Asset threat analysis method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to an asset threat analysis method and device, electronic equipment and a storage medium, which are used for improving the immediate response capability to a threat event and the accuracy of security analysis. The method comprises the following steps: establishing an initial identification strategy of each scene, wherein the initial identification strategy comprises a target asset attribute in an asset model and a mapping relationship between key elements of a log and the target asset attribute in the corresponding scene; the obtained initial identification strategies are bound with corresponding asset information, asset identification strategies are obtained, and the asset information comprises corresponding asset identifiers and asset attribute values; obtaining each to-be-processed log, determining an asset identifier corresponding to each to-be-processed log based on each asset identification strategy, and merging each associated log with the same asset identifier in each to-be-processed log; and taking each merged associated log as a target event, and performing security analysis based on the target event.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an asset threat analysis method, device, electronic device and storage medium. Background Art

[0002] In the software and hardware security platform, assets are the core elements of security analysis and response. With the development of network technology, many scenarios have multiple Internet Protocol (IP) addresses (i.e., multiple IP addresses), such as cloud resource pool scenarios, master-slave scenarios, Dynamic Host Configuration Protocol (DHCP) scenarios, and multiple proxy scenarios.

[0003] The multiple IP addresses of assets make it impossible to accurately identify and correlate attack information of multiple IP addresses in logs during security analysis and security operations. This may lead to underreporting of threat events and untimely response, affecting the accuracy of security analysis.

[0004] Therefore, there is an urgent need for an asset threat analysis method to solve the problem of threat identification and analysis caused by multiple IP addresses of assets, and to improve the ability to respond immediately to threat events and the accuracy of security analysis. Summary of the invention

[0005] The embodiments of the present application provide an asset threat analysis method, device, electronic device, and storage medium to improve the ability to respond immediately to threat events and the accuracy of security analysis.

[0006] The specific technical solutions provided by the embodiments of this application are as follows:

[0007] In a first aspect, a method for analyzing asset threats is provided, the method comprising:

[0008] Establishing an initial identification strategy for each scenario, the initial identification strategy includes: target asset attributes in the asset model, and a mapping relationship between key elements of the log in the corresponding scenario and the target asset attributes, wherein the target asset attributes are asset attributes that match the key elements of the corresponding scenario;

[0009] Binding each obtained initial identification strategy with each corresponding asset information to obtain each asset identification strategy, wherein each asset information includes: a corresponding asset identifier and an asset attribute value;

[0010] Obtain each log to be processed, and based on each asset identification strategy, determine the asset identifier corresponding to each log to be processed, and merge the associated logs with the same asset identifier in each log to be processed;

[0011] The merged related logs are used as target events, and security analysis is performed based on the target events.

[0012] In a possible embodiment, an initial recognition strategy for each scene is established, including:

[0013] Determine the key elements of each scenario and the target asset attributes to match in the asset model;

[0014] Establish mapping relationships between key elements of logs and target asset attributes in each scenario;

[0015] Generate an initial recognition strategy for each scenario based on the target asset attributes and mapping relationships corresponding to each scenario.

[0016] Through the above method, through the target asset attributes in the asset model that match the key elements of the scene, and the mapping relationship between the target asset attributes and the key elements of the log, the key elements in the log correspond to the key elements of different scenes, and a binding relationship is established and added to the initial identification strategy, which can enable the subsequent initial velocity identification strategy to accurately identify the key elements in the log to be processed, thereby achieving subsequent accurate identification of the log to be processed.

[0017] In a possible embodiment, before establishing the initial recognition strategy for each scene, the process further includes:

[0018] Obtain reported asset information;

[0019] Compare the asset attributes included in the reported asset information with the asset attributes included in the asset model, determine the newly added asset attributes, and add the newly added asset attributes to the asset model;

[0020] If the reported asset information contains asset attribute values, the asset information is stored in the asset table.

[0021] Through the above method, the asset model extension supports the access to external asset information and the extension of asset attributes for multiple IPs in different scenarios, thus solving the unified processing of various asset multi-IP scenarios.

[0022] In a possible embodiment, based on each asset identification strategy, the asset identifier corresponding to each log to be processed is determined respectively, including:

[0023] For each log to be processed, the following operations are performed respectively: from each asset identification strategy, filter out the target asset identification strategy whose asset attribute value matches the key attribute value in the log to be processed, and add the asset identifier contained in the target asset identification strategy to the log to be processed as the asset identifier corresponding to the log to be processed.

[0024] Through the above method, an asset identifier is added to the log to be processed. The asset identifier of each asset is unique. The asset identifier can ensure the uniqueness of repeated IPs or multiple IPs in the logs in different scenarios.

[0025] In a possible embodiment, each asset identification strategy further includes: a strategy priority;

[0026] Then, from each asset identification strategy, select the target asset identification strategy whose asset attribute value matches the key attribute value in the log to be processed, including:

[0027] According to the policy priority of each asset identification policy, the key attribute value in the log to be processed and the asset attribute value of each asset identification policy are compared in turn to determine the target asset identification policy.

[0028] Through the above method, the target asset identification strategy matching the log to be processed can be quickly determined, which can enable faster processing of the enrichment of the log to be processed.

[0029] In a possible embodiment, before determining the asset identifiers corresponding to the logs to be processed based on the asset identification strategies, the method further includes:

[0030] The formats of the logs to be processed are standardized to obtain the standardized logs to be processed.

[0031] Through the above method, the data quality can be improved, the logs to be processed can be accurately matched with the asset identification strategy, and accurate enrichment results can be obtained.

