A security perception management method and platform

Abstract

The present invention discloses a security perception management method and platform, which includes determining the user type of the uploading user, and analyzing the user behavior log of the uploading user based on the user type of the uploading user to obtain a first analysis result; extracting objects and command objects in the first analysis result, analyzing the objects and command objects through an abnormal analysis database, and determining the source information of the command object; recording the source information through a time series model, and calculating the source distribution of the source information using an HMM algorithm, simulating the host loss process based on the obtained source distribution result, and synchronously warning the host. Therefore, the present invention integrates multi-source data, conducts real-time monitoring of the in-depth analysis of user behavior and potential attacks, improves the overall security protection capability, enhances real-time performance, and reduces the risk of security threats faced by enterprises.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a security perception management platform and device. Background Art

[0002] With the rapid development of information technology, network security has become increasingly important. As enterprises and organizations advance digital transformation, the amount of data continues to increase, and the methods of network attacks have become more complex and diverse. The traditional security management system can no longer meet the current needs of enterprises in terms of security protection, threat response and risk management. Therefore, the security perception management platform came into being to achieve comprehensive monitoring and intelligent analysis of the network environment.

[0003] In the existing technology, the data integrated by the security management system is from a single source, resulting in serious information island phenomenon, making the investigation and response process of security incidents complicated and inefficient, and increasing the risk of enterprises facing security threats; the existing security management system has delays in the data collection and analysis process, which results in the security team being unable to respond quickly after the attack occurs, thereby extending the time for incident handling, increasing the risk of loss, and lacking real-time performance. Summary of the invention

[0004] The present invention provides a security perception management method and platform to propose a security perception management method.

[0005] To this end, the present invention proposes a security perception management method that can integrate multi-source data, conduct in-depth analysis of user behavior and real-time monitoring of potential attacks, improve overall security protection capabilities, enhance real-time performance, and reduce the risk of security threats faced by enterprises.

[0006] Another object of the present invention is to provide a security awareness management platform.

[0007] To achieve the above object, the present invention provides a security perception management method, which includes:

[0008] Determine the user type of the uploading user, and analyze the user behavior log of the uploading user based on the user type of the uploading user to obtain a first analysis result; wherein the user types include basic customers, regular customers and key customers; the determining the type of the uploading user, and analyzing the user behavior log of the uploading user based on the type of the uploading user to obtain the first analysis result includes: if the uploading user is a basic customer, then match each command line in the user behavior log of the uploading user with a specific command in a preset rule, and obtain the first analysis result based on the obtained matching result; if the uploading user is a regular customer, then match the key command lines in the user behavior log of the uploading user with the specific commands in the preset rules, and obtain the first analysis result based on the obtained matching result; if the uploading user is a key customer, then match the random command lines in the user behavior log of the uploading user with the specific commands in the preset rules, and obtain the first analysis result based on the obtained matching result;

[0009] Extracting objects and command objects from the first analysis result, analyzing the objects and command objects through an abnormality analysis database, and determining source information of the command objects;

[0010] The source information is recorded through a time series model, and the source distribution of the source information is calculated using a hidden Markov model HMM algorithm. The host loss process is simulated based on the obtained source distribution result, and the host is warned synchronously.

[0011] The security perception management method of the embodiment of the present invention may also have the following additional technical features:

[0012] In one embodiment of the present invention, before analyzing the object and the command object through the abnormality analysis database to determine the source information of the command object, the method further includes:

[0013] Collect the user's normal behavior data, and establish a normal standard behavior process based on the normal behavior data through the UEBA model;

[0014] Collecting data associated with users and entities, determining deviant behaviors in the associated data that deviate from the normal standard behavior process through a machine learning algorithm, and performing feature analysis on the deviant behaviors to obtain feature analysis results;

[0015] A security threat indicator parameter is established through the feature analysis result, and an anomaly analysis database is constructed based on the security threat indicator parameter.

[0016] In one embodiment of the present invention, establishing security threat indicator parameters through the feature analysis results, and constructing an anomaly analysis database based on the security threat indicator parameters, includes:

[0017] Based on the characteristic analysis results, establish security threat indicator parameters;

[0018] Prioritize the abnormal behaviors based on the security threat indicator parameters to obtain a priority ranking result;

[0019] Based on the priority sorting results, an abnormality analysis database is constructed.

