Attack path restoration method and device

Abstract

The application provides an attack path restoration method and device, which can be used in the field of computer technology. The method comprises the following steps: monitoring the running state of an application program in each server and collecting key data of the application program in the running process by using a RASP agent installed on each server; when an attack event is detected, generating an alarm information according to the key data, and determining a target server in each server which has a correlation with the attack event according to the alarm information; generating a server attack path according to the interaction relationship among the target servers; and generating an attack path corresponding to the attack event according to the server attack path and each component in the target server. The application can quickly and accurately restore the attack path of the attack event.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to an attack path restoration method and device. BACKGROUND

[0002] In the current network environment, internal network attack events occur frequently, which seriously threatens the information security of enterprises.

[0003] Traditional global wide area network (World Wide Web, Web) application security products often face a large number of invalid attack requests when processing attacks, which will bring a great burden and misjudgment to the security team. As a new security protection technology, runtime application self-protection (Runtime Application Self-Protection, RASP) can exclude a large number of invalid attack requests by monitoring and protecting in real time during the running of the application.

[0004] However, the above security protection means is difficult to quickly and accurately restore the attack path of the attack event. SUMMARY

[0005] The present application provides an attack path restoration method and device, which can quickly and accurately restore the attack path of the attack event.

[0006] In a first aspect, the present application provides an attack path restoration method, which comprises the following steps:

[0007] Using the RASP agent installed on each server, the running state of the application program in the server is monitored, and the key data of the application program in the running process is collected;

[0008] When an attack event is detected, alarm information is generated according to the key data, and target servers in the servers that have a correlation with the attack event are determined according to the alarm information;

[0009] According to the interaction relationship between a plurality of target servers, a server attack path is generated;

[0010] According to the server attack path and each component in the target server, an attack path corresponding to the attack event is generated.

[0011] In a possible implementation, the key data comprises at least one of the following: request message, response message, access path, execution log; the alarm information comprises source IP address and destination IP address.

[0012] The step of determining the target server among the servers that is associated with the attack event based on the alarm information includes:

[0013] The server corresponding to the destination IP address is identified as the target server.

[0014] In one possible implementation, generating a server attack path based on the interaction relationships between the multiple target servers includes:

[0015] Obtain target alarm information;

[0016] Mark the time when the target alarm information is generated as the first end time point;

[0017] Obtain historical alarm information within a preset time period before the first end time point; find the first historical alarm information in the historical alarm information whose destination IP address is the same as the source IP address in the target alarm information; and determine the first server that generated the first historical alarm information;

[0018] Replace the target alarm information with the first historical alarm information, and return to the step of marking the generation time of the target alarm information as the first end time point until the preset execution deadline condition is met;

[0019] Based on the established interaction relationships between the various first servers, the server attack path is generated.

[0020] In one possible implementation, generating the attack path corresponding to the attack event based on the server attack path and the various components in the target server includes:

[0021] Based on the server attack path and the various components in the target server, determine the interaction relationships between the various components;

[0022] Based on the interaction relationships between the various components, the attack path corresponding to the attack event is generated.

[0023] In one possible implementation, determining the interaction relationships between the various components based on the server attack path and the various components in the target server includes:

[0024] Based on the server attack path, obtain the log information of each component in the target server;

[0025] Based on the log information, the interaction relationships between the various components are determined, and the interaction relationships include at least one of the following: API call relationship, data transmission relationship, and service request relationship.

[0026] In one possible implementation, the method further includes:

[0027] Determine the repair priority score of each server on the attack path, and determine the repair priority of each server on the attack path based on the repair priority score;

[0028] And / or, determine the severity score of each component on the attack path, and determine the remediation priority of each component on the attack path based on the severity score.

[0029] Secondly, this application provides an attack path reconstruction device, which includes:

[0030] The data acquisition module is used to monitor the running status of applications on each server using RASP agents installed on each server, and to collect key data of the applications during their operation.

[0031] The node analysis module is used to generate alarm information based on the key data when an attack event is detected, and to determine the target server among the servers that is associated with the attack event based on the alarm information.

[0032] An attack path construction module is used to generate server attack paths based on the interaction relationships between multiple target servers; and to generate attack paths corresponding to the attack events based on the server attack paths and the various components in the target servers.

[0033] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0034] The memory stores computer-executed instructions;

[0035] The processor executes computer execution instructions stored in the memory to implement the attack path restoration method provided in the first aspect.

[0036] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the attack path reconstruction method provided in the first aspect.

[0037] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the attack path restoration method as provided in the first aspect.

[0038] The attack path restoration method and device provided by the application can realize real-time monitoring and data collection of the application program by installing and configuring the RASP agent on the server where the application is located, can accurately restore the attack path by associating the related servers and components in the attack event, and help enterprises quickly analyze and respond to the internal network attack event. BRIEF DESCRIPTION OF DRAWINGS

[0039] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0040] Figure 1 A flowchart of an attack path restoration method provided in an embodiment of the application;

[0041] Figure 2 Another flowchart of an attack path restoration method provided in an embodiment of the application;

[0042] Figure 3 Still another flowchart of an attack path restoration method provided in an embodiment of the application;

[0043] Figure 4 A component-level attack path diagram provided in an embodiment of the application;

[0044] Figure 5 A server-dimension attack path diagram provided in an embodiment of the application;

[0045] Figure 6 An architecture diagram of an attack path restoration system provided in an embodiment of the application;

[0046] Figure 7 A program module diagram of an attack path restoration device provided in an embodiment of the application;

[0047] Figure 8 A hardware structure diagram of an electronic device provided in an embodiment of the application.