[0032] In a second aspect, an asset threat analysis device is provided, the device comprising:

[0033] A first generation module is used to establish an initial identification strategy for each scenario, wherein the initial identification strategy includes: a target asset attribute in the asset model, and a mapping relationship between a key element of a log in a corresponding scenario and the target asset attribute, wherein the target asset attribute is an asset attribute that matches the key element of the corresponding scenario;

[0034] The second generation module is used to bind each obtained initial identification strategy with each corresponding asset information to obtain each asset identification strategy, wherein each asset information includes: a corresponding asset identifier and an asset attribute value;

[0035] A processing module, used to obtain each log to be processed, and based on each asset identification strategy, determine the asset identification corresponding to each log to be processed, and merge the associated logs with the same asset identification in each log to be processed;

[0036] The analysis module is used to take the merged related logs as target events and perform security analysis based on the target events.

[0037] In a possible embodiment, when establishing the initial recognition strategy for each scene, the first generation module is further used to:

[0038] Determine the key elements of each scenario and the target asset attributes to match in the asset model;

[0039] Establish mapping relationships between key elements of logs and target asset attributes in each scenario;

[0040] Generate an initial recognition strategy for each scenario based on the target asset attributes and mapping relationships corresponding to each scenario.

[0041] In a possible embodiment, the device further includes a model extension module, and the model extension module is used to:

[0042] Obtain reported asset information;

[0043] Compare the asset attributes included in the reported asset information with the asset attributes included in the asset model, determine the newly added asset attributes, and add the newly added asset attributes to the asset model;

[0044] If the reported asset information contains asset attribute values, the asset information is stored in the asset table.

[0045] In a possible embodiment, when the asset identifiers corresponding to the logs to be processed are determined based on the asset identification strategies, the processing module is further configured to:

[0046] For each log to be processed, the following operations are performed respectively: from each asset identification strategy, filter out the target asset identification strategy whose asset attribute value matches the key attribute value in the log to be processed, and add the asset identifier contained in the target asset identification strategy to the log to be processed as the asset identifier corresponding to the log to be processed.

[0047] In a possible embodiment, each asset identification strategy further includes: a strategy priority;

[0048] When selecting a target asset identification strategy whose asset attribute value matches the key attribute value in the log to be processed from each asset identification strategy, the processing module is further used to:

[0049] According to the policy priority of each asset identification policy, the key attribute value in the log to be processed and the asset attribute value of each asset identification policy are compared in turn to determine the target asset identification policy.

[0050] In a possible embodiment, before determining the asset identifiers corresponding to the logs to be processed based on the asset identification strategies, the processing module is further configured to:

[0051] The formats of the logs to be processed are standardized to obtain the standardized logs to be processed.

[0052] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any one of the methods described in the first aspect are implemented.

[0053] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the methods described in the first aspect above.

[0054] In a fifth aspect, the present application provides a computer program product, comprising: a computer program code, when the computer program code is run on a computer, the computer executes any one of the methods described in the first aspect.

[0055] In an embodiment of the present application, an initial identification strategy is established for each scenario, and the initial identification strategy includes: target asset attributes in the asset model, and a mapping relationship between key elements of the log in the corresponding scenario and the target asset attributes, wherein the target asset attributes are asset attributes that match the key elements of the corresponding scenario, and then each obtained initial identification strategy is respectively bound to each corresponding asset information to obtain each asset identification strategy, wherein each asset information includes: a corresponding asset identifier and an asset attribute value, and then each log to be processed is obtained, and based on each asset identification strategy, the asset identifier corresponding to each log to be processed is determined, and each associated log with the same asset identifier in each log to be processed is merged, and finally each associated log after the merger is used as a target event, and a security analysis is performed based on the target event. In this way, based on the unique asset identifier in the asset identification strategy, the logs to be processed in different scenarios are enriched, that is, the asset identifier corresponding to the logs to be processed is obtained, and unified processing of different asset multi-IP scenarios is achieved. In addition, the associated logs with the same asset identifier are merged to obtain a complete target event, and the association analysis of multiple IPs of an asset is completed. This can solve the problem of threat identification and analysis caused by multiple IPs of assets, thereby improving the ability to respond immediately to threat events and the accuracy of security analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a schematic diagram of the structure of the asset threat analysis system in the embodiment of the present application;

[0057] Figure 2 This is a flowchart of an implementation of an asset threat analysis method provided in an embodiment of the present application;

[0058] Figure 3 A schematic diagram of the expanded asset model attributes in an embodiment of the present application;

[0059] Figure 4 A schematic diagram of an asset model attribute extension in an embodiment of the present application;

[0060] Figure 5 This is a schematic diagram of enriching the logs to be processed in an embodiment of the present application;

[0061] Figure 6 This is a schematic diagram of merging related logs in an embodiment of the present application;

[0062] Fig. 7A A first example diagram of generating an asset identification strategy in an embodiment of the present application;

[0063] Figure 7B A second example diagram for generating an asset identification strategy in an embodiment of the present application;

[0064] Figure 7C A third example diagram for generating an asset identification strategy in an embodiment of the present application;

[0065] Fig.7D A fourth example diagram for generating an asset identification strategy in an embodiment of the present application;

[0066] Figure 8 This is a schematic diagram of the structure of the asset threat analysis device in the embodiment of the present application;

[0067] Fig. 9 Schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0069] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0070] The following is a brief introduction to the design concept of the embodiment of the present application:

[0071] In the software and hardware security platform, assets are the core elements of security analysis and response. Assets are users' hosts, application servers, and hardware devices in security products. With the development of network technology, many scenarios have multiple IP addresses for assets (i.e., asset multi-IP), such as cloud resource pool scenarios, master-slave scenarios, DHCP scenarios, and multiple proxy scenarios.