[0020] In one embodiment of the present invention, recording the source information through a time series model and calculating the source distribution using a hidden Markov model HMM algorithm includes:

[0021] Establishing a timetable through a time series model to record access and behavior information at different times in the source information;

[0022] The HMM algorithm is used to calculate the source distribution through the access and behavior information in the source information.

[0023] In one embodiment of the present invention, simulating the host compromise process based on the obtained source distribution result and simultaneously issuing an early warning to the host includes:

[0024] Based on the obtained source distribution results, a directed graph and a spanning tree are generated;

[0025] Based on the directed graph and the spanning tree, a behavior source time and node distribution table is obtained;

[0026] Based on the behavior source time and node distribution table, the host loss process is simulated and an early warning is issued to the host simultaneously.

[0027] In one embodiment of the present invention, simulating the host loss process based on the behavior source time and the node distribution table and simultaneously issuing an early warning to the host includes:

[0028] Simulate the host compromise process based on the behavior source time and node distribution table, and record the activity frequency of the source during the host compromise process;

[0029] When the activity frequency of the source exceeds a preset threshold, an alarm is sent to the host.

[0030] In one embodiment of the present invention, obtaining a first analysis result based on the obtained matching result includes:

[0031] Determining suspected high-risk commands in the matching results;

[0032] Repeatedly testing the suspected high-risk command to determine whether the suspected high-risk command is a high-risk command;

[0033] If it is determined that the suspected high-risk command is a high-risk command, a first analysis result is obtained based on the high-risk command.

[0034] To achieve the above object, the present invention further provides a security awareness management platform, the platform comprising:

[0035] A threat-specific analysis unit, for determining a user type of an uploading user, and analyzing a user behavior log of the uploading user based on the user type of the uploading user to obtain a first analysis result; wherein the user types include basic customers, regular customers, and key customers; the determining the type of the uploading user, and analyzing the user behavior log of the uploading user based on the type of the uploading user to obtain a first analysis result, comprises: if the uploading user is a basic customer, then matching each command line in the user behavior log of the uploading user with a specific command in a preset rule, and obtaining a first analysis result based on the obtained matching result; if the uploading user is a regular customer, then matching a key command line in the user behavior log of the uploading user with a specific command in a preset rule, and obtaining a first analysis result based on the obtained matching result; if the uploading user is a key customer, then matching a random command line in the user behavior log of the uploading user with a specific command in a preset rule, and obtaining a first analysis result based on the obtained matching result;

[0036] an abnormal behavior analysis unit, used to extract objects and command objects from the first analysis result, analyze the objects and command objects through an abnormal analysis database, and determine source information of the command objects;

[0037] The automated attack tracing unit is used to record the source information through a time series model, calculate the source distribution of the source information using a hidden Markov model (HMM) algorithm, simulate the host compromise process based on the obtained source distribution results, and simultaneously issue an early warning to the host.

[0038] Another object of the present invention is to provide an electronic device, comprising:

[0039] at least one processor; and

[0040] a memory communicatively connected to the at least one processor; wherein,

[0041] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform any one of the methods described in the above aspect.

[0042] Another object of the present invention is to provide a computer storage medium, wherein the computer storage medium stores computer executable instructions; after the computer executable instructions are executed by a processor, the computer executes any one of the methods described in the above aspect.

[0043] The security perception management method and platform of the embodiment of the present invention determines the user type of the uploading user, and analyzes the user behavior log of the uploading user based on the user type of the uploading user to obtain a first analysis result; extracts the object and command object in the first analysis result, analyzes the object and command object through the abnormal analysis database, and determines the source information of the command object; records the source information through a time series model, and calculates the source distribution of the source information using the HMM algorithm, simulates the host loss process based on the obtained source distribution result, and simultaneously warns the host. Therefore, the present invention can integrate multi-source data, conduct in-depth analysis of user behavior and real-time monitoring of potential attacks, improve the overall security protection capability, enhance real-time performance, and reduce the risk of security threats faced by enterprises.

[0044] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0046] Figure 1 is a flow chart of a security perception management method according to an embodiment of the present invention;

[0047] Figure 2 It is a structural diagram of a security awareness management platform according to an embodiment of the present invention. DETAILED DESCRIPTION

[0048] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0049] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0050] The following describes the security awareness management method and platform proposed according to the embodiments of the present invention with reference to the accompanying drawings.

