Network threat disposal method, device, equipment and medium

Abstract

The invention discloses a network threat disposal method and device, equipment and a medium, and relates to the technical field of information security, and the method comprises the steps: capturing abnormal traffic on threat initiating equipment, and determining a network threat; according to the feature information corresponding to the network threat, matching threat disposal measures from a preset knowledge warehouse, and searching for first equipment information and second equipment information; generating an automatic threat disposal command based on the threat disposal measure and the first device information, and respectively logging in the threat initiating device and the threat to-be-processed device; and executing the automatic threat processing command in the threat to-be-processed equipment, and after the automatic threat processing command is successfully executed, replaying the abnormal flow in the threat initiating equipment to verify whether the automatic threat processing command takes effect or not. Therefore, the appearing network threats can be automatically handled and verified, and the problem that the threat handling efficiency is difficult to improve due to poor handling timeliness and high technical level requirements of related personnel is solved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a network threat handling method, device, equipment and medium. Background Art

[0002] In the power industry, the network security situation platform is often used to collect and analyze network security incidents that occur in the dispatching data network. If some network security incidents are determined to be threatening after analysis, it is necessary to respond to and deal with such network threat incidents. The existing network threat disposal method is for relevant personnel to manually intervene in network threats based on experience, manually execute threat disposal commands, and observe whether the disposal is effective over a period of time. The disposal timeliness is poor and the efficiency is low. In addition, since a variety of network security equipment is deployed in the dispatching data network in addition to power secondary equipment, not only does the operation and maintenance personnel need to have a high level of power-related knowledge, but also network security-related knowledge and operation and maintenance experience of network security equipment. However, the market for such talents is limited and it is difficult to meet the needs of operation and maintenance. The efficiency of threat disposal needs to be improved, and the effect of the disposal is difficult to verify.

[0003] In summary, how to solve the problem of difficulty in improving threat disposal efficiency due to poor disposal timeliness and high technical requirements for relevant personnel is a technical problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a network threat handling method, device, equipment and medium, which can solve the problem that the threat handling efficiency is difficult to improve due to the poor timeliness of handling and the high technical level requirements of related personnel. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a network threat handling method, which is applied to a threat handling system, comprising:

[0006] Capturing abnormal traffic on the threat-initiating device and determining the network threat corresponding to the abnormal traffic;

[0007] According to the characteristic information corresponding to the network threat, a threat handling measure corresponding to the network threat is matched from a preset knowledge warehouse, and first device information of a threat-to-be-processed device affected by the network threat and second device information of the threat-initiating device are searched;

[0008] Generate an automated threat handling command based on the threat handling measure and the first device information, and log in to the threat initiating device and the threat to be handled device respectively based on the second device information and the first device information;

[0009] The automated threat handling command is executed in the threat to be handled device, and after the automated threat handling command is successfully executed, the abnormal traffic is replayed in the threat initiating device to verify whether the automated threat handling command is effective.

[0010] Optionally, capturing abnormal traffic on the threat initiating device and determining a network threat corresponding to the abnormal traffic includes:

[0011] Determine a threat-initiating device among the current plurality of devices, and capture abnormal traffic of the threat-initiating device;

[0012] The abnormal traffic is analyzed to determine the network threat corresponding to the abnormal traffic.

[0013] Optionally, matching the threat handling measures corresponding to the network threat from a preset knowledge warehouse according to the feature information corresponding to the network threat, and searching for first device information of the threat-to-be-processed device affected by the network threat and second device information of the threat-initiating device, includes:

[0014] Determine feature information corresponding to the network threat, and match the feature information in sequence from an asset library of the preset knowledge warehouse based on a preset matching order to determine a threat type of the network threat;

[0015] According to the threat type, matching a threat handling measure corresponding to the threat type from a threat library of the preset knowledge warehouse;

[0016] A threat-to-be-processed device affected by the network threat is determined, and first device information corresponding to the threat-to-be-processed device and second device information of the threat-initiating device are searched from the asset library.

[0017] Optionally, matching the feature information in sequence from the asset library of the preset knowledge warehouse based on a preset matching order to determine the threat type of the network threat includes:

[0018] Matching the feature information in sequence from the asset library of the preset knowledge warehouse based on a preset matching order to generate corresponding matching results;

[0019] If the matching result indicates a successful match, determining a threat type corresponding to the network threat based on the matching result;

[0020] If the matching result indicates a matching failure, a completion notification is generated and fed back to the front end of the threat handling system; the completion notification is a notification used to complete the threat type.