[0072] The multiple IP addresses of assets make it impossible to accurately identify and correlate attack information of multiple IP addresses in logs during security analysis and security operations. This may lead to underreporting of threat events and untimely response, affecting the accuracy of security analysis.

[0073] For example, in a cloud resource pool scenario, a cloud host is usually assigned multiple IP addresses, including an intranet IP, an extranet IP, and a management IP. The existence of these multiple IPs complicates the identification of overall attack information.

[0074] Active / standby scenario: In active / standby configuration, the same host may have multiple IP addresses, and these IPs are in the same network segment and have normal access capabilities. Each IP may correspond to a different service port, for example, IP1 is bound to port 80, IP2 is bound to port 21, etc., making it difficult to effectively monitor and judge.

[0075] DHCP scenario: The device obtains an IP address dynamically through a DHCP server. Therefore, the IP address of each device is not fixed. The identity of the host cannot be accurately identified by the IP address alone. It needs to be judged in combination with other information (such as the MAC address).

[0076] Multiple proxy scenarios: When communicating through proxies such as F5 and IPS, when monitoring switch traffic, the source IP may not be the IP of the actual host, resulting in an inability to accurately identify the host that is actually communicating.

[0077] Therefore, there is an urgent need for an asset threat analysis method to solve the problem of threat identification and analysis caused by multiple IP addresses of assets, and to improve the ability to respond immediately to threat events and the accuracy of security analysis.

[0078] In view of this, in an embodiment of the present application, an asset threat analysis method, device, electronic device and storage medium are provided to establish an initial identification strategy for each scenario, wherein the initial identification strategy includes: target asset attributes in the asset model, and a mapping relationship between key elements of the log in the corresponding scenario and the target asset attributes, wherein the target asset attributes are asset attributes that match the key elements of the corresponding scenario, and then the obtained initial identification strategies are respectively bound to the corresponding asset information to obtain each asset identification strategy, wherein each asset information includes: a corresponding asset identifier and an asset attribute value, and then each log to be processed is obtained, and based on each asset identification strategy, the asset identifier corresponding to each log to be processed is determined respectively, and the associated logs with the same asset identifier in each log to be processed are merged, and finally, the merged associated logs are used as target events, and security analysis is performed based on the target events. In this way, based on the binding relationship between the asset identification strategy and the asset identifier, the logs to be processed in different scenarios are enriched, that is, the asset identifier corresponding to the log to be processed is obtained, and unified processing of different asset multi-IP scenarios is achieved. In addition, the associated logs with the same asset identifier are merged to obtain a complete target event, and the association analysis of multiple IPs of an asset is completed. This can solve the problem of threat identification and analysis caused by multiple IPs of assets, thereby improving the ability to respond immediately to threat events and the accuracy of security analysis.

[0079] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments of the present application and the features in the embodiments may be combined with each other if there is no conflict.

[0080] See also Figure 1 As shown, it is a structural diagram of the asset threat analysis system in the embodiment of the present application. It includes a model extension unit 101, a policy unit 102, a normalization engine unit 103, and a security analysis engine unit 104. The model extension unit 101 is used to extend the asset attributes of the asset model, the policy unit 102 is used to generate each asset identification policy, the normalization engine unit 103 is used to determine the asset identification corresponding to each log to be processed based on each asset identification policy, and the security analysis engine unit 104 is used to perform security analysis on the target event after the associated logs with the same asset identification are merged.

[0081] See also Figure 2 As shown, it is an implementation flow chart of an asset threat analysis method provided in an embodiment of the present application. The specific implementation process of the method is as follows:

[0082] Step 20: Establish initial recognition strategies for each scenario.

[0083] The initial identification strategy includes: the target asset attributes in the asset model, and the mapping relationship between the key elements of the log in the corresponding scenario and the target asset attributes. The target asset attributes are the asset attributes that match the key elements of the corresponding scenario.

[0084] In the embodiment of the present application, the asset model includes: general asset attributes and specific asset attributes corresponding to each scenario, and the specific asset attributes are obtained by extending the attributes of the asset model. The asset model is a framework for identifying, classifying and evaluating assets and their security requirements, including asset attributes, asset classification and fingerprints.

[0085] In addition, it is worth noting that the various scenarios in the embodiments of the present application include but are not limited to asset multi-IP scenarios such as cloud resource scenarios, master-slave scenarios, DHCP scenarios, and multi-proxy scenarios.

[0086] Optionally, in the embodiment of the present application, a possible embodiment is provided for dynamically extending the asset model attributes, and the following operations are specifically performed:

[0087] Step A1: Obtain reported asset information.

[0088] In the embodiment of the present application, the asset information can be reported through an external system, a terminal, a DHCP, and a unified authentication system.

[0089] Among them, the external system is accessed through the API interface. The unified authentication system includes Shenlan authentication and city hotspots. The attributes of the asset information reported by the terminal include: ip, mac, agentId, etc. The attributes of the asset information reported by DHCP include: ip, host name, mac, etc. The attributes of the asset information reported by the unified authentication system include: authenticated user, account, mac, IP, etc.