[0048] The above-described drawings have shown the specific embodiments of the application, and the following will have a more detailed description. These drawings and textual descriptions are not intended to limit the scope of the concept of the application by any means, but to illustrate the concept of the application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0049] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The following description is made with reference to the accompanying drawings in which like reference numerals refer to like elements, unless the context of use indicates otherwise. The following exemplary embodiments described herein represent implementations consistent with the present application. However, the following description is not meant to represent all implementations consistent with the present application. Rather, it is merely an example of apparatus and methods consistent with some aspects of the present application as detailed in the appended claims.

[0050] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards, and provide corresponding operation portal for user to choose authorization or refusal.

[0051] The following explains some technical terms involved in the embodiments of the present application:

[0052] 1. RASP: A runtime application self-protection technology that monitors and protects the security of an application during its execution, detects and prevents potential attack behavior.

[0053] 2. Attack path restoration: Refers to restoring the action path and attack process of an attacker after an attack event occurs by analyzing the key data and event sequence in the attack process, so as to conduct subsequent analysis and response.

[0054] 3. Proxy: In network communication, a proxy acts as an intermediary between a client and a server, receiving and sending network requests and responses.

[0055] 4. Monitoring: Refers to continuous real-time observation and data collection of a system, application or network to detect abnormal behavior or events.

[0056] 5. Internal network attack: Refers to malicious attack behavior occurring in the internal network environment of an enterprise or organization, aiming to obtain sensitive information, damage systems or other malicious purposes.

[0057] 6. Alarm information: Alarm information generated when a system or application detects abnormal or suspicious activity during monitoring, indicating potential security risks or attack events.

[0058] 7. Egress network information: Refers to the network path and related information for sending data in network communication, including network devices, routing information, etc.

[0059] 8、Enterprise network information security operation center (SOC): It is an enterprise network security platform integrating various types of network security devices, log collection services, and big data storage modules to ensure the safe and stable operation of production systems.

[0060] In the current network environment, internal network attacks occur frequently, posing a serious threat to the information security of enterprises and organizations.

[0061] Traditional Web application security products often face a large number of invalid attack requests when handling attacks, which can cause a heavy burden and misjudgment for the security team. RASP, as a new security protection technology, can exclude a large number of invalid attack requests and focus on discovering real known and unknown security threats by monitoring and protecting in real time during application runtime.

[0062] However, it is still difficult to effectively deal with some attacks using RASP technology, so there is an urgent need for a method that can quickly and accurately restore the attack path.

[0063] To solve the above technical problems, the attack path restoration method provided in the embodiments of the present application installs and configures a RASP agent on the server where the application is located, monitors the running of the application program in the server and collects relevant data, and after an attack event occurs in the internal network, based on the alarm information generated by RASP, the relevant servers in a time sequence are associated, and the relationship and interaction information between each component in the application program involved in the attack process are determined, and the attack path in the attack event is restored. Compared with traditional Web application security products, RASP filters out a large number of invalid attacks from the massive attacks, focuses on discovering real known and unknown security threats, can clearly restore the attack path at the code line level, and quantifies the repair priority of individual nodes, innovatively solves the problem of insufficiently fine and accurate attack path restoration granularity, can clearly display key component defect information, and can improve the efficiency of operation and maintenance personnel in analyzing and emergency handling of attack events, providing comprehensive protection for the information security of enterprises and organizations.

[0064] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0065] Referring to Figure 1 , Figure 1 The flowchart of the attack path restoration method provided in the embodiments of the present application, in some embodiments of the present application, the attack path restoration method comprises:

[0066] S101, monitoring the running state of the application program in each server by using the RASP agent installed on each server, and collecting key data of the application program in the running process.

[0067] In some embodiments, the RASP agent can be installed and configured on the server where the application is located to monitor the running of the application program in the server and collect key data.

[0068] Optionally, the key data includes request message, response message, access path, execution log, etc.

[0069] S102, when an attack event is detected, generating alarm information according to the key data, and determining target servers in each server which have a correlation with the attack event according to the alarm information.

[0070] Optionally, the alarm information includes source IP address information, destination IP address information, port information, and exit network information.

[0071] In some embodiments, after the internal network attack event occurs, the related servers in a time sequence are associated based on the alarm information generated by the RASP, and the relationship and interaction information between each component in the application program involved in the attack process are determined.

[0072] S103, generating a server attack path according to the interaction relationship between the target servers.

[0073] In some embodiments, the servers involved in the entire attack event can be associated and the server layer attack path can be generated according to the interaction relationship between the target servers.

[0074] S104, generating an attack path corresponding to the attack event according to the server attack path and each component in the target server.

[0075] In some embodiments, after the attack path is confirmed, each server in the attack path is taken as a node, the server with alarm information is marked, each marked server node is processed, the RASP log information of the server in the time period is collected, and the interaction information between each component when the alarm is generated is determined.

[0076] In some embodiments, based on the server attack path and the interaction information between each component, the attack path corresponding to the attack event can be generated.

