Internal and external network comprehensive security analysis method and system

Abstract

The invention relates to the technical field of security analysis, in particular to a comprehensive security analysis method and system for internal and external networks, and the method comprises the steps: searching log templates of original security logs of target internal and external networks, comparing all searched log templates with real-time log streams of the target internal and external networks, and determining an inconsistent index; and determining threat identifiability and vulnerability identifiability according to all attack events and blocking events of the target intranet and extranet, determining security levels of the target intranet and extranet according to the threat identifiability and the vulnerability identifiability, and performing comprehensive analysis to obtain a comprehensive security analysis result of the target intranet and extranet. According to the method, potential security risks in the network can be accurately identified, immediate response to security threats can be realized, information of various security events and blocking measures is integrated, the network security protection capability is improved, the coping efficiency for complex security threats is enhanced, manual intervention is reduced, and the safety of the network is improved. And the operation efficiency and usability are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of security analysis, and in particular to a method and system for comprehensive security analysis of internal and external networks. Background Art

[0002] At present, with the development of science and technology, computers are used more and more widely. However, computer programs may also contain some malicious codes or malicious software, or legal software may be used for malicious purposes, making the network unable to operate normally. Therefore, it is very important to conduct real-time security analysis of internal and external networks. However, the existing network security analysis methods have the problems of single method, rough analysis process, uncontrollable analysis accuracy, etc., which leads to the deterioration of the security performance of internal and external networks. In view of the limitations of the existing network security analysis methods, the present invention proposes a comprehensive security analysis method and system for internal and external networks. This method can accurately identify the inconsistencies between logs by analyzing the security logs of internal and external networks in real time, comparing the log template with the actual log stream, and thus timely discovering potential security threats. Summary of the invention

[0003] In view of the above problems existing in the prior art, the present invention is proposed.

[0004] Therefore, the present invention provides a comprehensive security analysis method for internal and external networks, which can solve the problems of insufficient accuracy and single method in traditional existing network security analysis methods. The present invention compares and analyzes the real-time log streams and log templates of the internal and external networks, comprehensively considers various security indexes and blocking events, thereby realizing a comprehensive and real-time evaluation and analysis of the security status of the internal and external networks.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions, a method for comprehensive security analysis of internal and external networks, comprising:

[0006] Search for log templates of the original security logs of the target intranet and intranet, compare all the searched log templates with the real-time log streams of the target intranet and intranet, and determine the inconsistency index;

[0007] Determine the threat identification and vulnerability identification of the corresponding attack event based on all attack events on the target internal and external networks and the blocking events matched by each attack event;

[0008] Determine the security level of the target internal and external networks based on the threat identification and vulnerability identification of all attack events;

[0009] A comprehensive analysis is conducted on the inconsistency index and security level of the target internal and external networks to obtain the comprehensive security analysis results of the target internal and external networks.

[0010] As a preferred solution of the method for comprehensive security analysis of internal and external networks described in the present invention, wherein: the inconsistency index is obtained by determining the first difference index, obtaining the log template of the original security log of the target internal and external network in different security states and the first information matching the log template, and filling them into the corresponding positions of the log data table in sequence;

[0011] The first information includes log information of different parameter types, one security state corresponds to one log template, each row in the filled log data table contains log information of the same parameter type corresponding to the log templates in different security states, and each column represents log information of the same log template in the same security state based on different parameter types;

[0012] Based on the log information corresponding to each row in the filled log data table, the basic log information of the corresponding row is obtained;

[0013] Obtain the real-time log stream of the target internal and external networks and fill it into the corresponding position of the log data table, and compare the real-time log stream with the corresponding basic log information. Based on the comparison result, determine the first difference index between each log stream information in the real-time log stream and the corresponding basic log information, and obtain the inconsistency index based on all the first difference indices.

[0014] As a preferred solution of the method for comprehensive security analysis of internal and external networks described in the present invention, wherein: the determining of the first difference index includes obtaining each log stream information and the corresponding basic log information in the real-time log stream, and splitting the corresponding information according to the information subtype to obtain the corresponding first log stream information set and the basic log information set;

[0015] Compare the first sub-information in the first log stream information set with the second sub-information of the same sub-type in the corresponding basic log information set, obtain the similarity between the current first sub-information and the second sub-information of the same sub-type, and determine the second sub-information with the highest similarity;

[0016] If there are two or more second sub-information with the same similarity in the result, compare the relative position of the second sub-information in the basic log information set with the relative position of the first sub-information in the first log stream information set to determine the second sub-information that uniquely corresponds to the first sub-information in the basic log stream information set;

[0017] If there are no two or more second sub-information with the same similarity in the result, the second sub-information with the highest similarity is used as the corresponding information of the current first sub-information;

