Security situation awareness method based on network security attack and defense state change

Abstract

The invention provides a security situation awareness method based on network security attack and defense state changes. The security situation awareness method comprises the following steps: 1) an aggregation algorithm based on feature attribute similarity; for attack type characteristic attributes, from abstract to concrete, an attack characteristic attribute-class hierarchical relationship is established; under different alarm classifications, time and space attribute similarities have different consideration methods and emphasis; and 2) calculating the similarity of the characteristic attributes. By applying the technical scheme, the limitation of network security management can be effectively overcome.

Description

Technical Field

[0001] The present invention relates to the field of network security attack and defense technology, and in particular to a security situation awareness method based on changes in network security attack and defense states. Background Art

[0002] With the expansion of network scale and the increase of complexity of network attacks, many security devices such as intrusion detection, firewalls, antivirus, security auditing, etc. have been widely used in the network. Although these security devices have played a certain role in network security, they still have certain limitations, which are mainly manifested in three aspects: First, the massive alarms and logs of various security devices have low semantic level, high redundancy, occupy a large storage space, and there are a large number of false alarms, which leads to the real alarm information being submerged and further data processing is needed; second, most of the security devices have single functions and cannot realize information sharing and data interaction. The comprehensive collation and advanced analysis functions are weak, which makes it impossible for the overall protection effectiveness of various security devices, especially key assets, to be fully exerted; third, the processing results of various security devices can only reflect the operation status of a certain aspect of the network, and it is difficult to provide comprehensive and intuitive overall network security status and trend information. There is a lack of asset attribute similarity matching query function and corresponding situation awareness capabilities. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a security situation awareness method based on changes in network security attack and defense states, which effectively overcomes the limitations of these network security management.

[0004] To achieve the above object, the present invention adopts the following technical solution: a security situation awareness method based on changes in network security attack and defense states, comprising:

[0005] 1) Aggregation algorithm based on feature attribute similarity; for attack type feature attributes, establish attack feature attack-class category hierarchy from abstract to specific; under different alarm categories, the similarity of time and space attributes has different consideration methods and emphases;

[0006] 2) Calculation of feature attribute similarity.

[0007] In a preferred embodiment, the feature attribute similarity or dissimilarity calculation formula is as follows:

[0008]

[0009] In the above formula, n is the total number of attributes in objects i and j, f is the attribute label, wf represents the weight of object attribute f in similarity calculation, and its range is a number between 0 and 1; diffijf represents the difference between objects i and j in attribute f. The following will analyze the calculation method of different log attribute differences;

[0010] The formula for calculating the source IP address / destination IP address dissimilarity is as follows:

[0011]

[0012] n is the number of the same highest bit in the IP address; the calculation formula is based on the same prefix divided by the IP addresses in the same network segment, that is, the calculated similarity distance will be closer.

[0013] In a preferred embodiment, the port attribute dissimilarity calculation formula is as follows:

[0014]

[0015] The calculation formula of port attribute dissimilarity is very simple. It is to compare whether the port numbers in two alarm log records are the same. If they are the same, the dissimilarity is 0, otherwise it is 1.

[0016] Alarm type attribute dissimilarity calculation method: For firewall logs and IDS logs, if their alarm types are the same, the value is 0, otherwise it is 1.

[0017] In a preferred embodiment, time attribute dissimilarity calculation: To cluster the logs, the time attribute dissimilarity must be calculated first; when the time interval between two adjacent alarm logs is less than the threshold T, the time attribute dissimilarity is 0, otherwise it is 1;

[0018] During the log clustering process, the alarm logs are temporarily stored in a queue, and the count field is used to record the number of repeated alarms in each alarm log. Whenever a new alarm log is aggregated, the time attribute dissimilarity is first calculated. If the dissimilarity is less than a certain threshold, the log is directly merged into the alarm log with the smallest dissimilarity, and the count field value is increased by 1. Otherwise, the alarm log is used as a new alarm log, its count value is recorded as 1, and the time threshold is set to the default value.