[0077] In the embodiment of the present application, by installing and configuring the RASP agent on the target server, real-time monitoring and data collection of the application program can be realized, the running of the application program in the server is monitored, and relevant data is collected: the RASP agent regularly monitors the running state of the application program in the server, collects key data including but not limited to request messages, response messages, access paths, execution logs, etc., and stores them into the enterprise-level network information security operation center. By collecting the alarm information of the internal network attack event, according to the monitoring data of the RASP agent, when an internal network attack event is detected, corresponding alarm information is generated; the related servers in the attack event are associated, and based on the key data in the alarm information, the related server components in a time sequence are associated, so that the attack path of the attack event can be determined.

[0078] The attack path restoration method provided in the embodiment of the present application realizes real-time monitoring and data collection of the application program by installing and configuring the RASP agent on the server where the application is located, and can accurately restore the attack path by associating the related servers and components in the attack event, thereby helping enterprises to quickly analyze and respond to internal network attack events.

[0079] In some embodiments, the attack path restoration method described above can include the following steps:

[0080] S1, data collection

[0081] The RASP alarm information and process, file operation, network log data in the server node are collected.

[0082] Among them, the server corresponding to the destination IP address in the alarm information triggering the attack path generation is defined as a server node.

[0083] S2, server node association analysis, and server node attack path construction

[0084] In some embodiments, it includes:

[0085] Obtain target alarm information;

[0086] Mark the generation time of the target alarm information as a first end time point;

[0087] Obtain historical alarm information within a preset time period before the first end time point, find first historical alarm information with the same destination IP address as the source IP address in the target alarm information in the historical alarm information, and determine a first server generating the first historical alarm information;

[0088] Replace the target alarm information with the first historical alarm information, return to the step of marking the generation time of the target alarm information as the first end time point, until a preset execution cutoff condition is met;

[0089] Based on the determined interaction relationship between the first servers, a server attack path is generated.

[0090] For example, in some embodiments, based on time series analysis of node association, a time period TimeLine (default 24 hours, can be customized) can be set, and the time of RASP alarm information generation is taken as the end time TimeEnd. The source address in the alarm information is taken as the key information, and the RASP alarm information collected by the enterprise-level network information security operation center in the TimeLine time period is traced back. If the destination IP address in other RASP alarm information is the same as the above key information before TimeEnd, the server is taken as a new server node, and the RASP alarm generation time is taken as a new TimeEnd.

[0091] The above steps are repeated to trace back before the alarm in the TimeLine time series until it is not possible to trace back further or the tracing back reaches a specified time.

[0092] In some embodiments, a graph search algorithm can be applied to construct an attack path according to the interaction relationship between the server nodes, wherein the path between the server nodes exists in the direction A->B (indicating that the time of RASP alarm information occurrence of server node A is earlier than the time of RASP alarm information occurrence of server node B).

[0093] S3, component node attack path construction

[0094] In some embodiments, the interaction relationship between each component can be determined according to the above server attack path and each component in the target server; and a component node attack path, i.e., an attack path corresponding to the attack event, is generated according to the interaction relationship between each component.

[0095] For example, in some embodiments, based on the server node attack path, the server log information corresponding to the node in the entire TimeLine can be associated with the RASP alarm information, the relationship between the component nodes can be marked based on the interaction frequency, data transmission volume, network connection mode, etc., and the weight of the edge between the component nodes can be defined, wherein the direction of the component node is the data transmission direction.

[0096] In the above embodiments, the server application program key components in the alarm information are defined as component nodes.

[0097] S4, path optimization

[0098] The attack path is displayed in a graphical manner, clearly identifying server nodes and component nodes, and showing the interaction between nodes. With the generation of new RASP alert information, repeat the above steps, dynamically update the attack path, and design a feedback mechanism to allow security analysts to manually adjust and verify the attack path, improving the accuracy and readability of the attack path.

[0099] Referring to Figure 2 , Figure 2 Another flowchart of an attack path restoration method provided in an embodiment of the present application, in some embodiments of the present application, the attack path restoration method comprises:

[0100] 1. Define attack path graph nodes

[0101] 1.1. Define server nodes

[0102] A server refers to a computer or device that provides a specific service in a network. In an embodiment of the present application, a server node refers to a server corresponding to a destination address in RASP alert information that triggers the generation of an attack path in a network attack, i.e., a server identified as being attacked.

[0103] For example, assume that a network attack attacks a web server by exploiting a vulnerability, resulting in data leakage. In this scenario, the web server is the server node.

[0104] 1.2. Define component nodes

[0105] A component node refers to a key component inside a server node, which can provide a specific service or function. In security monitoring, identifying component nodes helps to more accurately locate the impact range and key assets of an attack.

[0106] For example, if a web server uses Apache as a web server software and the attack is through a known vulnerability of Apache, then Apache is a component node.

[0107] Optionally, the above component nodes can further include: web server software, application server, database management system, web application framework, etc.

[0108] 2. Collect attack path graph construction data

[0109] Collect and store RASP alert information and log data of server nodes. For each server node, collect the interaction logs of its internal component nodes. For example, Elasticsearch, Kafka, and other search engines and data storage technologies can be used to build log information indexes according to different log types, optimizing query and search speed.

[0110] 2.1 Collecting alert information of internal network attack events

[0111] Objective: Quickly identify and respond to internal network attacks, reduce potential losses.

[0112] Method: When the RASP agent detects attack behavior, automatically generate alert information and send it to the security operation center.