[0018] Based on the similarity between all the first sub-information and the corresponding second sub-information determined last, a first difference index T between the first log stream information and the corresponding basic log information is obtained;

[0019]

[0020] Among them, ω i is the similarity between the ith first sub-information and the corresponding second sub-information finally determined, d i is the impact factor of the i-th first sub-information on the first log stream information, ξ i is the error index between the ith first sub-information and the corresponding second sub-information determined last in the similarity comparison process, e is a constant, m is the number of first sub-information in the first log stream information, ln is a logarithmic function, and i is the index of the sub-information;

[0021] Based on all the first difference indices, determining the inconsistency index S between the real-time log stream and the basic log information,

[0022]

[0023] Where S is the inconsistency index between the real-time log stream and the basic log information, k is the number of first difference indexes between the first log stream information and the corresponding basic log information, δ p is the weight coefficient of the information corresponding to the pth first difference index, T p is the pth first difference index.

[0024] As a preferred solution of the comprehensive security analysis method for internal and external networks described in the present invention, wherein: the determination of the threat recognition and vulnerability recognition of the corresponding attack event includes obtaining all attack events of the target internal and external networks within a preset time period and the blocking events matched by each attack event, performing event analysis on each attack event, judging the impact of the attack event on the target internal and external networks based on the analysis result, and determining the threat recognition result of the current attack event;

[0025] Perform blocking judgment on the blocking event corresponding to each attack event, determine the blocking index of the current attack event, and use the blocking index as the first reference for vulnerability identification corresponding to the current attack event;

[0026] According to the threat identification result of the current attack event, the corresponding threat index is screened in the threat database, and the threat index is used as the second reference for the vulnerability identification corresponding to the current attack event;

[0027] A vulnerability identification result of the current attack event is obtained based on the first reference and the second reference of the vulnerability identification corresponding to the same attack event.

[0028] As a preferred solution of the method for comprehensive security analysis of internal and external networks described in the present invention, wherein: the determination of the blocking index of the current attack event includes making a blocking judgment on the blocking event corresponding to each attack event, judging the blocking effect of the current blocking event, and comparing the blocking effect with the corresponding preset effect;

[0029] If the blocking effect is greater than the first preset blocking effect, the blocking effect of the current blocking event is determined to be a first-level blocking result, and a blocking index corresponding to the first-level blocking effect is obtained from the blocking database;

[0030] If the blocking effect is greater than the second preset blocking effect, the blocking effect of the current blocking event is determined to be a secondary blocking result, and a blocking index corresponding to the secondary blocking effect is obtained from the blocking database;

[0031] If the blocking effect is less than or equal to the second preset blocking effect, the blocking effect of the current blocking event is determined to be a third-level blocking result, and a blocking index corresponding to the third-level blocking effect is obtained from the blocking database.

[0032] As a preferred solution of the comprehensive security analysis method for internal and external networks described in the present invention, the determination of the security level of the target internal and external networks includes obtaining the threat identification results of all attack events and the result conversion values ​​corresponding to the vulnerability identification, performing comprehensive conversion to obtain the real-time conversion index of the target internal and external networks, and determining the current security level corresponding to the current real-time conversion index based on the real-time conversion index.

[0033] As a preferred solution of the method for comprehensive security analysis of internal and external networks described in the present invention, wherein: the comprehensive security analysis result includes taking the inconsistency index of the target internal and external networks as the first security reference for comprehensive security analysis of the target internal and external networks;

[0034] The current security level of the target internal and external network is used as the second security reference for the comprehensive security analysis of the target internal and external network, the first security reference and the second security reference are converted into the first value and the second value of the comprehensive security analysis of the target internal and external network based on a preset conversion formula, and weighted processing is performed based on the first value and the second value to obtain the initial analysis result of the comprehensive security analysis of the target internal and external network;

[0035] The initial analysis results are optimized based on the preset interference factors to obtain the comprehensive security analysis results of the target internal and external networks.

[0036] Another object of the present invention is to provide an internal and external network comprehensive security analysis system, which aims to solve the problems of insufficient accuracy and single method in existing network security analysis methods. The present invention compares and analyzes the real-time log streams and log templates of the internal and external networks, comprehensively considers various security indexes and blocking events, and thus realizes a comprehensive and real-time evaluation and analysis of the security status of the internal and external networks.

[0037] As a preferred solution of the comprehensive security analysis system for internal and external networks described in the present invention, it includes: an index determination module, an identification determination module, a level determination module and a security analysis module;

[0038] The index determination module searches for log templates of original security logs of target intranet and intranet networks, and compares all searched log templates with the real-time log streams of the target intranet and intranet networks to determine the inconsistency index;

[0039] The identification and determination module determines the threat recognition and vulnerability recognition of the corresponding attack event based on all attack events of the target internal and external networks within a specified time period including the current moment and the blocking events matched with each attack event;

[0040] The level determination module determines the current security level of the target intranet and extranet based on the threat identification and vulnerability identification of all attack events;

[0041] The security analysis module performs a comprehensive analysis on the inconsistency index and current security level of the target internal and external networks to obtain a comprehensive security analysis result of the target internal and external networks.

