Blacklist management method, electronic equipment and readable storage medium

Abstract

The invention provides a blacklist management method, electronic equipment and a readable storage medium. The method comprises the following steps: acquiring to-be-monitored data; extracting key data fields from the to-be-monitored data and integrating the key data fields to obtain structured data corresponding to the to-be-monitored data; a pre-constructed blacklist data model is adopted to analyze the structured data corresponding to the to-be-monitored data so as to judge whether threats exist in an IP address, a user or equipment corresponding to the to-be-monitored data, and the blacklist data model comprises an IP address threat detection rule, a user threat detection rule and an equipment threat detection rule; and dynamically adding the IP address, the user or the equipment with the threat into the blacklist. According to the method and the system, the IP address, the user and the equipment with threats can be dynamically managed to prevent hostile attacks and bad behaviors, and dynamic updating and efficient management of the blacklist can be realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a blacklist management method, electronic equipment and a readable storage medium. Background Art

[0002] With the rapid development of the Internet, the risks of network attacks, malicious access and data leakage are increasing. Although traditional firewalls and security devices can intercept known threats to a certain extent, the traditional blacklist management method has problems such as untimely updates, single data sources, and inability to dynamically adjust, resulting in insufficient security protection capabilities. In order to improve network security, it is particularly important to establish a dynamic and intelligent blacklist management mechanism. At present, the management of blacklists mainly relies on manual maintenance or screening through static rules, lacking automation and intelligent means. The shortcoming of existing technologies is that they cannot quickly respond to and handle emerging threats, resulting in poor network security protection effects.

[0003] It should be noted that the information disclosed in the background technology section of the invention is only intended to deepen the understanding of the general background technology of the invention, and should not be regarded as an admission or suggestion in any form that the information constitutes prior art already known to those skilled in the art. Summary of the invention

[0004] The purpose of the present invention is to provide a blacklist management method, an electronic device and a readable storage medium, which can not only dynamically manage threatening IP addresses, users and devices to prevent malicious attacks and bad behaviors, but also realize dynamic updating and efficient management of the blacklist, and effectively solve the problem that the blacklist cannot be dynamically adjusted in the prior art.

[0005] To achieve the above-mentioned purpose, the present invention provides a blacklist management method, which includes: obtaining data to be monitored; extracting key data fields from the data to be monitored and integrating them to obtain structured data corresponding to the data to be monitored; using a pre-built blacklist data model to analyze the structured data corresponding to the data to be monitored to determine whether the IP address, user or device corresponding to the data to be monitored is threatening, wherein the blacklist data model includes IP address threat detection rules, user threat detection rules and device threat detection rules; dynamically adding threatening IP addresses, users or devices to the blacklist.

[0006] Optionally, the IP address threat detection rule includes the following IP address threat detection sub-rules: for any external IP address, if the number of attacks on the external IP address is greater than a first preset number and the attack vulnerability level of the external IP address is higher than or equal to the first preset vulnerability level, the external IP address is determined to be a threat; for any external IP address, if the number of internal company IP addresses accessed by the external IP address within a first preset time window is greater than a first preset number, the external IP address is determined to be a threat; for any external IP address, if the external IP address logs into the company's internal system and the number of incorrect user password inputs within a second preset time window is greater than a second preset number, the external IP address is determined to be a threat; for any external IP address, if the number of port scan requests initiated by the external IP address to the company's internal IP address within a third preset time window is greater than a third preset number, the external IP address is determined to be a threat; for any external IP address, if the external IP address attempts If the external IP address communicates with the company's internal IP address through multiple network protocols with known high-risk security vulnerabilities, the external IP address is determined to be a threat; for any external IP address, if the number of unauthorized access attempts to the external IP address within a fourth preset time window is greater than the fourth preset number, the external IP address is determined to be a threat; for any external IP address, if the traffic data from the external IP address contains the propagation characteristics of known malicious behavior and the number of malicious behavior propagation characteristic detections within a fifth preset time window is greater than the fifth preset number, the external IP address is determined to be a threat; for any external IP address, if the external IP address is marked as malicious by at least a second preset number of security vendors, the external IP address is determined to be a threat; for any external IP address, if the attack vulnerability type of the external IP address is not recorded in the historical database corresponding to the blacklist data model and the attack vulnerability level of the external IP address is higher than the second preset vulnerability level, the external IP address is determined to be a threat.

