Attack data multi-dimensional analysis method, device, equipment and storage medium

Abstract

The embodiments of the present application provide a multi-dimensional analysis method, device, equipment and storage medium for attack data, and relate to the field of network security technology. For each source address data list, the method performs attack stage mapping corresponding to ATT&CK based on the attack event to obtain the first attack score corresponding to the attack source address, determines the asset category according to the unique asset identifier corresponding to the attack destination address to obtain the second attack score of the attack source address, searches for the attack source address in at least one attack address database to obtain the third attack score of the attack source address; and obtains the analysis result of each attack source address based on the first attack score, the second attack score and the third attack score. To perform a simple attack quantification calculation on the attack source address, and then accurately indicate the risk probability of the attack source address, generate the risk analysis result of the abnormal source address in a relatively short time, respond quickly to potential dangers, reduce the complexity of data processing, and improve the risk processing efficiency of the system.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, equipment and storage medium for multi-dimensional analysis of attack data. Background Art

[0002] The network security data correlation analysis technology in the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) attack scenario aims to extract information from many complex and heterogeneous data sources to make judgments on the network security status. These heterogeneous data sources cover various types of data such as network logs, terminal monitoring logs, and threat intelligence data. Given that the amount of data from heterogeneous data sources in the ATT&CK attack scenario is quite large, and it is mixed with a lot of noise and non-threatening information, the practice of using machine learning methods to conduct big data analysis is becoming increasingly common.

[0003] In related technologies, when faced with complex multi-system and multi-dimensional correlation analysis scenarios, the machine learning process usually involves large-scale data processing and complex calculation processes, which to a certain extent cannot ensure the real-time nature of risk response, resulting in response delays. If the dimensions of data analysis are reduced, although a certain degree of real-time nature can be ensured, the accuracy of the analysis results will be affected. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a method, device, equipment and storage medium for multi-dimensional analysis of attack data, which can improve the real-time response when performing multi-dimensional analysis on attack data.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application proposes a multi-dimensional attack data analysis method, comprising:

[0006] Acquire multiple alarm logs, each of which includes at least an attack source address, an attack destination address, and an attack event;

[0007] Obtaining a source address data list of the attack source address according to at least one alarm log corresponding to each of the attack source addresses;

[0008] For each of the source address data lists, perform attack stage mapping corresponding to ATT&CK based on the attack event, obtain a first attack score corresponding to the attack source address according to the mapping result, determine the asset category according to the unique asset identifier corresponding to the attack destination address, obtain a second attack score of the attack source address based on the asset category, search for the attack source address in at least one attack address database, and obtain a third attack score of the attack source address according to the search result;

[0009] A risk probability of each of the attack source addresses is obtained based on the first attack score, the second attack score, and the third attack score, and an analysis result of the attack source address is obtained according to the risk probability and a preset probability value.

[0010] In some embodiments, performing attack stage mapping corresponding to ATT&CK based on the attack event, and obtaining a first attack score corresponding to the attack source address according to the mapping result, includes:

[0011] Obtain an attack category list corresponding to each attack stage, wherein the attack stage includes at least: a reconnaissance stage, an intrusion stage, a lateral movement stage, and a target execution stage, and the attack category list includes at least one ATT&CK attack type associated with the corresponding attack stage;

[0012] If the attack event is found in the attack category list, mapping the attack event to the attack stage corresponding to the attack category list;

[0013] Obtain the mapping frequency of each attack stage, multiply the mapping frequency by the first risk weight corresponding to the attack stage to obtain the first stage score, and accumulate the first stage scores to obtain the first attack score, the first risk weights corresponding to the reconnaissance stage, the intrusion stage, the lateral movement stage, and the purpose execution stage increase in sequence.

[0014] In some embodiments, determining the asset category according to the unique asset identifier corresponding to the attack destination address, and obtaining the second attack score of the attack source address based on the asset category includes:

[0015] Obtaining the asset device corresponding to the attack destination address in the source address data list, and determining a preset asset category according to the unique asset identifier of the asset device, wherein the asset category includes at least key assets, important assets, secondary assets and other assets;

[0016] Obtain the category frequency of each of the asset categories, multiply the category frequency by the second risk weight corresponding to the asset category to obtain the second stage score, and accumulate the second stage scores to obtain the second attack score, and the second risk weights corresponding to the key assets, the important assets, the secondary assets and the other assets decrease in sequence.

[0017] In some embodiments, the unique asset identifier of the asset device is obtained according to the following steps:

[0018] Acquire multiple types of device information of the asset device, and combine the device information to obtain device asset information, wherein the device information includes at least one of a MAC address, a device serial number, a device type, and a physical location;

[0019] The unique asset identifier is obtained by calculating a hash value of the device asset information.

[0020] In some embodiments, the process of generating the asset category corresponding to the unique asset identifier includes the following steps:

[0021] Obtain at least one value attribute data, at least one attack attribute data and at least one environment attribute data of each of the asset devices, wherein the value attribute data at least includes asset value and business-related quantitative values, the attack attribute data at least includes historical attack frequency and historical attack severity quantitative values, and the environment attribute data at least includes network connection area security quantitative values ​​and connection trust quantitative values;

[0022] Constructing an attribute matrix based on the value attribute data, the attack attribute data and the environment attribute data, and obtaining asset weight values ​​corresponding to the value attribute data, the attack attribute data and the environment attribute data respectively;

[0023] Obtaining the importance index of the asset equipment based on the attribute matrix and the asset weight value;

[0024] According to the matching relationship between the importance index and the judgment threshold range corresponding to the key assets, the important assets, the secondary assets and the other assets, the asset category of the asset equipment is obtained, and the asset category is associated with the corresponding unique asset identifier.

[0025] In some embodiments, searching for the attack source address in at least one attack address database and obtaining a third attack score for the attack source address according to the search result includes:

[0026] Matching the attack source address in at least one attack address database to obtain a corresponding matching hit frequency, wherein the attack address database includes at least one of a threat intelligence database, an external address database, and a proxy address database, wherein the threat intelligence database is used to determine whether the attack source address is a malicious IP address or a phishing site, the external address database is used to determine whether the attack source address is an unauthorized external IP, and the proxy address database is used to determine whether the attack source address is a proxy IP;

[0027] Adjusting the basic address scores corresponding to different attack address databases according to the attack source addresses;

[0028] The third attack score is calculated based on the corresponding matching hit frequency and the basic address score.

[0029] In some embodiments, adjusting the basic address scores corresponding to different attack address databases according to the attack source addresses includes:

[0030] Obtaining initial address scores and additional scores corresponding to different attack address databases;

[0031] If the matching hit frequency of the threat intelligence database is not zero, obtain the first recorded duration and the first recent activity of the attack source address in the threat intelligence database; if the first recorded duration is greater than or equal to the first preset duration, or the first recent activity is greater than or equal to the first preset activity, add the additional score to the initial address score to obtain the basic address score of the threat intelligence database;

[0032] If the matching hit frequency of the external address database is not zero, obtain the second recorded duration and the second recent activity of the attack source address in the external address database, and if the second recorded duration is greater than or equal to the second preset duration, or the second recent activity is greater than or equal to the second preset activity, add the additional score to the initial address score to obtain the basic address score of the external address database;

[0033] If the matching hit frequency of the proxy address database is not zero, the credit rating of the proxy service provider corresponding to the attack source address is obtained. If the credit rating is lower than the preset rating, the additional score is added to the initial address score to obtain the basic address score of the proxy address database.

[0034] In some embodiments, obtaining the risk probability of each of the attack source addresses based on the first attack score, the second attack score, and the third attack score includes:

[0035] Obtaining third risk weights corresponding to the first attack score, the second attack score, and the third attack score respectively;

[0036] Based on the corresponding third risk weight, respectively calculate probability scores corresponding to the first attack score, the second attack score, and the third attack score;

[0037] An index score of the probability score is calculated, and the index score is increased by one and then the inverse is calculated to obtain the risk probability.

[0038] In some embodiments, obtaining the analysis result of the attack source address according to the risk probability and a preset probability threshold includes:

[0039] If the risk probability is less than or equal to the preset probability value, an analysis result indicating a low risk is generated; otherwise, an analysis result indicating a high risk is generated;

[0040] When the analysis result is high risk, an analysis report is generated based on at least the mapping result of the attack event, the asset category of the attack target address, and the search result of the attack address database.