[0113] Data types: Source IP, destination IP, port information, protocol type, attack type, timestamp, etc.

[0114] 2.2 Collecting interaction logs of internal component nodes

[0115] Objective: Deploy RASP agents on servers to monitor application behavior in real time, record any abnormal or suspicious activities, and identify potential internal threats.

[0116] Method: Configure a logging system to capture all interactions between components, including Application Programming Interface (API) calls, database queries, etc., and send them to the security operation center.

[0117] Data types: Including but not limited to request and response messages, access paths, execution logs, system resource usage; abnormal access patterns, unauthorized file access, suspicious system calls; communication records between components, error logs, transaction logs, etc.

[0118] 2.3 Data storage

[0119] Objective: Centralized management and analysis of security data to improve response speed and efficiency.

[0120] Method: Store the collected data in the enterprise-level network information security operation center central database according to the format requirements of different types.

[0121] Data types: All collected security-related data, including alerts, logs, monitoring data, etc.

[0122] 3 Node association analysis in attack path graph

[0123] Using time series analysis, use the source address in the alert information as the key information to search for the same destination address in other RASP alert information.

[0124] The purpose of node association analysis is to use time series analysis technology to identify and associate security events occurring within a certain time period, construct a complete timeline and impact range of attack events, and determine the propagation path and range of attacks.

[0125] 3.1, Time window setting

[0126] The dynamic time window adjustment mechanism is adopted, allowing users to input custom time window length as needed, and the system automatically adjusts the time line (TimeLine) according to the input. The default TimeLine is 24 hours.

[0127] In the node association relationship analysis process, if it is found that the associated events may exceed the current TimeLine, the system automatically expands the time window by 0.2*TimeLine. If more potential associated data (i.e., new node information) is generated, the time window continues to be expanded until no more associated data can be generated or the time window exceeds 2*TimeLine.

[0128] 3.2, Determining the starting point of analysis

[0129] Real-time monitoring of RASP generated alarm information, the server corresponding to the destination address in the RASP alarm information triggering the attack path generation is taken as the starting node, the server corresponding to the source address is taken as the search node, and the alarm generation time corresponding to the node is marked as TimeEnd.

[0130] 3.3, Identification of server node association

[0131] Backtracking to the RASP alarm information collected by the enterprise-level network information security operation center in the entire TimeLine period, using Python and other programming languages, developing automated scripts, searching for RASP alarm information generated before TimeEnd with the same destination address as the search node using regular expression matching. If found, there is a directed association A->B between the two server nodes, with the server node A with earlier alarm time pointing to the node server B with later alarm time.

[0132] 3.4, Server node iterative backtracking

[0133] The source address corresponding to the RASP alarm information in 3.3 is taken as a new search node, and the alarm information generation time corresponding to the search node is marked as TimeEnd. Based on the Breadth-First Search (BFS) algorithm, the alarm is traced back before TimeLine until it cannot be traced back further or the specified time is reached.

[0134] 4, Server node attack path construction

[0135] The server node connection relationship generated in the above step 3 is taken as the server node attack path.

[0136] 5、Component node attack path construction

[0137] Based on the server node attack path, the log information in the server corresponding to the node in the entire TimeLine is associated with the RASP alarm information. Taking the server node as the boundary and the component as the server node construction unit, the node internal component interaction path and the component interaction path are constructed respectively.

[0138] Among them, component={component list, component attribute}.

[0139] Component list: list all components on each node, including but not limited to software, service, database, etc.

[0140] Component attribute: record the version information, supplier, function description and other attributes of each component.

[0141] Through monitoring tools and log analysis, the interaction relationship between components is identified, including API calling, data transmission, service request, etc. The flow of data between components is tracked, the source and destination of data are analyzed, the frequency of interaction between components is counted, and the high-frequency interaction path is identified. If the logs show that different components have a mutual relationship, then there is an association between the components, and the component node direction is the data transmission direction. If the components interact with each other, the interaction direction is bidirectional. Based on the interaction frequency, data transmission volume, network connection mode, etc. between components during the TimeLine, the relationship between component nodes is marked, and the interaction risk value between components is calculated.

[0142] 5.1, Component interaction risk value calculation within the same node, taking components a and b existing in the same server as an example:

[0143] The following factors are considered for the same node component interaction: component interaction frequency, transmission data sensitivity, and component criticality.

[0144] Among them, the interaction frequency ratio is the proportion of the communication times C ab of all components in the same server during the TimeLine: sum

[0145]

[0146] The component interaction frequency score I ab can be represented as:

[0147]

[0148] Data sensitivity: score according to the sensitivity of the data transmitted between components, i.e. according to the SOC data classification hit by each transmission data:

[0149] Non-sensitive data: 0 points;​

[0150] Low sensitive data: 2 points;

[0151] Medium sensitive data: 5 points;

[0152] High sensitive data: 8 points;

[0153] Extremely sensitive data: 10 points.

[0154] Let T be the total number of data, H i is the number of hit data of the i-th level. Where i ranges from 1 to 5, corresponding to non-sensitive, low-sensitive, medium-sensitive, high-sensitive and extremely sensitive data respectively. The weight W i of each level of data is 0, 2, 5, 8, 10 respectively. The calculation formula of data sensitivity score S ab can be expressed as:

[0155]

[0156] Component criticality: score according to the importance of the component to the system:

[0157] Non-critical component: 0 points;

[0158] Minor component: 2 points;

[0159] Important component: 5 points;

[0160] Critical component: 8 points;

[0161] Core component: 10 points;

[0162] The calculation formula of component criticality score K ab can be expressed as:

[0163]

[0164] Where K a , K b are the importance scores of components a and b to the system respectively.