[0007] Optionally, the user threat detection rule includes the following user threat detection sub-rules: for any user account, if the user account performs an abnormal operation that does not conform to the historical behavior pattern, it is determined that the user account and / or the IP address when the user account performs the abnormal operation is under threat; for any user account, if the user account repeatedly attempts to log in between multiple different IP addresses and performs suspicious activities, it is determined that the user account is under threat; for any user account, if the number of failed logins of the user account within a sixth preset time window is greater than a sixth preset number, it is determined that the user account is under threat; for any user account, if the login frequency of the user account is greater than the preset frequency, it is determined that the user account is under threat.

[0008] Optionally, the device threat detection rule includes the following device threat detection sub-rules: for any device, if the MAC address of the device is detected to be associated with multiple different IP addresses within the seventh preset time window, and at least one of these IP addresses has suspicious activity, the device is determined to be a threat; for any device, if the device repeatedly attacks multiple different Wi-Fi access points of the company's internal network, the device is determined to be a threat; for any device, if the device repeatedly attacks an internal server and the attack method hits a vulnerability in the internal server, the device is determined to be a threat.

[0009] Optionally, the blacklist management method provided by the present invention further includes: blocking operations of IP addresses, users or devices in the blacklist according to a preset firewall policy.

[0010] Optionally, the blacklist management method provided by the present invention also includes: storing the blacklist through a data window and displaying it through a graphical interface, so that the administrator can perform at least one of adding, deleting, modifying and searching operations on the blacklist through the graphical interface.

[0011] Optionally, the blacklist management method provided by the present invention further includes: regularly generating a corresponding analysis report based on the blacklist, wherein the analysis report includes at least one of total number of blacklist entries, classification information of blacklist entries, and change trend information of blacklist entries.

[0012] Optionally, the blacklist management method provided by the present invention further includes: dynamically updating the blacklist according to the verification result of the threat intelligence center.

[0013] To achieve the above object, the present invention further provides an electronic device, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the blacklist management method described above is implemented.

[0014] To achieve the above object, the present invention further provides a readable storage medium, wherein the readable storage medium stores a computer program, and when the computer program is executed by a processor, the blacklist management method described above is implemented.

[0015] Compared with the prior art, the blacklist management method, electronic device and readable storage medium provided by the present invention have the following beneficial effects: the blacklist management method provided by the present invention first obtains the data to be monitored; then extracts key data fields from the data to be monitored and integrates them to obtain structured data corresponding to the data to be monitored; then uses a pre-constructed blacklist data model including IP address threat detection rules, user threat detection rules and device threat detection rules to analyze the structured data corresponding to the data to be monitored to determine whether the IP address, user or device corresponding to the data to be monitored is threatening; finally, the threatening IP address, user or device is dynamically added to the blacklist. It can be seen that by adopting the blacklist management method provided by the present invention, not only can the threatening IP addresses, users and devices be dynamically managed to prevent malicious attacks and bad behaviors and effectively improve the security of the network, but also the dynamic update and efficient management of the blacklist can be realized, effectively solving the problem that the blacklist cannot be dynamically adjusted in the prior art, and the need for manual intervention can be significantly reduced.

[0016] Since the electronic device and the readable storage medium provided by the present invention belong to the same inventive concept as the blacklist management method provided by the present invention, the electronic device and the readable storage medium provided by the present invention at least have all the beneficial effects of the blacklist management method provided by the present invention. For details, please refer to the relevant description of the beneficial effects of the blacklist management method provided by the present invention in the above text. Therefore, the beneficial effects of the electronic device and the readable storage medium provided by the present invention will not be described one by one here. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of a blacklist management method provided by one embodiment of the present invention.

[0018] Figure 2 A schematic diagram of the block structure of an electronic device provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0019] The blacklist management method, electronic device and readable storage medium proposed in the present invention are further described in detail below in conjunction with the accompanying drawings and specific implementation methods. According to the following description, the advantages and features of the present invention will be clearer. It should be noted that the drawings are in a very simplified form and use non-precise proportions, which are only used to conveniently and clearly assist in explaining the purpose of the present invention. In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, please refer to the accompanying drawings. It should be noted that the structure, proportion, size, etc. illustrated in the drawings of this specification are only used to match the content disclosed in the specification, so that people familiar with this technology can understand and read, and are not used to limit the limiting conditions for the implementation of the present invention. Any modification of the structure, change in the proportional relationship or adjustment of the size, when the effect that the present invention can produce and the purpose that can be achieved are the same or similar, should still fall within the scope of the technical content disclosed in the present invention.

