Network asset security monitoring method and device and processing equipment
By configuring one-to-one adaptation and dynamically adjusting baseline thresholds for each network asset, the problem of large traditional baseline detection errors is solved, high-precision network asset security monitoring is achieved, and network security is ensured.
Patent Information
- Application Number
- CN202411964649.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-30
- Publication Date
- 2025-02-28
AI Technical Summary
Traditional fixed threshold baseline detection has high errors and obvious false alarms in network asset security monitoring, resulting in poor security monitoring results.
The baseline threshold is adopted for each network asset configuration one-to-one adaptation and dynamic adjustment, and the port access behavior data of network assets is obtained and collected, and the feature quantification is performed by combining multiple indicators, and the dynamic adjustment mechanism is used to improve the accuracy of baseline detection.
It significantly improves the accuracy of the system baseline detection, effectively avoids erroneous deviation from alarm information, achieves high-precision security monitoring effect, and ensures overall network security.
Smart Images
Figure CN119544377A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security, and specifically to a network asset security monitoring method, device and processing equipment. Background Art
[0002] In practical applications, the safety monitoring (or safety surveillance) of the equipment's operating status may involve the application of baseline detection. Generally speaking, for different operating states of the equipment, a corresponding normal range can be configured. Therefore, the baseline can also be understood by a range threshold. In this way, by comparing the difference between the equipment's current operating state and a given baseline, it can be found whether the equipment has any abnormal conditions or is in an abnormal state.
[0003] In network security work, it is understandable that the network attack and defense situation is becoming increasingly severe. For example, DDoS attacks, SQL injections, cross-site scripting, etc., can lead to security incidents such as data leakage and service interruptions. Therefore, network security is becoming more and more important.
[0004] In the internal network architecture of an enterprise, numerous network assets are involved. With the popularization of the Internet of Things (IoT) and cloud computing, the types and quantities of assets have increased dramatically, and the complexity of port management and access control has also increased. Based on the above situations, asset port access security detection is an important aspect of network security management. Its main purpose is to identify unauthorized access and potential security threats by monitoring port access on assets (such as servers, network devices and other types of network assets) and respond in a timely manner.
[0005] However, the inventors of the present application have discovered that when baseline detection is introduced into network assets in a network architecture, traditional fixed threshold baseline detection often has high errors and obvious false positives, and is not effective for security monitoring of network assets. Summary of the invention
[0006] The present application provides a network asset security monitoring method, apparatus and processing equipment, which are used to configure a one-to-one adapted and dynamically adjusted baseline threshold for each network asset on the basis of introducing a baseline detection mechanism to perform security monitoring on the ports of network assets. This can significantly improve the accuracy of system baseline detection, effectively avoid many erroneous deviation alarm information in the prior art, accurately capture possible network attacks for different network assets, achieve high-precision security monitoring effects, and thus ensure overall network security.
[0007] In a first aspect, the present application provides a network asset security monitoring method, the method comprising:
[0008] Obtaining a security monitoring task for a target network asset in a network architecture, wherein the security monitoring task is used to monitor whether there is a network attack on a port access behavior for the target network asset within a monitoring period;
[0009] Collecting descriptive data of port access behavior of target network assets during the monitoring period, wherein the descriptive data quantifies the characteristics of port access behavior through multiple indicators;
[0010] Based on the descriptive data and combined with the baseline threshold, it is determined whether there is a network attack on the target network assets during the monitoring period. The baseline threshold is specifically adapted one-to-one to the target network assets, and the baseline threshold is dynamically adjusted using a dynamic adjustment mechanism.
[0011] In combination with the first aspect of the present application, in a first possible implementation method of the first aspect of the present application, in the description data, the multiple indicators specifically include the destination IP, the source IP, the destination port and the source port.
[0012] In combination with the first possible implementation of the first aspect of the present application, in a second possible implementation of the first aspect of the present application, the description data is configured in units of sessions;
[0013] Based on the descriptive data and combined with the baseline threshold, determine whether there is a network attack on the target network assets during the monitoring period, including:
[0014] Based on the descriptive data and combined with the baseline threshold, determine whether there are any abnormal sessions of an attack nature in the target network assets during the monitoring period.
[0015] In combination with the second possible implementation method of the first aspect of the present application, in the third possible implementation method of the first aspect of the present application, the baseline threshold is dynamically adjusted under the dynamic adjustment mechanism, specifically based on the session data of multiple monitoring time periods, and the abnormal session data in the monitoring time period is ignored.