[0090] Step A2: Compare the asset attributes included in the reported asset information with the asset attributes included in the asset model, determine the newly added asset attributes, and add the newly added asset attributes to the asset model.

[0091] In an embodiment of the present application, the strategy unit queries and compares the asset attributes contained in the reported asset information and the asset attributes contained in the asset model, determines the newly added asset attributes, adds the newly added asset attributes to the asset model, and updates the asset attributes of the asset model.

[0092] For example, assuming that the asset attributes included in the reported asset information are user ID, resource pool ID, PublicIP, DummyIP, and Private IP, and the common asset attributes included in the asset model are asset name, IP / URL, mac, contact, contact phone number, asset description, and asset tag, then the newly added asset attributes are user ID, resource pool ID, Dummy IP, and Private IP, and user ID, resource pool ID, Dummy IP, and Private IP are added to the asset model.

[0093] For example, see Figure 3 As shown, it is a schematic diagram of the expanded asset model attributes in the embodiment of the present application, wherein the intranet IP, Dummy IP, mac, virtual machine ID, agent ID, and tenant ID are newly added asset attributes.

[0094] For example, see Figure 4 As shown, it is a schematic diagram of the asset model attribute expansion in the embodiment of the present application. The asset information is reported through API, terminal, DHCP, and unified authentication system. The asset attributes contained in the reported asset information are compared with the asset attributes contained in the asset model, and the asset attributes of the asset model are updated. An association is established between the asset attributes and the asset table, and then the asset information to be stored is stored according to the updated asset model and stored in the asset table.

[0095] In this way, the asset model extension supports the access to external asset information, identifies the asset attributes of asset information, automatically extends the asset model attributes, establishes associated updates and storage for asset attributes and asset tables, supports the extension of asset attributes for multiple IPs in different scenarios, solves the unified processing of various asset multi-IP scenarios, and facilitates the existence of target asset attributes in the subsequent asset model that match the key elements of each scenario.

[0096] In addition, it is worth noting that in the embodiment of the present application, the attributes and fingerprints in the asset model can be added and modified in real time.

[0097] Step A3: If the reported asset information contains asset attribute values, the asset information is stored in the asset table.

[0098] In the embodiment of the present application, if the reported asset information includes asset attribute values, the asset information is stored in the asset table; if the reported asset information package does not include asset attribute values, only the attributes of the asset model are expanded.

[0099] Optionally, in the embodiment of the present application, a possible embodiment is provided for establishing an initial recognition strategy for each scene, and the following operations are specifically performed:

[0100] Step 200: Determine the key elements of each scenario and the target asset attributes to match in the asset model.

[0101] In the embodiment of the present application, the strategy unit performs the following operations for each scenario: determining the key elements of the scenario, and determining the target asset attributes in the asset model that match the key elements of the scenario.

[0102] Exemplarily, the key elements of the cloud resource scenario include: user ID, resource pool ID, Public IP, Dummy IP, Private IP; the key elements of the multi-proxy scenario include: proxied IP, proxy IP1, proxy IP2, ..., proxy IPX; the key elements of the DHCP scenario include: IP, mac; the key elements of the master-slave scenario include: master node IP, slave node IP; the target asset attributes matched by the key elements of the cloud resource scenario include: user ID, resource pool ID, IP, Dummy IP, Private IP; the target asset attributes matched by the key elements of the multi-proxy scenario include: IP, proxy IP1, proxy IP2; the target asset attributes matched by the key elements of the DHCP scenario include: IP, mac; the target asset attributes matched by the key elements of the master-slave scenario include: IP, slave node IP. Specifically, the key elements of each scenario and the target asset attributes matched in the asset model are shown in Table 1:

[0103] Table 1

[0104]

[0105]

[0106] Step 201: Establish mapping relationships between key elements of logs and target asset attributes in each scenario.

[0107] In the embodiment of the present application, for each scenario, the following operations are performed respectively: a mapping relationship between key elements of the log in the scenario and the target asset attributes is established.

[0108] Among them, the log can be a firewall log, http log, etc., which is not limited in the embodiments of the present application.

[0109] For example, in a cloud resource scenario, the key element IP in the log will be the IP (Public IP), Dummy IP or Private IP in the target asset attributes. The user ID and resource pool ID in the cloud resource pool are also key elements of the log. The mapping relationship is established as: log {IP, user ID, resource pool ID}->asset model {Private IP, IP, DummyIP, user ID, resource pool ID}.

[0110] In a multi-agent scenario, the key element IP of the log will be the IP, proxy IP, or proxy IP2 in the target asset attributes, and a mapping relationship is established: log {IP}->asset model {IP, proxy IP1, proxy IP2}.

[0111] In the DHCP scenario, the key element IP in the log keeps changing. At this time, the key element of the log also includes the key element mac. The IP and mac in the log are bound to the IP and mac in the target asset attributes to establish a mapping relationship as follows: log {IP, mac}->asset model {IP, mac}.

[0112] In the master-slave proxy scenario, the key element IP of the log will be the IP (master node IP) or slave node IP in the target asset attributes, and a mapping relationship is established: log {IP}->asset model {IP, slave node IP}.

[0113] Step 202: Generate an initial recognition strategy for each scenario based on the target asset attributes and mapping relationships corresponding to each scenario.

[0114] In the embodiment of the present application, for each scenario, the following operations are performed respectively: the target asset attributes and mapping relationships corresponding to the scenario are configured in the initial identification strategy of the scenario.