[0021] Optionally, the logging in to the threat initiating device and the threat to be processed device respectively based on the second device information and the first device information includes:

[0022] Logging in to the threat-to-be-processed device based on the first device information, backing up the first device configuration information of the threat-to-be-processed device if logging in to the threat-to-be-processed device is successful; and feeding back first login abnormality information if logging in to the threat-to-be-processed device is unsuccessful;

[0023] The threat initiating device is logged in based on the second device information. If the threat initiating device is successfully logged in, the second device configuration information of the threat initiating device is backed up; if the threat initiating device is not successfully logged in, the second login exception information is fed back.

[0024] Optionally, executing the automated threat handling command in the threat to be processed device includes:

[0025] Executing the automated threat handling command in the threat to be handled device, and tracking the execution result of the automated threat handling command;

[0026] If the execution result indicates that the automated threat handling command is not successfully executed, feeding back a threat handling measure modification notification;

[0027] If the execution result indicates that the automated threat handling command is successfully executed, a threat repair rate update notification is fed back.

[0028] Optionally, replaying the abnormal traffic in the threat initiating device to verify whether the automated threat handling command is effective includes:

[0029] Replaying the abnormal traffic in the threat initiating device, and tracking the devices in the traffic path corresponding to the abnormal traffic to determine whether the threat to be processed device is affected by the network threat again;

[0030] If the threat-to-be-processed device is affected by the network threat again, executing a configuration rollback command to restore the configuration of the threat-to-be-processed device according to the first device configuration information;

[0031] If the threat-to-be-processed device is not affected by the network threat again, a successful processing notification is fed back.

[0032] In a second aspect, the present application provides a network threat handling device, which is applied to a threat handling system, including:

[0033] A threat determination module, used to capture abnormal traffic on the threat-initiating device and determine the network threat corresponding to the abnormal traffic;

[0034] An information search module, used to match the threat handling measures corresponding to the network threat from a preset knowledge warehouse according to the characteristic information corresponding to the network threat, and to search for the first device information of the threat-to-be-processed device affected by the network threat and the second device information of the threat-initiating device;

[0035] a device login module, configured to generate an automated threat handling command based on the threat handling measure and the first device information, and to log in to the threat initiating device and the threat to be handled device respectively based on the second device information and the first device information;

[0036] The traffic replay module is used to execute the automated threat handling command in the threat processing device, and after the automated threat handling command is successfully executed, replay the abnormal traffic in the threat initiating device to verify whether the automated threat handling command is effective.

[0037] In a third aspect, the present application provides an electronic device, including:

[0038] Memory, used to store computer programs;

[0039] The processor is used to execute the computer program to implement the aforementioned network threat handling method.

[0040] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned network threat handling method is implemented.

[0041] In the present application, the threat handling system captures the abnormal traffic on the threat initiating device and determines the network threat corresponding to the abnormal traffic; matches the threat handling measures corresponding to the network threat from the preset knowledge warehouse according to the characteristic information corresponding to the network threat, and searches for the first device information of the threat to be processed device affected by the network threat and the second device information of the threat initiating device; generates an automated threat handling command based on the threat handling measures and the first device information, and logs in the threat initiating device and the threat to be processed device respectively based on the second device information and the first device information; executes the automated threat handling command in the threat to be processed device, and after the automated threat handling command is successfully executed, replays the abnormal traffic in the threat initiating device to verify whether the automated threat handling command is effective. As can be seen from the above, the threat handling system of the present application first captures the abnormal traffic and determines the network threat, generates and executes the automated threat handling command according to the threat handling measures and the first device information found from the preset knowledge warehouse based on the characteristic information corresponding to the network threat, so as to handle the network threat. At the same time, after the network threat is successfully handled, the abnormal traffic is replayed in the threat initiating device to verify whether the network threat occurs again. In this way, through the above process of the present application, the network threats that arise can be automatically handled and verified without the need for human intervention, thereby improving the timeliness of handling, while reducing the difficulty of handling by relevant operation and maintenance personnel and verifying the effect of the handling, thereby solving the problem of difficulty in improving the efficiency of threat handling due to poor timeliness of handling and high technical requirements for relevant personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0043] Figure 1 A flowchart of a network threat handling method disclosed in this application;

[0044] Figure 2 A flowchart of a specific network threat handling method disclosed in this application;

[0045] Figure 3 A system architecture diagram of a network threat handling method disclosed in this application;

[0046] Figure 4 A schematic diagram of a workflow of a management unit disclosed in this application;

[0047] Figure 5 A schematic diagram of a workflow of a treatment unit disclosed in this application;

[0048] Figure 6 A schematic diagram of a workflow of an execution unit disclosed in this application;

[0049] Figure 7 A schematic diagram of the structure of a network threat handling device disclosed in this application;

