Attack path restoration method and equipment

Abstract

The invention provides an attack path restoration method and equipment, which can be applied to the technical field of computers. The method comprises the following steps: monitoring the running state of an application program in each server by using an RASP agent installed on each server, and collecting key data of the application program in the running process; when an attack event is detected, alarm information is generated according to the key data, and a target server having an association relationship with the attack event in the servers is determined according to the alarm information; generating a server attack path according to the interaction relationship among the plurality of target servers; and generating an attack path corresponding to the attack event according to the server attack path and each component in the target server. According to the method, the attack path of the attack event can be quickly and accurately restored.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an attack path restoration method and device. Background Art

[0002] In the current network environment, intranet attacks occur frequently, posing a serious threat to the information security of enterprises.

[0003] Traditional World Wide Web (Web) application security products often face a large number of invalid attack requests when handling attacks, which will bring great burden and misjudgment to the security team. Runtime Application Self-Protection (RASP), as an emerging security protection technology, can eliminate a large number of invalid attack requests by real-time monitoring and protection when the application is running.

[0004] However, the above security protection measures are difficult to quickly and accurately restore the attack path of the attack event. Summary of the invention

[0005] The present application provides an attack path restoration method and device, which can quickly and accurately restore the attack path of an attack event.

[0006] In a first aspect, the present application provides an attack path restoration method, the method comprising:

[0007] Using the RASP agent installed on each server, monitor the running status of the application in each server and collect key data of the application during operation;

[0008] When an attack event is detected, generating alarm information according to the key data, and determining a target server among the servers that has an associated relationship with the attack event according to the alarm information;

[0009] Generate a server attack path according to the interaction relationship between the plurality of target servers;

[0010] An attack path corresponding to the attack event is generated according to the server attack path and various components in the target server.

[0011] In a possible implementation manner, the key data includes at least one of the following items: a request message, a response message, an access path, and an execution log; the alarm information includes a source IP address and a destination IP address;

[0012] The determining, according to the alarm information, a target server among the servers that has an association relationship with the attack event comprises:

[0013] The server corresponding to the destination IP address is determined as the target server.

[0014] In a possible implementation manner, generating a server attack path according to the interaction relationship between the plurality of target servers includes:

[0015] Obtain target warning information;

[0016] Marking the generation time of the target warning information as the first end time point;

[0017] Obtain historical alarm information within a preset time period before the first end time point, search for first historical alarm information whose destination IP address in the historical alarm information is the same as the source IP address in the target alarm information; and determine a first server that generates the first historical alarm information;

[0018] The target alarm information is replaced with the first historical alarm information, and the step of marking the generation time of the target alarm information as the first end time point is returned to execute until a preset execution deadline condition is met;

[0019] The server attack path is generated based on the determined interaction relationship between the first servers.

[0020] In a possible implementation manner, generating the attack path corresponding to the attack event according to the server attack path and each component in the target server includes:

[0021] Determine the interaction relationship between the components according to the server attack path and the components in the target server;

[0022] An attack path corresponding to the attack event is generated according to the interaction relationship between the various components.

[0023] In a possible implementation manner, determining the interaction relationship between the components according to the server attack path and the components in the target server includes:

[0024] Based on the server attack path, obtaining log information of each component in the target server;

[0025] According to the log information, the interaction relationship between the components is determined, where the interaction relationship includes at least one of the following: an API call relationship, a data transmission relationship, and a service request relationship.

[0026] In a possible implementation, the method further includes:

[0027] Determine a repair priority score for each server on the attack path, and determine a repair priority for each server on the attack path according to the repair priority score;

[0028] And / or, determining a severity score of each component on the attack path, and determining a repair priority of each component on the attack path based on the severity score.

[0029] In a second aspect, the present application provides an attack path restoration device, the device comprising:

[0030] A data collection module, for monitoring the running status of the applications in each server by using the RASP agent installed on the server, and collecting key data of the applications during the running process;

[0031] A node analysis module, configured to generate alarm information according to the key data when an attack event is detected, and determine a target server among the servers that has an associated relationship with the attack event according to the alarm information;

[0032] The attack path construction module is used to generate a server attack path according to the interaction relationship between multiple target servers; and to generate an attack path corresponding to the attack event according to the server attack path and each component in the target server.

[0033] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0034] The memory stores computer-executable instructions;

[0035] The processor executes the computer-executable instructions stored in the memory to implement the attack path restoration method provided in the first aspect.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, they are used to implement the attack path restoration method provided in the first aspect.

[0037] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the attack path restoration method provided in the first aspect.

