Attack chain restoration method and device, product, equipment and medium

Abstract

The invention discloses an attack chain restoration method and device, a product, equipment and a medium, and the method comprises the steps: mapping an alarm into a first attack type, and enabling the first attack type to be an attack type divided based on an attack mode; the first attack type is matched with a scenarized model, and the scenarized model is a model which is created based on an intrusion scene and comprises a second attack type corresponding to the intrusion scene; the matching condition of the scenarized model is that the first attack type is at least matched with a preset attack type in the second attack types; and when the matching condition of any scenarized model is met, restoring the attack chain based on the first attack type matched with the second attack type. Therefore, the attack types are divided based on the attack mode, the alarm is mapped into the attack type with finer granularity, and the attack chain is restored under the condition that the matching condition of the scenarized model is met, so that the accuracy of attack chain restoration can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an attack chain restoration method, device, product, equipment and medium. Background Art

[0002] An intrusion attack may cause security devices to generate many alarms. If they are only displayed in a list, there are two problems. First, it is impossible to clearly understand whether there is a connection between alarms. It is necessary to analyze each alarm, which increases the cost of tracing. Second, it is impossible to intuitively see the entire intrusion process. The intrusion process can only be restored through manual analysis. Attack chain restoration is to restore the entire intrusion process and form a complete intrusion alarm attack chain.

[0003] Existing attack chain restoration solutions usually refer to the attack stage or the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework for association. This association method abstracts the alarms into attack stages for association, which is easy to associate with non-critical alarms. The association is inaccurate, resulting in inaccurate attack chain restoration. Summary of the invention

[0004] In view of this, the purpose of this application is to provide an attack chain restoration method, device, product, equipment and medium, which can improve the accuracy of attack chain restoration. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses an attack chain restoration method, comprising:

[0006] Mapping the alarm to a first attack type, wherein the first attack type is an attack type classified based on an attack method;

[0007] Matching the first attack type with a scenario-based model, wherein the scenario-based model is a model created based on an intrusion scenario and includes a second attack type corresponding to the intrusion scenario, and a matching condition of the scenario-based model is that the first attack type matches at least a preset attack type in the second attack type;

[0008] When the matching condition of any scenario model is met, the attack chain is restored based on the first attack type that matches the second attack type.

[0009] Optionally, before mapping the alarm to the first attack type, the method further includes:

[0010] Using the security baseline to determine whether the alarm is a false alarm;

[0011] If the alarm is a false alarm, filtering out the alarm;

[0012] If the alarm is not a false alarm, the step of mapping the alarm to the first attack type is triggered.

[0013] Optionally, the using the security baseline to determine whether the alarm is a false alarm includes:

[0014] Determine whether the alarm is a false alarm based on the preset rules in the security baseline, wherein the preset rules include one or more of the following rules:

[0015] The alarm is triggered a number of times within a first preset time period that reaches a first preset threshold;

[0016] The number of target unit times within the second preset time corresponding to the alarm reaches a second preset threshold, wherein the target unit time is the unit time that triggered the alarm;

[0017] The alarm is an alarm of the same type triggered by multiple devices sending requests to the same device.

[0018] Optionally, the first attack type is an attack type divided based on attack method and alarm type, wherein the alarm type includes traffic alarm and terminal alarm, the traffic alarm is an alarm generated by security equipment detecting network attacks, and the terminal alarm is an alarm generated by terminal security software.

[0019] Optionally, the scenario model corresponds to multiple matching conditions, and when any matching condition among the multiple matching conditions is met, it is determined that the alarm meets the matching condition of the scenario model.

[0020] Optionally, when the scenario model is an upload vulnerability model, the second attack type includes external network vulnerability exploitation, abnormal terminal file creation behavior, C2 communication, abnormal terminal command execution, and intranet lateral vulnerability exploitation, and the matching condition is:

[0021] The first attack type at least matches the external network vulnerability exploitation and terminal abnormal file creation behavior in the second attack type;

[0022] Or, the first attack type at least matches the external network vulnerability exploitation and C2 communication in the second attack type;

[0023] Or, the first attack type at least matches the external network vulnerability exploit and terminal abnormal command execution in the second attack type.

[0024] In a second aspect, the present application discloses an attack chain restoration device, comprising:

[0025] A type mapping module, used to map the alarm to a first attack type, wherein the first attack type is an attack type classified based on an attack method;

[0026] a scenario matching module, configured to match the first attack type with a scenario model, wherein the scenario model is a model created based on an intrusion scenario and includes a second attack type corresponding to the intrusion scenario, and a matching condition of the scenario model is that the first attack type matches at least a preset attack type in the second attack type;

[0027] An attack chain restoration module is used to restore the attack chain based on the first attack type matching the second attack type when the matching condition of any scenario model is met.