[0041] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a device for multi-dimensional analysis of attack data, comprising:

[0042] Alarm log acquisition module: used to acquire multiple alarm logs, each of which includes at least an attack source address, an attack destination address and an attack event;

[0043] Attack source address data statistics module: used to obtain a source address data list of the attack source address according to at least one alarm log corresponding to each of the attack source addresses;

[0044] Attack score calculation module: for each of the source address data lists, based on the attack event, performing attack stage mapping corresponding to ATT&CK, obtaining a first attack score corresponding to the attack source address according to the mapping result, determining the asset category according to the unique asset identifier corresponding to the attack destination address, obtaining a second attack score of the attack source address based on the asset category, searching for the attack source address in at least one attack address database, and obtaining a third attack score of the attack source address according to the search result;

[0045] Analysis result generating module: used to obtain the risk probability of each attack source address based on the first attack score, the second attack score and the third attack score, and obtain the analysis result of the attack source address according to the risk probability and a preset probability value.

[0046] To achieve the above objectives, a third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0047] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a storage medium, which is a storage medium. The storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0048] The multi-dimensional analysis method, device, equipment and storage medium of attack data proposed in the embodiment of the present application obtains a plurality of alarm logs, and obtains a source address data list of the attack source address according to at least one alarm log corresponding to each attack source address; for each source address data list, the attack stage mapping corresponding to ATT&CK is performed based on the attack event, and the first attack score corresponding to the attack source address is obtained according to the mapping result, the asset category is determined according to the unique asset identifier corresponding to the attack destination address, and the second attack score of the attack source address is obtained based on the asset category, and the attack source address is searched in at least one attack address database, and the third attack score of the attack source address is obtained according to the search result; finally, the risk probability of each attack source address is obtained according to the first attack score, the second attack score and the third attack score, and the analysis result of the attack source address is obtained according to the risk probability and the preset probability value. First of all, in the embodiment of the present application, considering that the amount of data from the heterogeneous data source is quite large, and there is a lot of noise and non-threatening information mixed therein, the attack source address is selected as the analysis focus, which can focus on the information directly related to the attack, filter out most of the non-threatening information and noise, and then accurately locate the potential threat and improve the analysis efficiency. Secondly, the embodiment of the present application mainly conducts a multi-dimensional analysis of the attack source address in the ATT&CK attack scenario, and performs a simple attack quantification calculation on the attack source address based on the attack stage in the ATT&CK attack scenario, the asset category attacked, and the search results of the attack source address in the prior risk database, thereby accurately indicating the risk probability of the attack source address. In this way, the risk analysis results of the abnormal source address can be generated in a short time, and a quick response can be made to potential dangers, thereby minimizing the complexity of data processing and improving the risk processing efficiency of the system. Finally, the embodiment of the present application does not rely on complex model algorithms, and the results of the attack quantification process and the intermediate data can be intuitively displayed. The risk probability obtained has a high degree of interpretability, which can improve the application scope of the analysis results. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a flow chart of the multi-dimensional analysis method of attack data provided in an embodiment of the present application.

[0050] Figure 2 This is a flowchart of performing attack stage mapping corresponding to ATT&CK based on attack events, and obtaining a first attack score corresponding to the attack source address according to the mapping result, provided in an embodiment of the present application.

[0051] Figure 3 This is a flowchart of an embodiment of the present application for determining an asset category according to a unique asset identifier corresponding to an attack target address, and obtaining a second attack score of an attack source address based on the asset category.

[0052] Figure 4 This is the step of obtaining the unique asset identifier of the asset equipment provided in the embodiment of the present application.

[0053] Figure 5 This is a flowchart of generating an asset category corresponding to each unique asset identifier provided in an embodiment of the present application.

[0054] Figure 6 It is a flowchart of searching for an attack source address in at least one attack address database and obtaining a third attack score of the attack source address according to the search result provided by an embodiment of the present application.

[0055] Figure 7 It is a flowchart of adjusting the basic address scores corresponding to different attack address databases according to the attack source addresses provided in an embodiment of the present application.

[0056] Figure 8 It is a flowchart of obtaining the risk probability of each attack source address based on the first attack score, the second attack score and the third attack score provided in an embodiment of the present application.

[0057] Fig. 9 It is an overall principle diagram of the multi-dimensional attack data analysis method provided in the embodiment of the present application.

[0058] Fig.10 It is a structural block diagram of an attack data multi-dimensional analysis device provided by another embodiment of the present application.

[0059] Fig.11 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0061] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0063] The network security data correlation analysis technology in the ATT&CK attack scenario aims to extract information from many complex and heterogeneous data sources to make judgments on the network security status. These heterogeneous data sources cover various types of data such as network logs, terminal monitoring logs, and threat intelligence data. Given that the amount of data from heterogeneous data sources in the ATT&CK attack scenario is quite large, and there is a lot of noise and non-threat information mixed in it, the interference of a large amount of irrelevant information will significantly reduce the accuracy of the correlation analysis results, increase the false alarm rate, and thus affect the effectiveness of security defense.

[0064] In the face of complex multi-system and multi-dimensional correlation analysis scenarios, most related technologies use machine learning methods to conduct big data analysis. However, the machine learning process usually involves large-scale data processing and complex calculation processes, which cannot ensure the real-time nature of risk response to a certain extent, resulting in response delays. For fast-spreading network attacks, delays mean that threats cannot be detected and blocked in a timely manner. If the dimensions of data analysis are reduced, although a certain degree of real-time nature can be ensured, the accuracy of the analysis results will be affected. In addition, the analysis results of the machine learning process often rely on complex algorithms and models, and the interpretability of the threat analysis results generated by them is insufficient. Therefore, when conducting multi-dimensional attack data analysis in the ATT&CK attack scenario, it is necessary to propose a solution that can improve data processing efficiency, enhance real-time response capabilities, and improve the interpretability of threat analysis results.

[0065] Based on this, the embodiment of the present application provides a multi-dimensional analysis method, device, equipment and storage medium for attack data. First, in the embodiment of the present application, considering that the amount of data from heterogeneous data sources is quite large, and there is a lot of noise and non-threatening information mixed therein, the attack source address is selected as the analysis focus, which can focus on the information directly related to the attack, filter out most of the non-threatening information and noise, and then accurately locate the potential threat and improve the analysis efficiency. Secondly, the embodiment of the present application mainly carries out multi-dimensional analysis on the attack source address in the ATT&CK attack scenario, and performs a simple attack quantification calculation on the attack source address according to the attack stage in the ATT&CK attack scenario, the asset category attacked, and the search result of the attack source address in the prior risk database, and then accurately indicates the risk probability of the attack source address. In this way, the risk analysis results of the abnormal source address can be generated in a short time, and a quick response can be made to the potential danger, so as to minimize the complexity of data processing and improve the risk processing efficiency of the system. Finally, the embodiment of the present application does not rely on complex model algorithms, and the results of the attack quantification process and the intermediate data can be intuitively displayed. The obtained risk probability has high interpretability, which can improve the application scope of the analysis results.

[0066] The embodiments of the present application provide a method, apparatus, device and storage medium for multi-dimensional analysis of attack data, which are specifically illustrated by the following embodiments. First, the method for multi-dimensional analysis of attack data in the embodiments of the present application is described.

[0067] The multi-dimensional analysis method of attack data provided in the embodiment of the present application relates to the field of network security technology. The multi-dimensional analysis method of attack data provided in the embodiment of the present application can be applied to a terminal, can also be applied to a server side, and can also be a computer program running in a terminal or a server side. For example, a computer program can be a native program or software module in an operating system; it can be a native application (Application, APP), that is, a program that needs to be installed in the operating system to run, such as a client that supports multi-dimensional analysis of attack data, that is, a program that can be run only by downloading it to a browser environment; it can also be a small program that can be embedded in any APP. In short, the above-mentioned computer program can be an application, module or plug-in in any form. Among them, the terminal communicates with the server through a network. The multi-dimensional analysis method of attack data can be executed by a terminal or a server, or by a terminal and a server in collaboration.

[0068] In some embodiments, the terminal may be a smart phone, tablet computer, laptop computer, desktop computer or smart watch, etc. The server may be an independent server, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms; or a service node in a blockchain system, where each service node in the blockchain system forms a peer-to-peer (P2P) network, and the P2P protocol is an application layer protocol running on the Transmission Control Protocol (TCP) protocol. The terminal and the server may be connected via Bluetooth, Universal Serial Bus (USB) or network communication connection methods, which are not limited in this embodiment.