[0038] The attack path restoration method and device provided in this application realize real-time monitoring and data collection of the application by installing and configuring the RASP agent on the server where the application is located. By associating the relevant servers and components in the attack event, the attack path can be accurately restored, helping enterprises to quickly analyze and respond to intranet attack events. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0040] Figure 1 A schematic diagram of a flow chart of an attack path restoration method provided in an embodiment of the present application;

[0041] Figure 2 Another schematic diagram of a flow chart of an attack path restoration method provided in an embodiment of the present application;

[0042] Figure 3 It is another flowchart of an attack path restoration method provided in an embodiment of the present application;

[0043] Figure 4 A schematic diagram of a component-level attack path provided in an embodiment of the present application;

[0044] Figure 5 A schematic diagram of an attack path in the server dimension provided in an embodiment of the present application;

[0045] Figure 6 A schematic diagram of the architecture of an attack path restoration system provided in an embodiment of the present application;

[0046] Figure 7 A schematic diagram of a program module of an attack path restoration device provided in an embodiment of the present application;

[0047] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0048] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0049] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0050] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0051] The following is an explanation of some of the technical terms involved in the embodiments of this application:

[0052] 1. RASP: A runtime application self-protection technology that detects and blocks potential attack behaviors by monitoring and protecting the security of applications during their operation.

[0053] 2. Attack path restoration: After an attack occurs, the attacker’s action path and attack process are restored by analyzing key data and event sequences in the attack process in order to conduct subsequent analysis and response.

[0054] 3. Proxy: In network communications, the proxy acts as a middleman between the client and the server, receiving and sending network requests and responses.

[0055] 4. Monitoring: refers to the continuous real-time observation and data collection of systems, applications, or networks to detect abnormal behavior or events.

[0056] 5. Intranet attack: refers to malicious attacks that occur within the internal network environment of an enterprise or organization, aiming to obtain sensitive information, destroy the system or other malicious purposes.

[0057] 6. Alarm information: During the monitoring process, alarm information is generated when the system or application detects abnormal or suspicious activities, which is used to indicate potential security risks or attack incidents.

[0058] 7. Egress network information: refers to the network path and related information for sending data in network communications, including network equipment, routing information, etc.

[0059] 8. Enterprise-level Network Information Security Operations Center (SOC): It is an enterprise-level network security platform that integrates various types of network security equipment, log collection services, and big data storage modules to ensure the safe and stable operation of the production system.

[0060] In the current network environment, intranet attacks occur frequently, posing a serious threat to the information security of enterprises and organizations.

[0061] Traditional Web application security products often face a large number of invalid attack requests when handling attacks, which will bring great burdens and misjudgments to the security team. RASP, as an emerging security protection technology, can eliminate a large number of invalid attack requests through real-time monitoring and protection when the application is running, and focus on discovering real known and unknown security threats.

[0062] However, it is still difficult to effectively deal with some attacks using RASP technology, so there is an urgent need for a method that can quickly and accurately restore the attack path.

[0063] In the face of the above technical problems, an attack path restoration method is provided in the embodiment of the present application. By installing and configuring the RASP agent on the server where the application is located, monitoring the operation of the application in the server and collecting relevant data, after an attack event occurs in the intranet, the relevant servers in a time sequence are associated based on the alarm information generated by RASP, and the relationship and interaction information between the various components in the application involved in the attack process are determined, and the attack path in the attack event is restored. Compared with traditional Web application security products, RASP filters out a large number of invalid attacks from a large number of attacks, focusing on discovering real known and unknown security threats, can clearly restore the attack path at the code line level, and quantify the priority of repairing each node, innovatively solving the problem of insufficient granularity and low accuracy of attack path restoration, can clearly display key component defect information, can improve the efficiency of operation and maintenance personnel in attack event analysis and emergency response, and provide comprehensive protection for the information security of enterprises and organizations.

[0064] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0065] Reference Figure 1 , Figure 1 The following is a flow chart of an attack path restoration method provided in an embodiment of the present application. In some embodiments of the present application, the attack path restoration method includes:

[0066] S101. Using the RASP agent installed on each server, monitor the running status of the application in each server and collect key data of the application during operation.

[0067] In some implementations, a RASP agent may be installed and configured on a server where the application is located to monitor the operation of the application in the server and collect key data.

[0068] Optionally, the above key data includes request messages, response messages, access paths, execution logs, etc.

[0069] S102: When an attack event is detected, alarm information is generated according to the key data, and a target server associated with the attack event is determined among the servers according to the alarm information.

[0070] Optionally, the above alarm information includes source IP address information, destination IP address information, port information, egress network information, etc.

[0071] In some implementations, after an intranet attack occurs, based on the alarm information generated by RASP, relevant servers over a time series are associated, and the relationship and interaction information between various components in the application involved in the attack process are determined.

[0072] S103: Generate a server attack path according to the interaction relationship between the plurality of target servers.

[0073] In some implementations, the servers involved in the entire attack event may be associated based on the interaction relationship between the plurality of target servers, and an attack path at the server layer may be generated.

[0074] S104: Generate an attack path corresponding to the above attack event according to the server attack path and various components in the target server.

[0075] In some embodiments, after the attack path is confirmed, each server on the attack path is regarded as a node, the servers that generate alarm information are marked, each marked server node is processed, the RASP log information of the server during that period is collected, and the interaction information between the components when the alarm is generated is determined.

[0076] In some implementations, based on the server attack path and the interaction information between the above components, an attack path corresponding to the above attack event may be generated.