[0051] Figure 1 It is a flow chart of the security perception management method according to an embodiment of the present invention.

[0052] like Figure 1 As shown, the method includes:

[0053] S1, determining the user type of the uploading user, and analyzing the user behavior log of the uploading user based on the user type of the uploading user to obtain a first analysis result;

[0054] In one embodiment of the present invention, the user types of the uploading user include basic customers, regular customers and key customers.

[0055] In one embodiment of the present invention, the method for determining the user type of the uploading user may include: acquiring historical data of the uploading user, and determining the user type of the uploading user according to the historical data.

[0056] In one embodiment of the present invention, the historical data may include any one of interaction frequency and transaction record. In one embodiment of the present invention, the interaction frequency may be the number of interactions within a preset time; the transaction record may be the number of transactions within a preset time.

[0057] And, in one embodiment of the present invention, the method for determining the user type of the uploading user according to the historical data may include: if the historical data exceeds the corresponding first threshold, the uploading user is determined as a key customer; if the historical data exceeds the corresponding second threshold and is less than the first threshold, the uploading user is determined as a regular customer; if the historical data is less than the second threshold, the uploading user is determined as a basic customer. Wherein, the first threshold is greater than the second threshold.

[0058] For example, in one embodiment of the present invention, assuming that the historical data is interaction frequency, if the interaction frequency of the uploading user exceeds the corresponding first threshold, the uploading user is determined as a key customer; if the interaction frequency of the uploading user exceeds the corresponding second threshold and is less than the first threshold, the uploading user is determined as a regular customer; if the interaction frequency is less than the second threshold, the uploading user is determined as a basic customer.

[0059] In one embodiment of the present invention, after the user type of the uploading user is determined, the user behavior log of the uploading user may be analyzed based on the user type of the uploading user to obtain a first analysis result.

[0060] Specifically, in one embodiment of the present invention, the method for analyzing the user behavior log of the uploading user based on the user type of the uploading user to obtain the first analysis result may include the following steps:

[0061] S11, if the uploading user is a basic customer, each command line in the user behavior log of the uploading user is matched with a specific command in a preset rule, and a first analysis result is obtained based on the obtained matching result;

[0062] S12, if the uploading user is a regular customer, matching the key command lines in the user behavior log of the uploading user with the specific commands in the preset rules, and obtaining a first analysis result based on the obtained matching result;

[0063] S13: If the uploading user is a key customer, a random command line in the user behavior log of the uploading user is matched with a specific command in a preset rule, and a first analysis result is obtained based on the obtained matching result.

[0064] Among them, in one embodiment of the present invention, the above-mentioned preset rules can be a set of commands with risks obtained based on manual experience. And, in one embodiment of the present invention, different review strategies will be adopted to analyze the user behavior logs of different types of uploading users. Specifically, the user behavior logs of basic customers will be reviewed item by item, the user behavior logs of regular customers will be reviewed in detail, and the user behavior logs of key customers will be reviewed in random checks. Through the above-mentioned classification management, resources can be effectively utilized and focused on possible high-risk behaviors.

[0065] Furthermore, in one embodiment of the present invention, the method for obtaining the first analysis result based on the obtained matching result may include the following steps:

[0066] Step 1: Identify suspected high-risk commands in the matching results;

[0067] Step 2: Repeat the detection of the suspected high-risk command to determine whether the suspected high-risk command is a high-risk command;

[0068] Step 3: If the suspected high-risk command is determined to be a high-risk command, a first analysis result is obtained based on the high-risk command.

[0069] In one embodiment of the present invention, after obtaining the matching results, the suspected high-risk commands in the matching results can be determined, and the suspected high-risk commands can be repeatedly detected through other different detection rules. If different detection rules all determine that the command is a high-risk command, the suspected high-risk command is determined to be a high-risk command, and the first analysis result is obtained based on the relevant information corresponding to the high-risk command. In one embodiment of the present invention, the relevant information corresponding to the high-risk command includes but is not limited to the object in the high-risk command, the command object, and the address, port, time period, and location of the access server.

[0070] Furthermore, in one embodiment of the present invention, after the high-risk command is determined, an object and a command object are obtained based on the high-risk command, wherein the object may be the first machine information (such as a server and / or database) and operation information of the executed command, and the command object may be the output result of executing the command.