[0019] Compared with the prior art, the present invention has the following beneficial effects: BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flow chart of a clustering algorithm based on log attribute dissimilarity according to a preferred embodiment of the present invention;

[0021] Figure 2 Schematic diagram of situation awareness of changes in the network security attack and defense status of the entire network according to a preferred embodiment of the present invention, wherein (a) is the security situation value of the entire network 1 hour before the hour, (b) is the security situation value of the entire network 6 hours before the hour, (c) is the security situation value of the entire network 12 hours before the hour, and (d) is the security situation value of the entire network 24 hours before the hour. DETAILED DESCRIPTION

[0022] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0023] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0024] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0025] A security situation awareness method based on changes in network security attack and defense status, reference Figure 1-2 , including the following steps:

[0026] 1) Aggregation algorithm based on feature attribute similarity

[0027] The more similar the attack type characteristics of two S6000 events are, the more likely they are to belong to the same attack process; the shorter the time interval between two events is, the more likely they are to belong to the same attack process. Based on the above experience, the more similar the source addresses of two events are, the more likely they are to belong to the same attack process.

[0028] First, for the attack type feature attributes, from abstract to specific (such as ttack-class, attack-type, sub-type, ..., name), establish the attack feature attack-class category hierarchy. Under different alarm categories, the similarity of time and space attributes has different consideration methods and focuses:

[0029] ① Discovery attack alarms are mainly when attackers want to inquire whether certain IPs, domain names, or networks exist. Usually, a large number of query messages are sent in a short period of time. Therefore, the source IP address needs to be accurately matched to a large extent, and the target IP needs to at least match the network address. The query time interval is relatively short. Therefore, for discovery alarms, these three attribute values ​​are mainly considered. In addition, string attributes can be used to determine whether the queried domain names are similar.

[0030] ② Scanning alarms are often generated through port scanning and vulnerability scanning tools. Therefore, such alarms mainly rely on precise matching of the target IP address and network matching of the source IP address (because sometimes it will send out some forged IP address packets). The format string is also very important because the data packets sent out by the same tool often have some common features. Time attributes also need to be taken seriously. Some scans will send out a large number of packets in a short period of time, but some scans are more covert. For example, they may send out a packet every few minutes or so. You can set a larger time interval to aggregate such scan alarms, which requires dynamic time adjustment.

[0031] ③ Denial of service alarms are usually coordinated by a large number of hosts, so the matching of source IP addresses is meaningless. The main consideration is the precise matching of target IP and port. The time interval is very short, and the attack datagrams are usually similar. Therefore, the matching of packet size and format string sometimes accounts for a certain weight;

[0032] ④ Privilege escalation alarms are generally for all hosts in a network or a single target host to automatically run remote attack programs. Therefore, the main consideration is the precise match of the target network and the target port. Usually the source IP address is the attacker's IP. Because the attack program is the same, the datagram characteristics must be the same, and the time interval is also very small.

[0033] 2) Calculation of feature attribute similarity

[0034] The calculation formula of feature attribute similarity (difference) is as follows:

[0035]

[0036] In the above formula, n is the total number of attributes in objects i and j, f is the attribute number, and wf represents the weight of object attribute f in similarity calculation, which is a number between 0 and 1. diffijf represents the dissimilarity between objects i and j on attribute f. The following will analyze the calculation method of different log attribute dissimilarity.

[0037] The formula for calculating the source IP address / destination IP address dissimilarity is as follows:

[0038]

[0039] In the above formula, n is the number of the highest bits of the IP addresses that are the same. This calculation formula is mainly based on the same prefix of the IP addresses in the same network segment, that is, the calculated similarity distance will be closer.

[0040] The calculation formula of port attribute dissimilarity is as follows:

[0041]

[0042] The calculation formula of port attribute dissimilarity is very simple. It only needs to compare whether the port numbers in two alarm log records are the same. If they are the same, the dissimilarity is 0, otherwise it is 1.

[0043] Alarm type attribute dissimilarity calculation method: For firewall logs and IDS logs, if their alarm types are the same, the value is 0, otherwise it is 1.

[0044] Time attribute dissimilarity calculation: To cluster logs, the time attribute dissimilarity must be calculated first. When the time interval between two adjacent alarm logs is less than the threshold T, the time attribute dissimilarity is 0, otherwise it is 1. The flow chart of the attribute dissimilarity clustering algorithm based on network security logs is as follows: Figure 1 .

[0045] During the log clustering process, the alarm logs are temporarily stored in a queue, and the count field is used to record the number of repeated alarms in each alarm log. Whenever a new alarm log is aggregated, the time attribute dissimilarity is first calculated. If the dissimilarity is less than a certain threshold, the log is directly merged into the alarm log with the smallest dissimilarity, and the count field value is increased by 1. Otherwise, the alarm log is used as a new alarm log, its count value is recorded as 1, and the time threshold is set to the default value.