[0042] A computer device includes a memory and a processor, wherein the memory stores a computer program, and wherein the processor implements the steps of any one of the methods for comprehensive security analysis of internal and external networks when executing the computer program.

[0043] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of any one of the methods for comprehensive security analysis of internal and external networks are implemented.

[0044] Beneficial effects of the present invention: The present invention can accurately identify potential security risks in the network and achieve immediate response to security threats through comprehensive comparative analysis of real-time log streams and log templates of internal and external networks. In addition, the systematic analysis method integrates information on various security events and blocking measures, which not only improves the ability of network security protection, but also enhances the efficiency of responding to complex security threats, while reducing manual intervention and improving the efficiency and ease of use of operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0046] Figure 1A flowchart of a method for comprehensive security analysis of internal and external networks is provided for one embodiment of the present invention.

[0047] Figure 2 A structural diagram of an internal and external network comprehensive security analysis system provided for one embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0049] Example 1

[0050] Reference Figure 1 , which is the first embodiment of the present invention, provides a method for comprehensive security analysis of internal and external networks, including:

[0051] S1: Search for log templates of the original security logs of the target intranet and intranet, compare all the searched log templates with the real-time log streams of the target intranet and intranet, and determine the inconsistency index.

[0052] It should be noted that the original security log refers to the security log corresponding to different security states obtained during the test of the target internal and external networks before they are officially put into operation. For example, the original security log is the operating system log, network daemon log, application log, network infrastructure log, etc. corresponding to different security states during the test of the target internal and external networks. The log template refers to the log type and basic log information of the original security log. The log templates corresponding to different security states are different, but they are all pre-set. For example, security state 1 corresponds to log template 1, and security state 2 corresponds to log template 2.

[0053] The real-time log stream refers to the log stream generated during the real-time operation of the target intranet and extranet at the current moment. The log stream includes the operating system logs, network daemon logs, application logs, network infrastructure logs, etc. contained in the real-time operation of the target intranet and extranet.

[0054] The inconsistency index is obtained by determining the first difference index, obtaining the log template of the original security log of the target internal and external network in different security states and the first information matching the log template, and filling them into the corresponding positions of the log data table in sequence;

[0055] The first information includes log information of different parameter types, one security state corresponds to one log template, each row in the filled log data table contains log information of the same parameter type corresponding to the log templates in different security states, and each column represents log information of the same log template in the same security state based on different parameter types;

[0056] Based on the log information corresponding to each row in the filled log data table, the basic log information of the corresponding row is obtained;

[0057] Obtain the real-time log stream of the target internal and external networks and fill it into the corresponding position of the log data table, and compare the real-time log stream with the corresponding basic log information. Based on the comparison result, determine the first difference index between each log stream information in the real-time log stream and the corresponding basic log information, and obtain the inconsistency index based on all the first difference indices.

[0058] Determining the first difference index includes obtaining each log stream information and corresponding basic log information in the real-time log stream, and splitting the corresponding information according to the information subtype to obtain the corresponding first log stream information set and the basic log information set;

[0059] Compare the first sub-information in the first log stream information set with the second sub-information of the same sub-type in the corresponding basic log information set, obtain the similarity between the current first sub-information and the second sub-information of the same sub-type, and determine the second sub-information with the highest similarity;

[0060] If there are two or more second sub-information with the same similarity in the result, compare the relative position of the second sub-information in the basic log information set with the relative position of the first sub-information in the first log stream information set to determine the second sub-information that uniquely corresponds to the first sub-information in the basic log stream information set;

[0061] If there are no two or more second sub-information with the same similarity in the result, the second sub-information with the highest similarity is used as the corresponding information of the current first sub-information;

[0062] Based on the similarity between all the first sub-information and the corresponding second sub-information determined last, a first difference index T between the first log stream information and the corresponding basic log information is obtained;

[0063]

[0064] Among them, ω i is the similarity between the ith first sub-information and the corresponding second sub-information finally determined, d i is the impact factor of the i-th first sub-information on the first log stream information, ξ iis the error index between the ith first sub-information and the corresponding second sub-information determined last in the similarity comparison process, e is a constant, m is the number of first sub-information in the first log stream information, ln is a logarithmic function, and i is the index of the sub-information;

[0065] Based on all the first difference indices, determining the inconsistency index S between the real-time log stream and the basic log information,

[0066]

[0067] Where S is the inconsistency index between the real-time log stream and the basic log information, k is the number of first difference indexes between the first log stream information and the corresponding basic log information, δ p is the weight coefficient of the information corresponding to the pth first difference index, T p is the pth first difference index.

