Banking industry distributed internet asset monitoring method and system based on VPT

Abstract

The invention discloses a VPT-based bank industry distributed internet asset monitoring method and system, and the method and system provide a result consistency algorithm through a distributed automatic monitoring mode, fuse the attack and defense experience of internal and external penetration expert teams, discover unknown assets, especially mobile terminal assets, and troubleshoot sensitive information leakage. The invention further provides an internet asset vulnerability monitoring processing method based on the VPT, the relation between internet assets, vulnerabilities and development departments of banks is sorted, the asset exposure condition is researched and evaluated, optimization and improvement of enterprise network security work are further promoted, and enterprise internal data and service security can be effectively guaranteed.

Description

Technical Field

[0001] The present invention belongs to the field of computer and information security technology, and in particular, relates to a VPT-based banking distributed Internet asset monitoring method and system. Background Art

[0002] With the explosive growth of mobile Internet and the digital transformation of banking business, various banking services are increasingly exposed to the Internet environment. Due to the high degree of openness of the Internet, various Internet assets deployed on the Internet are inevitably subject to external security threats, including the risk of cyber attacks or data leakage on Internet assets. At the same time, banks are facing strong regulatory compliance control, and the requirements for data and network security are more stringent. In the face of multiple internal and external demands, banks need to regularly conduct risk screening of Internet assets within the bank.

[0003] Before conducting risk investigation on assets, sorting out Internet assets is of utmost importance. At the same time, the banking industry is facing the requirements of investigating and sorting out its own Internet assets and complying with regulations. At present, there is a lack of an Internet monitoring platform that combines multiple processes and processing methods to achieve a closed loop of security operations and maintenance. The existing Internet monitoring platform has a small coverage and low efficiency. A distributed approach can be used to improve efficiency. At the same time, a method is needed to synchronize the results of distributed pluggable monitoring nodes.

[0004] For assets under monitoring that have various types of vulnerabilities, the existing CVSS-based vulnerability rating calculation is too complex and emphasizes the technical severity of the vulnerability itself. In most scenarios, it does not meet the actual needs of enterprises, and some vulnerabilities are rated too high, while vulnerabilities with a larger actual impact are rated too low. The existing assessment process cannot take into account factors such as the exploitability and business criticality of vulnerabilities in the actual IT environment of the enterprise during vulnerability handling, and give a clear priority order. In response to this issue, Gartner defined Vulnerability Priority Technology (VPT) as an expected pinnacle technology at the Security Risk and Management Summit in September 2020. However, in current actual applications, the specific practical form of this technology has not been accurately defined.

[0005] By applying vulnerability priority technology (VPT) to asset monitoring and processing, we can dynamically prioritize the vulnerabilities that need to be repaired and optimize the process, screen out asset vulnerabilities that pose actual security risks, and then optimize the monitoring and processing methods, improve monitoring accuracy and security operation efficiency, and solve the difficulty of managing existing asset vulnerabilities. Summary of the invention

[0006] In view of this, the purpose of the present invention is to provide a distributed Internet asset monitoring system and method for the banking industry based on VPT, which can realize full-scale, high-frequency and effective monitoring of the Internet assets of the banking industry.

[0007] The objective of the present invention is achieved through the following technical solutions:

[0008] According to a first aspect of this specification, a VPT-based distributed Internet asset monitoring method for the banking industry is provided, the method comprising the following steps:

[0009] S1. Obtain asset information and send port scanning tasks to distributed engine nodes.

[0010] S2, distributed engine node detection task type, select the port scanning range and scanning speed;

[0011] S3, the distributed engine node scans the information, determines the port asset detection type and processes different types of assets;

[0012] S4. Monitor the processed data according to the monitoring rules, and clean and deduplicate the data for assets that do not trigger the monitoring rules through the asset whitelist; manually check and confirm the assets that trigger the monitoring rules and record the time and processing status; the monitoring rules are used to determine whether the monitoring keywords and high-risk service ports are exposed;

[0013] S5. Classify nodes according to the untriggered monitoring rules and the data after investigation in each node: select the leader node and the follower node;

[0014] S6. Perform VPT score evaluation based on the data obtained by the leader node to complete the VPT-based monitoring process.

[0015] Furthermore, the task types include periodic tasks, temporary tasks, traceability tasks and special inspections.

[0016] Furthermore, the distributed engine includes: a general IT asset scanning engine, a mobile asset scanning engine, a sensitive information scanning engine and a vulnerability monitoring scanning engine.

[0017] Furthermore, the information obtained by the information scanning includes: IP, port information, system information, service information, port fingerprint information, favicon icon, rebot.txt configuration file, website title, error information, location of the service, Web service webpage screenshot, component name and version.

[0018] Further, the determining the port asset detection type and processing different types of assets includes:

[0019] For IP processing: fingerprint matching is performed on the response message to determine whether dark links are involved;

[0020] For domain name asset processing: If the port uses an SSL / TLS certificate, determine whether the certificate is expired, whether it matches the domain name, whether the certificate is abnormal, whether the domain name is a test domain name, and perform fingerprint matching on the response message to determine whether a dark link is involved;

[0021] For a given asset information keyword processing: obtain the corresponding port asset from the network asset mapping engine to supplement potential data loss.