[0016] In combination with the third possible implementation of the first aspect of the present application, in a fourth possible implementation of the first aspect of the present application, the dynamic adjustment process includes the following processing contents:
[0017] Based on the number of visits obtained by grouping different destination IPs, different source IPs, different destination ports and different source ports, determine the number of visits set composed of the number of visits in the latest five consecutive monitoring time periods in time sorting;
[0018] Based on the access count set, the access count baseline threshold is calculated according to the following formula:
[0019] Q i =M i ×k+Qi-1 ×(1-k),
[0020] Among them, i = 1, 2, 3, 4, 5, Q5 is the latest visit count baseline threshold output value, Q1 = M1, Q5 is iteratively calculated from Q2, M i is the number of visits in the i-th monitoring time period in the visit number set, and k is the adjustment coefficient.
[0021] In combination with the third possible implementation of the first aspect of the present application, in the fifth possible implementation of the first aspect of the present application, the monitoring time period is specifically a daily time period.
[0022] In combination with the third possible implementation of the first aspect of the present application, in a sixth possible implementation of the first aspect of the present application, the method further includes:
[0023] If, based on the descriptive data and combined with the baseline threshold, it is determined that there are abnormal sessions of an attack nature in the target network assets during the previous monitoring period, an alarm reminder will be issued and the session data of the abnormal session will be pushed to the device on the staff side to prompt manual processing and arrange further response.
[0024] In a second aspect, the present application provides a network asset security monitoring device, the device comprising:
[0025] An acquisition unit, used to acquire a security monitoring task for a target network asset in a network architecture, wherein the security monitoring task is used to monitor whether there is a network attack on a port access behavior for the target network asset within a monitoring period;
[0026] A collection unit, used to collect description data of port access behavior of target network assets during a monitoring period, wherein the description data quantifies the characteristics of the port access behavior through multiple indicators;
[0027] The judgment unit is used to judge whether there is a network attack on the target network asset within the monitoring time period based on the description data and the baseline threshold, wherein the baseline threshold is specifically adapted one-to-one to the target network asset, and the baseline threshold is specifically dynamically adjusted using a dynamic adjustment mechanism.
[0028] In combination with the second aspect of the present application, in a first possible implementation method of the second aspect of the present application, in the description data, the multiple indicators specifically include the destination IP, the source IP, the destination port and the source port.
[0029] In combination with the first possible implementation of the second aspect of the present application, in a second possible implementation of the second aspect of the present application, the description data is configured in units of sessions;
[0030] The judgment unit is specifically used for:
[0031] Based on the descriptive data and combined with the baseline threshold, determine whether there are any abnormal sessions of an attack nature in the target network assets during the monitoring period.
[0032] In combination with the second possible implementation method of the second aspect of the present application, in the third possible implementation method of the second aspect of the present application, the baseline threshold is dynamically adjusted under the dynamic adjustment mechanism, specifically based on the session data of multiple monitoring time periods, and the abnormal session data in the monitoring time period is ignored.
[0033] In combination with the third possible implementation of the second aspect of the present application, in a fourth possible implementation of the second aspect of the present application, the dynamic adjustment process includes the following processing contents:
[0034] Based on the number of visits obtained by grouping different destination IPs, different source IPs, different destination ports and different source ports, determine the number of visits set composed of the number of visits in the latest five consecutive monitoring time periods in time sorting;
[0035] Based on the access count set, the access count baseline threshold is calculated according to the following formula:
[0036] Q i =M i ×k+Q i-1 ×(1-k),
[0037] Among them, i = 1, 2, 3, 4, 5, Q5 is the latest visit count baseline threshold output value, Q1 = M1, Q5 is iteratively calculated from Q2, M i is the number of visits in the i-th monitoring time period in the visit number set, and k is the adjustment coefficient.
[0038] In combination with the third possible implementation of the second aspect of the present application, in the fifth possible implementation of the second aspect of the present application, the monitoring time period is specifically a daily time period.
[0039] In combination with the third possible implementation manner of the second aspect of the present application, in a sixth possible implementation manner of the second aspect of the present application, the device further includes a response unit, which is used to:
[0040] If, based on the descriptive data and combined with the baseline threshold, it is determined that there are abnormal sessions of an attack nature in the target network assets during the previous monitoring period, an alarm reminder will be issued and the session data of the abnormal session will be pushed to the device on the staff side to prompt manual processing and arrange further response.