[0069] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0070] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0071] The following describes a multi-dimensional analysis method for attack data in an embodiment of the present application.

[0072] Figure 1 is an optional flow chart of the multi-dimensional analysis method of attack data provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps 110 to 140. It can also be understood that this embodiment Figure 1 The order of step 110 to step 140 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0073] Step 110: Obtain multiple alarm logs.

[0074] In one embodiment, the alert log is a log file that records data related to attack behaviors of ATT&CK tactics, which is a knowledge base used to describe the tactics, techniques, and steps used by attackers during an attack.

[0075] In the embodiment of the present application, the alarm log is generated based on the data related to the ATT&CK tactics, and the data source can be a security device or security software. Among them, security devices include intrusion detection systems (IDS), intrusion prevention systems (IPS), firewalls, etc. These security devices monitor network traffic and system activities, and once an attack behavior related to the ATT&CK tactics is detected, a corresponding alarm log will be generated. The security software covers endpoint protection software, security information and event management (SIEM) systems, etc. This type of software monitors terminal devices and system logs, and after discovering suspicious activities based on ATT&CK tactics, it will record them and generate an alarm log.

[0076] In one embodiment, the alarm log contains at least the following relevant data: attack source address, attack destination address, source port, destination port, and attack events. Among them, the attack source address is the IP address of the device or network node that initiates the attack. The attack destination address refers to the IP address of the device or system being attacked. The source port refers to the port number used by the initiator of the attack, and different attacks may use specific source ports for communication. For example, some attacks may use common service ports to implement intrusions, such as port 80 of HTTP or port 443 of HTTPS. The destination port refers to the port number attacked on the attacked device, and the information of the destination port can reveal the attacker's target service or application. Attack events refer to specific attack behaviors and characteristics, which may cover information such as the type of attack (such as DDoS attacks, SQL injection attacks, malware infections, etc.), the timestamp of the attack, etc.

[0077] In one embodiment, for multiple alarm logs reported by security devices or security software, data preprocessing is required, and they are formatted according to a standard format to improve the efficiency of subsequent data processing. For example, all reported alarm data within a preset time period are obtained, and the corresponding attack source address, attack destination address, source port, destination port, and attack event information are converted into a standard format, thereby obtaining standardized alarm data corresponding to each alarm data. Next, the standardized alarm data is deduplicated, and standardized alarm data with the same attack source address, attack destination address, source port, destination port, and attack event information are merged into one. Finally, all standardized alarm data obtained after the above processing is used as an alarm log.

[0078] Step 120: Obtain a source address data list of the attack source addresses according to at least one alarm log corresponding to each attack source address.

[0079] In one embodiment, in view of the fact that the amount of data from heterogeneous data sources is quite large and is mixed with a large amount of noise and non-threatening information, in order to improve the efficiency of data analysis, the attack source address is selected as the focus of analysis, thereby filtering out most of the non-threatening information and noise, and focusing on the attack source address to carry out multi-dimensional data association analysis. By analyzing the attack source address, this embodiment can not only track the launch location of the attack and determine the possible scope of the attacker, but also reveal the attack mode and behavior characteristics of different attack source addresses, thereby accurately locating potential threats and improving analysis efficiency. At the same time, targeted security operations can be formulated based on the analysis results. For example, for attack source addresses that frequently launch attacks, measures such as blocking and restricting access can be taken; for attack source addresses of specific types of attacks, firewall rules can be adjusted or specific security protection mechanisms can be deployed to improve the overall network security protection level.

[0080] Therefore, for multiple alarm data, the fields of attack source address are used for classification, and at least one alarm data containing the same attack source address is classified into a source address data list. In this way, the source address data list corresponding to each attack source address is obtained.

[0081] Step 130: For each source address data list, perform attack stage mapping corresponding to ATT&CK based on the attack event, obtain a first attack score corresponding to the attack source address according to the mapping result, determine the asset category according to the unique asset identifier corresponding to the attack destination address, obtain a second attack score for the attack source address based on the asset category, search for the attack source address in at least one attack address database, and obtain a third attack score for the attack source address according to the search result.

[0082] In one embodiment, a multi-dimensional correlation analysis is performed on the attack source address based on the source address data list corresponding to each attack source address. A simple attack quantification calculation is performed on the attack source address based on the attack stage in the ATT&CK attack scenario, the asset category attacked, and the search results of the attack source address in the prior risk database, thereby accurately indicating the risk probability of the attack source address. The attack quantification calculation process is described in detail below.

[0083] In one embodiment, referring to Figure 2 , Figure 2 The embodiment of the present application provides a flowchart of performing attack stage mapping corresponding to ATT&CK based on an attack event, and obtaining a first attack score corresponding to the attack source address according to the mapping result, which specifically includes:

[0084] Step 210: Obtain an attack category list corresponding to each attack stage.

[0085] In one embodiment, the attack phases corresponding to ATT&CK include at least: reconnaissance phase, intrusion phase, lateral movement phase, and purpose execution phase. Each attack phase has a corresponding attack category list, and the attack type list includes at least one ATT&CK attack type associated with the corresponding attack phase. The corresponding attack type list set for the attack phase corresponding to ATT&CK in the embodiment of the present application is shown in Table 1.

[0086]

[0087] Table 1 Attack types in the present embodiment

[0088] It can be seen from Table 1 that in the embodiment of the present application, the attack stage covers the reconnaissance stage, the invasion stage, the lateral movement stage and the target execution stage. In addition, each attack stage includes at least one sub-stage, for example, the invasion stage includes an execution sub-stage and a persistence sub-stage, wherein the execution sub-stage is used to run malicious code, and the persistence sub-stage is used to maintain access rights in the system. Each sub-stage may have at least one corresponding attack type, and all attack types in each attack stage together constitute the corresponding attack category list. For example, the attack type list corresponding to the lateral movement stage can be expressed as: {cross-site request forgery, ARP spoofing, DNS spoofing, brute force cracking, lateral movement}.

[0089] Step 220: If an attack event is found in the attack category list, the attack event is mapped to the attack stage corresponding to the attack category list.

[0090] In one embodiment, in the source address data list, each alarm log corresponds to an attack event. Therefore, for each alarm log, its attack event needs to be searched in all attack type lists. If it can be found, it means that the attack event belongs to the corresponding attack stage. At this time, the attack event can be mapped to the attack stage corresponding to the attack category list.

[0091] For example, referring to Table 1, if the attack event of a certain alarm log is "overflow attack", it can be found in the attack type list corresponding to the intrusion stage {SQL injection, malware, vulnerability exploit, file inclusion vulnerability, code execution, overflow attack, file inclusion}, and then the attack event can be mapped to the "intrusion stage".

[0092] According to the above mapping method, each alarm log in the source address data list is mapped to the corresponding attack stage.

[0093] Step 230: Obtain the mapping frequency of each attack stage, multiply the mapping frequency by the first risk weight corresponding to the attack stage to obtain a first stage score, and accumulate the first stage scores to obtain a first attack score.

[0094] In one embodiment, the number of times the same attack stage is mapped is added together to obtain the mapping frequency of each attack stage. The mapping frequency can reflect the number of alarm data in the source address data list that are divided into each attack stage. For example, for a certain attack source address, the mapping frequencies of its source address data list are: n1 times in the reconnaissance stage, n2 times in the intrusion stage, n3 times in the lateral movement stage, and n4 times in the target execution stage.

[0095] Next, the first risk weights corresponding to the reconnaissance stage, the intrusion stage, the lateral movement stage, and the destination execution stage are obtained. The first risk weights here are used to evaluate the importance of different attack stages in the risk analysis process of the attack source address.

[0096] Given that the attack phases progress in sequence, the further back one goes, the closer the attacker is to achieving the ultimate attack goal, and accordingly, the more complete the attack behavior is.

[0097] For example, the reconnaissance phase is only the initial collection of information about the target by the attacker, such as the target network architecture, open ports, and possible weaknesses. At this stage, the attack has not yet been substantially launched. The intrusion phase indicates that the attacker has found exploitable vulnerabilities and other means, and has begun to try to break through the target's defenses and enter the system. The lateral movement phase means that after the attacker successfully invades, he or she begins to move between different nodes in the target network in order to expand the scope of control and obtain more permissions and resources. By the execution phase, the attacker has basically gained sufficient permissions and began to implement the malicious behavior he or she originally planned, such as stealing confidential data and destroying the system. At this time, the attack behavior is close to completion and the harm caused is often the greatest.