[0028] In a third aspect, the present application discloses a computer program product, which implements the aforementioned attack chain restoration method when executed.

[0029] In a fourth aspect, the present application discloses an electronic device, including a memory and a processor, wherein:

[0030] The memory is used to store the computer program;

[0031] The processor is used to execute the computer program to implement the aforementioned attack chain restoration method.

[0032] In a fifth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned attack chain restoration method when executed by a processor.

[0033] It can be seen from the above scheme that the present invention provides an attack chain restoration method, including: mapping an alarm to a first attack type, wherein the first attack type is an attack type divided based on an attack method; matching the first attack type with a scenario model, wherein the scenario model is a model created based on an intrusion scenario and includes a second attack type corresponding to the intrusion scenario, and the matching condition of the scenario model is that the first attack type at least matches a preset attack type in the second attack type; when the matching condition of any scenario model is met, restoring the attack chain based on the first attack type matching the second attack type. .

[0034] It can be seen that the beneficial effects of the present application are: dividing the attack types based on the attack methods, with a finer granularity than the attack stages, mapping the alarms to finer-grained attack types, matching them with the attack models created based on the intrusion scenarios, and performing attack chain restoration when the matching conditions of the scenario-based models are met, thus avoiding the use of alarms that are not related to the attack scenarios for restoration, making the restoration more in line with the intrusion scenarios and improving the accuracy of the attack chain restoration.

[0035] Correspondingly, an attack chain restoration device, product, equipment and readable storage medium provided by the present application also have the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0037] Figure 1 A flow chart of an attack chain restoration method provided in an embodiment of the present application;

[0038] Figure 2 A schematic diagram of attack chain restoration provided in an embodiment of the present application;

[0039] Figure 3 A specific attack chain restoration method flow chart provided in an embodiment of the present application;

[0040] Figure 4 A specific attack chain restoration schematic diagram provided in an embodiment of the present application;

[0041] Figure 5 A system architecture diagram using an attack chain restoration solution provided in an embodiment of the present application;

[0042] Figure 6 A schematic diagram of the structure of an attack chain restoration device provided in an embodiment of the present application;

[0043] Figure 7 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] The attack chain describes the entire network attack steps of a hacker attack from the initial stage, reconnaissance to the final stage - data leakage. The attack chain model uses different steps to describe each stage of the network attack life cycle. The existing attack chain restoration refers to the attack stage or the ATT&CK framework for association. The ATT&CK framework is also classified according to the attack stage, such as the reconnaissance stage, resource development, initial access, execution, etc., without understanding that the alarm itself is only abstracted into stages for association. The association granularity is too coarse, and it is easy to associate with non-critical alarms. Even the associated intrusions are not a malicious attack. They may be false alarms and false alarms that are associated, resulting in the attack chain restoration being not accurate enough. To this end, the present application provides an attack chain restoration solution that can improve the accuracy of attack chain restoration.

[0046] See also Figure 1 As shown, the embodiment of the present application discloses an attack chain restoration method, including:

[0047] Step S11: Map the alarm to a first attack type, wherein the first attack type is an attack type classified based on an attack method.

[0048] Among them, the alarm may include traffic alarm and terminal alarm. The traffic alarm is an alarm generated by the security device detecting a network attack, that is, an alarm log generated after the network attack is detected by the security device, such as SQL (Structured Query Language) injection attack alarm, command injection attack alarm, etc. Security equipment refers to a device used to protect computer systems and networks from threats such as unauthorized access, attack, destruction or leakage. The terminal alarm is an alarm generated by terminal security software, that is, an alarm log generated by EDR (Endpoint Detection and Response) software such as terminal antivirus, for example, when the terminal antivirus detects that the terminal has downloaded a virus file, an alarm will be generated, and when the terminal antivirus detects that the terminal is remotely controlled, an alarm will be generated. It can be understood that an intrusion may trigger multiple alarms. In this embodiment, each alarm can be mapped to the first attack type corresponding to the alarm.

[0049] In this embodiment, the first attack type can be divided based on the attack method, which can be understood as a specific attack method, such as: detection, command execution, downloading, account blasting, webshell (i.e., command execution environment) upload, etc., which is finer than the attack stage. Of course, when dividing, the attack stage will also be considered. Different attack stages must be divided into different types. The attack stage can include information collection, execution, lateral, external connection, etc.

[0050] In an optional implementation, the first attack type is an attack type classified based on attack methods and alarm types, wherein the alarm types include traffic alarms and terminal alarms. That is, in this embodiment, when performing the first attack type classification, the alarm type and attack method may be considered to more reasonably map the alarm to the corresponding attack type, thereby avoiding alarms with a low correlation with the attack scenario.