[0165] The node internal component interaction risk value RI ab can be expressed as:

[0166] RI ab = 10 × (ω1×I ab + ω2×S ab + ω3×K ab )

[0167] Optionally, ω1=0.3, ω2=0.5, ω3=0.2.

[0168] 5.2, Component interaction risk value calculation within a different node, taking components m, n existing in a different server as an example:

[0169] The following factors are considered for component interaction within a different node: data transmission volume, transmission data sensitivity, component criticality, component geographical location to the node server, and security measures between components.

[0170] Data transmission volume Data transmission volume score D mn A design based on all involved component interaction data volume between the corresponding two servers is designed, and the following is the specific calculation method:

[0171] The following parameters are defined:

[0172] Vall: the data volume set of all component interactions corresponding to the two servers.

[0173] Vmedian: the median of Vall.

[0174] Vmean: the mean of Vall.

[0175] Vmax: the maximum value in Vall.

[0176] Dmin: the minimum value of the data transmission volume score, set to 0.

[0177] Dmax: the maximum value of the data transmission volume score, set to 10.

[0178] In some embodiments, D mn satisfies the following formula:

[0179]

[0180] Where V mn is the data volume of component m, n interaction.

[0181] Similarly, the calculation formula of the data sensitivity score S mn between components m, n can be expressed as:

[0182]

[0183] The network connection mode score N mn between components m, n satisfies:

[0184] N mn = max{each network connection mode score};

[0185] Where each network connection mode score is:

[0186] Non-encrypted connection: 10 points;

[0187] Encrypted but weak: 8 points;

[0188] Encrypted and standard: 6 points;

[0189] Encrypted and strong: 3 points;

[0190] Encrypted and very strong: 0 points.

[0191] Similarly, the key degree score K mn of components m, n can be calculated as:

[0192]

[0193] Where K m , K n are the importance scores of components m, n to the system.

[0194] Component corresponding node server geographical location: score according to the geographical distance between the servers where the components are located:

[0195] G mn = server relative geographical location score / 10;

[0196] Where the server relative geographical location score is:

[0197] Same place: 0 points;

[0198] Same city: 3 points;

[0199] Same country, different city: 6 points;

[0200] Different countries: 10 points.

[0201] Security measures between components: score according to the security measures between components, when there are multiple security measures between components:

[0202] P mn = min{each security measure score} / 10;

[0203] Where each security measure score is:

[0204] No security measures: 10 points;

[0205] Basic security measures: 8 points;

[0206] Standard security measures: 6 points;

[0207] Enhanced security measures: 3 points;

[0208] Maximum security measures: 0 points.

[0209] The risk value of different node internal component interaction is:

[0210] REmn = 50 x (μ1 x D mn + μ2 x S mn + μ3 x N mn + μ4 x K mn + μ5 x G mn + μ6 x P mn )

[0211] Optionally, μ1 = 0.2, μ2 = 0.3, μ3 = 0.1, μ4 = 0.2, μ5 = 0.1, μ6 = 0.1.

[0212] 6. Dynamic update and feedback

[0213] With the generation of new RASP alarm information, automatically update the attack path graph, including the newly added potential attack steps and affected component nodes, and perform risk scoring on each component node connection on the updated attack path. The risk value of each component connection is calculated using the quantification method defined earlier. The server endpoint node is the latest corresponding server node in the RASP alarm information, and the server starting node is the earliest corresponding server node in the RASP alarm information.

[0214] In some embodiments, an artificial correction feedback mechanism can be designed to allow security analysts to manually adjust the attack path. The corresponding server nodes or component nodes in the attack path can be manually deleted. After deletion, redundant nodes and attack paths are automatically deleted according to whether the attack path is connected, and each component node score is recalculated.

[0215] 7. Repair priority

[0216] According to the attack path graph and the score generated by the interaction of the corresponding components, the server to be repaired first is determined.

[0217] 7.1. Server internal component repair priority

[0218] Select the risk score of the interaction between component i and component j in the server and the interaction between component m corresponding to the server in the attack path graph that has a connection;

[0219] Component severity score:

[0220] S severity_i = ∑ (RI ij + RE im )

[0221] S severity_i is taken as the severity score of the server, where the higher the value of S severity_i , the higher the priority of component repair.

[0222] 7.2. Server node repair priority

[0223] Repair priority score = (server severity score x v1 + attack path criticality index x v2 + attack path diversity factor x v3); optionally, v1 = 0.5, v2 = 0.3, v3 = 0.2.

[0224] Wherein, server severity score: S severity = max(S severity_i ).

[0225] Attack path criticality index (APCI): considering the position of the attacked server in the attack chain, and the connectivity between servers and the diversity of the possible action paths of the attacker. It is calculated in the following way:

[0226] Server node connectivity coefficient (C) represents the number of connections between the server node and other service nodes in the attack path.

[0227] Path criticality location coefficient (L) represents the criticality of the server node in the attack path.

[0228] L = (node shortest attack path length relative to the starting node / node corresponding shortest attack path length) x W. Wherein W is the node weight, wherein the starting node and the end node correspond to W = 2, and other nodes correspond to W = 1.