[0098] It is precisely based on the characteristics of the above-mentioned attack stages and the differences in the potential degree of harm they cause to the target, and the fact that the later the attack stage, the higher the completeness of the attack behavior, so in the embodiment of the present application, the first risk weights of different attack stages are set according to the order of the attack stages, and are specifically set to the first risk weights corresponding to the reconnaissance stage, the invasion stage, the lateral movement stage, and the purpose execution stage, which increase in sequence. For example, the first risk weight corresponding to the reconnaissance stage is relatively the smallest, then the weight of the invasion stage is greater than the reconnaissance stage, the weight of the lateral movement stage is higher than the invasion stage, and the weight of the purpose execution stage is the largest. Through such a method of setting weights in a sequentially increasing manner, the embodiment of the present application can highlight the severity of the attack behavior in the later stages when comprehensively evaluating the risk of the attack source address, so that the risk analysis results are more in line with the actual attack situation, which helps to formulate a more reasonable response strategy.

[0099] In one embodiment, after obtaining the mapping frequency and the first risk weight of each attack stage, the mapping frequency is multiplied by the first risk weight corresponding to the attack stage to obtain the first stage score, and the first stage scores are accumulated to obtain the first attack score.

[0100] The first attack score behavior_value is expressed as:

[0101]

[0102] in, represents the mapping frequency corresponding to the i-th attack stage, Represents the first risk weight corresponding to the i-th attack stage.

[0103] The quantitative calculation of the first attack score in the embodiment of the present application provides a quantifiable and standardized way to evaluate the risk of the attack source address. In the field of network security, the attack behavior is complex and diverse, and each stage has different characteristics and influences. It is difficult to accurately grasp the risk level of each attack source address based on subjective judgment alone. Through this quantitative calculation, the abstract risk concept can be converted into a specific value, making the risk analysis of the attack source address more objective and scientific. In addition, analyzing the risk of the attack source address from the dimension of the attack stage can deeply analyze the state of the attack behavior, and then more accurately estimate the damage that may be caused in the future and the current danger level. For example, if a certain attack source address is quantitatively calculated to obtain a high first attack score in the purpose execution stage, it means that this attack source is already extremely dangerous, and it is necessary to immediately take strong countermeasures such as blocking the connection and tracing the source to protect the target system and network security. At the same time, after analyzing many attack source addresses based on this method, they can also be sorted according to the level of risk, reasonably allocate security resources, give priority to high-risk attack source address related situations, and improve the efficiency and effect of overall network security defense.

[0104] Next, we conduct a quantitative analysis of the attack source addresses from the dimension of asset category.

[0105] In one embodiment, referring to Figure 3 , Figure 3 The flowchart of determining the asset category according to the unique asset identifier corresponding to the attack target address and obtaining the second attack score of the attack source address based on the asset category provided by the embodiment of the present application specifically includes the following steps:

[0106] Step 310: Obtain the asset device corresponding to the attack destination address in the source address data list, and determine the preset asset category according to the unique asset identifier of the asset device.

[0107] In one embodiment, the attack destination address in the alarm log corresponds to an asset device, where the asset can be a server, a database, a certain type of network equipment, or other resources that carry important business functions and data, etc. In the embodiment of the present application, each asset device is assigned a unique asset identifier that does not repeat each other, which is similar to the "identity card" of the asset device, and is used to accurately distinguish and identify the asset device.

[0108] In one embodiment, referring to Figure 4 , Figure 4 The steps for obtaining the unique asset identifier of the asset device provided in the embodiment of the present application specifically include the following steps:

[0109] Step 410: Acquire various types of equipment information of asset equipment, and combine the equipment information to obtain equipment asset information.

[0110] Among them, asset equipment corresponds to different equipment, and the equipment information covers at least one of the following: MAC address, equipment serial number, equipment type, and physical location. MAC address is the physical address of the network card of each network device, which is unique. With the help of MAC address, the specific network interface device can be accurately identified. The equipment serial number is the unique number assigned to the equipment by the equipment manufacturer. Its function is to distinguish different equipment individuals of the same type, and usually contains relevant information such as the production batch and model of the equipment. Equipment types include different categories such as databases, servers, routers, terminal computers, printers, etc. Different types of equipment have different functions and uses in the network architecture, and the security risks they face and their positions in the business process are also different. Physical location refers to the actual geographical location of the equipment, such as the specific computer room in a data center, the floor of an office building, etc. The physical location is extremely important for on-site maintenance, security management, and determining whether the equipment is in a safe and controllable environment. By collecting equipment information of these different dimensions, the relevant information of asset equipment can be portrayed from multiple angles.

[0111] Next, after collecting one or more of the above-mentioned types of device information, they need to be spliced ​​and integrated according to certain rules. For example, you can first write the device type in a specific order, then record the device serial number, and then fill in the MAC address and physical location and other information to form a complete description string, which is the device asset information. The embodiment of the present application uses the device asset information to integrate the scattered device information together, fully presenting the comprehensive characteristics of the device assets, so as to facilitate the subsequent generation of a unified unique asset identifier.

[0112] Step 420: Calculate the hash value of the device asset information to obtain a unique asset identifier.

[0113] In one embodiment, a specific hash algorithm is used to calculate the device asset information, and then a hash value of a fixed length is obtained, which is used as a unique asset identifier. Since the hash algorithm is unidirectional, that is, it is difficult to reversely derive the original device asset information based on the hash value. And different device asset information will most likely generate different hash values ​​after calculation (although there is a very small probability of hash collision, this can be avoided as much as possible by reasonably selecting a hash algorithm), so by calculating the hash value of the spliced ​​device asset information, a unique asset identifier can be obtained.

[0114] Next, after obtaining the unique asset identifier corresponding to each asset device, the asset type corresponding to each asset device can be uniquely determined. The asset categories here include at least key assets, important assets, secondary assets and other assets.

[0115] In one embodiment, referring to Figure 5 , Figure 5 This is a flowchart of generating an asset category corresponding to each unique asset identifier provided by an embodiment of the present application, which specifically includes the following steps:

[0116] Step 510: Obtain at least one value attribute data, at least one attack attribute data, and at least one environment attribute data of each asset device.

[0117] In one embodiment, the importance of asset equipment is evaluated from different dimensions, specifically value attributes, attack attributes, and environmental attributes.

[0118] In one embodiment, the value attribute data at least covers two contents: asset value and business-related quantitative value. Among them, the asset value is intended to measure the importance of assets and equipment, and can be quantified from multiple dimensions, such as the purchase cost of assets and equipment, the economic losses caused by damage or loss of assets and equipment, and the supporting role of assets and equipment in business operations. The business-related quantitative value is a quantitative assessment from the perspective of the closeness between assets and equipment and business processes, and the contribution to business continuity. For example, a server is specifically used to carry critical business systems. Once the server goes down, the entire business process cannot be carried out normally, then its business-related quantitative value will be higher; conversely, an ordinary computer that is only used by employees for daily office work has a relatively low business-related quantitative value.

[0119] In one embodiment, the attack attribute data includes at least two parts: historical attack frequency and historical attack severity quantification value. The historical attack frequency here is a statistical count of the number of times the asset device has been attacked in a specific time period in the past. For example, a network server has been detected and scanned dozens of times in the past month. Such a high attack frequency indicates that the asset device may be a target of concern to attackers, and the security risk it faces is relatively high, so it is necessary to strengthen protection measures. The historical attack severity quantification value is an indicator that quantitatively measures the degree of harm of past attacks against the asset device. The impact caused by different types of attacks varies significantly. For example, a simple port scanning attack has a low severity and may only involve the information collection level; if it suffers from situations such as distributed denial of service attacks (DDoS) or data leakage attacks, it will cause serious damage to the availability and confidentiality of the asset device, and the corresponding quantification value will be very high. By quantifying the severity of historical attacks, the embodiment of the present application helps to focus on assets and equipment that have suffered major threats, and then prepare for response in advance.