[0115] The initial identification strategy for each scenario also includes: a policy priority and a policy activation status. The policy priority represents the order of comparison with the logs to be processed, and the policy activation status represents whether the initial identification strategy is bound to the asset information.

[0116] Exemplarily, the initial identification strategy corresponding to the cloud resource scenario is:

[0117] {Target asset attributes: user ID, resource pool ID, Public IP, Dummy IP, Private IP;

[0118] Log mapping: Log {IP, user ID, resource pool ID} -> asset model {Private IP, IP, DummyIP, user ID, resource pool ID};

[0119] Priority: 15;

[0120] Enabled status: Enabled}

[0121] Exemplarily, the initial identification strategy corresponding to the multi-agent scenario is:

[0122] {Target asset attributes: IP, proxy IP1, proxy IP2;

[0123] Log mapping: log{IP}->asset model{IP, proxy IP1, proxy IP2};

[0124] Priority: 16;

[0125] Enabled status: Enabled}

[0126] Exemplarily, the initial identification strategy corresponding to the DHCP scenario is:

[0127] {Target asset attributes: IP, mac;

[0128] Log mapping: log {IP, mac} -> asset model {IP, mac};

[0129] Priority: 17;

[0130] Enabled status: Enabled}

[0131] Exemplarily, the initial identification strategy corresponding to the active / standby scenario is:

[0132] {Target asset attributes: IP, slave node IP;

[0133] Log mapping: log{IP}->asset model{IP, slave node IP};

[0134] Priority: 18;

[0135] Enabled status: Enabled}

[0136] In this way, through the target asset attributes in the asset model that match the key elements of the scene, and the mapping relationship between the target asset attributes and the key elements of the log, the key elements in the log correspond to the key elements of different scenes, and a binding relationship is established to be added to the initial identification strategy, which solves the unified processing of various asset multi-IP scenarios, and enables the subsequent accurate identification of the key elements in the log to be processed through the initial velocity identification strategy, as well as the identification of the relationship with the target asset attributes, to achieve subsequent accurate identification of the log to be processed.

[0137] Step 21: Bind each obtained initial identification strategy with corresponding asset information to obtain each asset identification strategy.

[0138] Among them, each asset information includes: a corresponding asset identifier and an asset attribute value. The asset identifier can be a universally unique identifier (Universally Unique Identifier, UUID), which is not limited in the embodiments of the present application.

[0139] In an embodiment of the present application, the strategy unit performs the following operations for each initial identification strategy: adds the asset attribute value contained in an asset information corresponding to a scene to the target asset attribute in the initial identification strategy of the scene, and adds the asset identifier contained in the asset information to the initial identification strategy to obtain the asset identification strategy of the asset information in the scene.

[0140] Optionally, in an embodiment of the present application, if the startup status of an initial identification strategy for a scenario is disabled, the disabled initial identification strategy is not bound to the corresponding asset information.

[0141] In addition, it is worth noting that in the embodiment of the present application, an asset identification strategy can be generated dynamically in real time. Specifically, when adding the asset information to be stored to the asset table, at least one scenario corresponding to the asset information to be stored is determined, and the asset information to be stored is bound to the initial identification strategy of at least one scenario to generate at least one asset identification strategy. Among them, if the startup state of the initial identification strategy of a scenario is not enabled, the asset information to be stored is not bound to the disabled initial identification strategy.

[0142] Exemplarily, the initial identification strategy corresponding to the cloud resource scenario is bound to an asset information as follows:

[0143] Asset UUID->->{target asset attribute value: user ID: XX, resource pool ID: XX, PublicIP: XX, DummyIP: XX, Private IP: XX;

[0144] Log mapping: Log {IP, user ID, resource pool ID} -> asset model {Private IP, IP, DummyIP, user ID, resource pool ID};

[0145] Priority: 15;

[0146] Enabled status: Enabled}

[0147] Exemplarily, the initial identification strategy corresponding to the multi-agent scenario is bound to an asset information as follows:

[0148] Asset UUID->->{target asset attribute value: IP: XX, proxy IP1: XX, proxy IP2: XX;

[0149] Log mapping: log{IP}->asset model{IP, proxy IP1, proxy IP2};

[0150] Priority: 16;

[0151] Enabled status: Enabled}

[0152] Exemplarily, the initial identification strategy corresponding to the DHCP scenario is bound to an asset information as follows:

[0153] Asset UUID->->{target asset attribute value: IP:XX, mac:XX;

[0154] Log mapping: log {IP, mac} -> asset model {IP, mac};

[0155] Priority: 17;

[0156] Enabled status: Enabled}

[0157] Exemplarily, the initial identification strategy corresponding to the active / standby scenario is bound to an asset information as follows:

[0158] Asset UUID->->{target asset attribute value: IP: XX, slave node IP: XX;

[0159] Log mapping: log{IP}->asset model{IP, slave node IP};

[0160] Priority: 18;

[0161] Enabled status: Enabled}

[0162] Furthermore, in the embodiment of the present application, after the policy unit generates each asset identification policy, it pushes each enabled asset identification policy to the normalization engine unit.

[0163] Step 22: Obtain each log to be processed, and based on each asset identification strategy, determine the asset identifier corresponding to each log to be processed, and merge the associated logs with the same asset identifier in each log to be processed.

[0164] In an embodiment of the present application, the normalization engine unit obtains each log to be processed, and based on each asset identification strategy, determines the asset identifier corresponding to each log to be processed, and then the security analysis engine unit treats each log to be processed with the same asset identifier as an associated log and merges them.