[0051] Furthermore, when performing the first attack type classification, the attack direction can also be considered. The attack direction can be understood as the path chosen by the attacker to launch the attack, which can include external attack directions and internal attack directions. The external attack direction can be understood as the attacker attacking the target system from outside the network, such as using the network entry point of the target system (such as Web servers, mail servers, etc.) to find and exploit security vulnerabilities. The external attack direction usually involves remote attacks, such as remote code execution, SQL injection, cross-site scripting attacks, etc. The internal attack direction can be understood as the attacker exploiting vulnerabilities or weaknesses inside the target system to attack. By considering the attack direction and attack method, richer information can be provided for attack chain restoration. For example, if the attack method is a vulnerability attack, it can be distinguished based on the direction as an external vulnerability attack or an internal vulnerability attack.

[0052] In an optional implementation, the alarm can be mapped to the first attack type based on the configuration file, that is, there is a mapping relationship between the alarm and the first attack type in the configuration file. For the mapping logic corresponding to different types of alarms, for example, brute force and weak passwords will be mapped to account attacks. The first attack type can be described by two dimensions, including attack method and attack direction. For example, there is a mapping table in the configuration file, and the first attack type can be described by two columns, namely attack method and attack direction. The two dimensions can also be merged and described by one dimension. The key information of the alarm can be stored in the configuration file, that is, the mapping relationship between the alarm and the first attack type can be expressed as a mapping of the key information of the alarm to the first attack type. In the specific process of mapping the alarm to the first attack type in this embodiment, the key information of the alarm can be extracted, and based on the configuration file, the extracted key information is matched with the key information in the configuration file, and then the alarm is mapped to the first attack type.

[0053] Further, in an optional implementation, the first attack type corresponding to the traffic alarm may include: account attack (such as blasting, weak password), external network vulnerability attack, intranet horizontal vulnerability exploitation, intranet host-port detection, intranet remote command execution, download, C2 (i.e. Command and Control) communication (such as webshell, rebound shell, CS (i.e. Circuit Switching, circuit switching), etc.), intelligence, etc. Intranet horizontal attack vulnerabilities may include intranet privilege escalation vulnerabilities, horizontal command execution vulnerabilities, etc. Intranet host-port detection may include: IP (i.e. Internet Protocol Address Internet Protocol Address) scanning, port scanning, etc. Intranet remote command execution may include smb (i.e. Server Message Block) remote command execution, remote creation of scheduled tasks. Downloads may include webshell downloads and malicious script downloads. Intelligence may include IP intelligence, domain name intelligence, and md5 (i.e. Message Digest Algorithm 5, message digest algorithm fifth edition) intelligence. Terminal behavior is a point on the attack chain, so there is no need to subdivide it into too many categories. The first attack type corresponding to the terminal alarm can include abnormal command execution, abnormal network request, abnormal file creation behavior, and other abnormal behaviors. External network vulnerability attacks can include webshell upload vulnerabilities, SQL injection vulnerabilities, etc.

[0054] Among them, account attack refers to the attacker's attempt to illegally obtain, guess or steal user account information (such as username and password) to access the system or service. It is usually carried out through brute force cracking (trying all possible password combinations), dictionary attack (using a list of common passwords), phishing attack (deceiving users to reveal passwords) or using known password leakage databases. External network vulnerability attack, also known as external network vulnerability exploitation, refers to the attacker's use of security vulnerabilities in services or systems on the Internet (such as unpatched software vulnerabilities, insecure configurations, etc.) to perform malicious operations, such as data leakage, service denial, system control, etc. These vulnerabilities may be public or unknown, but they all require attackers to have the corresponding knowledge and tools to exploit them. Intranet horizontal vulnerability exploitation usually occurs after the attacker has successfully invaded a host in the network. The attacker will use the vulnerabilities or permissions on this host to further attack other hosts in the network, thereby horizontally expanding the scope of the attack. This type of attack is common in the enterprise intranet environment. The attacker can gradually control the entire network through a successful invasion. Intranet host-port detection is an attacker in the intranet environment using scanning technology to discover hosts, open ports and services in the network. This helps attackers understand the intranet topology, identify potential service vulnerabilities, and prepare for subsequent vulnerability exploits and attacks. Intranet remote command execution refers to the attacker exploiting vulnerabilities or improper configurations in the intranet to remotely execute commands to control the target host, such as smb remote command execution, psexec command (i.e. remote process execution command) execution, remote creation of scheduled tasks, etc. This attack method allows attackers to execute arbitrary code or commands directly on the controlled host to obtain sensitive information, destroy data, or further control the network. Downloading can be understood as the attacker downloading files or data from the controlled host or server. These files may be malware, sensitive data, or tools for further attacks. The download operation may be a link in the attack process to obtain more information or perform more complex attacks. C2 communication refers to the communication process between the attacker and the controlled host (also known as the botnet node). The attacker sends instructions to the controlled host through C2 communication to control it to perform malicious operations and receive feedback information from the controlled host. C2 communication is a key mechanism for maintaining the attacker's long-term control over the infected network. Intelligence refers to information and knowledge about network threats, vulnerabilities, attacker behavior, etc. Intelligence can help organizations understand the current threat environment, predict potential security risks, and develop corresponding defense strategies. Intelligence collection and analysis are important components of network security defense.