[0071] S2, extracting the object and command object in the first analysis result, analyzing the object and command object through the abnormal analysis database, and determining the source information of the command object;

[0072] In one embodiment of the present invention, after obtaining the first analysis result through the above steps, the object and command object in the first analysis result can be extracted, and then the object and command object are analyzed through the abnormal analysis database to determine the source information of the command object.

[0073] Specifically, in one embodiment of the present invention, before analyzing the object and the command object through the abnormal analysis database to determine the source information of the command object, the method may further include the following steps:

[0074] Step a: Collect the user's normal behavior data and establish a normal standard behavior process based on the normal behavior data through the UEBA model;

[0075] Step b, collecting data associated with users and entities, determining deviant behaviors that deviate from normal standard behavior processes according to a machine learning algorithm, and performing feature analysis on the deviant behaviors to obtain feature analysis results;

[0076] Step c: Establish security threat indicator parameters through feature analysis results, and build an anomaly analysis database based on the security threat indicator parameters.

[0077] In one embodiment of the present invention, the UEBA model can be generated by comprehensively monitoring and analyzing the behaviors of users and entities, wherein the behaviors of users and entities include but are not limited to the login time, access frequency and operation habits of users. Furthermore, the UEBA model can continuously update and adjust the normal behavior standards according to real-time data, thereby more accurately reflecting the real behavior of users and providing a more flexible and intelligent security protection mechanism.

[0078] Furthermore, in one embodiment of the present invention, after obtaining the normal standard behavior process through the above steps, the deviation behavior that deviates from the normal standard behavior process can be determined according to the machine learning algorithm, and the deviation behavior can be feature analyzed to obtain the feature analysis result, so that the root cause of the abnormal behavior can be revealed according to the feature analysis result, providing an important basis for subsequent security response. Among them, the above machine learning algorithm can be an algorithm in the prior art, such as K-means, decision tree, random forest and regression algorithm.

[0079] In one embodiment of the present invention, the above-mentioned feature analysis results may include access frequency and specific abnormal operations, for example, the input command contains special high-risk characters.

[0080] Further, in one embodiment of the present invention, after obtaining the characteristic analysis results through the above steps, security threat indicator parameters can be established through the characteristic analysis results, and an abnormal analysis database can be constructed based on the security threat indicator parameters. Among them, in one embodiment of the present invention, the above method of establishing security threat indicator parameters through characteristic analysis results and constructing an abnormal analysis database based on the security threat indicator parameters can include: establishing security threat indicator parameters based on the characteristic analysis results, and prioritizing abnormal behaviors based on the security threat indicator parameters to obtain priority sorting results, and then constructing an abnormal analysis database based on the priority sorting results.

[0081] Among them, in one embodiment of the present invention, the security threshold of each feature data can be determined by analyzing the feature data in the feature analysis results, and the security threat indicator parameters corresponding to each feature can be established based on the corresponding security threshold. In one embodiment of the present invention, the security threshold of each feature data can be determined by manual experience according to the importance of the business corresponding to the host in the feature analysis results, wherein the security threshold may include the access frequency. For example, assuming that the feature analysis results include access to database A and logging in to server B, the security threshold for accessing database A can be determined to be an access frequency of 10 times / minute (10 visits per minute) based on the importance of the business data in database A being general, and the security threshold for logging in to server B can be determined to be an access frequency of 5 times / minute based on the importance of the business in server B being important.

[0082] And, in one embodiment of the present invention, after the corresponding security threshold is obtained through the above steps, the security threat index coefficient corresponding to each feature can be determined based on the security threshold and the importance value of the corresponding host. Among them, the importance value corresponding to each host can be determined through the corresponding relationship table between the host and the importance value, and the range of the importance value is [0,1]. The range of the above security threshold is also set to [0,1] through data normalization processing, and then the security threat index coefficient corresponding to each feature is determined through the security threat index formula, wherein the security threat index formula is:

[0083] T=w1X+w2Y.

[0084] Wherein, T is the security threat index coefficient, X is the security threshold, Y is the importance value of the host, w1 and w2 are corresponding weight coefficients, wherein w1+w2=1. In one embodiment of the present invention, the values ​​of w1 and w2 can be set as needed, for example, w1=0.3 and w2=0.7.