[0077] In the embodiment of the present application, by installing and configuring the RASP agent on the target server, real-time monitoring and data collection of the application can be achieved, the operation of the application in the server can be monitored and relevant data can be collected: the RASP agent regularly monitors the operation status of the application in the server, collects key data, including but not limited to request messages, response messages, access paths, execution logs, etc., and stores them in the enterprise-level network information security operation center. By collecting the alarm information of the intranet attack event, according to the monitoring data of the RASP agent, when the intranet attack event is detected, the corresponding alarm information is generated; the relevant servers in the attack event are associated, and the relevant server components in a time series are associated based on the key data in the alarm information, so as to determine the attack path of the attack event.

[0078] The attack path restoration method provided in the embodiment of the present application realizes real-time monitoring and data collection of the application by installing and configuring the RASP agent on the server where the application is located. By associating the relevant servers and components in the attack event, the attack path can be accurately restored, helping enterprises to quickly analyze and respond to intranet attack events.

[0079] In some embodiments, the above attack path restoration method may include the following steps:

[0080] S1. Data Collection

[0081] Collect RASP alarm information and process, file operation, network and other log data in server nodes.

[0082] The server corresponding to the destination IP address in the alarm information that triggers the generation of the attack path is defined as the server node.

[0083] S2. Server node association analysis and server node attack path construction

[0084] In some embodiments, including:

[0085] Obtain target warning information;

[0086] Marking the generation time of the target warning information as the first end time point;

[0087] Obtain historical alarm information within a preset time period before a first end time point, search for first historical alarm information whose destination IP address in the historical alarm information is the same as the source IP address in the target alarm information; and determine a first server that generates the first historical alarm information;

[0088] The target alarm information is replaced with the first historical alarm information, and the step of marking the generation time of the target alarm information as the first end time point is returned to execute until a preset execution deadline condition is met;

[0089] Based on the determined interaction relationship between the first servers, a server attack path is generated.

[0090] Exemplarily, in some embodiments, the node correlation can be analyzed based on the time series, and the time period TimeLine (the default is 24 hours, which can be customized) can be set. The time when the RASP alarm information is generated is used as the deadline TimeEnd, and the source address in the alarm information is used as the key information. The RASP alarm information collected by the enterprise-level network information security operation center during the entire time period of TimeLine is traced back. Before TimeEnd, if the destination IP address in other RASP alarm information is the same as the above key information, the server is used as a new server node, and the time when the RASP alarm is generated is used as the new TimeEnd.

[0091] Repeat the above steps to trace back to the time before the alarm on the TimeLine time series until you can no longer trace back or the traceback reaches the specified time.

[0092] In some implementations, a graph search algorithm may be applied to construct an attack path based on the interaction relationship between server nodes, where the path between server nodes has a direction A->B (indicating that the RASP alarm information of server node A occurs earlier than the RASP alarm information of server node B).

[0093] S3. Construction of component node attack path

[0094] In some implementations, the interaction relationship between the various components can be determined based on the above-mentioned server attack path and the various components in the above-mentioned target server; based on the interaction relationship between the various components, a component node attack path is generated, that is, the attack path corresponding to the above-mentioned attack event.

[0095] Exemplarily, in some embodiments, based on the server node attack path, the server log information of the corresponding node in the entire TimeLine can be associated with the RASP alarm information, and the relationship between component nodes can be marked based on the interaction frequency, data transmission volume, network connection method, etc., and the weight of the edge between component nodes is defined, where the direction of the component node is the data transmission direction.

[0096] Among them, the key components of the server application in the alarm information are defined as component nodes.

[0097] S4. Path Optimization

[0098] The attack path is displayed in a graphical way, clearly identifying the server nodes and component nodes, and showing the interaction relationship between the nodes. As new RASP alarm information is generated, the above steps are repeated to dynamically update the attack path, and a feedback mechanism is designed to allow security analysts to manually adjust and verify the attack path, improving the accuracy and readability of the attack path.

[0099] Reference Figure 2 , Figure 2 This is another flow chart of an attack path restoration method provided in an embodiment of the present application. In some embodiments of the present application, the attack path restoration method includes:

[0100] 1. Define attack path graph nodes

[0101] 1.1. Define server nodes

[0102] A server refers to a computer or device that provides specific services in a network. In an embodiment of the present application, a server node refers to a server corresponding to the destination address in the RASP alarm information generated by triggering the attack path in a network attack, that is, a server identified as being attacked.

[0103] For example, suppose a network attack attacks a web server by exploiting a vulnerability, resulting in data leakage. In this scenario, the web server is the server node.

[0104] 1.2. Define component nodes

[0105] Component nodes refer to key components within server nodes that can provide specific services or functions. In security monitoring, identifying component nodes helps to more accurately locate the impact scope and key assets of attacks.

[0106] For example, if a web server uses Apache as the web server software, and the attack is carried out through a known vulnerability of Apache, then Apache is a component node.