[0050] Figure 8 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] The existing network threat handling method is that relevant personnel manually intervene in network threats based on experience, manually execute threat handling commands, and observe whether the handling is effective within a period of time. This method requires relevant personnel to be on duty for a long time, which is prone to omissions and has great limitations. In some more complex situations, it is necessary to ask for instructions from superiors before execution. The handling timeliness is poor and the efficiency is low. In addition, since the dispatching data network is deployed with a variety of network security equipment in addition to power secondary equipment, the operation and maintenance personnel are required to have not only high power-related knowledge, but also network security-related knowledge and operation and maintenance experience of network security equipment. However, the market for such talents is limited and it is difficult to meet the needs of operation and maintenance. The efficiency of threat handling needs to be improved, and it is difficult to verify the effect of the handling. Since some network attacks are instantaneous, the threat itself may disappear but the command is still executed on the system. In the above, it can be seen that the method of manually executing threat handling commands alone has high technical requirements for personnel, and the applicable scenarios are greatly limited. The upper limit of threat handling efficiency needs to be improved.

[0053] In order to overcome the above technical problems, the present application provides a network threat handling method to solve the problem that it is difficult to improve the threat handling efficiency due to poor handling timeliness and high technical level requirements of relevant personnel.

[0054] See also Figure 1 As shown, an embodiment of the present invention discloses a network threat handling method, which is applied to a threat handling system, including:

[0055] Step S11: Capture abnormal traffic on the threat-initiating device and determine the network threat corresponding to the abnormal traffic.

[0056] In this embodiment, the threat handling system determines the network threat corresponding to the abnormal traffic according to the abnormal traffic from the threat initiating device. Specifically, in this embodiment, the threat initiating device among the current several devices is first determined, and the abnormal traffic of the threat initiating device is captured; the abnormal traffic is analyzed to determine the network threat corresponding to the abnormal traffic. Among them, the threat initiating device is a device that detects the abnormal traffic, that is, the device that detects the abnormal traffic among the current several devices is determined as the threat initiating device. It should be pointed out that the abnormal traffic refers to the traffic whose characteristics or behavior patterns transmitted in the network are different from the normal network traffic. The manifestation of the difference includes but is not limited to the sharp increase or decrease of traffic, the large amount of data packet loss, the significant increase of network delay, etc. The reasons for the abnormal traffic include but are not limited to hardware failure, malware propagation, network attack, configuration error or system failure, etc., all of which will pose a threat to the scheduling data network. That is, if the existence of abnormal traffic is detected from the scheduling data network, it means that a network threat has appeared in the current scheduling data network, and the network threat needs to be handled in time to achieve the maintenance and management of the scheduling data network. In this way, by detecting abnormal traffic, the network threats that may appear in the current scheduling data network can be discovered in time.

[0057] This embodiment can timely identify abnormal traffic that is significantly different from the normal traffic pattern by real-time monitoring and analysis of network traffic. Specifically, this embodiment can use tools such as a network traffic analysis platform or an intrusion detection system to monitor and analyze the traffic in the scheduling data network in real time, and identify abnormal traffic through pre-set traffic rate thresholds, matching rules, etc. For example, if the traffic rate of the network traffic exceeds the traffic rate threshold, the current network traffic is determined to be abnormal traffic; if the behavior characteristics of the network traffic match the behavior of the network attack, the current network traffic is determined to be abnormal traffic. When the abnormal traffic is identified, the threat initiating device among the current several devices is determined and the abnormal traffic on the threat initiating device is captured, and the characteristics of the abnormal traffic are recorded, the characteristics include but are not limited to the data packet content, source, destination, protocol type, etc. of the abnormal traffic, and then the abnormal traffic is analyzed according to the characteristics to determine the network threat corresponding to the abnormal traffic. In this way, the present embodiment monitors and analyzes network traffic in real time, identifies and captures abnormal traffic in a timely manner, and analyzes the abnormal traffic to determine corresponding network threats, so as to determine relevant threat handling measures based on the determined network threats, and handle the network threats, thereby avoiding the serious consequence of system crash due to arbitrary execution of threat handling measures without determining the network threats.

[0058] Step S12: match the threat handling measures corresponding to the network threat from the preset knowledge warehouse according to the characteristic information corresponding to the network threat, and search for the first device information of the threat-to-be-processed device affected by the network threat and the second device information of the threat-initiating device.

[0059] In this embodiment, the threat handling system matches the threat handling measures corresponding to the network threat from the preset knowledge warehouse according to the characteristic information corresponding to the determined network threat, and searches the preset knowledge warehouse for the first device information of the threat-to-be-processed device affected by the network threat and the second device information of the threat-initiating device. Among them, the threat-to-be-processed device is the device affected by the network threat in the traffic path corresponding to the abnormal traffic. The preset knowledge warehouse is used to store the common operating guides of all devices involved in the scheduling data network and their historical bugs, vulnerabilities, malicious codes, malformed messages, DoS (i.e., Disk Operating System), etc., as well as information on various processing methods for network threats.