[0020] The core idea of ​​the present invention is to provide a blacklist management method, an electronic device and a readable storage medium, which can not only dynamically manage threatening IP (Internet Protocol) addresses, users and devices to prevent malicious attacks and bad behaviors, but also realize dynamic updating and efficient management of the blacklist, effectively solving the problem that the blacklist cannot be dynamically adjusted in the prior art.

[0021] It should be noted that the blacklist management method provided by the present invention can be applied to the electronic device provided by the present invention, wherein the electronic device can be a personal computer, a mobile terminal, etc., and the mobile terminal can be a mobile phone, a tablet computer, or other hardware device with various operating systems.

[0022] To realize the above idea, the present invention provides a blacklist management method, please refer to Figure 1 , which is a flow chart of a blacklist management method provided by an embodiment of the present invention. Figure 1 As shown, the blacklist management method provided by the present invention includes the following steps: Step S100: Acquire the data to be monitored; Step S200: Extract key data fields from the data to be monitored and integrate them to obtain structured data corresponding to the data to be monitored; Step S300: Use a pre-built blacklist data model to analyze the structured data corresponding to the data to be monitored to determine whether the IP address, user or device corresponding to the data to be monitored poses a threat, wherein the blacklist data model includes IP address threat detection rules, user threat detection rules and device threat detection rules; Step S400: Dynamically add threatening IP addresses, users or devices to the blacklist.

[0023] It can be seen that by adopting the blacklist management method provided by the present invention, not only can threatening IP addresses, users and devices be dynamically managed to prevent malicious attacks and bad behaviors and effectively improve the security of the network, but also the dynamic update and efficient management of the blacklist can be realized, effectively solving the problem that the blacklist in the prior art cannot be dynamically adjusted, and the need for manual intervention can be significantly reduced.

[0024] It should be noted that, as can be understood by those skilled in the art, if the threatening IP address, user or device corresponding to the data to be monitored already exists in the blacklist, there is no need to add the external IP address, user or device to the blacklist again.

[0025] In some exemplary embodiments, the data to be monitored includes at least one of network traffic data, log data, and API interface data.

[0026] Specifically, network traffic data can be obtained by dynamically monitoring all traffic in and out of the network, log data can be obtained by dynamically monitoring key events in all terminal logs, and API (Application Programming Interface) data can be obtained by performing regular queries.

[0027] In some exemplary implementations, the blacklist management method provided by the present invention further includes: marking the source and timestamp of the data to be monitored.

[0028] Therefore, by marking the timestamp of the data to be monitored, it can be used for data sorting and correlation analysis in subsequent analysis.

[0029] In some exemplary embodiments, extracting key data fields from the data to be monitored includes: preprocessing the data to be monitored using regular expressions; and extracting key data fields from the preprocessed data to be monitored using preset rules or preset expressions.

[0030] Thus, by preprocessing the data to be monitored using regular expressions, irrelevant information (such as unnecessary identifiers) in the data to be monitored can be cleaned up. By extracting key data fields from the preprocessed data to be monitored using preset rules or preset expressions and integrating them, unstructured data to be monitored can be converted into structured data, thereby not only ensuring that the data input into the blacklist data model meets the standardized requirements of subsequent analysis, but also facilitating the indexing and rapid query of subsequent data.

[0031] Furthermore, for network traffic data, the public-end traffic observed by the network infrastructure needs to be sent to the cloud for analysis to obtain its corresponding structured data.

[0032] In some exemplary implementations, the blacklist management method provided by the present invention further includes: classifying and storing, indexing, and lifecycle management of the structured data corresponding to the data to be monitored.

[0033] Specifically, the structured data corresponding to the data to be monitored can be stored in storage areas of corresponding categories (e.g., hot data (real-time analysis data) storage area, warm data (historical analysis data) storage area, cold data (long-term archive data) storage area) according to the usage frequency and importance of the structured data corresponding to the data to be monitored, so as to optimize storage efficiency. By indexing the structured data corresponding to the data to be monitored (creating index categories), it is convenient to quickly query subsequent data. Furthermore, according to the usage frequency and importance of the structured data corresponding to the data to be monitored, the index of the structured data corresponding to the data to be monitored can be managed for the life cycle to determine the retention, backup and deletion timing of the structured data corresponding to the data to be monitored. It should be noted that the structured data can be arranged in chronological order and stored together with relevant metadata (e.g., timestamp, data source). Furthermore, functions such as data filtering, aggregation, sorting and statistics can be implemented through tools such as commands and functions.

[0034] In some exemplary embodiments, the blacklist data model is constructed by the following process: collecting a threat intelligence data set; generating a blacklist based on the threat intelligence data set; and performing feature analysis on the IP addresses, users, and devices in the blacklist to construct the blacklist data model.