[0107] Optionally, the above-mentioned component nodes may also include: Web server software, application server, database management system, Web application framework, etc.

[0108] 2. Collect attack path map construction data

[0109] Collect and store RASP alarm information and log data of server nodes. For each server node, collect the interaction logs of its internal component nodes. For example, you can use search engines and data storage technologies such as Elasticsearch and Kafka to build log information indexes according to different log types to optimize query and search speed.

[0110] 2.1. Collecting warning information of intranet attack events

[0111] Purpose: To quickly identify and respond to intranet attacks and reduce potential losses.

[0112] Method: When the RASP agent detects an attack behavior, it automatically generates an alarm message and sends it to the security operation center.

[0113] Data type: source address IP, destination address IP, port information, protocol type, attack type, timestamp, etc.

[0114] 2.2. Collect interaction logs of internal component nodes

[0115] Purpose: Deploy RASP agents on servers to monitor application behavior in real time, record any abnormal or suspicious activities, and identify potential internal threats.

[0116] Method: Configure a logging system to capture all interactions between components, including Application Programming Interface (API) calls, database queries, etc., and send them to the security operation center.

[0117] Data types: including but not limited to request and response messages, access paths, execution logs, system resource usage; abnormal access patterns, unauthorized file access, suspicious system calls; communication records between components, error logs, transaction logs, etc.

[0118] 2.3 Data Storage

[0119] Purpose: Centrally manage and analyze security data to improve response speed and efficiency.

[0120] Method: The collected data is stored in the central database of the enterprise-level network information security operation center according to the corresponding format requirements of different types.

[0121] Data type: All collected security-related data, including alarms, logs, monitoring data, etc.

[0122] 3. Node correlation analysis in the attack path diagram

[0123] By using time series analysis, the source address in the alarm information is used as the key information, and the destination address consistent with the key information in other RASP alarm information is searched.

[0124] The purpose of node correlation analysis is to use time series analysis technology to identify and correlate security events that occurred within a specific time period, build a complete timeline and impact range of the attack event, and determine the propagation path and scope of the attack.

[0125] 3.1. Time window setting

[0126] A dynamic time window adjustment mechanism is adopted, allowing users to input a customized time window length as needed. The system automatically adjusts the timeline (TimeLine) based on the input. The default TimeLine is 24 hours.

[0127] During the node association relationship analysis process, if it is found that the associated event may exceed the current TimeLine, the system automatically expands the time window by 0.2*TimeLine. If more potential associated data is generated (that is, new node information is generated), the time window will continue to be expanded until no more associated data can be generated or the time window exceeds 2*TimeLine.

[0128] 3.2. Determine the starting point of the analysis

[0129] Monitor the alarm information generated by RASP in real time, use the server corresponding to the destination address in the RASP alarm information that triggers the attack path as the starting node, the server corresponding to the source address as the search node, and mark the corresponding alarm generation time as the end time corresponding to the node as TimeEnd.

[0130] 3.3. Identification of server node association

[0131] Go back to the RASP alarm information collected by the enterprise-level network information security operation center during the entire time period of TimeLine, use Python and other programming languages ​​to develop an automated script, and search for the alarm information whose destination address is consistent with the search node in the RASP alarm information generated before TimeEnd through regular expression matching. If found, there is a directed association A->B between the two server nodes, from server node A with an earlier alarm time to node server B with a later alarm time.

[0132] 3.4. Server Node Iteration Backtracking

[0133] The corresponding source address in the RASP alarm information in 3.3 is used as a new search node, and the generation time of the corresponding alarm information is used as the time mark TimeEnd of the search node. Based on the breadth-first search algorithm (Breadth-First Search, BFS), trace back to the alarm on the TimeLine time series until it is impossible to trace back further or the backtracking reaches the specified time.

[0134] 4. Server node attack path construction

[0135] The server node connection relationship generated in the above step 3 is used as the server node attack path.

[0136] 5. Construction of component node attack path

[0137] Based on the server node attack path, the log information in the server of the corresponding node in the entire TimeLine is associated with the RASP alarm information. Taking the server node as the boundary and the component as the unit of the server node, the node internal component interaction path and the path interaction between components are constructed respectively.

[0138] Among them, component = {component list, component attributes}.

[0139] Component inventory: List all components on each node, including but not limited to software, services, databases, etc.

[0140] Component attributes: record the version information, supplier, function description and other attributes of each component.

[0141] Through monitoring tools and log analysis, identify the interaction relationship between components, including API calls, data transmission, service requests, etc., track the flow of data between components, analyze the source and destination of data, count the frequency of interaction between components, and identify high-frequency interaction paths. If the log shows that there is a relationship between different components, there is an association between components, where the direction of component nodes is the data transmission direction. If the components interact with each other, the interaction direction is bidirectional. Based on the interaction frequency between components during the TimeLine, data transmission volume, network connection method, etc., mark the relationship between component nodes and calculate the risk value of interaction between components.

[0142] 5.1. Calculation of component interaction risk value within the same node, taking components a and b in the same server as an example:

[0143] The following factors should be considered for the interaction between components on the same node: frequency of component interaction, sensitivity of transmitted data, and component criticality.