[0060] In order to facilitate the management and maintenance of the preset knowledge warehouse, this embodiment can divide the preset knowledge warehouse into two categories: an asset library and a threat library. The asset library is used to store each device type in the scheduling data network and the operation guides of each version corresponding to the device type and its historical BUGs, vulnerabilities, malicious codes, malformed messages, DoS, etc. The threat library is used to store various threat information, response methods, disposal measures, key nodes, disposal command execution nodes, number of disposal successes, number of disposal failures, etc. with the threat type of network threats as key factors. Therefore, the method of matching the threat handling measures corresponding to the network threat from the preset knowledge warehouse according to the characteristic information corresponding to the network threat, and searching for the first device information of the threat-to-be-processed device affected by the network threat and the second device information of the threat-initiating device, may specifically include: determining the characteristic information corresponding to the network threat, and matching the characteristic information in sequence from the asset library of the preset knowledge warehouse based on a preset matching order to determine the threat type of the network threat; matching the threat handling measures corresponding to the threat type from the threat library of the preset knowledge warehouse according to the threat type; determining the threat-to-be-processed device affected by the network threat, and searching for the first device information corresponding to the threat-to-be-processed device and the second device information of the threat-initiating device from the asset library. Among them, the characteristic information of the network threat is data that can identify or describe specific attributes or behaviors of the network threat, such as characteristic information of abnormal traffic, characteristic information of threat behavior, characteristic information of vulnerability exploitation, etc.; the threat handling measures include historical solutions and key nodes of the network threat; the first device information includes the operation instructions, user name and password corresponding to the threat-to-be-processed device; the second device information includes the operation instructions, user name and password corresponding to the threat-initiating device. Figure 2 As shown, the threat handling system of this embodiment may include three components: a management unit, a handling unit, and an execution unit, wherein the management unit is as follows: Figure 3 As shown, it is mainly responsible for the management and maintenance of the preset knowledge warehouse, collecting information from manufacturers, the Internet and the power OA system to supplement and update the preset knowledge warehouse. At the same time, when the disposal unit cannot find the threat processing measures or the disposal unit feedback execution failure, it receives the knowledge completion request sent by the disposal unit and notifies the administrator to perform manual knowledge supplement or correction.

[0061] In this embodiment, the threat type of the network threat can be matched from the asset library based on the preset matching order and the characteristic information of the network threat. Figure 4As shown, the preset matching order is to traverse the vulnerability library, malicious code, deformed message, DoS library and BUG library in the asset library in turn to match the feature information until the threat type of the network threat is matched. It should be noted that if the threat type of the network threat cannot be matched in the asset library, the threat disposal system can try to perform a more flexible matching strategy on the feature information, that is, fuzzy matching. For example, if a new network threat is very similar to a known threat type in its feature information, but there are some minor differences, such as using a different port number or modifying its attack payload, the fuzzy matching matching strategy can identify this similarity and classify the new network threat as a known threat type. The fuzzy matching method can enable the threat disposal system to quickly match the threat type of the network threat, thereby promptly handling some network threats that do not fully conform to the existing records in the asset library and improving the efficiency of threat disposal.

[0062] It is understandable that, since the threat types of network threats are continuously updated, the information in the preset knowledge warehouse also needs to be updated according to the emergence of new network threats. Therefore, the feature information is matched in sequence from the asset library of the preset knowledge warehouse based on the preset matching order to determine the threat type of the network threat. Specifically, it may include: matching the feature information in sequence from the asset library of the preset knowledge warehouse based on the preset matching order to generate corresponding matching results; if the matching result indicates a successful match, the threat type corresponding to the network threat is determined based on the matching result; if the matching result indicates a failed match, a completion notification is generated and fed back to the front end of the threat disposal system; the completion notification is a notification used to complete the threat type. Among them, the feedback form of the completion notification at the front end of the threat handling system can be a pop-up notification, and a pop-up window of the completion notification is popped up at the front end of the threat handling system, so that the staff in front of the threat handling system can promptly know the request for completing the threat type, send the information containing the abnormal traffic and the information acquisition request of the topological structure on the traffic path to the equipment manufacturer to obtain the relevant information of the network threat, and / or collect the relevant information of the network threat in the Internet or power OA (i.e. Office Automation) system, and use the acquired or collected relevant information of the network threat to complete the threat type in the asset library. In addition, the completion notification can also be fed back to the front end of the threat handling system in the form of a notification bar, suspension, sound or vibration reminder, icon or color change, etc. In this way, this embodiment matches the corresponding threat handling measures in the preset knowledge warehouse based on the determined network threat, draws on the historical threat handling measures, helps to automatically generate automated threat handling commands in a targeted manner, reduces the technical requirements for relevant personnel, and searches the preset knowledge warehouse for the first device information of the threat to be processed device affected by the network threat and the second device information of the threat initiating device, so that the relevant personnel do not need to manually search for this, thereby improving the efficiency of threat handling.