[0035] Specifically, the data in the threat intelligence data set can come from the global threat intelligence center, network monitoring system, user-defined blacklist, etc., thereby ensuring that the collected threat intelligence data set always has the latest threat intelligence, thereby ensuring that the created blacklist data model can respond quickly to new security threats.

[0036] In some exemplary embodiments, the IP address threat detection rule includes the following IP address threat detection sub-rules: for any external IP address, if the number of attacks on the external IP address is greater than a first preset number and the attack vulnerability level of the external IP address is higher than or equal to the first preset vulnerability level, the external IP address is determined to be a threat; for any external IP address, if the number of internal company IP addresses accessed by the external IP address within a first preset time window (minutes) is greater than a first preset number, the external IP address is determined to be a threat; for any external IP address, if the external IP address logs into the company's internal system and the number of incorrect user password inputs within a second preset time window (minutes) is greater than a second preset number, the external IP address is determined to be a threat; for any external IP address, if the number of port scan requests initiated by the external IP address to the company's internal IP address within a third preset time window (minutes) is greater than a third preset number, the external IP address is determined to be a threat; for any external IP address, if the external IP address attempts to If an external IP address communicates with the company's internal IP address through multiple network protocols with known high-risk security vulnerabilities, the external IP address is determined to be a threat; for any external IP address, if the number of unauthorized access attempts (such as unauthorized API calls) to the external IP address within a fourth preset time window (minutes) is greater than the fourth preset number, the external IP address is determined to be a threat; for any external IP address, if the traffic data from the external IP address contains the propagation characteristics of known malicious behavior and the number of malicious behavior propagation characteristic detections within a fifth preset time window (minutes) is greater than the fifth preset number, the external IP address is determined to be a threat; for any external IP address, if the external IP address is marked as malicious by at least a second preset number of security vendors, the external IP address is determined to be a threat; for any external IP address, if the attack vulnerability type of the external IP address is not recorded in the historical database corresponding to the blacklist data model and the attack vulnerability level of the external IP address is higher than the second preset vulnerability level, the external IP address is determined to be a threat.

[0037] Thus, by attacking an external IP address whose attack times are greater than a first preset times and whose vulnerability level is above a first preset vulnerability level, an external IP address whose number of company internal IP addresses visited within a first preset time window is greater than a first preset number, an external IP address that has logged into the company internal system and whose number of incorrect user password inputs within a second preset time window is greater than a second preset number, an external IP address that has initiated port scan requests to the company internal IP address within a third preset time window is greater than a third preset number, and an attempt to use multiple network protocols with known high-risk security vulnerabilities (such as HTTP (Hypertext Transfer Protocol), FTP (File Transfer Protocol), SMTP (Simple Mail Transfer Protocol) The external IP addresses that communicate with the company's internal IP addresses using the Simple Mail Transfer Protocol (SMP), the external IP addresses whose number of unauthorized access attempts within the fourth preset time window is greater than the fourth preset number, the external IP addresses whose traffic data contains the propagation characteristics of known malicious behaviors and the number of times the malicious behavior propagation characteristics are detected within the fifth preset time window (i.e., the number of malicious behavior propagation characteristic detections) is greater than the fifth preset number, the external IP addresses (public network IP addresses) marked as malicious by at least a second preset number of security vendors, and the external IP addresses whose attack vulnerability types are not recorded in the historical database corresponding to the blacklist data model and whose attack vulnerability levels are higher than the second preset vulnerability levels are determined as threatening IP addresses. Not only can the threatening IP addresses be effectively detected to prevent malicious attacks on the IP addresses, but also the misjudgment of IP addresses can be effectively prevented, thereby effectively ensuring the accuracy of the blacklist.

[0038] Specifically, the historical database corresponding to the blacklist data model records known attack vulnerability types. If the attack vulnerability type of the current external IP address does not exist in the historical database, it means that this is a new or unknown attack type, which means that the external IP address may be trying to exploit a new vulnerability, which may be the source of unknown attack behavior.