[0055] Abnormal command execution refers to the process executing some high-risk and uncommon command operations, such as executing high-risk commands such as whoami, creating scheduled tasks and other uncommon operations. Abnormal network requests refer to the process accessing some uncommon and malicious addresses, such as accessing malicious domain names, using jndi (Java Naming and Directory Interface) to connect to external network addresses, etc. Abnormal file creation behavior refers to the process creating a specific file in a specific location, and there is an abnormality, such as creating a dynamic script in the web upload file directory. Other abnormal behaviors: including abnormal operations of various processes, such as modifying the registry, etc.

[0056] Step S12: Match the first attack type with a scenario-based model, wherein the scenario-based model is a model created based on an intrusion scenario and includes a second attack type corresponding to the intrusion scenario, and a matching condition of the scenario-based model is that the first attack type matches at least a preset attack type in the second attack type.

[0057] Among them, the intrusion scenario can be understood as a security threat or attack event, including various situations in which hackers or malicious users unauthorizedly access, operate or destroy systems, networks or data. The scenario model is a model created based on various intrusion scenarios. Different intrusion scenarios can correspond to different scenario models, and each intrusion scenario can correspond to several second attack types. It can be understood that the classification rules of the second attack type are consistent with the first attack type, that is, they can be divided according to the attack method, attack direction and alarm type.

[0058] This example implementation can divide the attack types based on the attack method, attack direction and alarm type, and generate a first configuration file and a second configuration file. The first configuration file is the configuration file used to map the alarm to the first attack type. The attack type in the first configuration file is recorded as the first attack type. The second configuration file is a configuration file for storing scenario models. The attack type in the second configuration file is recorded as the second attack type. That is, the intrusion scenario can be analyzed, the attack type that appears in the intrusion scenario can be analyzed, and the attack type that appears in each intrusion scenario can be set to obtain the scenario model corresponding to each intrusion scenario, and the scenario model corresponding to each intrusion scenario can be written into the second configuration file for scenario model matching.

[0059] In addition, the preset attack type can be understood as a specified second attack type that must be matched with the scenario model. For example, a scenario model includes four second attack types, and the preset attack types are two of them. The scenario model can correspond to a matching condition.

[0060] That is, the embodiment of the present application abstracts the traffic alarm and the terminal alarm into various attack types to match whether they meet various scenario models. The scenario model is abstracted based on the more common intrusion scenarios, including a set of attack types that may appear in the intrusion scenario. In this embodiment, the scenario models that can be constructed based on common intrusion scenarios can be divided into the following categories: vulnerability attack model, account attack model, virus model, and download model, etc. Among them, the vulnerability attack model can be understood as a scenario model created based on the vulnerability attack scenario. The vulnerability attack refers to the attacker using security vulnerabilities in the system, application or network to conduct unauthorized access, data theft, system damage and other malicious behaviors to the target through a series of technical means. The account attack model can be understood as a scenario model created based on the account attack scenario, corresponding to the scenario of a series of attacks using the account attack as a breakthrough. The virus model can be understood as a scenario model created based on the virus attack scenario, corresponding to the attack scenarios of some automated attack families of zombies, such as after taking down the intranet host through the intranet vulnerability, the intranet will be batched. Detection, exploitation of intranet vulnerabilities, virus implantation, etc. The download model corresponds to an attack scenario in which there is an obvious virus sample download process during the attack, and there are often external C&C (Command and Control) communication addresses or webshell communication-related operations.

[0061] In an optional implementation, the scenario model corresponds to multiple matching conditions, and when any of the multiple matching conditions is met, the alarm is determined to meet the matching condition of the scenario model. In a specific implementation, multiple matching conditions can be set for each scenario model according to actual conditions, and when one of the matching conditions is matched, it is determined to match the scenario model.

[0062] In an optional implementation, when the scenario model is an upload vulnerability model, the second attack type includes external network vulnerability exploitation, abnormal terminal file creation behavior, C2 communication, abnormal terminal command execution, and intranet lateral vulnerability exploitation, then the matching condition is: the first attack type at least matches the external network vulnerability exploitation and abnormal terminal file creation behavior in the second attack type; or, the first attack type at least matches the external network vulnerability exploitation and C2 communication in the second attack type; or, the first attack type at least matches the external network vulnerability exploitation and abnormal terminal command execution in the second attack type. That is, three matching conditions can be set, namely: the first attack type at least matches the external network vulnerability exploitation and abnormal terminal file creation behavior in the second attack type, the first attack type at least matches the external network vulnerability exploitation and C2 communication in the second attack type, and the first attack type at least matches the external network vulnerability exploitation and abnormal terminal command execution in the second attack type. When the first attack type matches one of the conditions, it can be determined to match the upload vulnerability model.