[0085] Furthermore, in one embodiment of the present invention, the security threat indicator parameters established above can be used to quantify and evaluate the severity and impact of potential threats, and can intelligently classify and prioritize threats, ensuring that the security team can focus on the most urgent and riskiest incidents, thereby effectively improving the efficiency of security incident response.

[0086] Furthermore, in one embodiment of the present invention, abnormal behaviors can be sorted in ascending order of priority based on security threat indicator parameters, and based on the ascending sorting result, a preset number of low-priority threat indicators can be filtered out, and an abnormal analysis database can be constructed based on the remaining other security threat indicator parameters and corresponding features, thereby reducing false alarms, improving the efficiency and accuracy of security operations, and enabling the security team to focus resources on threats that really need attention and optimize the security response process.

[0087] Furthermore, in one embodiment of the present invention, after the abnormality analysis database is established through the above steps, the objects and command objects in the first analysis result can be analyzed and filtered based on the abnormality analysis database to determine the source information of the command object.

[0088] In one embodiment of the present invention, the above-mentioned source information may include but is not limited to:

[0089] User ID: The user ID that executes the command;

[0090] Device information: the type of device and operating system on which the operation is performed;

[0091] Network information: user's IP address and network environment, etc.;

[0092] Timestamp: The time information when the command is executed.

[0093] S3, records the source information through the time series model, and uses the hidden Markov model HMM algorithm to calculate the source distribution of the source information. Based on the obtained source distribution results, the host loss process is simulated and the host is warned simultaneously.

[0094] In one embodiment of the present invention, after the source information is obtained through the above steps, the source information can be recorded through a time series model, and the source distribution of the source information can be calculated using an HMM algorithm. Based on the obtained source distribution results, the host loss process can be simulated and the host can be warned simultaneously.

[0095] Specifically, in one embodiment of the present invention, the above-mentioned method of recording source information through a time series model and calculating source distribution using an HMM algorithm may include the following steps: establishing a timetable through a time series model, recording access and behavior information at different times in the source information, and calculating source distribution using the access and behavior information in the source information using an HMM algorithm.

[0096] In one embodiment of the present invention, a timetable is established through a time series model to record the access and behavior information at different times in each source information, wherein the behavior information includes the source IP address, request type and access path information recorded according to the timestamp of the attack event, and then the HMM algorithm is used to analyze the access and behavior information in the source information to calculate the source distribution of each source. The HMM algorithm is the same as the prior art, and the details of the HMM algorithm can refer to the prior art, and the embodiment of the present invention will not be repeated here.

[0097] And, in one embodiment of the present invention, the source distribution results obtained by the above method include but are not limited to:

[0098] Visit frequency: the number of visits from different sources;

[0099] Behavioral pattern: distribution of behavioral characteristics of each source;

[0100] Time distribution: The distribution of behaviors of different sources over time.

[0101] Furthermore, in one embodiment of the present invention, the HMM algorithm can process time series data and is suitable for analyzing dynamically changing attack sources. Based on this, the HMM algorithm is used for data analysis to improve the ability to parse source information.

[0102] Further, in one embodiment of the present invention, the method for simulating the host loss process based on the obtained source distribution result and simultaneously issuing an early warning to the host may include the following steps:

[0103] S31, generating a directed graph and a spanning tree based on the obtained source distribution result;

[0104] S32, based on the directed graph and the spanning tree, obtain the behavior source time and node distribution table;

[0105] S33, based on the behavior source time and node distribution table, simulates the host loss process and simultaneously issues an early warning to the host.

[0106] In one embodiment of the present invention, a directed graph and a spanning tree can be established based on the source distribution results. In one embodiment of the present invention, the nodes in the directed graph can be different sources, behaviors and times, and the edges in the directed graph can be directed edges established based on the relationship between the source and the behavior, and a directed graph is formed based on the nodes and edges in the directed graph. Also, in one embodiment of the present invention, after the directed graph is generated through the above steps, the nodes in the directed graph can be sorted to generate a tree to clarify the hierarchical relationship between different sources, thereby significantly enhancing the visual display of the attack path, and through visualization, security personnel can more intuitively understand the relationship between different sources and their attack paths, which helps to quickly identify the multi-level and complexity of attacks.