[0039] It should be noted that, as can be understood by those skilled in the art, the present invention does not limit the specific values ​​of the first preset number of times, the first preset time window (minutes), the first preset number, the second preset time window (minutes), the second preset number of times, the third preset time window (minutes), the third preset number of times, the fourth preset time window (minutes), the fourth preset number of times, the fifth preset time window (minutes), the fifth preset number of times and the second preset number, and the specific values ​​of the first preset number of times, the first preset time window, the first preset number of times, the second preset time window, the second preset number of times, the third preset time window, the third preset number of times, the fourth preset time window, the fourth preset number of times, the fifth preset time window, the fifth preset number of times and the second preset number can be set according to actual needs. It should also be noted that, as can be understood by those skilled in the art, for any external IP address, it is possible to determine whether the external IP address is marked as malicious by a security vendor and how many security vendors have marked the external IP address as malicious by using the threat intelligence data set provided by the Global Threat Intelligence Center. In addition, it should be noted that, as can be understood by those skilled in the art, the "external IP address" referred to herein refers to the internal IP address of the company, that is, the external IP address refers to the IP address located outside the company.

[0040] Furthermore, for any external IP address, if it triggers the third preset number of IP address threat detection sub-rules simultaneously within the eighth preset time window (hours) (i.e., it satisfies the third preset number of IP address threat detection sub-rules simultaneously within the eighth preset time window), the external IP address is immediately added to the blacklist. For any external IP address, if it triggers at least one IP address threat detection sub-rule within the eighth preset time window and the number of triggered IP address threat detection sub-rules is less than the third preset number, the external IP address can be added to the blacklist after a preset delay. It should be noted that, as can be understood by those skilled in the art, the present invention does not limit the specific values ​​of the eighth preset time window and the third preset number, and the specific values ​​of the eighth preset time window and the third preset number can be set according to actual needs.

[0041] In some exemplary embodiments, the user threat detection rule includes the following user threat detection sub-rules: for any user account, if the user account performs an abnormal operation that does not conform to the historical behavior pattern, it is determined that the user account and / or the IP address when the user account performs the abnormal operation is a threat; for any user account, if the user account repeatedly attempts to log in between multiple different IP addresses and performs suspicious activities, it is determined that the user account is a threat; for any user account, if the number of failed logins of the user account within a sixth preset time window is greater than the sixth preset number, it is determined that the user account is a threat; for any user account, if the login frequency of the user account is greater than the preset frequency, it is determined that the user account is a threat.

[0042] Therefore, by determining that the IP address and / or user account of a user account that has performed abnormal operations that do not conform to historical behavior patterns (such as accessing sensitive data or downloading a large number of files during non-working hours (such as late at night)) when the abnormal operation was performed is threatening, not only can threatening users be effectively detected to prevent malicious attacks by users, but also user misjudgment can be effectively prevented, thereby effectively ensuring the accuracy of the blacklist.

[0043] By determining as threats user accounts that make repeated login attempts between multiple different IP addresses and perform suspicious activities at these IP addresses in the same time period, user accounts whose number of login failures within the sixth preset time window (minutes) is greater than the sixth preset number, and user accounts whose login frequency is greater than the preset frequency (for example, multiple login attempts per second or minute), not only can we effectively detect threatening users to prevent malicious attacks by users, but we can also effectively prevent user misjudgments and effectively ensure the accuracy of the blacklist.

[0044] It should be noted that, as can be understood by those skilled in the art, the present invention does not limit the specific values ​​of the sixth preset time window, the sixth preset number of times and the preset frequency, and the specific values ​​of the sixth preset time window, the sixth preset number of times and the preset frequency can be set according to actual needs. It should also be noted that, as can be understood by those skilled in the art, the situation where the user account login fails may include logging in with an expired, invalid or abnormal password.

[0045] In some exemplary embodiments, the device threat detection rule includes the following device threat detection sub-rules: for any device, if the MAC address of the device is detected to be associated with multiple different IP addresses within the seventh preset time window (hours), and at least one of these IP addresses has suspicious activity, then the device is determined to be a threat; for any device, if the device repeatedly attacks multiple different Wi-Fi access points of the company's internal network, then the device is determined to be a threat; for any device, if the device repeatedly attacks an internal server and the attack method hits a vulnerability in the internal server, then the device is determined to be a threat.

[0046] Therefore, by determining as threats devices whose MAC (Media Access Control) addresses are detected to be associated with multiple different IP addresses within the seventh preset time window, and at least one of these IP addresses has suspicious activity, devices that repeatedly attack multiple different Wi-Fi access points of the company's internal network (that is, devices that repeatedly attempt to connect to multiple different Wi-Fi access points of the company's internal network, and these behaviors are similar to known attack patterns), and devices that repeatedly attack internal servers and whose attack methods hit internal server vulnerabilities, not only can threatening devices be effectively detected to prevent malicious attacks on the devices, but also misjudgment of devices can be effectively prevented, thereby effectively ensuring the accuracy of the blacklist.