[0165] Optionally, in the embodiment of the present application, a possible embodiment is provided for respectively determining the asset identifier corresponding to each log to be processed, and the following operations are specifically performed:

[0166] For each log to be processed, the following operations are performed respectively: from each asset identification strategy, filter out the target asset identification strategy whose asset attribute value matches the key attribute value in the log to be processed, and add the asset identifier contained in the target asset identification strategy to the log to be processed as the asset identifier corresponding to the log to be processed.

[0167] In an embodiment of the present application, each asset identification strategy is first parsed to obtain the content contained in each asset identification strategy. According to the asset attribute value and log field mapping in each asset identification strategy, the asset attribute value is compared with the key attribute value in the log to be processed to obtain a target asset identification strategy that matches the log to be processed, and the asset identifier contained in the target asset identification strategy is added to the log to be processed as the asset identifier corresponding to the log to be processed, and the enriched log to be processed is provided for subsequent analysis and business processing.

[0168] For example, the log 1 to be processed contains: IP1, attack characteristics, and attack results. The asset attribute values ​​in the asset identification strategy 1 are: master IP: IP1, slave node IP: IP2. Then the log 1 to be processed matches the asset identification strategy 1, and the asset identifier 1023 of the asset identification strategy 1 is added to the log 1 to be processed. The enriched log 1 to be processed contains: asset identifier 1023, IP1, attack characteristics, and attack results.

[0169] In this way, an asset identifier is added to the log to be processed. The asset identifier of each asset is unique. The asset identifier can ensure the uniqueness of repeated IPs or multiple IPs in the logs in different scenarios.

[0170] Optionally, in an embodiment of the present application, each asset identification strategy also includes: a policy priority, and the key attribute values ​​in the processing log and the asset attribute values ​​of each asset identification strategy are compared in sequence from high to low according to the policy priority of each asset identification strategy to determine the target asset identification strategy.

[0171] Among them, the asset identification policies corresponding to the same initial identification policy have the same policy priority. The policy priority is related to the importance of the scenario. For example, most of the logs to be processed are logs in the active-standby scenario. The policy priority of each asset identification policy corresponding to the initial identification policy corresponding to the active-standby scenario is set to the highest.

[0172] In this way, through the policy priority, the target asset identification policy that matches the log to be processed can be quickly determined, which can enable faster processing of the enrichment of the log to be processed.

[0173] Optionally, in an embodiment of the present application, before determining the asset identifier corresponding to each log to be processed based on each asset identification strategy, the format of each log to be processed may be standardized to obtain standardized logs to be processed.

[0174] Among them, format standardization is to process the data of the log to be processed so that it meets certain standards, specifications or ranges. For example, the date format is unified and unstructured data (such as text) is converted into structured data.

[0175] In this way, data quality can be improved, and the logs to be processed can be accurately matched with asset identification strategies to obtain accurate enrichment results.

[0176] For example, take the enrichment of pending logs in the DHCP scenario as an example. Figure 5 As shown, it is a schematic diagram of the enrichment of the logs to be processed in the embodiment of the present application, the alarm log 1 contains: IP1, mac, attack characteristics, attack results, the alarm log 2 contains: IP2, mac, attack characteristics, attack results, the data formats of the alarm log 1 and the alarm log 2 are standardized, each asset identification strategy contains each asset identification strategy corresponding to the DHCP scenario, and then the policy priority of each asset identification strategy is determined, according to the policy priority of each asset identification strategy, the key attribute values ​​in the alarm log 1 and the asset attribute values ​​of each asset identification strategy are compared in turn, the asset UUID corresponding to the alarm log 1 is determined, and the asset UUID is added to the alarm log 1, the key attribute values ​​in the alarm log 2 and the asset attribute values ​​of each asset identification strategy are compared in turn, the asset UUID corresponding to the alarm log 2 is determined, and the asset UUID is added to the alarm log 2.

[0177] Step 23: Take the merged related logs as target events and perform security analysis based on the target events.

[0178] For example, take the merging of related logs in the DHCP scenario as an example. Figure 6 As shown, it is a schematic diagram of merging various related logs in an embodiment of the present application. The denial of service attack log contains: asset UUID, IP1, mac, attack characteristics, and attack results. The SQL injection alarm log contains: asset UUID, IP2, mac, attack characteristics, and attack results. The asset UUID of the denial of service attack log and the SQL injection alarm log is the same. The denial of service attack log and the SQL injection alarm log are merged to obtain the target event. The IP of the target event includes IP1 and IP2.

[0179] In this way, the associated logs with the same asset identifier are associated and merged to obtain the target event, that is, complete event display and operational response processing are performed through a unified asset identifier, avoiding the situation where key information in the event is missing when the event is formed (for example, there are 5 IPs in multiple IPs, but there are only 4 IPs when the event is formed), obtaining the complete target event, and analyzing the complete target event can improve the immediate response capability of threat events and the accuracy of security analysis.

[0180] Based on the above embodiments, the generation of each asset identification strategy corresponding to each scenario in the embodiments of the present application is described in detail using specific examples, including:

[0181] Scenario 1: Cloud resource scenario. Fig. 7A As shown, it is a first example diagram of generating an asset identification strategy in an embodiment of the present application.

[0182] First, obtain cloud resource information (user ID, resource pool ID, Public IP, Dummy IP, Private IP) from the cloud service through the API interface, and then add new asset attributes (user ID, resource pool ID, Dummy IP, Private IP) to the asset attributes of the asset model (asset name, IP / URL, mac, contact, contact phone, asset description, asset tag).