[0041] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.
[0042] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.
[0043] From the above content, it can be concluded that the present application has the following beneficial effects:
[0044] Aiming at the security monitoring goal of network assets, this application introduces a baseline detection mechanism to perform security monitoring on the ports of network assets, and configures a one-to-one adapted and dynamically adjusted baseline threshold for each network asset. This can significantly improve the accuracy of system baseline detection, effectively avoid many erroneous deviation alarm messages in the prior art, accurately capture possible network attacks for different network assets, achieve high-precision security monitoring effects, and thus ensure overall network security. BRIEF DESCRIPTION OF THE DRAWINGS
[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.
[0046] Figure 1 A flowchart of a network asset security monitoring method for this application;
[0047] Figure 2 A schematic diagram of an example of creating a new task for this application;
[0048] Figure 3 An example diagram of a task queue for this application;
[0049] Figure 4 An example diagram of viewing a brief task status for this application;
[0050] Figure 5 An example diagram of viewing the specific task status for this application;
[0051] Figure 6 A schematic diagram of the structure of the network asset security monitoring device of the present application;
[0052] Figure 7A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION
[0053] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.
[0054] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.
[0055] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.
[0056] Before introducing the network asset security monitoring method provided by this application, the background content involved in this application is first introduced.
[0057] The network asset security monitoring method, device and computer-readable storage medium provided in the present application can be applied to processing equipment, and is used to configure a one-to-one adapted and dynamically adjusted baseline threshold for each network asset on the basis of introducing a baseline detection mechanism to perform security monitoring on the ports of network assets. This can significantly improve the accuracy of the system baseline detection, effectively avoid many erroneous deviation alarm messages in the prior art, accurately capture possible network attacks for different network assets, achieve high-precision security monitoring effects, and thus ensure overall network security.
[0058] The network asset security monitoring method mentioned in this application can be executed by a network asset security monitoring device, or a server, physical host or user equipment (UE) and other different types of processing devices integrated with the network asset security monitoring device. The network asset security monitoring device can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, tablet computer, laptop computer, desktop computer or personal digital assistant (PDA), and the processing device can be set in the form of a device cluster.
[0059] Among them, the processing equipment that executes the network asset security monitoring method of the present application or is equipped with the application service corresponding to the network asset security monitoring method of the present application is usually a device node other than the monitored object in the network architecture, that is, the network asset. Of course, in some cases, it is not ruled out that it is the currently monitored network asset itself or other network assets included in the monitoring scope. Furthermore, the processing equipment can also be a third-party device outside the network architecture. These are all possible in actual situations and can be adaptively configured according to actual needs. Therefore, the present application does not make specific limitations on the specific equipment type and equipment deployment form of the processing equipment.
[0060] Next, we will introduce the network asset security monitoring method provided by this application.
[0061] First, see Figure 1 , Figure 1 A schematic diagram of a process of the network asset security monitoring method of the present application is shown. The network asset security monitoring method provided by the present application may specifically include the following steps S101 to S103:
[0062] Step S101, obtaining a security monitoring task for a target network asset in a network architecture, wherein the security monitoring task is used to monitor whether there is a network attack on a port access behavior for the target network asset within a monitoring period;
[0063] It can be understood that in specific applications, under the goal of network asset security monitoring, this application specifically promotes security monitoring and processing of target network assets (usually pre-configured network assets, and in some cases network assets specified or identified in real time) in the form of tasks, which is the security monitoring task mentioned here.
[0064] In the task information, the current target network asset can be directly specified or indirectly indicated, which can be configured according to actual needs.
[0065] The network assets involved in this application are, specifically, device nodes involved in the network architecture within an enterprise / company, such as servers, network devices and other types of device nodes. The definition of network assets in the current network architecture can also be configured according to actual needs.
[0066] In addition, the acquisition and processing of security monitoring tasks for target network assets in the network architecture here may involve manual entry, or may be tasks forwarded by other devices, or may be tasks initiated locally according to pre-configured task initiation strategies. The specific method of acquiring tasks can also be configured as needed.
[0067] As an example, in actual applications, security monitoring tasks for target network assets can be generated regularly according to the monitoring cycle. For different network assets, under this task generation mechanism, tasks can also be generated autonomously at different time points, further improving the adaptability and flexibility of the application.