[0068] S2: Determine the threat recognition and vulnerability recognition of the corresponding attack event based on all attack events on the target internal and external networks and the blocking events matched by each attack event.

[0069] It should be noted that an attack incident refers to an event that causes potential harm to the target internal or external network through unauthorized access, destruction, leakage, data modification or denial of service.

[0070] A blocking event refers to an event in which an attack event is blocked in the target internal or external network. For example, there is an attack event that destroys data, but the event is blocked, which means that there is a relationship of destruction and protection between the two.

[0071] Determining the blocking index of the current attack event includes making a blocking judgment on the blocking event corresponding to each attack event, judging the blocking effect of the current blocking event, and comparing the blocking effect with the corresponding preset effect;

[0072] If the blocking effect is greater than the first preset blocking effect, the blocking effect of the current blocking event is determined to be a first-level blocking result, and a blocking index corresponding to the first-level blocking effect is obtained from the blocking database;

[0073] If the blocking effect is greater than the second preset blocking effect, the blocking effect of the current blocking event is determined to be a secondary blocking result, and a blocking index corresponding to the secondary blocking effect is obtained from the blocking database;

[0074] If the blocking effect is less than or equal to the second preset blocking effect, the blocking effect of the current blocking event is determined to be a third-level blocking result, and a blocking index corresponding to the third-level blocking effect is obtained from the blocking database.

[0075] Among them, the first preset blocking effect is greater than the second preset blocking effect.

[0076] S3: Determine the security level of the target internal and external networks based on the threat identification and vulnerability identification of all attack events.

[0077] It should be noted that the determination of the security level of the target internal and external network includes obtaining the threat identification results of all attack events and the result conversion values ​​corresponding to the vulnerability identification, performing comprehensive conversion, and obtaining the real-time conversion index of the target internal and external network;

[0078] Threat identification refers to the threat of potential harm to the target internal and external networks caused by attack incidents based on unauthorized access, destruction, leakage, data modification or denial of service.

[0079] Vulnerability identification refers to the performance of the target internal and external networks' defense capabilities against attack events when the attack events attack the target internal and external networks.

[0080] The current security level is the security level of the target internal and external networks determined by the threat identification and vulnerability identification of all attack events corresponding to the target internal and external networks.

[0081] S4: Comprehensively analyze the inconsistency index and security level of the target internal and external networks to obtain the comprehensive security analysis results of the target internal and external networks.

[0082] It should be noted that comprehensive analysis refers to analysis based on the inconsistency index of the target internal and external networks and the current security level. For example, the inconsistency index of the target internal and external networks is used as the first security reference for the comprehensive security analysis of the target internal and external networks, and the current security level of the target internal and external networks based on vulnerability identification and threat identification is used as the second security reference for the comprehensive security analysis of the target internal and external networks. The first security reference and the second security reference are used as the first and second values ​​of the comprehensive security analysis of the target internal and external networks, and the first and second values ​​are calculated to obtain the initial analysis results of the comprehensive security analysis of the target internal and external networks, and then optimization is performed based on the preset interference factors to achieve comprehensive analysis.

[0083] Example 2

[0084] The second embodiment of the present invention provides a method for comprehensive security analysis of internal and external networks. Based on the first embodiment, this embodiment further introduces in detail how to accurately determine the inconsistency index through advanced log analysis and processing.

[0085] Obtain log templates of original security logs of target intranet and extranet in different security states and first information matching the log templates, and fill them into corresponding positions of the log data table in sequence;

[0086] The first information includes log information of several different parameter types, and one security state corresponds to one log template. Each row in the filled log data table includes log information of the same parameter type corresponding to log templates in different security states, and each column represents log information of the same log template based on different parameter types in the same security state;

[0087] Based on the log information corresponding to each row in the filled log data table, the basic log information of the corresponding row is obtained, the real-time log stream of the target internal and external networks is obtained and filled into the corresponding position of the log data table, and the real-time log stream is compared with the corresponding basic log information. Based on the comparison result, the first difference index between each log stream information in the real-time log stream and the corresponding basic log information is determined, and the inconsistency index is obtained based on all the first difference indices.

[0088] The original security log refers to the security log corresponding to different security states obtained during the test of the target internal and external network before it is officially put into operation. The security state includes the secure state, sub-secure state, generally unsafe state and deadlock state.

[0089] The first information refers to the log information matched by the log templates of the original security logs of the target intranet and extranet in different security states.