[0063] Step S13: Generate an automated threat handling command based on the threat handling measure and the first device information, and log in to the threat initiating device and the threat to be handled device respectively based on the second device information and the first device information.

[0064] In this embodiment, the threat handling system can generate an automated threat handling command using the threat handling measures and the first device information, and log in to the threat initiating device and the threat to be handled device according to the second device information and the first device information. Figure 5As shown, this embodiment can utilize the historical solutions and key nodes of the network threats in the threat handling measures and the operation instructions in the first device information to generate an automated threat handling command, and utilize the user name and password in the first device information to log in to the threat initiating device, and utilize the user name and password in the second device information to log in to the threat to be processed device.

[0065] It should be noted that the operation of logging into the threat initiating device and the threat to be processed device may result in login failure of the threat initiating device and / or the threat to be processed device due to errors in the second device information and the first device information found or incorrect user name and password entered during login. Therefore, this embodiment logs in to the threat to be processed device based on the first device information. If the login to the threat to be processed device is successful, the first device configuration information of the threat to be processed device is backed up; if the login to the threat to be processed device is unsuccessful, the first login exception information is fed back; the threat initiating device is logged in based on the second device information. If the login to the threat initiating device is successful, the second device configuration information of the threat initiating device is backed up; if the login to the threat to be processed device is unsuccessful, the second login exception information is fed back. This embodiment tracks the login status of the threat initiating device and the threat to be processed device in real time, and promptly feeds back login exception information when device login fails, so that relevant personnel can deal with the error in time according to the error situation. At the same time, when the threat initiating device and the threat to be processed device log in successfully, the configuration information of the threat initiating device and the threat to be processed device is backed up to avoid the situation where the configuration information of the device cannot be restored due to the inability to roll back the configuration information of the threat initiating device and the threat to be processed device when the execution of the automated threat handling command fails.

[0066] Step S14: executing the automated threat handling command in the threat to be handled device, and after the automated threat handling command is successfully executed, replaying the abnormal traffic in the threat initiating device to verify whether the automated threat handling command is effective.

[0067] In this embodiment, the threat handling system executes the automated threat handling command in the threat-to-be-processed device and tracks the execution result of the automated threat handling command. After the execution result indicates that the automated threat handling command is successfully executed, the abnormal traffic is replayed in the threat-initiating device to verify whether the automated threat handling command is effective.

[0068] It is understandable that the present embodiment can also update the preset knowledge warehouse according to the execution result of the automated threat handling command, which can specifically include: executing the automated threat handling command in the threat to be handled device and tracking the execution result of the automated threat handling command; if the execution result indicates that the automated threat handling command is not successfully executed, then feedback a threat handling measure modification notification; if the execution result indicates that the automated threat handling command is successfully executed, then feedback a threat repair rate update notification. If the execution result indicates that the automated threat handling command is not successfully executed, it can be explained that there is a problem with the threat handling measure or the first device information used when generating the automated threat handling command, and it is necessary to feedback a threat handling measure modification notification so that relevant personnel can be informed of the threat handling measure modification notification and then modify the threat handling measure in the preset knowledge warehouse; if the execution result indicates that the automated threat handling command is successfully executed, it means that the repair of the network threat is effective, and a threat repair rate update notification can be fed back to update the number of successful disposals corresponding to the network threat in the preset knowledge warehouse, so as to facilitate reference to the effect of the threat handling measure when the network threat is disposed next time. In this way, after the successful execution of the automated threat handling command, this embodiment replays the abnormal traffic in the threat initiation device to simulate the scenario of replaying the network attack, verifies the execution effect of the command, and provides feedback based on the execution result, continuously improving the preset knowledge warehouse, making the threat handling measures more perfect, and improving the success rate of threat handling.

[0069] As can be seen from the above, the threat handling system of the embodiment of the present application first captures abnormal traffic and determines the network threat, generates and executes the automated threat handling command according to the threat handling measures found from the preset knowledge warehouse based on the characteristic information corresponding to the network threat and the first device information, so as to handle the network threat. At the same time, after the network threat is successfully handled, the abnormal traffic is replayed in the threat initiation device to verify whether the network threat occurs again. In this way, through the above process of the embodiment of the present application, on the one hand, when the network threat occurs, the network threat can be handled based on the threat handling measures found in the preset knowledge warehouse, thereby improving the timeliness of the handling. On the one hand, the network threat that occurs can be handled and verified automatically based on the threat handling system, without manual intervention, and on the other hand, only the relevant operation and maintenance personnel are required to supplement the preset knowledge warehouse, and it is not necessary to require them to have relevant operation and maintenance experience, thereby reducing the difficulty of handling by the relevant operation and maintenance personnel. After the automatic handling command is successfully executed, the effect of the handling is verified by replaying the abnormal traffic in the threat initiation device, thereby improving the success rate of the handling, thereby solving the problem that the efficiency of threat handling is difficult to improve due to the poor timeliness of the handling and the high technical level requirements of the relevant personnel.