[0047] It should be noted that, as those skilled in the art can understand, the present invention does not limit the specific value of the seventh preset time window (hours), and the specific value of the seventh preset time window can be set according to actual needs. It should also be noted that, as those skilled in the art can understand, a device may use multiple IP addresses at the same time, especially when using VPN (Virtual Private Network), proxy server, Wi-Fi switching, etc.

[0048] In some exemplary implementations, the blacklist management method provided by the present invention further includes: dynamically updating the blacklist according to the verification result of the threat intelligence center.

[0049] Therefore, by dynamically updating the blacklist according to the verification results of the threat intelligence center, the alarm items that have been eliminated or invalid (IP addresses, users or devices that no longer pose a threat) can be automatically removed from the blacklist, thereby reducing unnecessary blocking and improving the normal operation efficiency of the network.

[0050] Specifically, if an IP address (public IP address) in the blacklist is re-marked as credible or the threat level is reduced in the global threat intelligence center, the IP address will be automatically removed from the blacklist. It should be noted that the "threat intelligence center" can be other threat intelligence centers in addition to the global threat intelligence center.

[0051] In some exemplary embodiments, the blacklist management method provided by the present invention also includes: storing the blacklist through a data window and displaying it through a graphical interface, so that the administrator can perform at least one of adding, deleting, modifying and searching operations on the blacklist through the graphical interface.

[0052] Therefore, by using a data window to store blacklist data and displaying it through a graphical interface, it is easier for administrators to perform operations such as adding, deleting, modifying, and checking (CRUD) on blacklist data through the graphical interface. At the same time, by using a graphical interface to display blacklist data, it is also easier to provide multi-dimensional data filtering and sorting functions, making it easier to achieve comprehensive management of blacklist data, thereby ensuring the timeliness and accuracy of the blacklist. Specifically, the graphical interface supports filtering and sorting by multiple dimensions such as attack type, threat level, and time window, which can help administrators quickly locate and handle potential risks.

[0053] Furthermore, the data window also has an automatic synchronization function with the global threat intelligence center, so that the latest global threat intelligence stored locally can be updated in real time, and alarm items that have been eliminated or marked as credible can be automatically removed to ensure dynamic updating of the blacklist.

[0054] Furthermore, by using a data window to store the blacklist data, it can not only support automated threat alert updates, but also allow administrators to intervene according to actual business needs. For example, administrators can manually adjust specific entries to meet some complex or customized security needs. The administrator's manual intervention can be combined with the automatic synchronization function of the data window to provide a highly flexible blacklist management function, ensuring that the accuracy and flexibility of threat protection can be maintained in the face of complex network environments.

[0055] Furthermore, the data window supports one-key update and synchronization functions, making the operation easier and reducing the burden of daily management.

[0056] In some exemplary embodiments, the blacklist management method provided by the present invention further includes: regularly generating a corresponding analysis report based on the blacklist, wherein the analysis report includes at least one of the total number of blacklist entries, blacklist entry classification information, and blacklist entry change trend information.

[0057] Therefore, by regularly generating corresponding analysis reports based on the blacklist, it can not only help the administrator understand the usage of the blacklist and its changing trends, but also help the administrator identify the most frequently blacklisted IP addresses, users or devices to analyze their possible risk factors.

[0058] Specifically, the total number of blacklist entries includes the number of newly added, deleted and modified blacklist entries; the blacklist entry classification information includes classification statistics by IP address, country / region, label, etc.; the blacklist entry change trend information includes the change trend information of the blacklist by time (for example, by week or by day).

[0059] In some exemplary implementations, the blacklist management method provided by the present invention further includes: after generating the analysis report, sending a reminder message to an administrator.

[0060] Specifically, the administrator may be reminded to check the generated analysis report in a timely manner by sending an email to the administrator.

[0061] In some exemplary implementations, the blacklist management method provided by the present invention further includes: regularly updating the threat intelligence provided by the threat intelligence center and stored locally.

[0062] Specifically, the threat intelligence data regularly updated by a threat intelligence center (such as the Global Threat Intelligence Center) can be imported into a local database through an automated database synchronization task.

[0063] In some exemplary implementations, the blacklist management method provided by the present invention further includes: blocking operations of IP addresses, users or devices in the blacklist according to a preset firewall policy.

[0064] Therefore, by blocking the operations of the IP addresses, users or devices in the blacklist according to the preset firewall policy, malicious attacks and bad behaviors can be effectively prevented, thereby effectively improving the security of the network.

[0065] Specifically, the administrator can automatically or manually select a specific firewall policy, such as IP policy, device policy, user policy, etc., and deploy this policy to the firewall.