[0107] And, in one embodiment of the present invention, after obtaining the directed graph and spanning tree through the above steps, the behavior source time and node distribution table can be obtained based on the directed graph and spanning tree, providing an important data basis for subsequent attack analysis. Specifically, in one embodiment of the present invention, the access time of each node can be counted according to the directed graph and spanning tree to generate the behavior source time; the access frequency of different nodes can be counted according to the directed graph and spanning tree to form a node distribution table; and the node and connection information can be extracted from the spanning tree.

[0108] Further, in one embodiment of the present invention, the method for simulating the host loss process based on the behavior source time and the node distribution table and synchronously warning the host may include the following steps:

[0109] S331, simulating the host compromise process based on the behavior source time and node distribution table, and recording the activity frequency of the source during the host compromise process;

[0110] S332, when the activity frequency of the source exceeds a preset threshold, an alarm is issued to the host.

[0111] In one embodiment of the present invention, the host compromise process can be simulated in a virtual environment.

[0112] Furthermore, in one embodiment of the present invention, the host compromise process can be simulated in a virtual environment based on the behavior source time and the node distribution table, and the activity frequency of the source can be monitored, and the activity frequency of different sources during the compromise process can be recorded, wherein the activity frequency of the source can be the number of times the source operates within a preset time period.

[0113] Furthermore, in one embodiment of the present invention, when the activity frequency of a source exceeds a preset threshold, an alarm is automatically activated, which greatly improves the response speed to potential threats, thereby improving the monitoring capability of attack behaviors, and optimizing the emergency response process, ensuring the timeliness and effectiveness of network security management.

[0114] Furthermore, in one embodiment of the present invention, by simulating the host compromise process, it is possible to analyze the steps and strategies taken by the attacker, and deeply understand the evolution of the attack behavior, so that security personnel can predict the attacker's behavior pattern and formulate more targeted defense measures.

[0115] In the security perception management method proposed by the present invention, the user type of the uploading user is determined, and the user behavior log of the uploading user is analyzed based on the user type of the uploading user to obtain a first analysis result; the object and command object in the first analysis result are extracted, and the object and command object are analyzed through the abnormal analysis database to determine the source information of the command object; the source information is recorded through a time series model, and the source distribution of the source information is calculated using the HMM algorithm, and the host loss process is simulated based on the obtained source distribution result, and the host is warned synchronously. Therefore, the present invention can integrate multi-source data, conduct in-depth analysis of user behavior and real-time monitoring of potential attacks, improve the overall security protection capability, enhance real-time performance, and reduce the risk of security threats faced by enterprises.

[0116] In order to implement the above embodiment, Figure 2 As shown, in this embodiment, a security perception management platform 10 is also provided, which includes a threat-specific analysis unit 201, an abnormal behavior analysis unit 202, and an automated attack tracing unit 203;

[0117] The threat-specific analysis unit 201 is used to determine the user type of the uploading user, and analyze the user behavior log of the uploading user based on the user type of the uploading user to obtain a first analysis result; wherein the user type includes a basic customer, a regular customer, and a key customer; determine the type of the uploading user, and analyze the user behavior log of the uploading user based on the type of the uploading user to obtain a first analysis result, including: if the uploading user is a basic customer, then match each command line in the user behavior log of the uploading user with a specific command in a preset rule, and obtain a first analysis result based on the obtained matching result; if the uploading user is a regular customer, then match the key command line in the user behavior log of the uploading user with the specific command in the preset rule, and obtain a first analysis result based on the obtained matching result; if the uploading user is a key customer, then match the random command line in the user behavior log of the uploading user with the specific command in the preset rule, and obtain a first analysis result based on the obtained matching result;

[0118] The abnormal behavior analysis unit 202 is used to extract the object and the command object in the first analysis result, analyze the object and the command object through the abnormal analysis database, and determine the source information of the command object;

[0119] The automated attack tracing unit 203 is used to record source information through a time series model, calculate the source distribution of the source information using an HMM algorithm, simulate the host compromise process based on the obtained source distribution results, and simultaneously issue an early warning to the host.

[0120] In one embodiment of the present invention, the above platform is also used for:

[0121] Collect users' normal behavior data and establish normal standard behavior processes based on the normal behavior data through the UEBA model;

[0122] Collecting data associated with users and entities, determining deviant behaviors that deviate from normal standard behavior processes in the associated data through a machine learning algorithm, and performing feature analysis on the deviant behaviors to obtain feature analysis results;

[0123] Security threat indicator parameters are established through feature analysis results, and an anomaly analysis database is constructed based on the security threat indicator parameters.