[0070] See also Figure 6 As shown, in order to improve the execution effect of the threat handling system, the embodiment of the present application also provides a specific network threat handling method, which is applied to the threat handling system, including:

[0071] Step S21: Capture abnormal traffic on the threat-initiating device and determine the network threat corresponding to the abnormal traffic.

[0072] Step S22: match the threat handling measures corresponding to the network threat from the preset knowledge warehouse according to the characteristic information corresponding to the network threat, and search for the first device information of the threat-to-be-processed device affected by the network threat and the second device information of the threat-initiating device.

[0073] Step S23: Generate an automated threat handling command based on the threat handling measure and the first device information, and log in to the threat initiating device and the threat to be handled device respectively based on the second device information and the first device information.

[0074] Step S24: execute the automated threat handling command in the threat-to-be-processed device, and after the automated threat handling command is successfully executed, replay the abnormal traffic in the threat-initiating device, and track the devices in the traffic path corresponding to the abnormal traffic to determine whether the threat-to-be-processed device is affected by the network threat again.

[0075] Since it is not certain whether the threat handling measures corresponding to the network threat can produce a beneficial effect on the current network threat, in order to avoid the situation where the automated threat handling command does not produce a beneficial effect and the current network threat cannot be successfully handled, after the automated threat handling command is successfully executed, this embodiment replays the abnormal traffic in the threat initiating device and tracks the devices in the traffic path corresponding to the abnormal traffic to determine whether the threat-to-be-handled device is affected by the network threat again. If the threat-to-be-handled device is affected by the network threat again, it means that the threat handling measures have failed to produce a beneficial effect on the current network threat, and relevant personnel need to be informed so that they can handle it in a timely manner.

[0076] Furthermore, since some network threats cannot be completely eliminated by executing the automated threat handling command, this embodiment can introduce the parameter of threat impact index to judge in more detail whether the threat-to-be-handled device is affected by the network threat again. Specifically, this embodiment can count the first threat impact index of the network threat after capturing the abnormal traffic on the threat-initiating device and determining the network threat corresponding to the abnormal traffic. Among them, the threat impact index is positively correlated with the degree of impact caused by the network threat, that is, the greater the degree of impact caused by the network threat, the greater the threat impact index. This embodiment can compare the first threat impact index with the threat impact index after replaying the abnormal traffic to determine whether the automated threat handling command is effective for handling the network threat, which can specifically include: replaying the abnormal traffic in the threat-initiating device and counting the current second threat impact index; if the second threat impact index is less than the first threat impact index, it is determined that the threat-to-be-handled device is not affected by the network threat again. The effect of threat handling is verified by counting the threat impact index to confirm whether the same abnormal traffic will still cause damage to the system, so as to improve the preset knowledge warehouse and improve the upper limit of threat handling efficiency.

[0077] Step S25: If the threat-to-be-processed device is affected by the network threat again, a configuration rollback command is executed to restore the configuration of the threat-to-be-processed device according to the first device configuration information.

[0078] In this embodiment, after determining that the threat-to-be-processed device is affected by the network threat again, a configuration rollback command is executed to restore the configuration of the threat-to-be-processed device according to the first device configuration information, so that relevant personnel can collect other threat handling measures for handling the network threat in order to handle and repair the network threat.

[0079] Step S26: If the device to be processed is not affected by the network threat again, a successful processing notification is fed back.

[0080] Among them, the specific implementation process of steps S21, S22 and S23 can refer to the corresponding content disclosed in the aforementioned embodiments, and will not be repeated here.

[0081] As can be seen from the above, the embodiment of the present application promptly feeds back the execution result after executing the automated threat handling command, and restores the configuration of the threat handling device when it is determined that the threat handling device is affected by the network threat again, so as to facilitate relevant personnel to collect other threat handling measures for handling the network threat in order to handle and repair the network threat, thereby improving the execution effect of the threat handling system.

[0082] Accordingly, see Figure 7 As shown, the embodiment of the present application also provides a network threat handling device, which is applied to a threat handling system and may include:

[0083] A threat determination module 11 is used to capture abnormal traffic on the threat initiating device and determine the network threat corresponding to the abnormal traffic;

[0084] An information search module 12 is used to match the threat handling measures corresponding to the network threat from a preset knowledge warehouse according to the characteristic information corresponding to the network threat, and to search for the first device information of the threat-to-be-processed device affected by the network threat and the second device information of the threat-initiating device;

[0085] A device login module 13, configured to generate an automated threat handling command based on the threat handling measure and the first device information, and to log in to the threat initiating device and the threat to be handled device based on the second device information and the first device information respectively;

[0086] The traffic replay module 14 is used to execute the automated threat handling command in the threat processing device, and after the automated threat handling command is successfully executed, replay the abnormal traffic in the threat initiating device to verify whether the automated threat handling command is effective.