[0022] Furthermore, the selection of the leader node and the follower node is specifically as follows:

[0023] S5.1. Unit time interval t term Complete the first task within 10 seconds. Among all the results, the node with the highest similarity will be selected as the leader node. If the results are consistent, the node with the fastest execution speed will be selected. If the speeds are the same, the leader node will be randomly generated and the remaining nodes will be follower nodes.

[0024] S5.2, unit time interval t term Inside, the leader scans node N L Scan node N to the follower F Send heartbeat information; if there is a valid result from the leader node, return the result and enter S5.4; if the leader does not respond or returns an invalid monitoring result, enter S5.3 to start selecting a new leader node;

[0025] S5.3, same t term Within, all follower nodes are converted to candidate nodes, and vote for other candidate nodes based on the similarity with their own results and execution speed. Candidate node N i For candidate node N j The candidate evaluation score is s ij ∈(1,n), candidate node N j The candidate score S j =∑s ij ; Old leader node N′ L Reconnecting will make it a new follower node, executing tasks but not participating in the leader node selection;

[0026] S5.4. The leader node pushes data to the API gateway.

[0027] Furthermore, the VPT score includes four indicator scores: foundation, time, environment and application; the evaluation process includes:

[0028] S6.1. Calculate the basic index score V of the component base,k , which is determined by the impact indicator v impact,k and the exploitability index v exp,k Determine; Availability Indicator v exp,kIndicates the difficulty of exploiting asset vulnerabilities. The following is the calculation formula for each score:

[0029] Calculate the impact index v impact :

[0030] v impact =6.42*(1-[(1-v C )*(1-v I )*(1-v A )])

[0031] Among them, v C , v I and v A They respectively represent the confidentiality, integrity and availability of data security under the influence of asset vulnerabilities, and are divided into three levels: high, medium and low, with the values ​​decreasing in sequence;

[0032] Calculate the exploitability index v exp,k :

[0033] v exp,k =8.22*v AV *v AC *v PR *v UI

[0034] Among them, the network status indicator v AV Characterizing vulnerabilities requires establishing a network adjacency with the target system, which is divided into four levels: Internet link, LAN link, local network link, and physical link, with the values ​​decreasing in sequence;

[0035] Among them, the complexity index v AC Indicates the complexity of the attack. It is divided into low and high levels with values ​​decreasing in sequence. The recommended values ​​are 0.77 and 0.22.

[0036] Among them, the permission index v PR Indicates the permissions required for use, which are divided into three levels: no permission requirement, low permission requirement, and high permission requirement;

[0037] Among them, the interaction index v UI Indicates whether user interaction is required to exploit the vulnerability. It can be divided into two levels: not required and required.

[0038] Calculate the basic indicator V base,k :

[0039]

[0040] S6.2. Calculation time index V temp,k :

[0041]

[0042] Among them, the vulnerability exploitability indicator v E It is divided into five levels: undefined, high exploit maturity, exploit code available, only proof-of-concept exploit code exists, and no exploit code available, with the values ​​decreasing in order;

[0043] Among them, the repair solution index v RL It is divided into five levels: undefined, no repair plan, official temporary plan, and official completed repair plan, with the values ​​decreasing in descending order;

[0044] Among them, the indicator v that represents the credibility of vulnerability reports RC It is divided into four levels: undefined, confirmed vulnerability, important details published, and vulnerability report exists but details unknown, with values ​​decreasing in descending order;

[0045] S6.3. Calculate the environmental index score V env,k , which is determined by the modified impact index v′ impact,k and the modified exploitability index v′ exp,k The following is the calculation formula for each score:

[0046] Calculate the modified impact index score v′ impact,k :

[0047] v′ impact,k =6.42*min((1-[(1-v′ C *v CR )*(1-v′ I *v IR )*(1-v′ A *v AR )]),0.915)

[0048] Among them, the modified confidentiality index v′ C , Modified integrity index v′ I and the modified availability index v′ A The value is the same as v in step S6.3 C , v I and v A Consistent; confidentiality requirement index v CR , completeness requirement index v IR and availability requirement index v AR It represents the degree of confidentiality, integrity and availability of data security required by the enterprise, and is divided into four levels: undefined, high, medium and low, with the values ​​decreasing in descending order;

[0049] Calculate the modified exploitability index score v′ exp,k :

[0050] v′ exp,k =8.22*v′ AV *v′ AC*v′ PR *v′ UI

[0051] Among them, the modified network status index v′ AV , Modified complexity index v′ AC , modify the authority index v′ PR and modified interaction index v′ UI The corresponding indicator value is consistent with that in step 1;

[0052] Obtain environmental index score v env,k :

[0053]

[0054] where v E , v RL , v RC From step S6.2;

[0055] S6.4. Confirm the application index score V of component k app , the indicator consists of three parts:

[0056] V app =V sys *V vul *V dt

[0057] Among them, the system importance index V sys , used to measure the importance of the application affected by the vulnerability. The larger the index value, the higher the importance. The index value is customized. The previous value index V vul Represents the number of early vulnerabilities of the project team, and confirms the score through horizontal comparison of multiple project teams; project team response index V dt , according to the average processing cycle;