[0063] The upload vulnerability model is one of the vulnerability attack models. The upload vulnerability model corresponds to an actual intrusion scenario: a hacker discovers an arbitrary file upload vulnerability on a website on the external network. The hacker uses the vulnerability to upload a webshell, triggering a traffic-side webshell upload alarm (attack type: external network vulnerability exploitation) and a terminal webshell file detection alarm (attack type: terminal abnormal file creation behavior). After the upload is successful, webshell communication is performed (attack type: C2 communication), and then commands are executed through the webshell (attack type: terminal abnormal command execution). The host detection of the internal network is performed through the webshell (attack type: traffic horizontal host-port detection (that is, internal network horizontal vulnerability exploitation). The summarized scenario model is: external network vulnerability exploitation + terminal abnormal file creation behavior + C2 communication + terminal abnormal command execution + traffic horizontal host-port detection. Each scenario model has at least the minimum associated conditions that need to be met. For example, the minimum condition for the upload vulnerability model is: external network vulnerability exploitation + terminal abnormal file creation behavior or external network vulnerability exploitation + C2 communication or external network vulnerability exploitation + terminal abnormal command execution.

[0064] That is, each model has at least the minimum conditions that need to be met. For example, the minimum conditions for the upload vulnerability model are: external network vulnerability exploitation + abnormal terminal file creation behavior or external network vulnerability exploitation + C2 communication or external network vulnerability exploitation + abnormal terminal command execution. Each model has a minimum matching condition. For example, model A must meet at least 1 / 3 / 5 attack types. If an attack has 1 / 2 / 3 / 5 attack types, it meets model A. If an attack has only 1 / 2 / 5 / 7, it does not meet model A.

[0065] It is understandable that one intrusion may trigger multiple alarms. In this embodiment, the alarms occurring within a preset period may be mapped to the first attack type, thereby matching the scenario model, or a preset number of consecutive alarms may be mapped to the first attack type, thereby matching the scenario model. In the case where an intrusion event can be identified, multiple alarms corresponding to the intrusion event may be mapped to the first attack type, thereby matching the scenario model.

[0066] Step S13: When the matching condition of any scenario model is met, the attack chain is restored based on the first attack type that matches the second attack type.

[0067] It can be understood that the first attack type that matches the second attack type includes at least the preset attack type in the matching condition, and may also include the first attack type that matches other second attack types in the scenario model. In this embodiment, when the matching condition of any of the scenario models is met, the attack chain is restored based on the first attack type that matches the second attack type. If the matching condition of the scenario model is not met, the attack chain is not restored using the first attack type mapped to the alarm. And, when a scenario model is matched, the attack chain is restored. If an intrusion event matches multiple scenario models, the alarms are aggregated into an attack chain. Restoration can be understood as combining various types of attacks into an attack chain. Aggregation can be understood as splicing the first attack types matched by multiple scenario models into the same attack chain. Restoring an alarm of a network intrusion into an attack chain can more intuitively display the intrusion process.

[0068] See also Figure 2 As shown, Figure 2A schematic diagram of attack chain restoration provided for an embodiment of the present application. The attack chain restoration is performed based on the matched first attack type. The attack chain is as follows: the hacker uses namp (NetworkMapper, a network connection terminal scanning software) to scan the intranet address through IP: 198.202, and scans the IP address: 192.168.138.20. Then, through the shiro deserialization vulnerability, the host is made to download a frp (Fast Reverse Proxy, a high-performance reverse proxy application) software and execute it. The hacker IP: 198.202 subsequently uses frp to connect and control 192.168.138.20. IP: 198.202 controls 192.168.138.20 to perform database blasting on IP: 138.99. Among them, the Shiro deserialization vulnerability is that when the Shiro framework processes the RememberMe function, it will encrypt and encode the cookie generated after the user successfully logs in. As long as the attacker finds the encrypted key, he can construct a malicious object, serialize, encrypt and encode it, and then send it as the RememberMe field of the cookie. After receiving the cookie, Shiro will decrypt and deserialize it, thus triggering the vulnerability.

[0069] It can be seen that the embodiment of the present application divides attack types based on attack methods, and the division granularity is finer than that of the attack stage. Alarms are mapped to finer-grained attack types, which are matched with attack models created based on intrusion scenarios. When the matching conditions of the scenario model are met, the attack chain is restored, avoiding the use of alarms that are not related to the attack scenario for restoration. The restoration is more in line with the intrusion scenario, and the accuracy of attack chain restoration can be improved.