[0120] In one embodiment, the environmental attribute data includes at least two items: the network connection area security quantification value and the connection trust quantification value. Among them, the network connection area security quantification value is used to quantify the overall security protection level of the network area where the asset equipment is located, which can be specifically reflected in whether the network is equipped with strict access control, whether high-performance firewalls, intrusion detection systems and other security devices are deployed. If the asset equipment is in a network area with complete security protection measures and strict access control, its network connection area security quantification value will be higher, otherwise it will be lower. The connection trust quantification value is mainly related to the trust level assessment of other devices that are connected and interacted with the asset equipment. For example, in the internal office network of an enterprise, the connection trust between the terminal equipment used by employees and the company's server is relatively high; however, if the asset equipment often communicates with network nodes from external unknown sources, its connection trust may be low, and there is a high security risk. By quantifying the connection trust, the potential risk status of the asset environment can be more effectively grasped.

[0121] The embodiment of the present application quantifies the importance of asset equipment through the three dimensions of value attribute data, attack attribute data and environmental attribute data. The specific quantification standard can be set according to actual needs.

[0122] Step 520: construct an attribute matrix based on the value attribute data, the attack attribute data, and the environmental attribute data, and obtain asset weight values ​​corresponding to the value attribute data, the attack attribute data, and the environmental attribute data, respectively.

[0123] In one embodiment, for an asset device, its attribute matrix can be expressed as [asset value, business-related quantitative value, historical attack frequency, historical attack severity quantitative value, network connection area security quantitative value, connection trust quantitative value].

[0124] Next, obtain the asset weight values ​​corresponding to the value attribute data, attack attribute data, and environmental attribute data. In the embodiment of the present application, these asset weight values ​​can be adjusted accordingly according to actual needs. If you need to focus on the attack attribute data, then you can increase the asset weight value corresponding to the attack attribute data; if you need to focus on the value attribute data, then you can increase the asset weight value corresponding to the value attribute data. This embodiment does not limit the specific weight value adjustment method and value range.

[0125] Step 530: Obtain the importance index of the asset equipment based on the attribute matrix and the asset weight value.

[0126] In one embodiment, the matrix values ​​of the same attribute in the attribute matrix are added together, and then the result of the addition is multiplied by the corresponding asset weight value to obtain the corresponding importance index.

[0127] Among them, the importance index is expressed as:

[0128]

[0129] in, represents the importance index of the j-th asset data, represents the weight value of the ith asset, Indicates the first attribute value corresponding to the i-th attribute, Indicates the second attribute value corresponding to the i-th attribute. The order of attributes is: value attribute data, attack attribute data, and environment attribute data.

[0130] Step 540: According to the matching relationship between the importance index and the judgment threshold range corresponding to the key assets, important assets, secondary assets and other assets, the asset category of the asset equipment is obtained, and the asset category is associated with the corresponding unique asset identifier.

[0131] In one embodiment, assets are classified according to their importance into four asset categories: key assets, important assets, secondary assets, and other assets, and each asset category corresponds to a judgment threshold range.

[0132] Then, the importance index is compared with each judgment threshold range. If the importance index falls within a certain judgment threshold range, the asset category corresponding to the asset equipment can be determined. In this way, all asset data are classified, and the unique asset identifier corresponding to the asset data is associated with the asset category obtained by its classification.

[0133] In one embodiment, key assets include application servers, web servers, database servers, and data center servers. These assets and equipment play a vital role in business operations. Once lost or damaged, they will cause significant losses. Important assets include mail servers, identity authentication servers, document servers, etc. These assets and equipment have relatively little impact on the business. If lost or damaged, they usually do not cause serious consequences. Secondary assets include test servers, employee personal computers, etc. These assets have a relatively small impact on the business. Even if lost or damaged, they generally do not cause a direct impact. Other assets may include conventional equipment such as printers.

[0134] Through the above process, the mapping relationship between the unique asset identifier and the asset category can be obtained, and the mapping relationship can be saved so that the search operation can be performed in the subsequent analysis process. In addition, this mapping relationship can be updated regularly.

[0135] Step 320: Obtain the category frequency of each asset category, multiply the category frequency by the second risk weight corresponding to the asset category to obtain a second stage score, and accumulate the second stage scores to obtain a second attack score.

[0136] In one embodiment, according to a mapping process similar to that in the attack phase, for each alarm log in the source address data list, the asset device corresponding to the attack destination address is obtained, and the asset category corresponding to each alarm log is determined based on the mapping relationship between the unique asset identifier of the asset device and the asset category. Then, for each asset category, the number of times it appears in the source address data list is determined as the category frequency.

[0137] Next, the second risk weights corresponding to key assets, important assets, secondary assets and other assets are obtained. The second risk weights here are used to evaluate the importance of different asset categories in the risk analysis process of the attack source address. Specifically, the second risk weights corresponding to key assets, important assets, secondary assets and other assets decrease in sequence.

[0138] In one embodiment, after obtaining the category frequency and the second risk weight of each asset category, the category frequency is multiplied by the second risk weight corresponding to the asset category to obtain a second stage score, and the second stage scores are accumulated to obtain a second attack score.

[0139] The second attack score Attack_value is expressed as:

[0140]

[0141] in, Represents the second risk weight corresponding to the ith asset category.

[0142] In the embodiment of the present application, the attack tendency of the attack source address and the harm it may cause are evaluated by means of the quantitative calculation process of the second attack score. By quantitatively processing the attack target of the attack source address, the attack tendency and harm that were originally relatively vague and difficult to measure intuitively can be converted into specific values, and then the risks brought by each attack source address can be evaluated in a clearer and more objective way. For example, if the second attack score corresponding to an attack source address is quite high, this means that the attack target it points to is often a high-value, critical asset, and it may frequently launch attacks. It can be inferred that the attack source address has a strong attack tendency. Once it successfully implements the attack, the harm it brings to the entire network system and business operations is also great. On the contrary, a lower second attack score indicates that the attack tendency of the attack source address is relatively weak, the importance of its attack target and the frequency of attack are all at a low level, and the potential harm is also small. In short, the quantitative calculation process of the second attack score effectively evaluates the attack target of the attack source address from a specific perspective, which helps to improve the accuracy and effectiveness of network security protection work.

[0143] Next, analyze the attack source address from the third dimension.

[0144] In one embodiment, referring to Figure 6 , Figure 6 The flowchart of searching for an attack source address in at least one attack address database and obtaining a third attack score of the attack source address according to the search result provided by an embodiment of the present application specifically includes the following steps:

[0145] Step 610: Match the attack source address in at least one attack address database to obtain the corresponding matching hit frequency.

[0146] In one embodiment, the attack address database includes at least one of a threat intelligence database, an external address database, and a proxy address database.

[0147] Specifically, the threat intelligence database gathers a large amount of information related to known malicious entities, including malicious IP addresses and phishing sites. When it is necessary to determine whether an attack source address is a malicious IP address or a phishing site, the threat intelligence database can be used to conduct verification.

[0148] The role of the external address database is to determine whether the attack source address is an unauthorized external IP. The database stores information about external IPs that have been authorized to access the internal network. When the attack source address is compared with the database, if it is found that the attack source address is not in the authorized list, it means that the attack source address is an unauthorized external IP, which is likely to be trying to illegally break through the protection of the internal network and then carry out malicious acts such as stealing internal data and destroying internal systems.

[0149] The proxy address database is used to determine whether the attack source address is a proxy IP. When an attack source address matches a record in the proxy address database and is determined to be a proxy IP, it is necessary to further analyze the real intention behind it. This is because attackers may deliberately use proxies to cover up their true sources, thereby increasing the difficulty of tracing the source and conducting attack activities more covertly, such as using proxy IPs for web crawlers and malicious scanning.

[0150] In one embodiment, for each attack source address, it is searched in the above three databases, and if it is hit, the hit frequency is 1, otherwise it is 0. Based on this, the hit frequencies corresponding to the threat intelligence database, external address database, and proxy address database are obtained.

[0151] Step 620: adjusting the basic address scores corresponding to different attack address databases according to the attack source addresses.

[0152] In one embodiment, referring to Figure 7 , Figure 7 This is a flowchart of adjusting the basic address scores corresponding to different attack address databases according to the attack source addresses provided by an embodiment of the present application, which specifically includes the following steps:

[0153] Step 710: Obtain initial address scores and additional scores corresponding to different attack address databases.

[0154] In one embodiment, different attack address databases each correspond to an initial address score. In view of the different emphasis and security requirements of different data analysis scenarios, the initial address score will be determined according to the actual analysis scenario before adjustment. For example, the initial address score corresponding to the threat intelligence database is 30 points, the initial address score corresponding to the external address database is 25 points, and the initial address score corresponding to the proxy address database is 15 points.