[0090] In this embodiment, the log template refers to the log type of the original security log and the filling specification of the basic information of the log. Filling the log data table according to the parameter type means dividing the log information by the information attribute of the log information, each information attribute corresponds to a parameter type, and each parameter type corresponds to a row of the log data table. For example, the parameter type can be implemented as: login log, object access log, process tracking log, privilege use, account management, policy change, system event and other types.

[0091] The log data table refers to a data table of corresponding types containing different security states and corresponding log information under different security states.

[0092] The first information includes log information of several different parameter types, and one security state corresponds to one log template. Each row in the filled log data table includes log information of the same parameter type corresponding to log templates in different security states, and each column represents log information of the same log template based on different parameter types in the same security state.

[0093] Basic log information refers to the log information corresponding to each row in the populated log data table, and the log information obtained after deleting the duplicate log information in the comprehensive result and arranging the remaining information in order. Real-time log stream refers to the log stream generated during the real-time operation of the target intranet and extranet at the current moment.

[0094] In this embodiment, the first difference index is an index corresponding to the difference between each log stream information and the corresponding basic log information in the real-time log stream. The inconsistency index is an index corresponding to the inconsistency between the first information matched by the log template in different security states in the target intranet and extranet and the real-time log stream obtained by combining all the first difference indices.

[0095] Obtain each log stream information and the corresponding basic log information in the real-time log stream, and split the corresponding information according to the information subtype to obtain the corresponding first log stream information set and the basic log information set. Compare the first sub-information in the first log stream information set with the second sub-information of the same sub-type in the corresponding basic log information set one by one to obtain the similarity between the current first sub-information and the second sub-information of the same sub-type, and determine the second sub-information with the highest similarity.

[0096] If the determination result shows that there are two or more second sub-information with the same similarity, the relative position of the second sub-information in the basic log information set is compared with the relative position of the first sub-information in the first log stream information set, and the unique corresponding second sub-information of the first sub-information in the basic log stream information set is determined, and the second sub-information with the highest similarity is used as the corresponding information of the current first sub-information. Splitting by information sub-type means splitting each log stream information and the corresponding basic log information in the real-time log stream according to information structure, etc., and splitting means disassembling the log stream information and the basic log information according to the information sub-type.

[0097] The first log stream information set refers to a set obtained by merging the split log stream information in the original order, and the basic log stream information set refers to a set obtained by merging the split basic log information in the original order.

[0098] The first sub-information refers to information corresponding to each split result obtained after each log stream information in the real-time log stream information is split based on the information subtype.

[0099] The second sub-information refers to the information corresponding to each split result obtained after the basic log information is split based on the information subtype.

[0100] The similarity value refers to the value corresponding to the similarity between the information in the first sub-information and the information in the second sub-information. For example, if the information contained in the first sub-information is abcde, and the corresponding information contained in the second sub-information is defgh, the information de in the first sub-information is consistent with that in the second sub-information, and the corresponding similarity value is 0.4.

[0101] The relative position refers to the relative position of the current first sub-information and the second sub-information in the first log stream set and the basic log stream set.

[0102] The first difference index is an index corresponding to the difference between each log stream information in the real-time log stream and the corresponding basic log information, and the value range of the error index is (0, 1).

[0103] Possible influencing factors include information transmission media, information repetition, information presentation form, etc.

[0104] The inconsistency index is an index corresponding to the inconsistency between the first information matched by the log template in different security states in the target internal and external network, obtained by synthesizing all the first difference indices, and the real-time log stream. The inconsistency index is obtained by comparing the real-time log stream of the target internal and external network with the log template, and a comprehensive analysis is performed in combination with the threat recognition and vulnerability recognition of the corresponding attack events of the target internal and external network, which can make the security analysis of the target internal and external network more accurate and enhance the security performance of the target internal and external network.

[0105] Obtain all attack events of the target intranet and extranet within a preset time period and the blocking events matched by each attack event, wherein the preset time period refers to a time period that includes the current moment and exceeds one time acquisition cycle.

[0106] Perform event analysis on each attack event, and determine the impact of the attack event on the target internal and external networks based on the analysis results, so as to determine the threat identification result of the current attack event, perform blocking judgment on the blocking event corresponding to each attack event, determine the blocking index of the current attack event, and use the blocking index as the first reference for the vulnerability identification corresponding to the current attack event;

[0107] According to the threat identification result of the current attack event, a corresponding threat index is selected in the threat database, and the threat index is used as a second reference for vulnerability identification corresponding to the current attack event;

[0108] A vulnerability identification result of the current attack event is obtained based on the first reference and the second reference of the vulnerability identification corresponding to the same attack event.

[0109] An attack incident refers to an event that causes potential harm to the target internal or external network through unauthorized access, destruction, leakage, data modification or denial of service.