[0144] Among them, the interaction frequency ratio, that is, the number of component communications during the TimeLine, C ab The number of communications between all components in the same server C sum The proportion of x:

[0145]

[0146] Component Interaction Frequency Score I ab It can be expressed as:

[0147]

[0148] Data sensitivity: Scoring is based on the sensitivity of data transmission between components, that is, the SOC data is graded based on each transmission data hit:

[0149] Non-sensitive data: 0 points;

[0150] Low sensitivity data: 2 points;

[0151] Moderately sensitive data: 5 points;

[0152] Highly sensitive data: 8 points;

[0153] Extremely sensitive data: 10 points.

[0154] Let T be the total number of data items, H i is the number of hit data in the i-th level. The value of i ranges from 1 to 5, corresponding to non-sensitive, low-sensitive, medium-sensitive, high-sensitive and extremely sensitive data respectively. The weight of each level of data is W i They are 0, 2, 5, 8, and 10 respectively. Data sensitivity score S ab The calculation formula can be expressed as:

[0155]

[0156] Component criticality: Score the component based on its importance to the system:

[0157] Non-critical components: 0 points;

[0158] Minor component: 2 points;

[0159] Important components: 5 points;

[0160] Key components: 8 points;

[0161] Core components: 10 points;

[0162] Component criticality score K ab The calculation formula can be expressed as:

[0163]

[0164] Among them, K a , K b Score the importance of components a and b to the system respectively.

[0165] Node internal component interaction risk value RI ab It can be expressed as:

[0166] RI ab =10×(ω1×I ab +ω2×S ab +ω3×K ab )

[0167] Optionally, ω1=0.3, ω2=0.5, ω3=0.2.

[0168] 5.2. Calculation of component interaction risk values ​​within different nodes, taking components m and n existing in different servers as an example:

[0169] The following factors should be considered when components on different nodes interact: the amount of data transmitted, the sensitivity of the transmitted data, the criticality of the component, the geographical location of the component relative to the node server, and the security measures between components.

[0170] Data transfer volume Score D mn , the design is based on the amount of data transmitted by the components on the two servers corresponding to all the component interactions involved. The following is the specific calculation method:

[0171] Define the following parameters:

[0172] Vall: corresponds to the data volume collection of all components interacting between two servers.

[0173] Vmedian: The median of Vall.

[0174] Vmean: The mean value of Vall.

[0175] Vmax: Maximum value in Vall.

[0176] Dmin: The minimum value of the data transmission volume score, set to 0.

[0177] Dmax: The maximum value of the data transfer volume score, set to 10.

[0178] In some embodiments, D mn Satisfies the following formula:

[0179]

[0180] Among them, V mn The amount of data interacted between components m and n.

[0181] Similarly, the data sensitivity score S between components m and n mn The calculation formula can be expressed as:

[0182]

[0183] Score N for the interactive network connection mode between components m and n mn satisfy:

[0184] N mn =max{score of each network connection method};

[0185] Among them, the scores of each network connection method are:

[0186] Unencrypted connection: 10 points;

[0187] Encrypted but weak: 8 points;

[0188] Encrypted and standard: 6 points;

[0189] Encrypted and strong: 3 points;

[0190] Encrypted and extremely strong: 0 points.

[0191] Similarly, the criticality score K of components m and n mn The calculation formula can be expressed as:

[0192]

[0193] Among them, K m , K n Score the importance of components m and n to the system respectively.

[0194] Geographical location of the node server corresponding to the component: Score based on the geographical distance between the servers where the component is located:

[0195] G mn = Server relative geographic location score / 10;

[0196] Among them, the server relative geographical location score is:

[0197] Same location: 0 points;

[0198] Same city: 3 points;

[0199] Different cities in the same country: 6 points;

[0200] Different countries: 10 points.

[0201] Security measures between components: score based on the security measures between components. When a component has multiple security measures:

[0202] P mn =min{score of each safety measure} / 10;

[0203] Among them, the scores of each safety measure are:

[0204] No safety measures: 10 points;

[0205] Basic safety measures: 8 points;

[0206] Standard safety measures: 6 points;

[0207] Strengthening security measures: 3 points;

[0208] Maximum security measures: 0 points.

[0209] The risk values ​​of interaction between components within different nodes are:

[0210] REmn =50×(μ1×D mn +μ2×S mn +μ3×N mn +μ4×K mn +μ5×G mn +μ6×P mn )

[0211] Optionally, μ1=0.2, μ2=0.3, μ3=0.1, μ4=0.2, μ5=0.1, μ6=0.1.

[0212] 6. Dynamic updates and feedback

[0213] As new RASP alarm information is generated, the attack path diagram is automatically updated, including the newly added potential attack steps and affected component nodes, and each component node connection on the updated attack path is risk-scored, using the previously defined quantitative method to calculate the risk value of each component connection. The server end node is the server node with the latest corresponding occurrence in the RASP alarm information, and the server start node is the server node with the earliest corresponding occurrence in the RASP alarm information.

