of the trusted network behavior;

[0114] A trusted business identification module, used to determine whether the network behavior to be detected is a trusted business by using a business workflow identification model based on a finite state machine; and

[0115] The security blocking module is used to securely block the network behavior to be detected when it is detected that the network behavior to be detected is an untrusted business.

[0116] The embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps can be implemented;

[0117] Based on the legitimate and trusted business workflow of trusted network behavior, a business workflow identification model based on a finite state machine is established; using the business workflow identification model based on a finite state machine, it is determined whether the network behavior to be detected is a trusted business; and when it is detected that the network behavior to be detected is an untrusted business, the network behavior to be detected is securely blocked.

[0118] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM)> a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0119] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0120] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0121] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0122] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0123] The various component embodiments of the present invention can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components in the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0124] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A trusted network management and control method based on a finite state machine, characterized in that: The following steps are involved: Based on the legitimate and trusted business workflow of trusted network behavior, a business workflow identification model based on finite state machine is established; Using the business workflow recognition model based on finite state machines, it is determined whether the network behavior to be detected is a trusted business; as well as When it is detected that the network behavior to be detected is an untrusted service, the network behavior to be detected is securely blocked.

2. The trusted network management and control method based on finite state machine according to claim 1, characterized in that: Based on the legitimate and trusted business workflow of the trusted network behavior, establishing the business workflow identification model based on the finite state machine includes: Map legal and trusted businesses to legal and trusted business workflows; Identify the mechanism process and structural characteristics of the legal and trusted business workflow through an adaptive algorithm, and build a trusted business behavior state machine; Feature extraction is performed on the trusted business behavior state machine to establish the business workflow identification model based on the finite state machine. The business workflow identification model based on the finite state machine includes a security domain entity set, a security event set, and a security policy set.

3. The trusted network management and control method based on finite state machine according to claim 2, characterized in that: Using the business workflow identification model based on the finite state machine, the steps of determining whether the network behavior to be detected is a trusted business include: Map the network behavior to be detected to the business workflow to be detected; Identify the mechanism flow and structural characteristics of the business workflow to be detected through an adaptive algorithm, and construct a state machine for the business behavior to be detected; Determine whether the state migration of the business behavior state machine to be detected triggers a security event in the security event set. When a security event is triggered, determine whether the state migration process complies with the security policy corresponding to the security event. If not, determine that the network behavior to be detected is an untrusted network behavior.

4. The trusted network management and control method based on finite state machine according to claim 2, characterized in that: After extracting features from the trusted business behavior state machine and establishing the business workflow identification model based on the finite state machine, the method further includes: Detect whether there are incomplete states in the system; Construct new security policies when there are incomplete states in the system; Verify the correctness, consistency and redundancy of new security policies; After the new security policy passes the correctness verification, consistency verification and redundancy verification, the new security policy is added to the security policy set.

5. The trusted network management and control method based on finite state machine according to claim 1, characterized in that: When it is detected that the network behavior to be detected is an untrusted service, the step of securely blocking the network behavior to be detected includes: Evaluate the risk level of the network attack threat to the system by the network behavior to be detected through an improved static Bayesian attack graph and a dynamic Bayesian attack graph; Obtaining the maximum probability attack path of the network behavior to be detected; Automatic routing blocking and policy blocking are performed on the maximum probability attack path.

6. The trusted network management and control method based on finite state machine according to claim 5, characterized in that: The steps of generating the improved static Bayesian attack graph and the dynamic Bayesian attack graph include: Identify node configuration and link relationships in the network system; Use vulnerability scanners to scan network systems and discover system and service vulnerabilities; Based on the identified node configuration and link relationship as well as the scanned system vulnerabilities and service vulnerabilities, an attack graph generation algorithm is used to generate a basic attack graph that does not include risk probability; Calculate the success probability of each atomic attack in the basic attack graph, and then combine the Bayesian network and the causal relationship of multi-step atomic attacks to infer and calculate the conditional probability and the prior reachability probability of the conditional nodes to obtain a static Bayesian attack graph to evaluate static security risks; When there are repeated exploits of vulnerabilities in the static Bayesian attack graph, the success probability and prior reachability probability of the corresponding atomic attack are modified to obtain an improved static Bayesian attack graph to evaluate static security risks. According to the network security events that occur, the reachability probabilities of all affected nodes are dynamically updated, and their posterior reachability probabilities are calculated to obtain a dynamic Bayesian attack graph to evaluate dynamic security risks.

7. The trusted network management and control method based on finite state machine according to claim 5, characterized in that: The steps to obtain the most probable attack path include: Define network attack graph based on attack graph theory; Obtain the network connection matrix by detecting the attacker's permission status at the current time node; Get the vulnerabilities, attack effects and attack conditions used by the attacker; According to the predefined attack criteria, each attribute of the vulnerability existing in the network system is assigned a value; Detect the probability of an attacker successfully exploiting a vulnerability to invade, the probability of an attacker obtaining high permissions, and the probability of achieving the attack intention, so as to determine the attacker's maximum probability attack path.

8. A trusted network management and control system based on a finite state machine, characterized in that: include: A model building module is used to establish a business workflow identification model based on a finite state machine based on the legal and trusted business workflow of the trusted network behavior; A trusted business identification module is used to determine whether the network behavior to be detected is a trusted business by using a business workflow identification model based on a finite state machine; as well as The security blocking module is used to securely block the network behavior to be detected when it is detected that the network behavior to be detected is an untrusted business.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the trusted network management and control method based on a finite state machine as described in any one of claims 1 to 7 are implemented.

Images