[0110] A blocking event refers to an event that blocks an attack event in the target intranet or extranet. A preset time period refers to a time period that includes the current moment and exceeds a time acquisition cycle. Event analysis refers to the process of decomposing an attack event and analyzing the obtained event decomposition results to obtain analysis results. The degree of impact refers to the degree of impact on the target intranet or extranet when the attack event itself is successful. Threat identification refers to the threat of potential harm to the target intranet or extranet caused by attack events based on unauthorized access, destruction, leakage, data modification or denial of service. Blocking judgment refers to the judgment of the blocking result of the blocking event.

[0111] The first reference refers to using the blocking index as the first reference factor for the vulnerability identification corresponding to the current attack event. Vulnerability identification refers to the performance of the target internal and external networks' defense capabilities against the attack event when the attack event attacks the target's internal and external networks. The threat index is determined by screening the corresponding index of the threat identification results of the current attack event in the threat database. The second reference refers to using the threat index as another reference factor for the vulnerability identification corresponding to the current attack event.

[0112] By determining the vulnerability identification and threat identification of attack events in the target internal and external networks, and comprehensively determining the security level of the target internal and external networks, and conducting a comprehensive analysis with the inconsistency index, the security analysis of the target internal and external networks can be made more accurate and the security performance of the target internal and external networks can be enhanced.

[0113] Performing a blocking judgment on the blocking event corresponding to each attack event, judging the blocking effect of the current blocking event, and comparing the blocking effect with the corresponding preset effect;

[0114] If the blocking effect is greater than the first preset blocking effect, the blocking effect of the current blocking event is determined to be a first-level blocking result, and a blocking index corresponding to the first-level blocking effect is obtained from the blocking database;

[0115] If the blocking effect is greater than the second preset blocking effect, the blocking effect of the current blocking event is determined to be a secondary blocking result, and a blocking index corresponding to the secondary blocking effect is obtained from the blocking database;

[0116] Otherwise, it is determined that the blocking effect of the current blocking event is a third-level blocking result, and the blocking index corresponding to the third-level blocking effect is obtained from the blocking database;

[0117] Among them, the first preset blocking effect is greater than the second preset blocking effect.

[0118] A blocking event refers to an event in which an attack event is blocked in the target's internal or external network. A blocking judgment refers to the judgment of the blocking result of a blocking event. A blocking effect refers to the degree of blocking of the current attack event when a blocking event blocks an attack event. A preset blocking effect refers to the blocking effect of a blocking event determined based on the security level of the target's internal or external network on an attack event.

[0119] The first-level blocking result refers to the blocking result of the corresponding blocking event when the blocking effect is greater than the first preset blocking effect; the second-level blocking result refers to the blocking result of the corresponding blocking event when the blocking effect is greater than the second preset blocking effect; the third-level blocking result refers to the blocking result of the corresponding blocking event when the blocking effect is less than the third preset blocking effect. Each level of blocking result corresponds to a blocking index.

[0120] By determining the blocking index of the blocking events corresponding to the attack events of the target internal and external networks, the vulnerability identification is determined, and the security level of the target internal and external networks is determined in combination with the threat identification, and then a comprehensive analysis is performed with the inconsistency index, which can make the security analysis of the target internal and external networks more accurate.

[0121] Obtain the threat identification results and vulnerability identification results of all attack events, obtain the result conversion values ​​corresponding to the threat identification results and vulnerability identification results, perform comprehensive conversion, and obtain the real-time conversion index of the target internal and external networks, and determine the current security level corresponding to the current real-time conversion index based on the real-time conversion index.

[0122] Threat identification refers to the threat of potential harm to the target internal and external networks caused by attack events based on unauthorized access, destruction, leakage, data modification or denial of service. Vulnerability identification refers to the performance of the target internal and external networks' defense capabilities against attack events when the attack events attack the target internal and external networks. The result conversion value refers to the conversion of the performance results of threat identification and vulnerability identification into a numerical value that can be calculated. The real-time conversion index refers to the index obtained by converting the threat identification results and the vulnerability identification results, and comprehensively calculating the corresponding result conversion values. The current security level refers to the security level corresponding to the real-time conversion index in the index-level data table.

[0123] The security level of the target internal and external networks is obtained through the threat recognition and vulnerability recognition of the corresponding attack events of the target internal and external networks, and a comprehensive analysis is performed on the inconsistency index obtained by comparing the real-time log stream and log template of the target internal and external networks, which can make the security analysis of the target internal and external networks more accurate.

[0124] The inconsistency index of the target internal and external network is used as the first security reference for the comprehensive security analysis of the target internal and external network, and the current security level of the target internal and external network is used as the second security reference for the comprehensive security analysis of the target internal and external network. The first security reference and the second security reference are converted into the first value and the second value of the comprehensive security analysis of the target internal and external network based on a preset conversion formula;

[0125] Performing weighted processing based on the first value and the second value to obtain an initial analysis result of the comprehensive security analysis of the target internal and external networks;

[0126] The initial analysis results are optimized based on the preset interference factors to obtain the comprehensive security analysis results of the target internal and external networks.