[0214] In some implementations, a manual correction feedback mechanism can be designed to allow security analysts to manually adjust the attack path and manually delete the corresponding server nodes or component nodes in the attack path. After deletion, redundant nodes and attack paths are automatically deleted based on whether the attack path can be connected, and the scores of each component node are recalculated.

[0215] 7. Repair Priority

[0216] The servers to be repaired first are determined based on the attack path diagram and the scores generated by the interaction of the corresponding components.

[0217] 7.1. Server internal component repair priority

[0218] The risk score of the interaction between component i and component j in the selected server and the interaction risk score of component m in the server connected to the attack path graph;

[0219] Component Severity Score:

[0220] S severity_i =∑(RI ij +RE im )

[0221] S severity_i As the severity score corresponding to the server, S severity_i The higher the value, the higher the component repair priority.

[0222] 7.2. Server Node Repair Priority

[0223] Repair priority score = (server severity score × v1 + attack path criticality index × v2 + attack path diversity factor × v3); optionally, v1 = 0.5, v2 = 0.3, v3 = 0.2.

[0224] Among them, server severity score: S severity =max(S severity_i ).

[0225] Attack Path Criticality Index (APCI): Considers the position of the attacked server in the attack chain, the connectivity between servers, and the diversity of possible action paths for the attacker. It is calculated as follows:

[0226] The server node connectivity coefficient (Connectivity Coefficient, C) indicates the number of connections between the server node and other service nodes on the attack path.

[0227] The location coefficient (L) indicates the criticality of the server node in the attack path.

[0228] L = (the shortest attack path length of the node relative to the starting node / the shortest attack path length corresponding to the node) × W. W is the node weight, where W = 2 for the starting node and the end node, and W = 1 for other nodes.

[0229] APCI = C × L;

[0230] The attack path diversity factor (F) indicates the number of different action paths that an attacker may take to reach other server nodes after using the server node. The number of paths to all target nodes is added up to get the total number of paths, which can be used as the value of F. If there are n target nodes and each target node i has pi paths to reach it, the path diversity factor F can be calculated as:

[0231]

[0232] The repair priority score RS can be expressed as:

[0233] RS=S severity ×v1+APCI×v2+F×v3;

[0234] Optionally, v1=0.5, v2=0.3, v3=0.2.

[0235] The higher the RS score, the higher the repair priority of the corresponding server node. severity The value of can quantify the risk level of all nodes involved in the attack path graph generated after the attack occurs in the server and component dimensions, providing guidance for the priority of component repair after the attack occurs.

[0236] To better understand the embodiments of the present application, please refer to Figure 3 , Figure 3 This is another flowchart of an attack path restoration method provided in an embodiment of the present application.

[0237] Reference Figure 4 , Figure 4 A schematic diagram of a component-level attack path provided in an embodiment of the present application.

[0238] exist Figure 4 In it, server node A, server node B1, server node B2 and server node C are included; server node A includes component node a1_1, component node a1_2 and component node a1_3; server node B1 includes component node b1_1 and component node b1_2; server node B2 includes component node b2_1, component node b2_2, component node b2_3 and component node b2_4; server node C includes component node c1_1 and component node c1_2.

[0239] Reference Figure 5 , Figure 5 A schematic diagram of an attack path in the server dimension provided in an embodiment of the present application.

[0240] exist Figure 5 In the example, there are server nodes A, B, C, D, and E. There are four paths from A to E:

[0241] Path 1: A→B→D→E;

[0242] Path 2: A→C→D→E;

[0243] Path 3: A→B→E;

[0244] Path: A→C→E;

[0245] Among them, S severity A=2,S severity B=4,S severity C=5,S severity D=6,S severity E = 7. The shortest path of the above attack paths is 3.

[0246] Server node A connects server node B and server node C, so C_A = 2;

[0247] L_A=1 / 3×2=2 / 3; APCI_A=4 / 3; F_A=1+1+1+2+4=9.

[0248] Server node B connects server node A, server node D and server node E, so C_B=3; L_B=2 / 3; APCI_B=2; F_B=1+1+1=3.

[0249] Server node C connects server node A, server node D and server node E, so C_C=3; L_C=2 / 3; APCI_C=2; F_C=1+1+1=3.

[0250] Server node D connects server node B, server node C and server node E, so C_D=3; L_D=1; APCI_D=3; F_D=1+1=2.

[0251] Server node E connects server node B, server node D and server node C, so C_E=3; L_E=1×2=2; APCI_E=6; F_E=1.

[0252] According to the formula RS = Sseverity × v1 + APCI × v2 + F × v3, we can get:

[0253] RS_A = 1 + 0.4 + 1.8 = 3.2;

[0254] RS_B = 2 + 0.6 + 0.6 = 3.2;

[0255] RS_C = 2.5 + 0.6 + 0.6 = 3.7;

[0256] RS_D = 3 + 0.9 + 0.4 = 4.3;

[0257] RS_E=3.5+1.8+0.2=5.5.