[0058] S6.5. The above steps are for a single component or software k of the asset. The VPT value V of the component and software is vpt,k :

[0059]

[0060] The asset consists of m different components, and the VPT score of the asset is:

[0061] V vpt =max(V vpt,k ),k=1,...,m

[0062] According to another aspect of the specification, a system for implementing the method is provided, the system comprising: a system service layer, a data transmission layer, and an elastic mapping layer;

[0063] The system service layer is responsible for asset management, management of monitoring task types, task strategy configuration and task distribution, including cleaning of task monitoring results, data collation for regulatory reporting, reminders of new or abnormal ports, and VPT score evaluation;

[0064] The data transmission layer is used for forwarding task data of the system service layer and forwarding / temporary storage of data of the distributed scanning engine of the mapping layer, synchronizing the engine vulnerability plug-in and dictionary, and identifying node permissions. The data transmission layer is also used for calling and docking with external platforms, docking component data with the component component analysis platform, obtaining asset risk information from the threat intelligence / security big model platform, and performing data synchronization verification from the external mapping engine;

[0065] The elastic mapping layer obtains and receives monitoring scanning tasks through the API gateway of the data transmission layer, and manages vulnerability plug-ins, vulnerability verification plug-ins, port scanning plug-ins, subdomain scanning plug-ins, directory scanning plug-ins, self-developed crawler plug-ins, and vulnerability scanning plug-ins; and detects Internet assets by directly obtaining or accessing data platform snapshots. The elastic mapping layer includes four major types of distributed scanning engines: general IT asset scanning engine, mobile asset scanning engine, sensitive information scanning engine, and vulnerability monitoring scanning engine.

[0066] According to another aspect of the specification, a VPT-based distributed Internet asset monitoring device for the banking industry is provided, comprising a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, the VPT-based distributed Internet asset monitoring method for the banking industry is implemented.

[0067] According to another aspect of the specification, a computer-readable storage medium is provided, on which a program is stored. When the program is executed by a processor, the VPT-based distributed Internet asset monitoring method for the banking industry is implemented.

[0068] The beneficial effects of the present invention are: the platform uses distributed automated monitoring and provides a result consistency algorithm, integrates the attack and defense experience of internal and external penetration expert teams, discovers unknown assets, especially mobile assets, and investigates sensitive information leakage. It also provides a VPT-based Internet asset vulnerability monitoring and processing method to sort out the relationship between the bank's own Internet assets, vulnerabilities, and development departments, investigate and evaluate asset exposure, further promote the optimization and improvement of corporate network security work, and effectively protect the internal data and business security of the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 Distributed port monitoring flow chart provided for this application example;

[0070] Figure 2A distributed node reconnection strategy provided for this application example;

[0071] Figure 3 An evaluation flow chart of a VPT-based monitoring and processing method provided in an embodiment of the present application;

[0072] Figure 4 The infrastructure of the distributed Internet asset monitoring system for the banking industry is applied for;

[0073] Figure 5 This is a schematic diagram of the distributed Internet asset monitoring device for the banking industry based on VPT in this application. DETAILED DESCRIPTION

[0074] In order to better understand the technical solution of the present application, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. The technical solutions in the examples of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the examples of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0075] The embodiment of the present invention provides a distributed Internet asset monitoring method for the banking industry based on VPT, the method comprising the following steps:

[0076] S1. Obtain asset information and send port scanning tasks to distributed engine nodes;

[0077] The asset information includes the following types: general IT assets, mobile Internet assets, sensitive data assets, and processing ledgers.

[0078] Type 1: General IT assets include domain names, IP addresses, Web services, SSL / TLS certificates, components / middleware;

[0079] Type 2: Mobile Internet assets include various mobile operating system apps (from Apple Store, Huawei Hongmeng Software Application Market, Xiaomi Mobile Application Market, etc.), various Internet social platform applets (WeChat applets, Alipay applets, Baidu applets, etc.), various Internet social platform public accounts (WeChat public accounts, Douyin public accounts), and mobile web applications of various business systems. As the network entrance and exit of mobile terminals, mobile assets have become one of the most common targets of attack. For example, information leakage, unauthenticated interfaces, and unreinforced packages.

[0080] Type 3: Sensitive information includes employee ID, ID number, mobile phone number, office email address and password, customer information stored within the bank, development source code of the company's self-developed projects, supply chain outsourcing projects or on-site cooperation projects, bank application production / testing passwords, web service configuration and its service interface information;

[0081] Type 4: The processing ledger contains closed-loop records of abnormal Internet asset processing, including closed-loop data such as the time of the incident, relevant development departments, corresponding systems, and processing personnel. This part of the data is also one of the important sources of VPT evaluation.