[0127] The first security reference refers to using the inconsistency index of the target internal and external networks as the first reference for comprehensive security analysis, and the second security reference refers to using the current security level of the target internal and external networks as the second reference for comprehensive security analysis.

[0128] The first value refers to the inconsistency index converted into a value that can be calculated with the current security level based on the first preset formula, and the second value refers to the current security level converted into a value that can be calculated with the inconsistency index based on the second preset formula. For example, the first preset formula corresponding to the first value may be y=ax+b, where a is a conversion coefficient for converting the inconsistency index to a value that can be calculated with the current security level, and the second preset formula corresponding to the second value may be y=logc x , where c is the conversion coefficient that converts the current security level to a level that can be calculated with the inconsistency index.

[0129] The initial analysis result refers to the initial safety analysis result obtained by weighted processing and calculation based on the first value and the second value. The preset interference factors include system interference factors, accidental interference factors, and negligent interference factors.

[0130] The comprehensive security analysis result refers to the security analysis result obtained after optimizing the initial analysis result based on the preset interference factors. By comparing the inconsistency index obtained by comparing the real-time log stream of the target internal and external network with the log template, and conducting a comprehensive analysis with the threat recognition and vulnerability recognition of the corresponding attack events of the target internal and external network, the security analysis of the target internal and external network can be made more accurate and the security performance of the target internal and external network can be enhanced.

[0131] Example 3

[0132] The third embodiment of the present invention is different from the first two embodiments in that:

[0133] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0134] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0135] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0136] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0137] Example 4

[0138] refer to Figure 2 , which is the fourth embodiment of the present invention, and which provides an internal and external network comprehensive security analysis system, characterized in that it includes an index determination module, an identification determination module, a level determination module and a security analysis module;

[0139] The index determination module searches for log templates of original security logs of target intranet and intranet networks, and compares all searched log templates with the real-time log streams of the target intranet and intranet networks to determine the inconsistency index;

[0140] The identification and determination module determines the threat recognition and vulnerability recognition of the corresponding attack event based on all attack events of the target internal and external networks within a specified time period including the current moment and the blocking events matched with each attack event;

[0141] The level determination module determines the current security level of the target intranet and extranet based on the threat identification and vulnerability identification of all attack events;

[0142] The security analysis module performs a comprehensive analysis on the inconsistency index and current security level of the target internal and external networks to obtain a comprehensive security analysis result of the target internal and external networks.

[0143] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A comprehensive security analysis method for internal and external networks, characterized by: include, Search for log templates of the original security logs of the target intranet and intranet, compare all the searched log templates with the real-time log streams of the target intranet and intranet, and determine the inconsistency index; Determine the threat identification and vulnerability identification of the corresponding attack events based on all attack events on the target internal and external networks and the blocking events matched by each attack event; Determine the security level of the target internal and external networks based on the threat identification and vulnerability identification of all attack events; A comprehensive analysis is conducted on the inconsistency index and security level of the target internal and external networks to obtain the comprehensive security analysis results of the target internal and external networks.

2. The method for comprehensive security analysis of internal and external networks as claimed in claim 1, characterized in that: The inconsistency index is obtained by determining the first difference index, obtaining the log template of the original security log of the target internal and external network in different security states and the first information matching the log template, and filling them into the corresponding positions of the log data table in sequence; The first information includes log information of different parameter types, one security state corresponds to one log template, each row in the filled log data table contains log information of the same parameter type corresponding to the log templates in different security states, and each column represents log information of the same log template in the same security state based on different parameter types; Based on the log information corresponding to each row in the filled log data table, the basic log information of the corresponding row is obtained; Obtain the real-time log stream of the target internal and external networks and fill it into the corresponding position of the log data table, and compare the real-time log stream with the corresponding basic log information. Based on the comparison result, determine the first difference index between each log stream information in the real-time log stream and the corresponding basic log information, and obtain the inconsistency index based on all the first difference indices.