[0258] The sorting result is: E>D>C>B=A.

[0259] Among them, server node E has the highest repair priority score, which means that it is extremely critical in the attack path and has a high APCI, which makes it the target that needs to be repaired first. The high value of APCI may mean that there are multiple ways for an attacker to exploit node E. Therefore, repairing node E can significantly reduce the potential attack surface.

[0260] Server node D has the next highest repair priority score, indicating that it also plays an important role in the attack path, but may be slightly lower than node E in terms of criticality or diversity.

[0261] The repair priority score of server node C is in the middle, indicating that although it is important, it may not be as critical or diverse as server nodes E and D, so its repair priority is relatively low.

[0262] Server node B and server node A have the same repair priority score and are ranked last, that is, although server node A is the starting node, its risk assessment is the same as that of server node B.

[0263] The above ranking quantitatively determines the importance of repair priority. It helps the security team identify the most critical nodes and allocate resources appropriately to mitigate risks. In actual applications, the security team should formulate a repair plan based on this ranking, giving priority to those nodes that have the greatest impact on network security.

[0264] The attack path restoration method provided in the embodiment of the present application can accurately restore the attack path through real-time monitoring and data collection after an intranet attack event occurs, and present it to the user through visual display. The system and method can improve the information security level of enterprises and organizations and effectively deal with intranet attack threats.

[0265] The embodiment of the present application provides a new attack path restoration method by installing and configuring the RASP agent on the server where the application is located to achieve real-time monitoring and data collection of the application. By associating the relevant servers and components in the attack event, the attack path can be accurately restored to help enterprises and organizations quickly analyze and respond to intranet attack events. By visually displaying the attack path restoration results, an intuitive information presentation is provided. Based on the server network topology, component interaction, etc., the scattered key data in the network analysis, such as data volume transmission and data sensitivity, are comprehensively analyzed and quantified, which is convenient for the security team to conduct further analysis and decision-making, confirm the repair priority, and better respond to network security incidents.

[0266] Based on the contents described in the above embodiments, an attack path restoration system is also provided in the embodiments of the present application. Figure 6 , Figure 6 A schematic diagram of the architecture of an attack path restoration system provided in an embodiment of the present application.

[0267] In some embodiments, the attack path restoration system includes:

[0268] Data collection module 601: used to use the RASP agent to monitor the operation of the application program in real time on the server where the application is located and collect relevant data.

[0269] Node analysis module 602: used to associate related servers in the attack event based on the collected data, and determine the associated nodes in the attack path.

[0270] Attack path construction module 603: constructs the attack path and provides server-level and component-level attack path diagrams.

[0271] Path optimization module 604: adjusts the attack path diagram based on manual feedback.

[0272] Decision module 605: quantifies the risk of servers / components on the attack path, outputs an attack path diagram, and provides a reference for repair priority. In addition, it can also be used to update data collection module 601.

[0273] The attack path restoration system provided in the embodiment of the present application can accurately restore the attack path through real-time monitoring and data collection after an intranet attack occurs, and present it to the user through a visual display, which can improve the information security level of enterprises and organizations and effectively respond to intranet attack threats.

[0274] Based on the contents described in the above embodiments, an attack path restoration device is also provided in the embodiments of the present application. Figure 7 , Figure 7 Schematic diagram of a program module of an attack path restoration device provided in an embodiment of the present application. In some embodiments, the attack path restoration device 70 includes:

[0275] The data collection module 701 is used to monitor the running status of the application programs in each server by using the RASP agent installed on the server, and collect key data of the application programs during the running process.

[0276] The node analysis module 702 is used to generate alarm information according to the key data when an attack event is detected, and determine the target server among the servers that has an associated relationship with the attack event according to the alarm information.

[0277] The attack path construction module 703 is used to generate a server attack path according to the interaction relationship between multiple target servers; and to generate an attack path corresponding to the attack event according to the server attack path and each component in the target server.

[0278] In some embodiments, the key data includes at least one of the following: request message, response message, access path, execution log; the alarm information includes source IP address, destination IP address;

[0279] The node analysis module 702 is used to:

[0280] The server corresponding to the destination IP address is determined as the target server.

[0281] In some embodiments, the attack path construction module 703 is used to:

[0282] Obtain target warning information;

[0283] Marking the generation time of the target warning information as the first end time point;

[0284] Obtain historical alarm information within a preset time period before the first end time point, search for first historical alarm information whose destination IP address in the historical alarm information is the same as the source IP address in the target alarm information; and determine a first server that generates the first historical alarm information;

[0285] The target alarm information is replaced with the first historical alarm information, and the step of marking the generation time of the target alarm information as the first end time point is returned to execute until a preset execution deadline condition is met;

[0286] The server attack path is generated based on the determined interaction relationship between the first servers.

[0287] In some embodiments, the attack path construction module 703 is used to:

[0288] Determine the interaction relationship between the components according to the server attack path and the components in the target server;

[0289] An attack path corresponding to the attack event is generated according to the interaction relationship between the various components.