[0070] See also Figure 3 As shown, the embodiment of the present application discloses a specific attack chain restoration method, including:

[0071] Step S21: Use the security baseline to determine whether the alarm is a false alarm.

[0072] The security baseline includes a preset rule for determining whether an alarm is a false alarm. If the preset rule is met, the alarm is determined to be a false alarm. Otherwise, the alarm is not a false alarm. In this embodiment, the preset rule in the security baseline may be used to determine whether the alarm is a false alarm. The preset rule includes one or more of the following rules:

[0073] The alarm is triggered a number of times within a first preset time period that reaches a first preset threshold;

[0074] The number of target unit times within the second preset time corresponding to the alarm reaches a second preset threshold, wherein the target unit time is the unit time that triggered the alarm;

[0075] The alarm is an alarm of the same type triggered by multiple devices sending requests to the same device.

[0076] For example, the first preset time period may be 1 day, that is, the same alarm is triggered multiple times in one day. The second preset time period may be 1 week, with the unit time being 1 day, that is, the same alarm is triggered on multiple days in a week. The second preset time period may be 1 day, with the unit time being hourly segments, that is, the same alarm is triggered in multiple hourly segments.

[0077] It should be pointed out that both traffic alarms and terminal alarms have false alarms. Many alarms are not triggered by real attacks, but by normal internal business of customers. If such false alarms are involved in attack chain restoration, the attack chain will be polluted or even the entire attack chain will be false alarms. Baseline filtering requires the establishment of an alarm baseline first. For example, a 7-day baseline is established for all alarms, and the alarms that occur every day for each host are recorded. Generally, if it is a normal business, it will be triggered frequently. The baseline can be used to determine whether it is a normal business. There are many dimensions for determination, including: the same alarm appears for multiple days, the same alarm is triggered in multiple hourly periods, multiple hosts trigger the same rule alarm for the same host, the same alarm is triggered multiple times on the same day, etc. These dimensions can be used alone as conditions for identifying business false alarms, or multiple dimensions can be combined to determine whether it is a normal business false alarm. Multiple hosts triggering the same rule alarm for the same host can be understood as many computers initiating similar requests to the same server, resulting in the triggering of the same rule alarm. For example, three laptops A / B / C all initiate a request similar to SQL injection to server D. Security detection device E analyzes the request and finds that SQL injection rule F is triggered, which means an F-type alarm is generated.

[0078] Step S22: If the alarm is a false alarm, filter out the alarm.

[0079] That is, if the security baseline determines that the alarm is a false alarm, the alarm is filtered out and the attack chain restoration is not performed based on the alarm.

[0080] Step S23: If the alarm is not a false alarm, the alarm is mapped to a first attack type, wherein the first attack type is an attack type classified based on an attack method.

[0081] Step S24: Match the first attack type with a scenario-based model, wherein the scenario-based model is a model created based on an intrusion scenario and includes a second attack type corresponding to the intrusion scenario, and a matching condition of the scenario-based model is that the first attack type matches at least a preset attack type in the second attack type.

[0082] Step S25: When the matching condition of any scenario model is met, the attack chain is restored based on the first attack type that matches the second attack type.

[0083] For the contents of the above steps S23 to S25, reference may be made to the contents disclosed in the above embodiments, which will not be elaborated here.

[0084] It can be seen that when performing attack chain restoration, the embodiment of the present application first uses the security baseline to filter the alarms, filters out the false alarms, and does not participate in the subsequent attack chain restoration. In this way, it is possible to avoid the false alarms from participating in the attack chain restoration, resulting in the attack chain being contaminated or even the entire attack chain being a false alarm, thereby further improving the accuracy of the attack chain restoration.