3. The method for comprehensive security analysis of internal and external networks as claimed in claim 2, characterized in that: Determining the first difference index includes obtaining each log stream information and corresponding basic log information in the real-time log stream, and splitting the corresponding information according to the information subtype to obtain the corresponding first log stream information set and the basic log information set; Compare the first sub-information in the first log stream information set with the second sub-information of the same sub-type in the corresponding basic log information set, obtain the similarity between the current first sub-information and the second sub-information of the same sub-type, and determine the second sub-information with the highest similarity; If there are two or more second sub-information with the same similarity in the result, compare the relative position of the second sub-information in the basic log information set with the relative position of the first sub-information in the first log stream information set to determine the second sub-information that uniquely corresponds to the first sub-information in the basic log stream information set; If there are no two or more second sub-information with the same similarity in the result, the second sub-information with the highest similarity is used as the corresponding information of the current first sub-information; Based on the similarity between all the first sub-information and the corresponding second sub-information determined last, a first difference index T between the first log stream information and the corresponding basic log information is obtained; Among them, ω i is the similarity between the ith first sub-information and the corresponding second sub-information finally determined, d i is the impact factor of the i-th first sub-information on the first log stream information, ξ i is the error index between the ith first sub-information and the corresponding second sub-information determined last in the similarity comparison process, e is a constant, m is the number of first sub-information in the first log stream information, ln is a logarithmic function, and i is the index of the sub-information; Based on all the first difference indices, determining the inconsistency index S between the real-time log stream and the basic log information, Where S is the inconsistency index between the real-time log stream and the basic log information, k is the number of first difference indexes between the first log stream information and the corresponding basic log information, δ p is the weight coefficient of the information corresponding to the pth first difference index, T p is the pth first difference index.

4. The method for comprehensive security analysis of internal and external networks as claimed in claim 3, characterized in that: Determining the threat recognition and vulnerability recognition of the corresponding attack event includes obtaining all attack events of the target internal and external networks within a preset time period and the blocking events matched by each attack event, performing event analysis on each attack event, judging the impact of the attack event on the target internal and external networks based on the analysis results, and determining the threat recognition result of the current attack event; Perform blocking judgment on the blocking event corresponding to each attack event, determine the blocking index of the current attack event, and use the blocking index as the first reference for vulnerability identification corresponding to the current attack event; According to the threat identification result of the current attack event, the corresponding threat index is screened in the threat database, and the threat index is used as the second reference for the vulnerability identification corresponding to the current attack event; A vulnerability identification result of the current attack event is obtained based on the first reference and the second reference of the vulnerability identification corresponding to the same attack event.

5. The method for comprehensive security analysis of internal and external networks as claimed in claim 4, characterized in that: Determining the blocking index of the current attack event includes making a blocking judgment on the blocking event corresponding to each attack event, judging the blocking effect of the current blocking event, and comparing the blocking effect with the corresponding preset effect; If the blocking effect is greater than the first preset blocking effect, the blocking effect of the current blocking event is determined to be a first-level blocking result, and a blocking index corresponding to the first-level blocking effect is obtained from the blocking database; If the blocking effect is greater than the second preset blocking effect, the blocking effect of the current blocking event is determined to be a secondary blocking result, and a blocking index corresponding to the secondary blocking effect is obtained from the blocking database; If the blocking effect is less than or equal to the second preset blocking effect, the blocking effect of the current blocking event is determined to be a third-level blocking result, and a blocking index corresponding to the third-level blocking effect is obtained from the blocking database.

6. The method for comprehensive security analysis of internal and external networks as claimed in claim 5, characterized in that: Determining the security level of the target intranet and extranet includes obtaining the threat identification results of all attack events and the result conversion values ​​corresponding to the vulnerability identification, performing comprehensive conversion, and obtaining the real-time conversion index of the target intranet and extranet; A current security level corresponding to the current real-time conversion index is determined based on the real-time conversion index.

7. The method for comprehensive security analysis of internal and external networks as claimed in claim 6, characterized in that: The comprehensive security analysis result includes taking the inconsistency index of the target internal and external network as the first security reference for the comprehensive security analysis of the target internal and external network; Use the current security level of the target's internal and external networks as the second security reference for comprehensive security analysis of the target's internal and external networks; Convert the first security reference and the second security reference into a first value and a second value of the comprehensive security analysis of the target internal and external networks based on a preset conversion formula; Performing weighted processing based on the first value and the second value to obtain an initial analysis result of the comprehensive security analysis of the target internal and external networks; The initial analysis results are optimized based on the preset interference factors to obtain the comprehensive security analysis results of the target internal and external networks.

8. A system based on the method for comprehensive security analysis of internal and external networks according to any one of claims 1 to 7, characterized in that: It includes an index determination module, an identification determination module, a level determination module and a safety analysis module; The index determination module searches for log templates of original security logs of target intranet and intranet networks, and compares all searched log templates with the real-time log streams of the target intranet and intranet networks to determine the inconsistency index; The identification and determination module determines the threat recognition and vulnerability recognition of the corresponding attack event based on all attack events of the target internal and external networks within a specified time period including the current moment and the blocking events matched with each attack event; The level determination module determines the current security level of the target intranet and extranet based on the threat identification and vulnerability identification of all attack events; The security analysis module performs a comprehensive analysis on the inconsistency index and current security level of the target internal and external networks to obtain a comprehensive security analysis result of the target internal and external networks.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images