[0183] Then, the target asset attributes in the asset model that match the key elements of the cloud resource scenario (user ID, resource pool ID, Public IP, Dummy IP, Private IP) are determined as: user ID, resource pool ID, IP (Public IP), Dummy IP, Private IP, and a mapping relationship between the key elements of the log in the cloud resource scenario (IP, user ID, resource pool ID) and the target asset attributes is established, and an initial identification strategy is generated.

[0184] Finally, the initial identification strategy is bound to each specific asset information to obtain each asset identification strategy, and each asset identification strategy is pushed to the normalization engine unit, wherein the asset information is obtained when the asset model adds data.

[0185] Scenario 2: Multiple proxy scenarios. Figure 7B As shown, it is a second example diagram of generating an asset identification strategy in an embodiment of the present application.

[0186] First, obtain the multi-proxy information (proxy IP, proxy IP1, proxy IP2, etc.) from the multi-proxy server through the API interface, and then add new asset attributes (proxy IP1, proxy IP2) to the asset attributes of the asset model (asset name, IP / URL, contact, contact phone number, asset description, asset tag).

[0187] Then, the target asset attributes in the asset model that match the key elements of the multi-proxy scenario (proxy IP, proxy IP1, proxy IP2...) are determined as: IP (proxy IP), proxy IP1, proxy IP2..., and the mapping relationship between the key elements (IP) of the log in the multi-proxy scenario and the target asset attributes is established, and an initial identification strategy is generated.

[0188] Finally, the initial identification strategy is bound to each specific asset information to obtain each asset identification strategy, and each asset identification strategy is pushed to the normalization engine unit, wherein the asset information is obtained when the asset model adds data.

[0189] Scenario 3: DHCP scenario. Figure 7C As shown, it is a third example diagram for generating an asset identification strategy in an embodiment of the present application.

[0190] First, receive the DHCP information pushed by the DHCP service (service IP, host name, mac information), receive the DHCP information pushed by the unified authentication service (mac, IP information), receive the DHCP information pushed by the terminal service (mac, agent ID, IP information), and then add new asset attributes (mac, authentication user, agent ID, host name) to the asset attributes of the asset model (asset name, IP / URL, contact, contact phone number, asset description, asset tag).

[0191] Then, the target asset attributes in the asset model that match the key elements (IP, mac) of the DHCP scenario are determined to be: IP, mac, a mapping relationship between the key elements (IP, mac) of the log in the DHCP scenario and the target asset attributes is established, and an initial identification strategy is generated.

[0192] Finally, the initial identification strategy is bound to each specific asset information to obtain each asset identification strategy, and each asset identification strategy is pushed to the normalization engine unit, wherein the asset information is obtained when the asset model adds data.

[0193] Scenario 4: Active / standby scenario. Fig.7D As shown, it is a fourth example diagram for generating an asset identification strategy in an embodiment of the present application.

[0194] First, obtain the master-slave information (service information, master node IP, slave node IP) from the configuration service through the API interface, and then add new asset attributes (service information, slave node IP) to the asset attributes of the asset model (asset name, IP / URL, contact, contact phone number, asset description, asset tag).

[0195] Then, determine the target asset attributes in the asset model that match the key elements of the master-slave scenario (master node IP, slave node IP): IP (master node IP), slave node IP, establish a mapping relationship between the key elements (IP) of the log in the master-slave scenario and the target asset attributes, and generate an initial identification strategy.

[0196] Finally, the initial identification strategy is bound to each specific asset information to obtain each asset identification strategy, and each asset identification strategy is pushed to the normalization engine unit, wherein the asset information is obtained when the asset model adds data.

[0197] Based on the same inventive concept, an asset threat analysis device is also provided in the embodiment of the present application, see Figure 8As shown, it is a schematic diagram of the structure of the asset threat analysis device in the embodiment of the present application, which specifically includes:

[0198] The first generation module 801 is used to establish an initial identification strategy for each scenario, wherein the initial identification strategy includes: target asset attributes in the asset model, and a mapping relationship between key elements of the log in the corresponding scenario and the target asset attributes, wherein the target asset attributes are asset attributes that match the key elements of the corresponding scenario;

[0199] The second generation module 802 is used to bind each obtained initial identification strategy with each corresponding asset information to obtain each asset identification strategy, wherein each asset information includes: a corresponding asset identifier and an asset attribute value;

[0200] The processing module 803 is used to obtain each log to be processed, and determine the asset identification corresponding to each log to be processed based on each asset identification strategy, and merge the associated logs with the same asset identification in each log to be processed;

[0201] The analysis module 804 is used to take the merged related logs as target events and perform security analysis based on the target events.

[0202] In a possible embodiment, when establishing the initial recognition strategy for each scene, the first generation module 801 is further used to:

[0203] Determine the key elements of each scenario and the target asset attributes to match in the asset model;

[0204] Establish mapping relationships between key elements of logs and target asset attributes in each scenario;

[0205] Generate an initial recognition strategy for each scenario based on the target asset attributes and mapping relationships corresponding to each scenario.

[0206] In a possible embodiment, the device further includes a model extension module 805, and the model extension module 805 is used to:

[0207] Obtain reported asset information;

[0208] Compare the asset attributes included in the reported asset information with the asset attributes included in the asset model, determine the newly added asset attributes, and add the newly added asset attributes to the asset model;

[0209] If the reported asset information contains asset attribute values, the asset information is stored in the asset table.