[0046] From the definition formula of similarity, we can know that the weight value of log attribute directly affects the calculation of dissimilarity. Since the log attribute weights corresponding to different network attacks are not the same, for example, the destination IP address in a distributed denial of service attack is the same; while in a port scan attack, the source IP address or the destination IP address is the same, but the port attributes may be different. Therefore, in order to obtain a better log aggregation effect, it is necessary to continuously adjust the weight value of the alarm log attribute according to experiments for different network attack modes. Table 1 shows the default values ​​of the common network attack dissimilarity weights.

[0047] Table 1. Common network attack dissimilarity weights

[0048] Alarm Type Source IP address Source Port Destination IP address Destination Port Default time threshold PortScan 1 0 1 0 400s R2L 1 1 1 0 150s U2R 1 0 1 1 300s DOS 1 0 1 0 300s DDOS 0 0 1 0 300s Other 1 1 1 1 500s

[0049] After using the clustering algorithm based on the difference of log attributes to aggregate the attack-type repeated alarm logs, a hyperalert log (HyperAlertLog) is formed. Its normalized format after clustering is as follows, in which the count attribute and originalID attribute are newly added. The count attribute indicates that the hyperalert log is aggregated from several original logs. The originalID records the logID of the original log and separates them with a semicolon. In addition, the time attribute value takes the average value of the original log time as the record.

[0050] 3) Implementation verification

[0051] The experimental verification is divided into two dimensions: first, set the similarity thresholds of the asset's characteristic attributes to 90%, 80%, 70%, and 60% respectively, and filter out the assets that meet the threshold conditions; second, perform a scheduled task on the data of the previous 1, 6, 12, and 24 hours of the current hour, and execute it once every hour. Calculate the situation value of the asset group that meets the characteristic attribute similarity threshold, such as Figure 2 .

Claims

1. A security situation awareness method based on changes in network security attack and defense states, characterized in that include: 1) Aggregation algorithm based on feature attribute similarity; for attack type feature attributes, establish attack feature attack-class category hierarchy from abstract to specific; under different alarm categories, the similarity of time and space attributes has different consideration methods and emphases; 2) Calculation of feature attribute similarity.

2. A security situation awareness method based on changes in network security attack and defense states according to claim 1, characterized in that: The formula for calculating the similarity or dissimilarity of feature attributes is as follows: In the above formula, n is the total number of attributes in objects i and j, f is the attribute label, wf represents the weight of object attribute f in similarity calculation, and its range is a number between 0 and 1; diffijf represents the difference between objects i and j in attribute f. The following will analyze the calculation method of different log attribute differences; The formula for calculating the source IP address / destination IP address dissimilarity is as follows: n is the number of the same highest bit in the IP address; the calculation formula is based on the same prefix divided by the IP addresses in the same network segment, that is, the calculated similarity distance will be closer.

3. The method for security situation awareness based on changes in network security attack and defense states according to claim 1 is characterized in that: The calculation formula of port attribute dissimilarity is as follows: The calculation formula of port attribute dissimilarity is very simple. It is to compare whether the port numbers in two alarm log records are the same. If they are the same, the dissimilarity is 0, otherwise it is 1. Alarm type attribute dissimilarity calculation method: For firewall logs and IDS logs, if their alarm types are the same, the value is 0, otherwise it is 1.

4. The method for security situation awareness based on changes in network security attack and defense states according to claim 1 is characterized in that: Time attribute dissimilarity calculation: To cluster the logs, the time attribute dissimilarity must be calculated first; when the time interval between two adjacent alarm logs is less than the threshold T, the time attribute dissimilarity is 0, otherwise it is 1; During the log clustering process, the alarm logs are temporarily stored in a queue, and the count field is used to record the number of repeated alarms in each alarm log. Whenever a new alarm log is aggregated, the time attribute dissimilarity is first calculated. If the dissimilarity is less than a certain threshold, the log is directly merged into the alarm log with the smallest dissimilarity, and the count field value is increased by 1. Otherwise, the alarm log is used as a new alarm log, its count value is recorded as 1, and the time threshold is set to the default value.

Images