[0087] As can be seen from the above, the threat handling system of the embodiment of the present application first captures abnormal traffic and determines the network threat, generates and executes an automated threat handling command based on the threat handling measures found from the preset knowledge warehouse based on the characteristic information corresponding to the network threat and the first device information to handle the network threat. At the same time, after the network threat is successfully handled, the abnormal traffic is replayed in the threat initiating device to verify whether the network threat occurs again. In this way, through the above process of the embodiment of the present application, the network threats that appear can be automatically handled and verified without manual intervention, which improves the timeliness of handling, while reducing the difficulty of handling by the relevant operation and maintenance personnel and verifying the effect of the handling, thereby solving the problem that the efficiency of threat handling is difficult to improve due to the poor timeliness of handling and the high technical level requirements of the relevant personnel.

[0088] In some specific implementations, the threat determination module 11 may specifically include:

[0089] A traffic capture unit, used to determine a threat-initiating device among the current plurality of devices, and to capture abnormal traffic of the threat-initiating device;

[0090] The traffic analysis unit is used to analyze the abnormal traffic to determine the network threat corresponding to the abnormal traffic.

[0091] In some specific implementations, the information search module 12 may specifically include:

[0092] An information matching submodule, used to determine the characteristic information corresponding to the network threat, and sequentially match the characteristic information from the asset library of the preset knowledge warehouse based on a preset matching order to determine the threat type of the network threat;

[0093] A measure matching submodule, used for matching a threat handling measure corresponding to the threat type from a threat library of the preset knowledge warehouse according to the threat type;

[0094] The information search submodule is used to determine the threat-processing device affected by the network threat, and search the asset library for the first device information corresponding to the threat-processing device and the second device information of the threat-initiating device.

[0095] In some specific implementations, the information matching submodule may specifically include:

[0096] An information matching unit, configured to match the feature information in sequence from the asset library of the preset knowledge warehouse based on a preset matching order to generate a corresponding matching result;

[0097] a type determination unit, configured to determine a threat type corresponding to the network threat based on the matching result if the matching result indicates a successful match;

[0098] The first notification feedback unit is used to generate a completion notification if the matching result indicates a matching failure, and feed the completion notification back to the front end of the threat handling system; the completion notification is a notification for completing the threat type.

[0099] In some specific implementations, the device login module 13 may specifically include:

[0100] A first information feedback unit is configured to log in to the threat-to-be-processed device based on the first device information, and if the login to the threat-to-be-processed device is successful, back up the first device configuration information of the threat-to-be-processed device; if the login to the threat-to-be-processed device is unsuccessful, feed back first login abnormality information;

[0101] The second information feedback unit is used to log in to the threat initiating device based on the second device information. If the login to the threat initiating device is successful, the second device configuration information of the threat initiating device is backed up; if the login to the threat initiating device is unsuccessful, the second login exception information is fed back.

[0102] In some specific implementations, the traffic replay module 14 may specifically include:

[0103] A result tracking unit, configured to execute the automated threat handling command in the threat to be handled device and track the execution result of the automated threat handling command;

[0104] A second notification feedback unit, configured to feedback a threat handling measure modification notification if the execution result indicates that the automated threat handling command is not successfully executed;

[0105] The third notification feedback unit is configured to feedback a threat repair rate update notification if the execution result indicates that the automated threat handling command is successfully executed.

[0106] In some specific implementations, the traffic replay module 14 may specifically include:

[0107] A device tracking unit, configured to replay the abnormal traffic in the threat initiating device and track the devices in the traffic path corresponding to the abnormal traffic to determine whether the threat to be processed device is affected by the network threat again;

[0108] a command execution unit, configured to execute a configuration rollback command if the threat-to-be-processed device is affected by the network threat again, so as to restore the configuration of the threat-to-be-processed device according to the first device configuration information;

[0109] The fourth notification feedback unit is used to feedback a processing success notification if the threat to be processed device is not affected by the network threat again.

[0110] Furthermore, the present application also discloses an electronic device. Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network threat disposal method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0111] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0112] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0113] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the network threat disposal method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0114] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed network threat handling method. For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, and no further description will be given here.