[0082] S2, monitoring task type, select the port scanning range and scanning speed;

[0083] S3, the distributed engine node scans the information, determines the port asset detection type and processes different types of assets;

[0084] S4. Monitor the processed data according to the monitoring rules, and perform data cleaning and deduplication on the assets that have not triggered the monitoring rules through the asset whitelist; manually check and confirm the assets that triggered the monitoring rules and record the time and processing status; the monitoring rules are to determine whether the monitoring keywords and high-risk service exposure are triggered;

[0085] Figure 1 As shown, a specific process of port scanning of the elastic mapping layer distributed engine instance of the present invention is as follows:

[0086] Step 1: Enter asset information (domain name / IP) or pull from CMDB / SCMDB;

[0087] Step 2: Configure the detection task type, which can be periodic tasks, temporary tasks, tracing tasks, special inspection tasks, and select the port scanning range and port scanning speed;

[0088] Step 3: First determine the port asset monitoring type;

[0089] Step 3.1: For IP, the distributed scanning engine scans the port and makes a judgment after obtaining a unified result. The information obtained includes IP, port information, system information, service information, port fingerprint information, favicon icon, rebot.txt configuration file, website title, error message, service location, web service webpage screenshot, component name and version. Then, fingerprint matching is performed on the response message to determine whether a dark link is involved. After processing, proceed to step 4;

[0090] Step 3.2: For domain name assets, if the port uses an SSL / TLS certificate, determine whether the certificate is expired, whether it matches the domain name, whether the certificate is abnormal, etc. Determine whether the domain name is a test domain name, and perform fingerprint matching on the response message to determine whether it involves a dark link. After processing is completed, proceed to step 4;

[0091] Step 3.3: For a given asset information keyword, obtain the corresponding port asset from the network asset mapping engine, mainly to supplement potential data loss, clean and remove duplicates, and then proceed to step 4;

[0092] Step 4: Determine whether the monitoring keywords and high-risk service ports are exposed. For example, whether the 9200 port of Elastic Search is unauthorized, and whether the 3306 port of the MySQL database is open on the Internet.

[0093] Step 4.1: For assets that trigger monitoring rules, proceed to step 5 for detailed investigation;

[0094] Step 4.2: For assets that have not triggered monitoring rules, complete data cleaning, deduplication, and result deduplication through asset whitelist judgment, and proceed to step 6;

[0095] Step 5: After the monitoring rule is triggered, find the corresponding department and system manager to conduct a secondary investigation and confirmation and record the time and processing status. The data is used as the basis for calculating the VPT of the system service layer, and then proceed to step 6;

[0096] Step 6: Complete the data and finally push the data to the port asset history table / increment table / stock table of the system service layer to facilitate the later data archiving and to improve the configuration management database;

[0097] Step 7: End the port scanning process.

[0098] S5. Classify nodes according to the untriggered monitoring rules and the data after investigation in each node: select the leading node and the follower node; the specific monitoring result synchronization process is as follows:

[0099] Step 1: Unit time interval t term Complete the first task within 3 to 5 minutes. Among all the results, the node with the highest similarity and the fastest execution speed is selected as the leader node. If the results are consistent, the fastest node is selected; if the speeds are the same, the leader node is randomly selected and the remaining nodes are follower nodes.

[0100] Step 2: Unit time interval t term Inside, the leader scans node N L Scan node N to the follower FSend heartbeat information; if there is a valid result from the leader node, return the result and go to step 4; if the leader does not respond or returns an invalid monitoring result, go to step 3 to start selecting a new leader node;

[0101] Step 3: Also term In the process, all follower nodes are converted into candidate nodes, and they vote for other candidate nodes based on the similarity of their results and execution speed. The result similarity consists of three parts: the returned message title, length, and response code. Each similarity is scored 1 point, with a maximum of 3 points. If the result similarity scores are consistent, they are sorted according to execution speed. Candidate node N i For candidate node N j The candidate evaluation score is s ij ∈(1,n), and each value appears only once, the final candidate node N j The candidate score S j =∑s ij .See Figure 2 In phase 1, the candidate node with the highest candidate score becomes the new leader node, and the remaining nodes are converted to follower nodes;

[0102] Old leader node N′ L Reconnecting will make it a new follower node, executing tasks but not participating in the leader node selection;

[0103] Step 4: The leader node pushes data to the data transmission layer API gateway. If there is a new task, go to step 2 and all nodes pull the task.

[0104] S6. Perform VPT score evaluation based on the data obtained by the leader node to complete the VPT-based monitoring process.

[0105] Specifically, Figure 3 An evaluation flow chart of a monitoring and processing method based on VPT provided for the system service layer embodiment of the present invention. Computing assets are composed of multiple components or software. First, a VPT score evaluation is performed on a single component or software k, where 1≤k≤m, and m is the number of components of the asset. The score includes four indicator scores: basic, time, environment, and application. The time score can be obtained based on the basic indicator score. The basic indicator score of common asset vulnerabilities can be referenced from the software component analysis platform. The basic score of the vulnerability of the self-developed component / software is determined by the information security team. Basic indicator score V base,k Indicates the intrinsic characteristics of the vulnerability, which are constant over time and environment. Basic indicators and time indicators can be used separately. The specific steps are as follows:

[0106] Step 1: Calculate the component basic index score V base,k , which is determined by the impact indicator v impact,k and the exploitability index vexp,k Determine. Availability Indicatorv exp,k Indicates the difficulty of exploiting asset vulnerabilities. The following is the calculation formula for each score:

[0107] Calculate the impact index v impact :

[0108] v impact =6.42*(1-[(1-v C )*(1-v I )*(1-v A )])

[0109] Among them, v C , v I and v A Respectively represent the confidentiality, integrity and availability of data security under the influence of asset vulnerabilities, which can be divided into three levels: high, medium and low. The values ​​decrease in turn, and the recommended values ​​are 0.56, 0.22, and 0. Confidentiality refers to ensuring that information is not accessed without authorization, integrity refers to ensuring that data is not illegally modified or destroyed, and availability refers to ensuring that data can be accessed by authorized subjects;

[0110] Calculate the exploitability index v exp,k :

[0111] v exp,k =8.22*v AV *v AC *v PR *v UI

[0112] Among them, the network status indicator v AV To characterize a vulnerability, it is necessary to establish a network adjacency with the target system, which is divided into four levels: Internet link, LAN link, local network link, and physical link. The values ​​decrease in sequence, and the recommended values ​​are 0.85, 0.62, 0.55, and 0.2.

[0113] Among them, the complexity index v AC Indicates the complexity of the attack. It is divided into low and high levels with values ​​decreasing in sequence. The recommended values ​​are 0.77 and 0.22.

[0114] Among them, the permission index v PR The required permissions for utilization are characterized by no permission requirement, low permission requirement, and high permission requirement, with values ​​of 0.85, 0.62, and 0.27.

[0115] Among them, the interaction index v UI Indicates whether the exploitation of the vulnerability requires user interaction, which is divided into two levels: no need and required, with values ​​of 0.85 and 0.62;

[0116] Calculate the basic indicator V base,k :

[0117]

[0118] Step 2: Calculate the time indicator V temp,k :

[0119]

[0120] Among them, the vulnerability exploitability indicator v E It is divided into five levels: undefined, high exploit maturity, exploit code available, only proof-of-concept exploit code exists, and no exploit code is available. The scores decrease in order. The recommended values ​​are 1, 1, 0.97, 0.94, and 0.91.

[0121] Among them, the repair solution index v RL It is divided into five levels: undefined, no repair plan, official temporary plan, and official completed repair plan. The scores decrease in sequence. The recommended values ​​are 1, 1, 0.97, 0.96, and 0.95.

[0122] Among them, the indicator v that represents the credibility of vulnerability reports RC It is divided into four levels: undefined, confirmed vulnerability, important details published, vulnerability report exists but details unknown. The scores decrease in sequence. The recommended values ​​are 1, 1, 0.96, and 0.92.

[0123] Step 3: Calculate the environmental index score V env,k , which is determined by the modified impact index v′ impact,k and the modified exploitability index v′ exp,k The following is the calculation formula for each score:

[0124] Calculate the modified impact index score v′ impact,k :

[0125] v′ impact,k =6.42*min((1-[(1-v′ C *v CR )*(1-v′ I *v IR )*(1-v′ A *v AR )]),0.915)

[0126] Among them, the modified confidentiality index v′ C , Modified integrity index v′ I and the modified availability index v′ A The value is the same as v in step 1.1 C , v I and v a Consistent. Confidentiality requirement index v CR, completeness requirement index v IR and availability requirement index v AR Indicates the degree of confidentiality, integrity, and availability of data security requirements of the enterprise. It is divided into four levels: undefined, high, medium, and low. The scores decrease in descending order. The recommended values ​​are 1.0, 1.5, 1.0, and 0.5.

[0127] Calculate the modified exploitability index score v′ exp,k :

[0128] v′ exp,k =8.22*v′ AV *v′ AC *v′ PR *v′ UI

[0129] Among them, the modified network status index v′ AV , Modified complexity index v′ AC , modify the authority index v′ PR and modified interaction index v′ UI The corresponding indicator value is consistent with that in step 1;

[0130] Obtained environmental index score V env,k :

[0131]

[0132] where v E , v RL , v RC From step 2.

[0133] Step 4: Determine the application index score V of component k app , the indicator consists of three parts:

[0134] V app =V sys *V vul *V dt

[0135] Among them, the system importance index V sys , used to measure the importance of the application affected by the vulnerability. The index value ranges from [0.96, 1.04]. The larger the index value, the higher the importance. The index value can be customized and adjusted. The initial default value is 1.0. The importance of the application can also be obtained after confirmation by the office automation platform, CMDB / SCMDB and other platforms. Vulnerability pre-value index V vul Indicates the number of early vulnerabilities of the project team. The value range is [0.98, 1.02]. It is necessary to compare multiple project teams horizontally to confirm the score. Project Team Response Index V dt, the average processing period is 0.99 for 1 to 3 working days, 1 for 3 to 7 working days, and 1.01 for more than 7 working days;

[0136] Step 5: The above steps are for a single component or software k of the asset, and the VPT value V of the component and software vpt,k :

[0137]

[0138] The asset consists of m different components, and the VPT score of the asset is:

[0139] V vpt =max(V vpt,k ),k=1,...,m.