[0066] Furthermore, for firewalls that support external connectors, you can use the firewall external connector to associate threat sources. Firewalls in various areas (production area, office area, R&D area, DMZ (demilitarized zone, isolation zone) area, Internet area, etc.) will have corresponding policies. By calling the generated blacklist, the action of denying access to threatening IP addresses, users or devices is executed. If the firewall does not support external connectors, the API interface of the firewall policy is called through a script, and the blacklist is synchronized to the firewall policy.

[0067] In some exemplary implementations, the blacklist management method provided by the present invention further includes: backing up the blacklist and the structured data.

[0068] Therefore, by backing up the blacklist and the structured data, it can be ensured that all operations can be traced back, effectively avoiding the risks caused by misoperation.

[0069] Based on the same inventive concept, the present invention also provides an electronic device, please refer to Figure 2 , which is a schematic diagram of a block structure of an electronic device provided by an embodiment of the present invention. Figure 2 As shown, the electronic device includes a processor 101 and a memory 103, and a computer program is stored on the memory 103. When the computer program is executed by the processor 101, the blacklist management method described above is implemented. Since the electronic device provided by the present invention and the blacklist management method provided by the present invention belong to the same inventive concept, the electronic device provided by the present invention at least has all the beneficial effects of the blacklist management method provided by the present invention. Therefore, the beneficial effects of the electronic device provided by the present invention can refer to the relevant description of the beneficial effects of the blacklist management method provided by the present invention in the above text, and will not be repeated here one by one.

[0070] Please continue to refer to Figure 2 ,like Figure 2As shown, the electronic device also includes a communication interface 102 and a communication bus 104, wherein the processor 101, the communication interface 102, and the memory 103 communicate with each other through the communication bus 104. The communication bus 104 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus 104 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The communication interface 102 is used for communication between the above-mentioned electronic device and other devices.

[0071] It should be noted that the processor 101 referred to in the present invention may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 101 is the control center of the electronic device, and uses various interfaces and lines to connect various parts of the entire electronic device.

[0072] It should also be noted that the memory 103 can be used to store the computer program, and the processor 101 implements various functions of the electronic device by running or executing the computer program stored in the memory 103 and calling the data stored in the memory 103. The memory 103 may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable memory (PROM), electrically programmable memory (EPROM), electrically erasable programmable memory (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, random access memory is available in a variety of forms, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous random access memory (SDRAM), double data rate synchronous random access memory (DDRSDRAM), enhanced synchronous random access memory (ESDRAM), synchronous link (Synchlink) dynamic random access memory (SLDRAM), memory bus (Rambus) direct random access memory (RDRAM), direct memory bus dynamic random access memory (DRDRAM), and memory bus dynamic random access memory (RDRAM), etc.

[0073] The present invention also provides a readable storage medium, wherein a computer program is stored in the readable storage medium, and when the computer program is executed by a processor, the blacklist management method described above can be implemented. Since the readable storage medium provided by the present invention and the blacklist management method provided by the present invention belong to the same inventive concept, the readable storage medium provided by the present invention at least has all the beneficial effects of the blacklist management method provided by the present invention, so the beneficial effects of the readable storage medium provided by the present invention can refer to the relevant description of the beneficial effects of the blacklist management method provided by the present invention in the above text, and will not be repeated here one by one.

[0074] The readable storage medium provided by the present invention can adopt any combination of one or more computer-readable media. The readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared or semiconductor, or any combination of the above. More specific examples (non-exhaustive enumeration) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this article, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, a device or a device or used in combination with it.

[0075] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical cable, etc., or any suitable combination of the above.

[0076] In summary, compared with the prior art, the blacklist management method, electronic device and readable storage medium provided by the present invention have the following beneficial effects: the present invention can not only dynamically manage threatening IP addresses, users and devices to prevent malicious attacks and bad behaviors and effectively improve the security of the network, but also realize dynamic updating and efficient management of the blacklist, effectively solve the problem in the prior art that the blacklist cannot be dynamically adjusted, and can significantly reduce the need for manual intervention.