[0229] APCI = C x L;

[0230] Path diversity factor (F) represents the number of different action paths that the attacker may take to reach other server nodes after using this server node. The total number of paths is obtained by adding up the number of paths to all target nodes, and this sum can be used as the value of F. If there are n target nodes, each target node i has pi paths to reach, then the path diversity factor F can be calculated as:

[0231]

[0232] The repair priority score RS can be represented by the formula:

[0233] RS = S severity x v1 + APCI x v2 + F x v3;

[0234] Optionally, v1 = 0.5, v2 = 0.3, v3 = 0.2.

[0235] The higher the score of RS is, the higher the server node repair priority is, so that the risk degree of all involved nodes in the attack path graph generated after the attack event is quantified in the server and component dimensions by the value of RS and S severity , and a guide for component repair priority after the attack event is provided.

[0236] For better understanding of the embodiments of the present application, reference can be made to Figure 3 , Figure 3 Another flowchart of an attack path restoration method provided in the embodiments of the present application is shown in FIG. 6.

[0237] Reference can be made to Figure 4 , Figure 4 A component-level attack path diagram provided in the embodiments of the present application is shown in FIG. 7.

[0238] In Figure 4 , server node A, server node B1, server node B2, and server node C are included; server node A includes component node a1_1, component node a1_2, and component node a1_3; server node B1 includes component node b1_1 and component node b1_2; server node B2 includes component node b2_1, component node b2_2, component node b2_3, and component node b2_4; and server node C includes component node c1_1 and component node c1_2.

[0239] Reference can be made to Figure 5 , Figure 5 A server-dimension attack path diagram provided in the embodiments of the present application is shown in FIG. 8.

[0240] In Figure 5 , server nodes A, B, C, D, and E are included; and there are four paths from A to E:

[0241] Path 1: A→B→D→E;

[0242] Path 2: A→C→D→E;

[0243] Path 3: A→B→E;

[0244] Path: A→C→E;

[0245] Among them, S severity A=2, S severity B=4, S severity C=5, S severity D=6, and S severity E=7. The shortest path of the above attack path is 3.

[0246] Server node A is connected to server node B and server node C, so C_A=2;

[0247] L_A = 1 / 3 x 2 = 2 / 3; APCI_A = 4 / 3; F_A = 1 + 1 + 1 + 2 + 4 = 9.

[0248] Server node B connects server node A, server node D, and server node E, so C_B = 3; L_B = 2 / 3; APCI_B = 2; F_B = 1 + 1 + 1 = 3.

[0249] Server node C connects server node A, server node D, and server node E, so C_C = 3; L_C = 2 / 3; APCI_C = 2; F_C = 1 + 1 + 1 = 3.

[0250] Server node D connects server node B, server node C, and server node E, so C_D = 3; L_D = 1; APCI_D = 3; F_D = 1 + 1 = 2.

[0251] Server node E connects server node B, server node D, and server node C, so C_E = 3; L_E = 1 x 2 = 2; APCI_E = 6; F_E = 1.

[0252] According to the formula RS = Sseverity x v1 + APCI x v2 + F x v3, we get:

[0253] RS_A = 1 + 0.4 + 1.8 = 3.2;

[0254] RS_B = 2 + 0.6 + 0.6 = 3.2;

[0255] RS_C = 2.5 + 0.6 + 0.6 = 3.7;

[0256] RS_D = 3 + 0.9 + 0.4 = 4.3;

[0257] RS_E = 3.5 + 1.8 + 0.2 = 5.5.

[0258] The ranking result is: E > D > C > B = A.

[0259] Among them, server node E has the highest repair priority score, which means it has a very high criticality in the attack path, and has a higher APCI, which makes it the most needed target for priority repair. The high value of APCI may mean that the attacker has multiple ways to exploit node E. Therefore, repairing node E can significantly reduce the potential attack surface.

[0260] The repair priority score of server node D is second, indicating that it also plays an important role in the attack path, but may be slightly lower than node E in criticality or diversity.

[0261] The repair priority score of server node C is in the middle, indicating that it is important, but it may not be as critical or diverse as server node E and server node D, so its repair priority is relatively low.

[0262] Server node B and server node A have the same repair priority score and are ranked last, that is, although server node A is the starting node, the risk assessment is the same as server node B.

[0263] The above-mentioned form of ranking quantifies the importance of repair priority. It helps the security team to identify the most critical nodes and reasonably allocate resources to mitigate risks. In practical applications, the security team should develop a repair plan based on this ranking, and prioritize those nodes that have the greatest impact on network security.

[0264] The attack path restoration method provided by the embodiments of the present application can accurately restore the attack path after an internal network attack event occurs by real-time monitoring and data collection, and present it to the user through visual display. The system and method can improve the information security level of enterprises and organizations and effectively cope with internal network attack threats.

[0265] The embodiments of the present application realize real-time monitoring and data collection of the application program by installing and configuring the RASP agent on the server where the application is located, and provide a new attack path restoration method. By associating the related servers and components in the attack event, the attack path can be accurately restored, helping enterprises and organizations to quickly analyze and respond to internal network attack events. The attack path restoration results are displayed visually, providing intuitive information presentation. Based on the server network topology, component interaction, etc., the key data scattered in network analysis such as data volume transmission and data sensitivity are comprehensively analyzed and quantified, which facilitates the security team to further analyze and make decisions, confirm the repair priority, and better cope with network security events.