[0140] Step 6: If V vpt The higher the value, the higher the comprehensive risk value and importance of the asset. The top 3% of assets in a unit period will be automatically or manually screened and notified to the corresponding development department for rectification. For particularly serious cases, notifications can be initiated through processes, emails, etc.

[0141] Step 7: Complete the VPT-based monitoring process, score and archive its processing flow.

[0142] like Figure 4 As shown, according to the method in the above embodiment, the embodiment of the present invention provides a distributed Internet asset monitoring system infrastructure for the banking industry, including the following three parts: system service layer, data transmission layer and elastic mapping layer. Individual instances of the system service layer, data transmission layer and elastic mapping layer can be deployed and run independently.

[0143] 1. System service layer

[0144] Responsible for asset management, management of monitoring task types, task strategy configuration and task distribution, including cleaning of task monitoring results, data collation for regulatory reporting, reminders of new or abnormal ports, and finally Internet asset analysis and visualization of asset change trends;

[0145] Asset management covers the following types: general IT assets, mobile Internet assets, sensitive data assets, and processing ledgers.

[0146] Type 1: General IT assets include domain names, IP addresses, Web services, SSL / TLS certificates, components / middleware;

[0147] Type 2: Mobile Internet assets include various mobile operating system apps (from Apple Store, Huawei Hongmeng Software Application Market, Xiaomi Mobile Application Market, etc.), various Internet social platform applets (WeChat applets, Alipay applets, Baidu applets, etc.), various Internet social platform public accounts (WeChat public accounts, Douyin public accounts), and mobile web applications of various business systems. As the network entrance and exit of mobile terminals, mobile assets have become one of the most common targets of attack. For example, information leakage, unauthenticated interfaces, and unreinforced packages.

[0148] Type 3: Sensitive information includes employee ID, ID number, mobile phone number, office email address and password, customer information stored within the bank, development source code of the company's self-developed projects, supply chain outsourcing projects or on-site cooperation projects, bank application production / testing passwords, web service configuration and its service interface information;

[0149] Type 4: The processing ledger contains closed-loop records of abnormal Internet asset processing, including closed-loop data such as the time of the incident, relevant development departments, corresponding systems, and processing personnel. This part of the data is also one of the important sources of VPT evaluation.

[0150] The task strategy configuration includes the definition of task attributes, and the task type can be periodic / temporary / special investigation / reporting supervision / attack tracing. The task delivery content includes scanning speed, scanning range, timeout, vulnerability scanning, and scanning task group;

[0151] The cleaning of the task monitoring results is done by clustering repeated information in multiple ways through the cyberspace mapping engine, CMDB whitelist, and CDN blacklist, and verifying the whitelist of assets that are not the bank itself or the target range to ensure that the data in the ledger is the target asset; for new resources, a briefing is generated and pushed to the security operation and maintenance team to ensure the security and compliance of Internet assets;

[0152] In the visualization of asset change trends, the visualized data mainly includes the total amount of various data, the trend of new assets per unit period, and the total amount of high-risk asset vulnerabilities. For the monitoring of similar assets of the same bank, the above data are also counted and presented. The number of closed loops for high-risk asset processing is displayed for this unit. For specific assets, the historical opening status and process of the assets are displayed.

[0153] 2. Data transmission layer

[0154] like Figure 4As shown, the data transmission layer of the embodiment is used for forwarding task data of the service layer of the Internet asset monitoring system and forwarding / temporary storage of data of the distributed scanning engine of the mapping layer, synchronizing the engine vulnerability plug-in and dictionary, and identifying node permissions. The data transmission layer is also used for calling and docking with external platforms, docking component data with the component component analysis platform, obtaining asset risk information from the threat intelligence / security big model platform, and performing data synchronization verification from the external mapping engine.

[0155] In terms of asset monitoring, directly or indirectly obtain asset information from the company's internal asset management platform CMDB / SCMDB; connect to the external Internet space mapping platform to verify the accuracy of data obtained by the internal engine and supplement the missing Internet asset information; in terms of component security assessment, obtain monitoring results, asset desensitization, call the networked and purchased intranet threat intelligence system, and call the external security big model;

[0156] 3. Elastic Mapping Layer

[0157] like Figure 4 As shown, the elastic mapping layer obtains and receives monitoring scanning tasks through the API gateway of the data transmission layer, and manages vulnerability plug-ins, vulnerability verification plug-ins, port scanning plug-ins, subdomain scanning plug-ins, directory scanning plug-ins, self-developed crawler plug-ins, and vulnerability scanning plug-ins. Internet assets are detected by directly obtaining or accessing data platform snapshots, wherein the elastic mapping layer includes four types of distributed scanning engines: general IT asset scanning engine, mobile asset scanning engine, sensitive information scanning engine, and vulnerability monitoring scanning engine.

[0158] For the consistency of monitoring results, the same type of assets in the elastic mapping layer contain at least 5 scanning engine nodes N i (i=1,..,n,n≥5). The roles of scanning engine nodes can be divided into leader / follower / candidate nodes (N L / N F / N C ). Under normal circumstances, there are only two types of nodes: leader and follower. All nodes will run tasks, but the final scanning and monitoring data is confirmed by the leader node and uploaded to the data transmission layer. When running for the first time, all nodes are follower nodes.