[0124] Furthermore, in one embodiment of the present invention, the above device is also used for:

[0125] Based on the feature analysis results, establish security threat indicator parameters;

[0126] Prioritize abnormal behaviors based on security threat indicator parameters to obtain priority ranking results;

[0127] Based on the priority sorting results, an anomaly analysis database is constructed.

[0128] Furthermore, in one embodiment of the present invention, the above-mentioned automated attack tracing unit 203 is specifically used to:

[0129] Establish a timetable through the time series model to record the access and behavior information at different times in the source information;

[0130] The HMM algorithm is used to calculate the source distribution based on the access and behavior information in the source information.

[0131] Furthermore, in one embodiment of the present invention, the above-mentioned automated attack tracing unit 203 is specifically used to:

[0132] Based on the obtained source distribution results, a directed graph and a spanning tree are generated;

[0133] Based on the directed graph and spanning tree, the behavior source time and node distribution table are obtained;

[0134] Based on the behavior source time and node distribution table, the host loss process is simulated and the host is warned simultaneously.

[0135] Furthermore, in one embodiment of the present invention, the above-mentioned automatic attack tracing unit 203 is also used to:

[0136] Simulate the host compromise process based on the behavior source time and node distribution table, and record the activity frequency of the source during the host compromise process;

[0137] When the activity frequency of a source exceeds a preset threshold, an alarm is issued to the host.

[0138] Furthermore, in one embodiment of the present invention, the threat-specific analysis unit 201 is specifically used to:

[0139] Identify suspected high-risk commands in the matching results;

[0140] Repeat the test on suspected high-risk commands to determine whether they are high-risk commands;

[0141] If the suspected high-risk command is determined to be a high-risk command, a first analysis result is obtained based on the high-risk command.

[0142] In the security perception management platform proposed by the present invention, the user type of the uploading user is determined, and the user behavior log of the uploading user is analyzed based on the user type of the uploading user to obtain a first analysis result; the object and command object in the first analysis result are extracted, and the object and command object are analyzed through the abnormal analysis database to determine the source information of the command object; the source information is recorded through the time series model, and the source distribution of the source information is calculated using the HMM algorithm, and the host loss process is simulated based on the obtained source distribution result, and the host is warned synchronously. Therefore, the present invention can integrate multi-source data, conduct in-depth analysis of user behavior and real-time monitoring of potential attacks, improve the overall security protection capability, enhance real-time performance, and reduce the risk of security threats faced by enterprises.

[0143] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0144] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

Claims

1. A security perception management method, characterized in that: The method comprises: Determine the user type of the uploading user, and analyze the user behavior log of the uploading user based on the user type of the uploading user to obtain a first analysis result; wherein the user types include basic customers, regular customers and key customers; the analyzing the user behavior log of the uploading user based on the type of the uploading user to obtain the first analysis result includes: if the uploading user is a basic customer, then match each command line in the user behavior log of the uploading user with a specific command in a preset rule, and obtain the first analysis result based on the obtained matching result; if the uploading user is a regular customer, then match the key command lines in the user behavior log of the uploading user with the specific commands in the preset rules, and obtain the first analysis result based on the obtained matching result; if the uploading user is a key customer, then match the random command lines in the user behavior log of the uploading user with the specific commands in the preset rules, and obtain the first analysis result based on the obtained matching result; Extracting objects and command objects from the first analysis result, analyzing the objects and command objects through an abnormality analysis database, and determining source information of the command objects; The source information is recorded through a time series model, and the source distribution of the source information is calculated using a hidden Markov model HMM algorithm, and the host loss process is simulated based on the obtained source distribution result, and the host is warned synchronously; Wherein, before analyzing the object and the command object through the abnormal analysis database to determine the source information of the command object, the method further includes: Collect the user's normal behavior data, and establish a normal standard behavior process based on the normal behavior data through the UEBA model; Collecting data associated with users and entities, determining deviant behaviors in the associated data that deviate from the normal standard behavior process through a machine learning algorithm, and performing feature analysis on the deviant behaviors to obtain feature analysis results; Establishing security threat indicator parameters through the feature analysis results, and building an anomaly analysis database based on the security threat indicator parameters; The process of simulating the host loss based on the obtained source distribution result and simultaneously issuing an early warning to the host includes: Based on the obtained source distribution results, a directed graph and a spanning tree are generated; Based on the directed graph and the spanning tree, a behavior source time and node distribution table is obtained; Based on the behavior source time and node distribution table, the host loss process is simulated, and the host is warned synchronously; The obtaining of a first analysis result based on the obtained matching result includes: Determining suspected high-risk commands in the matching results; Repeatedly testing the suspected high-risk command to determine whether the suspected high-risk command is a high-risk command; If it is determined that the suspected high-risk command is a high-risk command, a first analysis result is obtained based on the high-risk command.