[0085] For example, see Figure 4 As shown, Figure 4A specific attack chain restoration schematic diagram disclosed in the embodiment of the present application. First, the traffic alarms and terminal alarms generated by the security equipment and terminal security software are filtered using the preset rules in the security baseline, so as to filter the false positives, and then the abstract type is used, that is, the alarm is mapped to the first attack type based on the configuration file. The first attack type is an attack type divided based on the attack method. The types corresponding to the traffic alarm may include: account attack (including blasting, weak password), external network vulnerability attack, intranet horizontal vulnerability exploitation, intranet host-port detection, intranet remote command execution, download, C2 communication (webshell, rebound shell, CS, etc.), intelligence, etc. The terminal behavior is a point on the attack chain, so there is no need to subdivide too many categories. Here, it is classified into: abnormal command execution, abnormal network request, abnormal file creation behavior, and other abnormal behaviors. Then the first attack type is matched with the scenario model. The scenario model is a model built based on common intrusion scenarios, and each scenario model contains the second attack type corresponding to the intrusion scenario. The scenario model may include a vulnerability attack model, an account attack model, a virus model, and a download model. The attack chain is restored based on the first attack type matched to the scenario model. As long as one of the scenario models is met, the attack chain will be restored. If an intrusion event meets multiple scenario models, the alarms will be aggregated into an attack chain. In this way, the alarms triggered by normal internal business of the customer are filtered as false alarms according to the security baseline, avoiding the problem of participating in the attack chain restoration, which will cause the attack chain to be polluted or even the entire attack chain to be a false alarm. After that, the attack type is abstracted into a more fine-grained attack type based on the attack method, and then matched with the scenario model built based on common intrusion scenarios, so that the alarm of an intrusion can be accurately associated and restored into an attack chain.

[0086] See also Figure 5 As shown, Figure 5 A system architecture diagram using an attack chain restoration solution provided in an embodiment of the present application. Specifically, it may include: an attack chain restoration device and a display terminal for establishing a communication connection with an electronic device. The attack chain restoration device is an electronic device for users to restore the attack chain, which may be a server, a personal computer (PC), etc. The server may be a physical server or a cloud server. The display terminal includes, but is not limited to, a tablet computer, a laptop computer, and a personal computer, which are not limited here.

[0087] In the present application, the attack chain restoration device can obtain traffic alarms and terminal alarms generated by security devices and terminal security software, first filter the alarms using the preset rules in the security baseline to filter out false alarms, and then map the alarms to a first attack type, wherein the first attack type is an attack type divided based on the attack method; match the first attack type with a scenario model, wherein the scenario model is a model created based on an intrusion scenario and includes a second attack type corresponding to the intrusion scenario, and the matching condition of the scenario model is that the first attack type at least matches the preset attack type in the second attack type; when the matching condition of any of the scenario models is met, the attack chain is restored based on the first attack type that matches the second attack type. The attack chain restoration device can push the relevant data of the attack chain to the display terminal for display via the network.

[0088] In another optional implementation, if the attack chain restoration device includes a display function, the attack chain may also be displayed on the attack chain restoration device.

[0089] See also Figure 6 As shown, the embodiment of the present application discloses an attack chain restoration device, including:

[0090] A type mapping module 11, configured to map an alarm to a first attack type, wherein the first attack type is an attack type classified based on an attack method;

[0091] A scenario matching module 12, configured to match the first attack type with a scenario model, wherein the scenario model is a model created based on an intrusion scenario and includes a second attack type corresponding to the intrusion scenario, and a matching condition of the scenario model is that the first attack type matches at least a preset attack type in the second attack type;

[0092] The attack chain restoration module 13 is used to restore the attack chain based on the first attack type matching the second attack type when the matching condition of any scenario model is met.

[0093] In an optional embodiment, the device may also include a false alarm filtering module, which is used to use the security baseline to determine whether the alarm is a false alarm before the type mapping module 11 maps the alarm to the first attack type; if the alarm is a false alarm, the alarm is filtered out; if the alarm is not a false alarm, the type mapping module 11 is triggered to map the alarm to the first attack type.

[0094] In an optional implementation, the false alarm filtering module is used to determine whether the alarm is a false alarm based on a preset rule in the security baseline, wherein the preset rule includes one or more of the following rules:

[0095] The alarm is triggered a number of times within a first preset time period that reaches a first preset threshold;

[0096] The number of target unit times within the second preset time corresponding to the alarm reaches a second preset threshold, wherein the target unit time is the unit time that triggered the alarm;

[0097] The alarm is an alarm of the same type triggered by multiple devices sending requests to the same device.

[0098] In an optional implementation, the first attack type is an attack type divided based on an attack method and an alarm type, wherein the alarm type includes a traffic alarm and a terminal alarm, the traffic alarm is an alarm generated by a security device detecting a network attack, and the terminal alarm is an alarm generated by terminal security software.

[0099] In an optional implementation, the scenario model corresponds to multiple matching conditions, and when any matching condition among the multiple matching conditions is met, it is determined that the alarm meets the matching condition of the scenario model.

[0100] In an optional implementation, when the scenario model is an upload vulnerability model, the second attack type includes external network vulnerability exploitation, abnormal terminal file creation behavior, C2 communication, abnormal terminal command execution, and intranet lateral vulnerability exploitation, then the matching condition is: the first attack type at least matches the external network vulnerability exploitation and abnormal terminal file creation behavior in the second attack type; or, the first attack type at least matches the external network vulnerability exploitation and C2 communication in the second attack type; or, the first attack type at least matches the external network vulnerability exploitation and abnormal terminal command execution in the second attack type.