[0159] Corresponding to the aforementioned embodiment of a distributed Internet asset monitoring method for the banking industry based on VPT, the present invention also provides an embodiment of a distributed Internet asset monitoring device for the banking industry based on VPT.

[0160] See also Figure 5A distributed Internet asset monitoring device for the banking industry based on VPT is provided in an embodiment of the present invention, comprising a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement a distributed Internet asset monitoring method for the banking industry based on VPT in the above embodiment.

[0161] The embodiment of a VPT-based distributed Internet asset monitoring device for the banking industry provided by the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory for execution. From a hardware perspective, if Figure 5 As shown in FIG. 1 , a hardware structure diagram of a distributed Internet asset monitoring device for banking industry based on VPT provided by the present invention is provided for any device with data processing capability, except Figure 5 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0162] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0163] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0164] An embodiment of the present invention also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a distributed Internet asset monitoring method for the banking industry based on VPT in the above embodiment is implemented.

[0165] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0166] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the VPT-based distributed Internet asset monitoring method for the banking industry.

[0167] Those skilled in the art will readily appreciate other embodiments of the present application after considering the description and practicing the contents disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The description and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the claims.

[0168] It should be understood that the above general description and the detailed description below are only exemplary and explanatory and cannot limit the present application. The present application is not limited to the precise structure described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present application is limited only by the attached claims.

Claims

1. A distributed Internet asset monitoring method for the banking industry based on VPT, characterized in that: The method comprises the following steps: S1. Obtain asset information and send port scanning tasks to distributed engine nodes. S2, monitor the task type, select the port scanning range and scanning speed; S3, the distributed engine node scans the information, determines the port asset detection type and processes different types of assets; S4. Monitor the processed data according to the monitoring rules, and clean and deduplicate the data for assets that do not trigger the monitoring rules through the asset whitelist; manually check and confirm the assets that trigger the monitoring rules and record the time and processing status; the monitoring rules are used to determine whether the monitoring keywords and high-risk service ports are exposed; S5. Classify nodes according to the untriggered monitoring rules and the data after investigation in each node: select the leader node and the follower node; S6. Perform VPT score evaluation based on the data obtained by the leader node to complete the VPT-based monitoring process.

2. According to a VPT-based distributed Internet asset monitoring method for banking industry according to claim 1, it is characterized in that: The task types include periodic tasks, temporary tasks, traceability tasks and special inspections.

3. According to a VPT-based distributed Internet asset monitoring method for banking industry according to claim 1, it is characterized in that: The distributed engine includes: a general IT asset scanning engine, a mobile asset scanning engine, a sensitive information scanning engine and a vulnerability monitoring scanning engine.

4. According to a VPT-based distributed Internet asset monitoring method for banking industry according to claim 1, it is characterized in that: The information obtained by the information scanning includes: IP, port information, system information, service information, port fingerprint information, favicon icon, rebot.txt configuration file, website title, error information, service location, Web service webpage screenshot, component name and version.

5. According to a VPT-based distributed Internet asset monitoring method for banking industry according to claim 1, it is characterized in that: The determining of the port asset detection type and processing of different types of assets includes: For IP processing: fingerprint matching is performed on the response message to determine whether dark links are involved; For domain name asset processing: If the port uses an SSL / TLS certificate, determine whether the certificate is expired, whether it matches the domain name, whether the certificate is abnormal, whether the domain name is a test domain name, and perform fingerprint matching on the response message to determine whether a dark link is involved; For a given asset information keyword processing: obtain the corresponding port asset from the network asset mapping engine to supplement potential data loss.

6. A VPT-based distributed Internet asset monitoring method for banking industry according to claim 1, characterized in that: The specific steps of selecting the leader node and the follower node are as follows: S5.

1. Unit time interval t term Complete the first task within 10 seconds, and select the node with the highest similarity among all the results and the node with the fastest execution speed as the leader node; If the results are consistent, the fastest node is selected; if the speeds are the same, a leader node is randomly selected and the remaining nodes are follower nodes; S5.2, unit time interval t term Inside, the leader scans node N L Scan node N to the follower F Send heartbeat information; if there is a valid result from the leader node, return the result and enter S5.4; if the leader does not respond or returns an invalid monitoring result, enter S5.3 to start selecting a new leader node; S5.3, same t term All follower nodes are converted into candidate nodes, and vote for other candidate nodes based on the similarity with their own results and execution speed. If the similarity is the same, they are sorted by execution speed; Candidate Node N i For candidate node N j The candidate evaluation score is s ij ∈(1,n), candidate node N j The candidate score S j =∑s ij ; Old leader node N′ L Reconnecting will make it a new follower node, executing tasks but not participating in the leader node selection; S5.

4. The leader node pushes data to the API gateway.

7. A VPT-based distributed Internet asset monitoring method for banking industry according to claim 1, characterized in that: The VPT score includes four indicators: foundation, time, environment and application. The evaluation process includes: S6.