[0077] It should be noted that the computer program code for performing the operation of the present invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0078] It should be noted that the devices and methods disclosed in the embodiments of this article can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to the multiple embodiments of this article. In this regard, each box in the flowchart or block diagram can represent a module, a part of a program or a code, and the module, a part of a program segment or a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart, can be implemented by a dedicated hardware-based system for performing a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0079] It should also be noted that the above description is only a description of the preferred embodiment of the present invention, and is not any limitation on the scope of the present invention. Any changes and modifications made by a person skilled in the art in the field of the present invention based on the above disclosure are within the scope of protection of the present invention. Obviously, a person skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations fall within the scope of the present invention and its equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A blacklist management method, characterized in that: include: Obtain the data to be monitored; Extracting key data fields from the data to be monitored and integrating them to obtain structured data corresponding to the data to be monitored; The structured data corresponding to the data to be monitored is analyzed using a pre-built blacklist data model to determine whether the IP address, user or device corresponding to the data to be monitored is a threat, wherein the blacklist data model includes IP address threat detection rules, user threat detection rules and device threat detection rules; Dynamically add threatening IP addresses, users or devices to the blacklist.

2. The blacklist management method according to claim 1, characterized in that: The IP address threat detection rule includes the following IP address threat detection sub-rules: For any external IP address, if the number of attacks on the external IP address is greater than a first preset number and the attack vulnerability level of the external IP address is higher than or equal to the first preset vulnerability level, then the external IP address is determined to be a threat; For any external IP address, if the number of internal IP addresses of the company accessed by the external IP address within a first preset time window is greater than a first preset number, it is determined that the external IP address is a threat; For any external IP address, if the external IP address logs into the company's internal system and the number of incorrect user password inputs within the second preset time window is greater than the second preset number, the external IP address is determined to be a threat; For any external IP address, if the number of port scan requests initiated by the external IP address to the company's internal IP address within the third preset time window is greater than the third preset number, then the external IP address is determined to be a threat; For any external IP address, if the external IP address attempts to communicate with the company's internal IP address through multiple network protocols with known high-risk security vulnerabilities, the external IP address is considered to be a threat; For any external IP address, if the number of unauthorized access attempts of the external IP address within a fourth preset time window is greater than a fourth preset number, it is determined that the external IP address is a threat; For any external IP address, if the traffic data from the external IP address contains the propagation characteristics of known malicious behavior and the number of malicious behavior propagation characteristic detections within the fifth preset time window is greater than the fifth preset number, then the external IP address is determined to be a threat; For any external IP address, if the external IP address is marked as malicious by at least a second predetermined number of security vendors, then the external IP address is determined to be a threat; For any external IP address, if the attack vulnerability type of the external IP address is not recorded in the historical database corresponding to the blacklist data model and the attack vulnerability level of the external IP address is higher than the second preset vulnerability level, it is determined that the external IP address is a threat.

3. The blacklist management method according to claim 1, characterized in that: The user threat detection rule includes the following user threat detection sub-rules: For any user account, if the user account performs an abnormal operation that does not conform to the historical behavior pattern, the user account and / or the IP address of the user account when performing the abnormal operation is determined to be a threat; For any user account, if the user account repeatedly attempts to log in from multiple different IP addresses and performs suspicious activities, the user account is considered to be under threat; For any user account, if the number of login failures of the user account within the sixth preset time window is greater than the sixth preset number, it is determined that the user account is threatened; For any user account, if the login frequency of the user account is greater than the preset frequency, it is determined that there is a threat to the user account.

4. The blacklist management method according to claim 1, characterized in that: The device threat detection rule includes the following device threat detection sub-rules: For any device, if the MAC address of the device is detected to be associated with multiple different IP addresses within a seventh preset time window, and at least one of the IP addresses has suspicious activities, then the device is determined to be a threat; For any device, if it repeatedly attacks multiple different Wi-Fi access points on the company's internal network, the device is considered a threat; For any device, if the device repeatedly attacks the internal server and the attack method hits the internal server vulnerability, the device is considered to be a threat.

5. The blacklist management method according to claim 1, characterized in that: The method further comprises: The operations of the IP addresses, users or devices in the blacklist are blocked according to the preset firewall policy.

6. The blacklist management method according to claim 1, characterized in that: The method further comprises: The blacklist is stored through a data window and displayed through a graphical interface, so that an administrator can perform at least one of adding, deleting, modifying and searching operations on the blacklist through the graphical interface.

7. The blacklist management method according to claim 1, characterized in that: The method further comprises: A corresponding analysis report is generated regularly according to the blacklist, wherein the analysis report includes at least one of total number of blacklist entries, classification information of blacklist entries, and change trend information of blacklist entries.

8. The blacklist management method according to claim 1, characterized in that: The method further comprises: The blacklist is dynamically updated according to the verification results of the threat intelligence center.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the blacklist management method according to any one of claims 1 to 8 is implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the blacklist management method according to any one of claims 1 to 8 is implemented.

Images