[0266] Based on the content described in the above embodiments, an attack path restoration system is also provided in the embodiments of the present application, which is described with reference to Figure 6 , Figure 6 is a schematic diagram of the architecture of an attack path restoration system provided in the embodiments of the present application.

[0267] In some embodiments, the attack path restoration system described above includes:

[0268] The data collection module 601 is configured to use the RASP agent to monitor the running of the application program in real time and collect related data on the server where the application is located.

[0269] The node analysis module 602 is configured to associate the related servers in the attack event based on the collected data, and determine the associated nodes in the attack path.

[0270] Attack path construction module 603: construct attack path, provide server level and component level attack path graph.

[0271] Path optimization module 604: adjust attack path graph based on artificial feedback.

[0272] Decision module 605: quantify server / component risk on attack path, output attack path graph, provide reference for repair priority. In addition, it can also be used to update data collection module 601.

[0273] The attack path restoration system provided by the embodiments of the present application can accurately restore the attack path after an internal network attack event occurs, and present the attack path to the user through visual display, thereby improving the information security level of enterprises and organizations and effectively dealing with internal network attack threats.

[0274] Based on the content described in the above embodiments, an attack path restoration apparatus is further provided in the embodiments of the present application, which refers to Figure 7 , Figure 7 A program module schematic diagram of the attack path restoration apparatus provided in the embodiments of the present application is shown in some embodiments, and the attack path restoration apparatus 70 includes:

[0275] The data collection module 701 is configured to monitor the running state of an application program in each server by using a RASP agent installed on each server, and collect key data of the application program in a running process.

[0276] The node analysis module 702 is configured to generate alarm information according to the key data when an attack event is detected, and determine a target server associated with the attack event in the each server according to the alarm information.

[0277] The attack path construction module 703 is configured to generate a server attack path according to an interaction relationship between a plurality of target servers, and generate an attack path corresponding to the attack event according to the server attack path and each component in the target servers.

[0278] In some embodiments, the key data includes at least one of the following: request message, response message, access path, execution log; the alarm information includes source IP address and destination IP address.

[0279] The node analysis module 702 is configured to:

[0280] Determine the server corresponding to the destination IP address as the target server.

[0281] In some embodiments, the attack path construction module 703 is configured to:

[0282] obtain target alarm information;

[0283] mark a generation time of the target alarm information as a first end time point;

[0284] obtain historical alarm information within a preset time period before the first end time point, find first historical alarm information with a same destination IP address as a source IP address in the target alarm information in the historical alarm information, and determine a first server generating the first historical alarm information;

[0285] replace the target alarm information with the first historical alarm information, and return to the step of marking the generation time of the target alarm information as the first end time point until a preset execution cut-off condition is met;

[0286] generate the server attack path based on the interaction relationship between the determined servers.

[0287] In some embodiments, the attack path construction module 703 is configured to:

[0288] determine an interaction relationship between components in the target server according to the server attack path and the components;

[0289] generate an attack path corresponding to the attack event according to the interaction relationship between the components.

[0290] In some embodiments, the attack path construction module 703 is configured to:

[0291] obtain log information of the components in the target server based on the server attack path;

[0292] determine an interaction relationship between the components according to the log information, the interaction relationship including at least one of the following: application API calling relationship, data transmission relationship, and service request relationship.

[0293] In some embodiments, the apparatus further includes a repair module configured to:

[0294] determine a repair priority score of each server on the attack path, and determine a repair priority of each server on the attack path according to the repair priority score;

[0295] and / or, determine a severity score of each component on the attack path, and determine a repair priority of each component on the attack path according to the severity score.

[0296] It should be noted that the attack path restoration apparatus provided in the embodiments of the present application specifically performs the contents described in the attack path restoration method in the embodiments, which will not be repeated here.

[0297] Further, based on the contents described in the above embodiments, the embodiments of the present application further provide an electronic device, which includes at least one processor and a memory; wherein the memory stores computer execution instructions; and the at least one processor executes the computer execution instructions stored in the memory to implement the steps of the attack path restoration method described in the above embodiments.

[0298] In order to better understand the embodiments of the present application, refer to Figure 8 , Figure 8 The hardware structure schematic diagram of an electronic device provided in the embodiments of the present application.

[0299] As shown in Figure 8 , the electronic device 80 of the present embodiment includes a processor 801 and a memory 802; wherein:

[0300] The memory 802 is configured to store computer execution instructions.

[0301] The processor 801 is configured to execute the computer execution instructions stored in the memory to implement the steps of the attack path restoration method described in the above embodiments.

[0302] Optionally, the memory 802 can be independent or integrated with the processor 801.

[0303] When the memory 802 is independently arranged, the device further includes a bus 803 for connecting the memory 802 and the processor 801.

[0304] The embodiments of the present application provide a computer readable storage medium, which stores computer execution instructions; when the processor executes the computer execution instructions, the steps of the attack path restoration method described in the above embodiments are implemented.

[0305] The embodiments of the present application provide a computer program product, which includes a computer program; when the computer program is executed by the processor, the steps of the attack path restoration method described in the above embodiments are implemented.