[0155] At the same time, each attack address database has an additional score, which can be used to adjust the corresponding score. For example, the additional score of the threat intelligence database is 16 points, the additional score of the external address database is 6 points, and the additional score of the proxy address database is 6 points.

[0156] Step 720: If the matching hit frequency of the threat intelligence database is not zero, obtain the first recorded duration and the first recent activity of the attack source address in the threat intelligence database. If the first recorded duration is greater than or equal to the first preset duration, or the first recent activity is greater than or equal to the first preset activity, add the additional score to the initial address score to obtain the basic address score of the threat intelligence database.

[0157] In one embodiment, for example, the hit frequency of the attack source address in the threat intelligence database is 1. In this case, it is necessary to obtain the first recorded duration and the first recent activity of the attack source address in the threat intelligence database. If the first recorded duration is longer than the first preset duration, or the first recent activity is higher than the first preset activity, it means that the risk of the attack source address is relatively higher, and at this time, it is necessary to assign a higher basic address score to the corresponding threat intelligence database.

[0158] Based on this, the additional score is added to the initial address score to obtain the basic address score of the threat intelligence database, for example, the basic address score is 46 points.

[0159] Step 730: If the matching hit frequency of the external address database is not zero, obtain the second recorded duration and the second recent activity of the attack source address in the external address database. If the second recorded duration is greater than or equal to the second preset duration, or the second recent activity is greater than or equal to the second preset activity, add the additional score to the initial address score to obtain the basic address score of the external address database.

[0160] In one embodiment, similar to the situation of the threat intelligence database, if the hit frequency of the attack source address in the external address database is 1, then in this case, it is necessary to obtain the second recorded duration and the second recent activity of the attack source address in the external address database. If the second recorded duration is longer than the second preset duration, or the second recent activity is higher than the second preset activity, this means that the risk of the attack source address is relatively higher, and at this time, it is necessary to assign a higher basic address score to the corresponding external address database.

[0161] Based on this, the additional score is added to the initial address score to obtain the basic address score of the external address database, for example, the basic address score is 31 points.

[0162] Step 740: If the matching hit frequency of the proxy address database is not zero, obtain the credit rating of the proxy service provider corresponding to the attack source address. If the credit rating is lower than the preset rating, add the additional score to the initial address score to obtain the basic address score of the proxy address database.

[0163] In one embodiment, considering that the proxy service may be used in normal network behavior, and different proxy service providers often have high credit ratings and usually provide regular commercial proxy services, it can be considered that the risk of the attack source address is low in this dimension, so the initial address score is directly used as the basic address score.

[0164] However, if the credit rating of the proxy service provider corresponding to the attack source address is lower than the preset level, it means that the risk of the proxy service provider is higher. At this time, the additional score needs to be added to the initial address score to obtain the basic address score of the proxy address database.

[0165] With the help of the above process, the embodiment of the present application can dynamically and adaptively adjust the basic address scores of different attack source addresses in the analysis dimension of the matching results of the prior risk database, thereby achieving more accurate risk assessment.

[0166] Step 630: Calculate a third attack score based on the corresponding matching hit frequency and the basic address score.

[0167] In one embodiment, for each attack address database, the product of the corresponding matching hit frequency and the basic address score is calculated, and the third attack score is obtained after accumulation.

[0168] The third attack score IP_value is expressed as:

[0169]

[0170] in, represents the matching hit frequency of the i-th address database, Indicates the basic address score of the i-th address database. The order of address databases is: threat intelligence database, external address database, and proxy address database.

[0171] In addition, a whitelist address database may be set up. If the attack source address appears in the whitelist database, the calculation process of the third attack score is directly skipped.

[0172] In one embodiment, according to the above process, the first attack score, the second attack score and the third attack score corresponding to the attack source address can be obtained. They reflect the relevant characteristics of the attack source address from different angles, such as the risk situation presented from the attack stage level (corresponding to the first attack score), the attack tendency and harmfulness reflected from the perspective of the attack target (corresponding to the second attack score), and the relevant risk level obtained based on different attack address databases (corresponding to the third attack score). However, since the calculation basis and value range of these scores are different, if they are directly compared or comprehensively analyzed, it will affect the calculation efficiency. Therefore, normalization processing is performed on the first attack score, the second attack score and the third attack score, and these scores from different dimensions are unified under a common standard scale. Normalization processing can be performed by linear normalization and other methods. This embodiment does not limit the specific normalization method.

[0173] Step 140: Obtain a risk probability of each attack source address based on the first attack score, the second attack score, and the third attack score, and obtain an analysis result of the attack source address according to the risk probability and a preset probability value.

[0174] In one embodiment, referring to Figure 8 , Figure 8 This is a flow chart of obtaining the risk probability of each attack source address based on the first attack score, the second attack score, and the third attack score provided in an embodiment of the present application, which specifically includes the following steps:

[0175] Step 810: Obtain third risk weights corresponding to the first attack score, the second attack score, and the third attack score, respectively.

[0176] Step 820: Based on the corresponding third risk weight, respectively calculate the probability scores corresponding to the first attack score, the second attack score, and the third attack score.

[0177] Step 830: Calculate the index score of the probability score, and add one to the index score and then calculate the inverse to obtain the risk probability.

[0178] In one embodiment, different weights are still set for the three dimensions according to their importance, and the third risk weights corresponding to the first attack score, the second attack score, and the third attack score are obtained. Then the attack scores are multiplied by the corresponding third risk weights, and the multiplication results are accumulated to obtain the probability score. Then the probability score is calculated to calculate the index score, and the index score is added by one and the inverse is calculated to obtain the risk probability.

[0179] The risk probability P is expressed as:

[0180]

[0181]

[0182] in, , , Respectively represent the third risk weights corresponding to the first attack score, the second attack score and the third attack score, represents the probability score, Represents the index score.

[0183] Next, the analysis result of the attack source address is determined based on the risk probability and the preset probability value. Specifically, if the risk probability is less than or equal to the preset probability value, then an analysis result indicating low risk is generated; conversely, if the risk probability is greater than the preset probability value, then an analysis result indicating high risk is generated. When the analysis result is high risk, an analysis report must be generated based on at least the mapping result of the attack event, the asset category of the attack destination address, and the search result of the attack address database. Assume that the preset probability value is ,if , an analysis result indicating low risk is generated. , an analysis result indicating high risk is generated.

[0184] If it is a high risk, it means that the attack source address needs further analysis. At this time, the mapping results of the attack event, the asset category of the attack destination address, and the search results of the attack address database are displayed to make the analysis results explainable.

[0185] In one embodiment, an example of high-risk analysis results is shown in Table 2 below.

[0186]

[0187] Table 2 Examples of high-risk analysis results

[0188] It is understandable that high-risk analysis results can include not only the mapping results of attack events, the asset categories of attack target addresses, and the search results of attack address databases, but also other data can be displayed according to actual needs to improve the interpretability of the results. At the same time, it can also improve analysis efficiency and accuracy.

[0189] As can be seen from the above, more weight settings are used in the embodiments of the present application. The weights set here for different analysis dimensions can be flexibly set according to actual needs. The overall calculation process used is mostly multiplication and addition operations. Compared with the method of using machine learning algorithms to carry out multidimensional analysis, its complexity is reduced as much as possible, and thus has a higher calculation efficiency. Compared with the analysis process of a single dimension, the analysis accuracy of the embodiment of the present application is higher. Moreover, the embodiment of the present application also provides integration algorithms for three dimensions respectively, through which the relevant factors can be quantified as a first attack score, a second attack score and a third attack score. Finally, the first attack score, the second attack score and the third attack score are analyzed as a whole by using the risk probability method. In this way, the analysis results obtained are not only more accurate, but also can reflect more information.

[0190] In one embodiment, referring to Fig. 9 , Fig. 9 It is an overall principle diagram of the attack data multi-dimensional analysis method provided by the embodiment of the present application. In the embodiment of the present application, the source address data list of the attack source address is obtained according to at least one alarm log corresponding to each attack source address.