2. The method according to claim 1, characterized in that The step of establishing security threat indicator parameters through the feature analysis results, and constructing an anomaly analysis database based on the security threat indicator parameters, includes: Based on the characteristic analysis results, establish security threat indicator parameters; Prioritize the abnormal behaviors based on the security threat indicator parameters to obtain a priority ranking result; Based on the priority sorting results, an abnormality analysis database is constructed.

3. The method according to claim 1, characterized in that The method of recording the source information through a time series model and calculating the source distribution using a hidden Markov model (HMM) algorithm includes: Establishing a timetable through a time series model to record access and behavior information at different times in the source information; The HMM algorithm is used to calculate source distribution through access and behavior information in the source information.

4. The method according to claim 1, characterized in that The simulating the host loss process based on the behavior source time and the node distribution table and simultaneously issuing an early warning to the host include: Simulate the host compromise process based on the behavior source time and node distribution table, and record the activity frequency of the source during the host compromise process; When the activity frequency of the source exceeds a preset threshold, an alarm is sent to the host.

5. A security awareness management platform, characterized in that: The platform includes: A threat-specific analysis unit, for determining a user type of an uploading user, and analyzing a user behavior log of the uploading user based on the user type of the uploading user to obtain a first analysis result; wherein the user types include basic customers, regular customers, and key customers; the determining the type of the uploading user, and analyzing the user behavior log of the uploading user based on the type of the uploading user to obtain a first analysis result, comprises: if the uploading user is a basic customer, then matching each command line in the user behavior log of the uploading user with a specific command in a preset rule, and obtaining a first analysis result based on the obtained matching result; if the uploading user is a regular customer, then matching a key command line in the user behavior log of the uploading user with a specific command in a preset rule, and obtaining a first analysis result based on the obtained matching result; if the uploading user is a key customer, then matching a random command line in the user behavior log of the uploading user with a specific command in a preset rule, and obtaining a first analysis result based on the obtained matching result; an abnormal behavior analysis unit, used to extract objects and command objects in the first analysis result, analyze the objects and command objects through an abnormal analysis database, and determine source information of the command objects; An automated attack tracing unit, used to record the source information through a time series model, calculate the source distribution of the source information using a hidden Markov model (HMM) algorithm, simulate the host compromise process based on the obtained source distribution results, and simultaneously issue an early warning to the host; The platform is also used to: Collect the user's normal behavior data, and establish a normal standard behavior process based on the normal behavior data through the UEBA model; Collecting data associated with users and entities, determining deviant behaviors in the associated data that deviate from the normal standard behavior process through a machine learning algorithm, and performing feature analysis on the deviant behaviors to obtain feature analysis results; Establishing security threat indicator parameters through the feature analysis results, and building an anomaly analysis database based on the security threat indicator parameters; The automated attack tracing unit is further used to: Based on the obtained source distribution results, a directed graph and a spanning tree are generated; Based on the directed graph and the spanning tree, a behavior source time and node distribution table is obtained; Based on the behavior source time and node distribution table, the host loss process is simulated, and the host is warned synchronously; The threat-specific analysis unit is also used for: Determining suspected high-risk commands in the matching results; Repeatedly testing the suspected high-risk command to determine whether the suspected high-risk command is a high-risk command; If it is determined that the suspected high-risk command is a high-risk command, a first analysis result is obtained based on the high-risk command.

6. A computer storage medium, wherein: The computer storage medium stores computer executable instructions; after the computer executable instructions are executed by the processor, any method described in claims 1-4 can be implemented.

7. A computer device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method according to any one of claims 1 to 4 is implemented.

Images