[0115] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0116] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0117] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0118] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0119] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A network threat handling method, characterized in that: Applied to threat management systems, including: Capturing abnormal traffic on the threat-initiating device and determining the network threat corresponding to the abnormal traffic; According to the characteristic information corresponding to the network threat, a threat handling measure corresponding to the network threat is matched from a preset knowledge warehouse, and first device information of a threat-to-be-processed device affected by the network threat and second device information of the threat-initiating device are searched; Generate an automated threat handling command based on the threat handling measure and the first device information, and log in to the threat initiating device and the threat to be handled device respectively based on the second device information and the first device information; The automated threat handling command is executed in the threat to be handled device, and after the automated threat handling command is successfully executed, the abnormal traffic is replayed in the threat initiating device to verify whether the automated threat handling command is effective.

2. The network threat handling method according to claim 1, characterized in that: The capturing of abnormal traffic on the threat initiating device and determining the network threat corresponding to the abnormal traffic includes: Determine a threat-initiating device among the current plurality of devices, and capture abnormal traffic of the threat-initiating device; The abnormal traffic is analyzed to determine the network threat corresponding to the abnormal traffic.

3. The network threat handling method according to claim 1, characterized in that: The matching of the threat handling measures corresponding to the network threat from a preset knowledge warehouse according to the feature information corresponding to the network threat, and searching for the first device information of the threat-to-be-processed device affected by the network threat and the second device information of the threat-initiating device, includes: Determine feature information corresponding to the network threat, and match the feature information in sequence from an asset library of the preset knowledge warehouse based on a preset matching order to determine a threat type of the network threat; According to the threat type, matching a threat handling measure corresponding to the threat type from a threat library of the preset knowledge warehouse; A threat-to-be-processed device affected by the network threat is determined, and first device information corresponding to the threat-to-be-processed device and second device information of the threat-initiating device are searched from the asset library.

4. The network threat handling method according to claim 3, characterized in that: The matching the feature information in sequence from the asset library of the preset knowledge warehouse based on a preset matching order to determine the threat type of the network threat includes: Matching the feature information in sequence from the asset library of the preset knowledge warehouse based on a preset matching order to generate corresponding matching results; If the matching result indicates a successful match, determining a threat type corresponding to the network threat based on the matching result; If the matching result indicates a matching failure, a completion notification is generated and fed back to the front end of the threat handling system; the completion notification is a notification used to complete the threat type.

5. The network threat handling method according to claim 1, characterized in that: The logging in to the threat initiating device and the threat to be processed device respectively based on the second device information and the first device information includes: Logging in to the threat-to-be-processed device based on the first device information, backing up the first device configuration information of the threat-to-be-processed device if logging in to the threat-to-be-processed device is successful; and feeding back first login abnormality information if logging in to the threat-to-be-processed device is unsuccessful; The threat initiating device is logged in based on the second device information. If the threat initiating device is successfully logged in, the second device configuration information of the threat initiating device is backed up; if the threat initiating device is not successfully logged in, the second login exception information is fed back.

6. The network threat handling method according to any one of claims 1 to 5, characterized in that: The executing the automated threat handling command in the threat to be handled device includes: Executing the automated threat handling command in the threat to be handled device, and tracking the execution result of the automated threat handling command; If the execution result indicates that the automated threat handling command is not successfully executed, feeding back a threat handling measure modification notification; If the execution result indicates that the automated threat handling command is successfully executed, a threat repair rate update notification is fed back.

7. The network threat handling method according to claim 5, characterized in that: The replaying the abnormal traffic in the threat initiating device to verify whether the automated threat handling command is effective includes: Replaying the abnormal traffic in the threat initiating device, and tracking the devices in the traffic path corresponding to the abnormal traffic to determine whether the threat to be processed device is affected by the network threat again; If the threat-to-be-processed device is affected by the network threat again, executing a configuration rollback command to restore the configuration of the threat-to-be-processed device according to the first device configuration information; If the threat-to-be-processed device is not affected by the network threat again, a successful processing notification is fed back.

8. A network threat handling device, characterized in that: Applied to threat management systems, including: A threat determination module, used to capture abnormal traffic on the threat-initiating device and determine the network threat corresponding to the abnormal traffic; An information search module, used to match the threat handling measures corresponding to the network threat from a preset knowledge warehouse according to the characteristic information corresponding to the network threat, and to search for the first device information of the threat-to-be-processed device affected by the network threat and the second device information of the threat-initiating device; a device login module, configured to generate an automated threat handling command based on the threat handling measure and the first device information, and to log in to the threat initiating device and the threat to be handled device respectively based on the second device information and the first device information; The traffic replay module is used to execute the automated threat handling command in the threat processing device, and after the automated threat handling command is successfully executed, replay the abnormal traffic in the threat initiating device to verify whether the automated threat handling command is effective.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the network threat handling method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program; wherein, when the computer program is executed by a processor, the network threat handling method according to any one of claims 1 to 7 is implemented.

Images