[0191] For each source address data list, firstly, the attack stage data is fused, and the attack stage mapping operation corresponding to ATT&CK is carried out based on the attack event, and then the first attack score corresponding to the attack source address is determined based on the mapping result. It should be noted that the attack stage corresponding to ATT&CK covers the reconnaissance stage, the intrusion stage, the lateral movement stage and the purpose execution stage. Subsequently, the asset category data is fused, and the asset category is clarified according to the unique asset identifier corresponding to the attack destination address, and the second attack score of the attack source address is calculated based on the asset category. In this process, the asset category includes key assets, important assets, secondary assets and other assets. Then, the attack address data is fused, and the attack source address is searched in at least one attack address database, and the attack address database includes at least one of the threat intelligence database, the external address database and the proxy address database, and then the third attack score of the attack source address is determined based on the search result. Finally, the risk probability of each attack source address is calculated by combining the first attack score, the second attack score and the third attack score, and then the analysis result of the attack source address is determined based on the risk probability and the preset probability value.

[0192] The embodiment of the present application performs attack behavior analysis based on the ATT&CK framework, directly corresponds the attack behavior to the attack stage in the ATT&CK framework based on the alarm log of the device, quantifies it into a first attack score according to the attack stage, and uses the first attack score to map different risk levels, such as low risk, medium risk, high risk, and severe four levels, forming a standardized attack identification and classification mechanism. At the same time, a multi-dimensional analysis is performed on the attack source address, which can quickly analyze and evaluate a large amount of abnormal IP data, generate analysis results of the risk level of abnormal IP in a short time, effectively reduce the complexity of data processing, improve the processing efficiency of the system to deal with a large number of abnormal IPs, enable the system to respond quickly to potential threats in a timely manner, avoid missing the opportunity to prevent attacks due to processing delays, and thus enhance the real-time defense capability against network attacks. And the correlation between abnormal IP and known security events, the severity of the attack behavior, the importance of the attack target, and the historical information of the attacker are comprehensively considered to ensure the rationality and accuracy of the evaluation process. In addition, the unique asset identifier is used to uniquely determine the attacked asset, and the corresponding asset category can be accurately identified, and the attack target can be accurately identified and classified.

[0193] The technical solution provided by the embodiment of the present application, firstly, in the embodiment of the present application, considering that the amount of data from heterogeneous data sources is quite large, and there are a lot of noise and non-threatening information in it, the attack source address is selected as the analysis focus, which can focus on the information directly related to the attack, filter out most of the non-threatening information and noise, and then accurately locate the potential threat and improve the analysis efficiency. Secondly, the embodiment of the present application mainly carries out multi-dimensional analysis on the attack source address in the ATT&CK attack scenario, and performs a simple attack quantification calculation on the attack source address according to the attack stage in the ATT&CK attack scenario, the asset category attacked, and the search results of the attack source address in the prior risk database, and then accurately indicates the risk probability of the attack source address. In this way, the risk analysis results of the abnormal source address can be generated in a short time, and a quick response can be made to potential dangers, which can minimize the complexity of data processing and improve the risk processing efficiency of the system. Finally, the embodiment of the present application does not rely on complex model algorithms, and the results of the attack quantification process and the intermediate data can be intuitively displayed. The risk probability obtained has a high interpretability, clearly shows the basis of the analysis, and can improve the application scope of the analysis results.

[0194] The present application also provides a device for multi-dimensional analysis of attack data, which can implement the above-mentioned multi-dimensional analysis method of attack data. Fig.10 , the device comprises:

[0195] The alarm log acquisition module 1010 is used to acquire multiple alarm logs, each of which includes at least an attack source address, an attack destination address and an attack event.

[0196] Attack source address data statistics module 1020: used to obtain a source address data list of the attack source address according to at least one alarm log corresponding to each attack source address.

[0197] Attack score calculation module 1030: used to perform attack stage mapping corresponding to ATT&CK based on the attack event for each source address data list, obtain a first attack score corresponding to the attack source address according to the mapping result, determine the asset category according to the unique asset identifier corresponding to the attack destination address, obtain a second attack score of the attack source address based on the asset category, search for the attack source address in at least one attack address database, and obtain a third attack score of the attack source address according to the search result.

[0198] Analysis result generating module 1040: used to obtain the risk probability of each attack source address based on the first attack score, the second attack score and the third attack score, and obtain the analysis result of the attack source address according to the risk probability and the preset probability value.

[0199] The specific implementation of the attack data multi-dimensional analysis device of this embodiment is basically the same as the specific implementation of the attack data multi-dimensional analysis method described above, and will not be repeated here.

[0200] The present application also provides an electronic device, including:

[0201] at least one memory;

[0202] at least one processor;

[0203] at least one program;

[0204] The program is stored in the memory, and the processor executes the at least one program to implement the multi-dimensional attack data analysis method implemented in the present application. The electronic device can be any intelligent terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), a car computer, etc.

[0205] See also Fig.11 , Fig.11 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0206] The processor 1101 may be implemented by a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0207] The memory 1102 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1102 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1102, and the processor 1101 calls and executes the attack data multi-dimensional analysis method of the embodiment of this application;

[0208] Input / output interface 1103, used to implement information input and output;

[0209] Communication interface 1104, used to realize communication interaction between the device and other devices, which can be realized by wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.); and

[0210] A bus 1105 that transmits information between various components of the device (e.g., the processor 1101, the memory 1102, the input / output interface 1103, and the communication interface 1104);

[0211] The processor 1101 , the memory 1102 , the input / output interface 1103 and the communication interface 1104 are connected to each other in communication within the device via the bus 1105 .

[0212] An embodiment of the present application further provides a storage medium, which is a storage medium storing a computer program. When the computer program is executed by a processor, the above-mentioned multi-dimensional analysis method of attack data is implemented.

[0213] As a non-transitory storage medium, the memory can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0214] The multi-dimensional analysis method, device, equipment and storage medium of attack data proposed in the embodiment of the present application obtains a plurality of alarm logs, and obtains a source address data list of the attack source address according to at least one alarm log corresponding to each attack source address; for each source address data list, the attack stage mapping corresponding to ATT&CK is performed based on the attack event, and the first attack score corresponding to the attack source address is obtained according to the mapping result, the asset category is determined according to the unique asset identifier corresponding to the attack destination address, and the second attack score of the attack source address is obtained based on the asset category, and the attack source address is searched in at least one attack address database, and the third attack score of the attack source address is obtained according to the search result; finally, the risk probability of each attack source address is obtained according to the first attack score, the second attack score and the third attack score, and the analysis result of the attack source address is obtained according to the risk probability and the preset probability value. First of all, in the embodiment of the present application, considering that the amount of data from the heterogeneous data source is quite large, and there is a lot of noise and non-threatening information mixed therein, the attack source address is selected as the analysis focus, which can focus on the information directly related to the attack, filter out most of the non-threatening information and noise, and then accurately locate the potential threat and improve the analysis efficiency. Secondly, the embodiment of the present application mainly conducts a multi-dimensional analysis of the attack source address in the ATT&CK attack scenario, and performs a simple attack quantification calculation on the attack source address based on the attack stage in the ATT&CK attack scenario, the asset category attacked, and the search results of the attack source address in the prior risk database, thereby accurately indicating the risk probability of the attack source address. In this way, the risk analysis results of the abnormal source address can be generated in a short time, and a quick response can be made to potential dangers, thereby minimizing the complexity of data processing and improving the risk processing efficiency of the system. Finally, the embodiment of the present application does not rely on complex model algorithms, and the results of the attack quantification process and the intermediate data can be intuitively displayed. The risk probability obtained has a high degree of interpretability, which can improve the application scope of the analysis results.

[0215] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0216] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0217] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0218] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0219] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0220] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0221] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0222] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0223] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0224] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store programs.