[0290] In some embodiments, the attack path construction module 703 is used to:

[0291] Based on the server attack path, obtaining log information of each component in the target server;

[0292] According to the log information, the interaction relationship between the components is determined, where the interaction relationship includes at least one of the following: an application API call relationship, a data transmission relationship, and a service request relationship.

[0293] In some embodiments, the above device further comprises a repair module, which is used to:

[0294] Determine a repair priority score for each server on the attack path, and determine a repair priority for each server on the attack path according to the repair priority score;

[0295] And / or, determining a severity score of each component on the attack path, and determining a repair priority of each component on the attack path based on the severity score.

[0296] It should be noted that the specific execution content of the attack path restoration device provided in the embodiment of the present application can refer to the various steps in the attack path restoration method described in the above embodiment, and will not be repeated here.

[0297] Furthermore, based on the contents described in the above embodiments, an electronic device is also provided in an embodiment of the present application, which includes at least one processor and a memory; wherein the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory to implement the various steps in the attack path restoration method described in the above embodiments.

[0298] In order to better understand the embodiments of the present application, refer to Figure 8 , Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0299] like Figure 8 As shown, the electronic device 80 of this embodiment includes: a processor 801 and a memory 802; wherein:

[0300] Memory 802, used to store computer-executable instructions;

[0301] The processor 801 is used to execute the computer-executable instructions stored in the memory to implement each step of the attack path restoration method described in the above embodiment.

[0302] Optionally, the memory 802 may be independent or integrated with the processor 801 .

[0303] When the memory 802 is independently provided, the device further includes a bus 803 for connecting the memory 802 and the processor 801 .

[0304] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, each step in the attack path restoration method described in the above embodiment is implemented.

[0305] An embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the computer program implements the various steps in the attack path restoration method described in the above embodiment.

[0306] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0307] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0308] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0309] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the method described in each embodiment of the present application.

[0310] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0311] The memory may include high-speed memory, and may also include non-volatile storage, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0312] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0313] The storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The storage medium may be any available medium that can be accessed by a general or special purpose computer.

[0314] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. An attack path restoration method, characterized in that: The method comprises: Using a runtime application self-protection RASP agent installed on each server, monitoring the running status of the application in each server and collecting key data of the application during operation; When an attack event is detected, generating alarm information according to the key data, and determining a target server among the servers that has an associated relationship with the attack event according to the alarm information; Generate a server attack path according to the interaction relationship between the plurality of target servers; An attack path corresponding to the attack event is generated according to the server attack path and various components in the target server.

2. The method according to claim 1, characterized in that: The key data includes at least one of the following: request message, response message, access path, execution log; the alarm information includes source IP address and destination IP address; The step of determining, according to the alarm information, a target server among the servers that has an association relationship with the attack event comprises: The server corresponding to the destination IP address is determined as the target server.

3. The method according to claim 2, characterized in that Generating a server attack path according to the interactive relationship between the plurality of target servers includes: Obtain target warning information; Marking the generation time of the target warning information as the first end time point; Obtain historical alarm information within a preset time period before the first end time point, search for first historical alarm information whose destination IP address in the historical alarm information is the same as the source IP address in the target alarm information; and determine a first server that generates the first historical alarm information; The target alarm information is replaced with the first historical alarm information, and the step of marking the generation time of the target alarm information as the first end time point is returned to execute until a preset execution deadline condition is met; The server attack path is generated based on the determined interaction relationship between the first servers.

4. The method according to claim 1, characterized in that: Generating an attack path corresponding to the attack event according to the server attack path and various components in the target server includes: Determine the interaction relationship between the components according to the server attack path and the components in the target server; An attack path corresponding to the attack event is generated according to the interaction relationship between the various components.

5. The method according to claim 4, characterized in that Determining the interaction relationship between the components according to the server attack path and the components in the target server includes: Based on the server attack path, obtaining log information of each component in the target server; According to the log information, the interaction relationship between the components is determined, where the interaction relationship includes at least one of the following: an application programming interface API call relationship, a data transmission relationship, and a service request relationship.

6. The method according to claim 1, characterized in that The method further comprises: Determine a repair priority score for each server on the attack path, and determine a repair priority for each server on the attack path according to the repair priority score; And / or, determining a severity score of each component on the attack path, and determining a repair priority of each component on the attack path according to the severity score.

7. An attack path restoration device, characterized in that: The device comprises: A data collection module, for monitoring the running status of the applications in each server by using the RASP agent installed on the server, and collecting key data of the applications during the running process; A node analysis module, configured to generate alarm information according to the key data when an attack event is detected, and determine a target server among the servers that has an associated relationship with the attack event according to the alarm information; The attack path construction module is used to generate a server attack path according to the interaction relationship between multiple target servers; and to generate an attack path corresponding to the attack event according to the server attack path and each component in the target server.

8. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the attack path restoration method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the attack path restoration method according to any one of claims 1 to 6.

10. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the attack path restoration method described in any one of claims 1 to 6.

Images