[0101] It can be seen that the embodiment of the present application divides attack types based on attack methods, and the division granularity is finer than that of the attack stage. Alarms are mapped to finer-grained attack types, which are matched with attack models created based on intrusion scenarios. When the matching conditions of the scenario model are met, the attack chain is restored, avoiding the use of alarms that are not related to the attack scenario for restoration. The restoration is more in line with the intrusion scenario, and the accuracy of attack chain restoration can be improved.

[0102] Furthermore, an embodiment of the present application discloses a computer program product, which implements the aforementioned attack chain restoration method when executed.

[0103] For the specific process of the above attack chain restoration method, reference may be made to the corresponding contents disclosed in the above embodiments, which will not be described in detail here.

[0104] Furthermore, an embodiment of the present application also provides an electronic device. Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0105] Figure 7 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the attack chain restoration method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be a server.

[0106] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0107] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222 and data 223, etc. The storage method may be temporary storage or permanent storage. The data 223 may include alarm data, etc.

[0108] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20 to implement the operation and processing of the data 223 in the memory 22 by the processor 21, and it can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the attack chain restoration method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0109] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the attack chain restoration method disclosed in the aforementioned embodiment.

[0110] For the specific process of the above attack chain restoration method, reference may be made to the corresponding contents disclosed in the above embodiments, which will not be described in detail here.

[0111] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0112] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0113] The above is a detailed introduction to an attack chain restoration method, device, product, equipment and medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An attack chain restoration method, characterized in that: include: Mapping the alarm to a first attack type, wherein the first attack type is an attack type classified based on an attack method; Matching the first attack type with a scenario-based model, wherein the scenario-based model is a model created based on an intrusion scenario and includes a second attack type corresponding to the intrusion scenario, and a matching condition of the scenario-based model is that the first attack type matches at least a preset attack type in the second attack type; When the matching condition of any scenario model is met, the attack chain is restored based on the first attack type that matches the second attack type.

2. The attack chain restoration method according to claim 1, characterized in that: Before mapping the alarm to the first attack type, the method further includes: Using the security baseline to determine whether the alarm is a false alarm; If the alarm is a false alarm, filtering out the alarm; If the alarm is not a false alarm, the step of mapping the alarm to the first attack type is triggered.

3. The attack chain restoration method according to claim 2, characterized in that: The using the security baseline to determine whether the alarm is a false alarm includes: Determine whether the alarm is a false alarm based on the preset rules in the security baseline, wherein the preset rules include one or more of the following rules: The alarm is triggered a number of times within a first preset time period that reaches a first preset threshold; The number of target unit times within the second preset time corresponding to the alarm reaches a second preset threshold, wherein the target unit time is the unit time that triggered the alarm; The alarm is an alarm of the same type triggered by multiple devices sending requests to the same device.

4. The attack chain restoration method according to claim 1, characterized in that: The first attack type is an attack type divided based on the attack method and the alarm type, wherein the alarm type includes traffic alarm and terminal alarm. The traffic alarm is an alarm generated by the security device detecting a network attack, and the terminal alarm is an alarm generated by the terminal security software.

5. The attack chain restoration method according to claim 1, characterized in that: The scenario model corresponds to multiple matching conditions. When any matching condition among the multiple matching conditions is met, it is determined that the alarm meets the matching condition of the scenario model.

6. The attack chain restoration method according to any one of claims 1 to 5, characterized in that: When the scenario model is an upload vulnerability model, the second attack type includes external network vulnerability exploitation, abnormal terminal file creation behavior, C2 communication, abnormal terminal command execution, and intranet lateral vulnerability exploitation, and the matching condition is: The first attack type at least matches the external network vulnerability exploitation and terminal abnormal file creation behavior in the second attack type; Or, the first attack type at least matches the external network vulnerability exploitation and C2 communication in the second attack type; Or, the first attack type at least matches the external network vulnerability exploit and terminal abnormal command execution in the second attack type.

7. An attack chain restoration device, characterized in that: include: A type mapping module, used to map the alarm to a first attack type, wherein the first attack type is an attack type classified based on an attack method; a scenario matching module, configured to match the first attack type with a scenario model, wherein the scenario model is a model created based on an intrusion scenario and includes a second attack type corresponding to the intrusion scenario, and a matching condition of the scenario model is that the first attack type matches at least a preset attack type in the second attack type; An attack chain restoration module is used to restore the attack chain based on the first attack type matching the second attack type when the matching condition of any scenario model is met.

8. A computer program product, characterized in that When the computer program product is executed, the attack chain restoration method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: comprising a memory and a processor, wherein: The memory is used to store the computer program; The processor is used to execute the computer program to implement the attack chain restoration method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the attack chain restoration method according to any one of claims 1 to 6 is implemented.

Images