[0225] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A multi-dimensional analysis method for attack data, characterized in that: include: Acquire multiple alarm logs, each of which includes at least an attack source address, an attack destination address, and an attack event; Obtaining a source address data list of the attack source address according to at least one alarm log corresponding to each of the attack source addresses; For each of the source address data lists, perform attack stage mapping corresponding to ATT&CK based on the attack event, obtain a first attack score corresponding to the attack source address according to the mapping result, determine the asset category according to the unique asset identifier corresponding to the attack destination address, obtain a second attack score of the attack source address based on the asset category, search for the attack source address in at least one attack address database, and obtain a third attack score of the attack source address according to the search result; Obtaining a risk probability of each of the attack source addresses based on the first attack score, the second attack score, and the third attack score, and obtaining an analysis result of the attack source addresses according to the risk probability and a preset probability value; The step of searching for the attack source address in at least one attack address database and obtaining a third attack score of the attack source address according to the search result includes: Matching the attack source address in at least one attack address database to obtain a corresponding matching hit frequency, wherein the attack address database includes at least one of a threat intelligence database, an external address database, and a proxy address database, wherein the threat intelligence database is used to determine whether the attack source address is a malicious IP address or a phishing site, the external address database is used to determine whether the attack source address is an unauthorized external IP, and the proxy address database is used to determine whether the attack source address is a proxy IP; Adjusting the basic address scores corresponding to different attack address databases according to the attack source addresses; The third attack score is calculated according to the corresponding matching hit frequency and the basic address score; The adjusting the basic address scores corresponding to different attack address databases according to the attack source addresses includes: Obtaining initial address scores and additional scores corresponding to different attack address databases; If the matching hit frequency of the threat intelligence database is not zero, obtain the first recorded duration and the first recent activity of the attack source address in the threat intelligence database; if the first recorded duration is greater than or equal to the first preset duration, or the first recent activity is greater than or equal to the first preset activity, add the additional score to the initial address score to obtain the basic address score of the threat intelligence database; If the matching hit frequency of the external address database is not zero, obtain the second recorded duration and the second recent activity of the attack source address in the external address database, and if the second recorded duration is greater than or equal to the second preset duration, or the second recent activity is greater than or equal to the second preset activity, add the additional score to the initial address score to obtain the basic address score of the external address database; If the matching hit frequency of the proxy address database is not zero, the credit rating of the proxy service provider corresponding to the attack source address is obtained. If the credit rating is lower than the preset rating, the additional score is added to the initial address score to obtain the basic address score of the proxy address database.

2. The attack data multi-dimensional analysis method according to claim 1, characterized in that: The performing attack stage mapping corresponding to ATT&CK based on the attack event, and obtaining a first attack score corresponding to the attack source address according to the mapping result, includes: Obtain an attack category list corresponding to each attack stage, wherein the attack stage includes at least: a reconnaissance stage, an intrusion stage, a lateral movement stage, and a target execution stage, and the attack category list includes at least one ATT&CK attack type associated with the corresponding attack stage; If the attack event is found in the attack category list, mapping the attack event to the attack stage corresponding to the attack category list; Obtain the mapping frequency of each attack stage, multiply the mapping frequency by the first risk weight corresponding to the attack stage to obtain the first stage score, and accumulate the first stage scores to obtain the first attack score, the first risk weights corresponding to the reconnaissance stage, the intrusion stage, the lateral movement stage, and the purpose execution stage increase in sequence.

3. The attack data multi-dimensional analysis method according to claim 1, characterized in that: The determining the asset category according to the unique asset identifier corresponding to the attack destination address, and obtaining the second attack score of the attack source address based on the asset category, includes: Obtaining the asset device corresponding to the attack destination address in the source address data list, and determining a preset asset category according to the unique asset identifier of the asset device, wherein the asset category includes at least key assets, important assets, secondary assets and other assets; Obtain the category frequency of each of the asset categories, multiply the category frequency by the second risk weight corresponding to the asset category to obtain the second stage score, and accumulate the second stage scores to obtain the second attack score, and the second risk weights corresponding to the key assets, the important assets, the secondary assets and the other assets decrease in sequence.

4. The attack data multi-dimensional analysis method according to claim 3 is characterized in that: The unique asset identification of the asset equipment is obtained according to the following steps: Acquire multiple types of device information of the asset device, and combine the device information to obtain device asset information, wherein the device information includes at least one of a MAC address, a device serial number, a device type, and a physical location; The unique asset identifier is obtained by calculating a hash value of the device asset information.

5. The attack data multi-dimensional analysis method according to claim 4, characterized in that: The process of generating the asset category corresponding to the unique asset identifier includes the following steps: Obtain at least one value attribute data, at least one attack attribute data and at least one environment attribute data of each of the asset devices, wherein the value attribute data at least includes asset value and business-related quantitative values, the attack attribute data at least includes historical attack frequency and historical attack severity quantitative values, and the environment attribute data at least includes network connection area security quantitative values ​​and connection trust quantitative values; Constructing an attribute matrix based on the value attribute data, the attack attribute data and the environment attribute data, and obtaining asset weight values ​​corresponding to the value attribute data, the attack attribute data and the environment attribute data respectively; Obtaining the importance index of the asset equipment based on the attribute matrix and the asset weight value; According to the matching relationship between the importance index and the judgment threshold range corresponding to the key assets, the important assets, the secondary assets and the other assets, the asset category of the asset equipment is obtained, and the asset category is associated with the corresponding unique asset identifier.

6. The attack data multi-dimensional analysis method according to claim 1, characterized in that: The obtaining the risk probability of each attack source address based on the first attack score, the second attack score, and the third attack score includes: Obtaining third risk weights corresponding to the first attack score, the second attack score, and the third attack score respectively; Based on the corresponding third risk weight, respectively calculate probability scores corresponding to the first attack score, the second attack score, and the third attack score; An index score of the probability score is calculated, and the index score is increased by one and then the inverse is calculated to obtain the risk probability.

7. The attack data multi-dimensional analysis method according to any one of claims 1 to 6, characterized in that: The analyzing result of obtaining the attack source address according to the risk probability and the preset probability threshold comprises: If the risk probability is less than or equal to the preset probability value, an analysis result indicating a low risk is generated; otherwise, an analysis result indicating a high risk is generated; When the analysis result is high risk, an analysis report is generated based on at least the mapping result of the attack event, the asset category of the attack target address, and the search result of the attack address database.

8. A device for multi-dimensional analysis of attack data, characterized in that: include: Alarm log acquisition module: used to acquire multiple alarm logs, each of which includes at least an attack source address, an attack destination address and an attack event; Attack source address data statistics module: used to obtain a source address data list of the attack source address according to at least one alarm log corresponding to each of the attack source addresses; Attack score calculation module: for each of the source address data lists, based on the attack event, performing attack stage mapping corresponding to ATT&CK, obtaining a first attack score corresponding to the attack source address according to the mapping result, determining the asset category according to the unique asset identifier corresponding to the attack destination address, obtaining a second attack score of the attack source address based on the asset category, searching for the attack source address in at least one attack address database, and obtaining a third attack score of the attack source address according to the search result; An analysis result generating module: used to obtain a risk probability of each of the attack source addresses based on the first attack score, the second attack score and the third attack score, and obtain an analysis result of the attack source address according to the risk probability and a preset probability value; The step of searching for the attack source address in at least one attack address database and obtaining a third attack score of the attack source address according to the search result includes: Matching the attack source address in at least one attack address database to obtain a corresponding matching hit frequency, wherein the attack address database includes at least one of a threat intelligence database, an external address database, and a proxy address database, wherein the threat intelligence database is used to determine whether the attack source address is a malicious IP address or a phishing site, the external address database is used to determine whether the attack source address is an unauthorized external IP, and the proxy address database is used to determine whether the attack source address is a proxy IP; Adjusting the basic address scores corresponding to different attack address databases according to the attack source addresses; The third attack score is calculated according to the corresponding matching hit frequency and the basic address score; The adjusting the basic address scores corresponding to different attack address databases according to the attack source addresses includes: Obtaining initial address scores and additional scores corresponding to different attack address databases; If the matching hit frequency of the threat intelligence database is not zero, obtain the first recorded duration and the first recent activity of the attack source address in the threat intelligence database; if the first recorded duration is greater than or equal to the first preset duration, or the first recent activity is greater than or equal to the first preset activity, add the additional score to the initial address score to obtain the basic address score of the threat intelligence database; If the matching hit frequency of the external address database is not zero, obtain the second recorded duration and the second recent activity of the attack source address in the external address database, and if the second recorded duration is greater than or equal to the second preset duration, or the second recent activity is greater than or equal to the second preset activity, add the additional score to the initial address score to obtain the basic address score of the external address database; If the matching hit frequency of the proxy address database is not zero, the credit rating of the proxy service provider corresponding to the attack source address is obtained. If the credit rating is lower than the preset rating, the additional score is added to the initial address score to obtain the basic address score of the proxy address database.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the multi-dimensional attack data analysis method according to any one of claims 1 to 7 when executing the computer program.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the attack data multi-dimensional analysis method according to any one of claims 1 to 7 is implemented.

Images