1. Calculate the basic index score V of the component base,k , which is determined by the impact indicator v impact,k and the exploitability index v exp,k Determine; Availability Indicator v exp,k Indicates the difficulty of exploiting asset vulnerabilities. The following is the calculation formula for each score: Calculate the impact index v impact : v impact =6.42*(1-[(1-v C )*(1-v I )*(1-v A )]) Among them, v C , v I and v A They respectively represent the confidentiality, integrity and availability of data security under the influence of asset vulnerabilities, and are divided into three levels: high, medium and low, with the values ​​decreasing in sequence; Calculate the exploitability index v exp,k : v exp,k =8.22*v AV *v AC *v PR *v UI Among them, the network status indicator v AV Characterizing vulnerabilities requires establishing a network adjacency with the target system, which is divided into four levels: Internet link, LAN link, local network link, and physical link, with the values ​​decreasing in sequence; the complexity index v AC Characterizes the complexity of the attack, divided into low and high levels with decreasing values; permission index v PR Indicates the permissions required for use, which can be divided into three levels: no permission requirement, low permission requirement, and high permission requirement; interaction index v UI Indicates whether user interaction is required to exploit the vulnerability. It can be divided into two levels: not required and required. Calculate the basic indicator V base,k : S6.

2. Calculation time index V trmp,k : Among them, the vulnerability exploitability indicator v E It is divided into five levels: undefined, high exploit maturity, exploit code available, only proof-of-concept exploit code exists, and no exploit code available, with the values ​​decreasing in order; the repair solution index v RL It is divided into five levels: undefined, no repair plan, official temporary plan, and official completed repair plan, with the values ​​decreasing in turn; the indicator v that represents the credibility of the vulnerability report RC It is divided into four levels: undefined, confirmed vulnerability, important details published, and vulnerability report exists but details unknown, with values ​​decreasing in descending order; S6.

3. Calculate the environmental index score V env,k , which is determined by the modified impact index v′ impact,k and the modified exploitability index v′ exp,k The following is the calculation formula for each score: Calculate the modified impact index score v′ impact,k : v′ impact,k =6.42*min((1-[(1-v′ C *v CR )*(1-v′ I *v IR )*(1-v′ A *v AR )]),0.915) Among them, the modified confidentiality index v′ C , Modified integrity index v′ I and the modified availability index v′ A The value is the same as v in step S6.3 C , v I and v A Consistent; confidentiality requirement index v CR , completeness requirement index v IR and availability requirement index v AR It represents the degree of confidentiality, integrity and availability of data security required by the enterprise, and is divided into four levels: undefined, high, medium and low, with the values ​​decreasing in descending order; Calculate the modified exploitability index score v′ exp,k : v′ exp,k =8.22*v′ AV *v′ AC *v′ PR *v′ UI Among them, the modified network status index v′ AV , Modified complexity index v′ AC , modify the authority index v′ PR and modified interaction index v′ UI The corresponding indicator value is consistent with that in step 1; Obtained environmental index score V env,k : where v E , v RL , v RC From step S6.2; S6.

4. Confirm the application index score V of component k app , the indicator consists of three parts: V app =V sys *V vul *V dt Among them, the system importance index V sys , used to measure the importance of the application affected by the vulnerability. The larger the index value, the higher the importance. The index value is customized. The previous value index V vul Represents the number of early vulnerabilities of the project team, and confirms the score through horizontal comparison of multiple project teams; project team response index V dt , according to the average processing cycle; S6.

5. The above steps are for a single component or software k of the asset. The VPT value V of the component and software is vpt,k : The asset consists of m different components, and the VPT score of the asset is: V vpt =max(V vpt,k ),k=1,...,m。 8. A system for implementing the method according to any one of claims 1 to 7, characterized in that: The system includes: system service layer, data transmission layer and elastic mapping layer; The system service layer is responsible for asset management, management of monitoring task types, task strategy configuration and task distribution, including cleaning of task monitoring results, data collation for regulatory reporting, reminders of new or abnormal ports, and VPT score evaluation; The data transmission layer is used for forwarding task data of the system service layer and forwarding / temporary storage of data of the distributed scanning engine of the mapping layer, synchronizing the engine vulnerability plug-in and dictionary, and identifying node permissions. The data transmission layer is also used for calling and docking with external platforms, docking component data with the component component analysis platform, obtaining asset risk information from the threat intelligence / security big model platform, and performing data synchronization verification from the external mapping engine; The elastic mapping layer obtains and receives monitoring scanning tasks through the API gateway of the data transmission layer, and manages vulnerability plug-ins, vulnerability verification plug-ins, port scanning plug-ins, subdomain scanning plug-ins, directory scanning plug-ins, self-developed crawler plug-ins, and vulnerability scanning plug-ins; and detects Internet assets by directly obtaining or accessing data platform snapshots. The elastic mapping layer includes four major types of distributed scanning engines: general IT asset scanning engine, mobile asset scanning engine, sensitive information scanning engine, and vulnerability monitoring scanning engine.

9. A VPT-based distributed Internet asset monitoring device for the banking industry, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, a distributed Internet asset monitoring method for the banking industry based on VPT is implemented as described in any one of claims 1-7.

10. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by the processor, a distributed Internet asset monitoring method for the banking industry based on VPT is implemented as described in any one of claims 1-7.

Images