[0210] In a possible embodiment, when the asset identifiers corresponding to the logs to be processed are determined based on the asset identification strategies, the processing module 803 is further configured to:

[0211] For each log to be processed, the following operations are performed respectively: from each asset identification strategy, filter out the target asset identification strategy whose asset attribute value matches the key attribute value in the log to be processed, and add the asset identifier contained in the target asset identification strategy to the log to be processed as the asset identifier corresponding to the log to be processed.

[0212] In a possible embodiment, each asset identification strategy further includes: a strategy priority;

[0213] When a target asset identification strategy whose asset attribute value matches the key attribute value in the log to be processed is screened out from each asset identification strategy, the processing module 803 is further used to:

[0214] According to the policy priority of each asset identification policy, the key attribute value in the log to be processed and the asset attribute value of each asset identification policy are compared in turn to determine the target asset identification policy.

[0215] In a possible embodiment, before determining the asset identifiers corresponding to the logs to be processed based on the asset identification strategies, the processing module 803 is further configured to:

[0216] The formats of the logs to be processed are standardized to obtain the standardized logs to be processed.

[0217] Based on the above embodiments, see Fig. 9 Shown is a schematic diagram of the structure of an electronic device in an embodiment of the present application.

[0218] An embodiment of the present application provides an electronic device, which may include a processor 910 (Center Processing Unit, CPU), a memory 920, an input device 930 and an output device 940, etc. The input device 930 may include a keyboard, a mouse, a touch screen, etc., and the output device 940 may include a display device, such as a liquid crystal display (Liquid Crystal Display, LCD), a cathode ray tube (Cathode Ray Tube, CRT), etc.

[0219] The memory 920 may include a read-only memory (ROM) and a random access memory (RAM), and provides the processor 910 with program instructions and data stored in the memory 920. In the embodiment of the present application, the memory 920 may be used to store the program of any asset threat analysis method in the embodiment of the present application.

[0220] The processor 910 calls the program instructions stored in the memory 920, and the processor 910 is used to execute any asset threat analysis method in the embodiments of the present application according to the obtained program instructions.

[0221] Based on the above embodiments, in an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the asset threat analysis method in any of the above method embodiments is implemented.

[0222] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0223] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0224] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0225] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0226] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An asset threat analysis method, characterized in that: include: Establishing an initial identification strategy for each scenario, the initial identification strategy comprising: a target asset attribute in the asset model, and a mapping relationship between a key element of a log in a corresponding scenario and the target asset attribute, wherein the target asset attribute is an asset attribute that matches the key element of the corresponding scenario; Binding each obtained initial identification strategy with each corresponding asset information to obtain each asset identification strategy, wherein each asset information includes: a corresponding asset identifier and an asset attribute value; Obtain each log to be processed, and based on each asset identification strategy, determine the asset identifier corresponding to each log to be processed, and merge the associated logs with the same asset identifier in the logs to be processed; The merged related logs are used as target events, and security analysis is performed based on the target events.

2. The method according to claim 1, characterized in that The initial recognition strategy for each scene is established, including: Determine the key elements of each scenario and the target asset attributes matched in the asset model; Establishing mapping relationships between key elements of the log and attributes of the target assets in each scenario; An initial identification strategy for each of the scenarios is generated based on the target asset attributes and the mapping relationships corresponding to each of the scenarios.

3. The method according to claim 1, characterized in that Before establishing the initial recognition strategy for each scene, the method further includes: Obtain reported asset information; Comparing the asset attributes included in the reported asset information with the asset attributes included in the asset model, determining newly added asset attributes, and adding the newly added asset attributes to the asset model; If the reported asset information includes asset attribute values, the asset information is stored in the asset table.

4. The method according to claim 1, characterized in that The determining, based on the asset identification strategies, the asset identifiers corresponding to the logs to be processed respectively includes: For each of the logs to be processed, the following operations are performed respectively: from the asset identification strategies, a target asset identification strategy with an asset attribute value that matches the key attribute value in the log to be processed is filtered out, and the asset identifier contained in the target asset identification strategy is added to the log to be processed as the asset identifier corresponding to the log to be processed.

5. The method according to claim 4, characterized in that Each asset identification strategy also includes: strategy priority; Then, the step of selecting a target asset identification strategy whose asset attribute value matches the key attribute value in the log to be processed from the asset identification strategies includes: According to the policy priorities of the asset identification policies, the key attribute values ​​in the log to be processed and the asset attribute values ​​of the asset identification policies are compared in sequence to determine the target asset identification policy.

6. The method according to claim 1, characterized in that Before determining the asset identifiers corresponding to the logs to be processed based on the asset identification strategies, the method further includes: The formats of the logs to be processed are standardized to obtain the standardized logs to be processed.

7. An asset threat analysis device, characterized in that: include: A first generation module is used to establish an initial identification strategy for each scenario, wherein the initial identification strategy includes: a target asset attribute in the asset model, and a mapping relationship between a key element of a log in a corresponding scenario and the target asset attribute, wherein the target asset attribute is an asset attribute that matches the key element of the corresponding scenario; The second generation module is used to bind each obtained initial identification strategy with each corresponding asset information to obtain each asset identification strategy, wherein each asset information includes: a corresponding asset identifier and an asset attribute value; A processing module, used to obtain each log to be processed, and based on each asset identification strategy, determine the asset identification corresponding to each log to be processed, and merge the associated logs with the same asset identification in the logs to be processed; The analysis module is used to take the merged related logs as target events and perform security analysis based on the target events.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images