[0306] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other manners. For example, the described device embodiments are merely illustrative, and the division of the modules is merely logical function division, and there can be another division manner in actual implementation, for example, a plurality of modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed coupling or direct coupling or communication connection between modules can be indirect coupling or communication connection through some interfaces, devices or modules, and can be electrical, mechanical or in other forms.

[0307] The modules illustrated as separated components can or can not be physically separated, and the components illustrated as modules can or can not be physical units, i.e., can be located in one place, or can be distributed to a plurality of network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments.

[0308] In addition, the functional modules in each of the embodiments of the present application can be integrated in one processing unit, or each module can be physically present alone, or two or more modules can be integrated in one unit. The unit formed by the above modules can be realized in the form of hardware, or in the form of hardware plus software functional unit.

[0309] The integrated modules realized in the form of software functional modules can be stored in a computer readable storage medium. The software functional modules stored in the storage medium include a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute part of the steps of the method described in each of the embodiments of the present application.

[0310] It should be understood that the above processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor, or the processor can also be any conventional processor, etc. The steps of the method disclosed in the present application can be directly embodied as hardware processor execution, or executed by a combination of hardware and software modules in the processor.

[0311] The memory can include a high-speed memory, and can also include a nonvolatile storage, for example, at least one disk memory, and can also be a U disk, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0312] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0313] The storage medium described above can be implemented by any type of volatile or nonvolatile storage devices or a combination thereof, such as a static random access memory, an electrically erasable programmable read-only memory, an erasable programmable read-only memory, a programmable read-only memory, a read-only memory, a magnetic storage, a flash memory, a magnetic disk, or an optical disk. The storage medium can be any available medium that a general or special purpose computer can access.

[0314] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. An attack path restoration method characterized by, The method comprises: Monitoring the running state of an application in each server and collecting key data of the application during running by using a runtime application self-protection (RASP) agent installed on each server; When an attack event is detected, generating alarm information according to the key data, and determining a target server in the servers that has a correlation with the attack event according to the alarm information; Generating a server attack path according to the interaction relationship between a plurality of target servers; Generating an attack path corresponding to the attack event according to the server attack path and each component in the target server; The method further comprises: Determining a repair priority score of each server on the attack path, and determining a repair priority of each server on the attack path according to the repair priority score. The method comprises: Monitoring the running state of an application in each server and collecting key data of the application during running by using a runtime application self-protection (RASP) agent installed on each server; When an attack event is detected, generating alarm information according to the key data, and determining a target server in the servers that has a correlation with the attack event according to the alarm information; Generating a server attack path according to the interaction relationship between a plurality of target servers; 2. The method of claim 1, wherein, Generating an attack path corresponding to the attack event according to the server attack path and each component in the target server; The method further comprises: Determining a repair priority score of each server on the attack path, and determining a repair priority of each server on the attack path according to the repair priority score.

3. The method of claim 1, wherein, The method comprises: Monitoring the running state of an application in each server and collecting key data of the application during running by using a runtime application self-protection (RASP) agent installed on each server; When an attack event is detected, generating alarm information according to the key data, and determining a target server in the servers that has a correlation with the attack event according to the alarm information; 4. The method of claim 3, wherein, Generating a server attack path according to the interaction relationship between a plurality of target servers; Generating an attack path corresponding to the attack event according to the server attack path and each component in the target server; The method further comprises:

5. The method of claim 1, wherein, Determining a repair priority score of each server on the attack path, and determining a repair priority of each server on the attack path according to the repair priority score. The method comprises: Monitoring the running state of an application in each server and collecting key data of the application during running by using a runtime application self-protection (RASP) agent installed on each server; When an attack event is detected, generating alarm information according to the key data, and determining a target server in the servers that has a correlation with the attack event according to the alarm information; Generating a server attack path according to the interaction relationship between a plurality of target servers; Generating an attack path corresponding to the attack event according to the server attack path and each component in the target server; The method further comprises: Determining a repair priority score of each server on the attack path, and determining a repair priority of each server on the attack path according to the repair priority score. And / or, determine a severity score of each component on the attack path, according to the severity score, determine a repair priority of each component on the attack path.

6. An attack path restoration apparatus characterized by comprising: The device comprises: A data collection module configured to monitor running states of application programs in each server by using RASP agents installed on the servers, and collect key data of the application programs during running; A node analysis module configured to generate alarm information according to the key data when detecting an attack event, and determine target servers in the servers having a correlation with the attack event according to the alarm information; An attack path construction module configured to generate a server attack path according to interaction relationships among the target servers, and generate an attack path corresponding to the attack event according to the server attack path and each component in the target servers; The server attack path is generated according to the interaction relationships among the target servers, and comprises: Obtaining target alarm information; Marking a generation time of the target alarm information as a first end time point; Obtaining historical alarm information within a preset time period before the first end time point, finding first historical alarm information having a same destination IP address as a source IP address in the target alarm information in the historical alarm information, and determining a first server generating the first historical alarm information; Replacing the target alarm information with the first historical alarm information, returning to the step of marking the generation time of the target alarm information as the first end time point, and executing until a preset execution cutoff condition is met; Generating the server attack path based on the interaction relationships among the determined first servers.

7. An electronic device, comprising: Comprise: A processor, and a memory connected with the processor in communication; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to implement the attack path restoration method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the attack path restoration method according to any one of claims 1 to 5.

9. A computer program product, characterised in that, A computer program is executed by the processor to implement the attack path restoration method according to any one of claims 1 to 5.

Images