[0068] As another example, see Figure 2 An example schematic diagram of a new task created in the present application is shown. In actual application, a baseline detection task for the corresponding port of the target network asset can be initiated by a staff member.
[0069] In addition, in terms of system application services, based on the visual interface (which may also involve web services), in addition to creating new tasks, it can also involve task management in terms of viewing task status, updating task information, etc., such as Figure 3 An example schematic diagram of the application viewing task queue is shown, Figure 4 An example schematic diagram of viewing a brief task status of the present application is shown and Figure 5 An example schematic diagram of viewing a specific task status in the present application is shown.
[0070] Step S102, collecting description data of port access behavior of the target network asset during the monitoring period, wherein the description data quantifies the characteristics of the port access behavior through multiple indicators;
[0071] It can be understood that, corresponding to the security monitoring requirements of the target network assets during the monitoring period, descriptive data of the port access behavior of the target network assets during the detection period can be collected for use in subsequent baseline detection processing.
[0072] Among them, it can be seen that what this application specifically wants to monitor is the access to the corresponding network ports of network assets, whether there are network attack events / behaviors / situations, and the actual situation of the corresponding network assets facing potential security threats such as unauthorized access.
[0073] In this case, the present application can quantify the behavior characteristics of the port access behaviors for busy and unbusy network assets during the monitoring period through the corresponding configured indicators to form the description data mentioned here.
[0074] As an example, the collected descriptive data, or the initial data that needs to be collected and processed into descriptive data, can be stored in the Clickhouse database, and when the data needs to be called, it can be located and pulled out from the Clickhouse database for use.
[0075] Among the existing database products that can be used, Clickhouse is a column-based database management system (DBMS) for online analytical processing (OLAP), which has the advantages of high performance, high scalability and efficient data compression, and is suitable for the present application.
[0076] It is worth adding that, in actual applications, the subsequent baseline detection processing can be carried out after the monitoring period has passed, that is, after the descriptive data of the port access behavior of the target network assets in the complete monitoring period has been collected, or, it can be during the monitoring period, in real time or at several time points therein, to collect the descriptive data of the port access behavior of the target network assets in the monitoring period to promote the subsequent baseline detection processing.
[0077] As an exemplary embodiment here, in the description data, the multiple indicators involved may specifically include destination IP, source IP, destination port and source port.
[0078] It can be understood that through the four elements of destination IP, source IP, destination port and source port, the present application can perform more specific port access category processing, that is, group processing, so as to promote fine-grained baseline detection processing.
[0079] Step S103, based on the description data and in combination with the baseline threshold, it is determined whether there is a network attack on the target network asset during the monitoring period, wherein the baseline threshold is specifically adapted one-to-one to the target network asset, and the baseline threshold is specifically dynamically adjusted using a dynamic adjustment mechanism.
[0080] In this way, after obtaining the descriptive data of the port access behavior of the target network assets during the monitoring period, it can be combined with the corresponding baseline threshold to determine whether the port access behavior of the target network assets during the monitoring period exceeds the normal level (deviates from the normal range), whether there are abnormal conditions, whether there is an attack nature, and then make a judgment on whether there is a network attack on the target network assets during the monitoring period.
[0081] It should be noted that compared with the fixed baseline threshold setting used in the prior art, the baseline threshold used in the present application for security monitoring of target network assets has two major characteristics:
[0082] 1. There is a one-to-one match between the baseline threshold and the target network asset. That is, the baseline thresholds applicable to different network assets are configured independently. In this way, for each network asset, a highly adaptive baseline detection process can be made according to the specific situation of the network asset, which helps to achieve high-precision security monitoring effects;
[0083] 2. The baseline threshold itself is dynamically adjusted. That is to say, for the same network asset, facing different situations, a corresponding baseline threshold will be formed. In this way, the adaptability will continue to be improved in details, and high-precision security monitoring effects will be further achieved.
[0084] Among them, in the process of dynamic adjustment, it can be adjusted in advance or in real time. This may also involve the difference in input data involved in the baseline threshold autonomous adjustment strategy. If all or part of the input data is real-time data, real-time adjustment is required.
[0085] In this way, under the highly adaptable baseline threshold setting through the above two aspects, in actual applications, by continuously correcting the threshold deviation between different rounds of baseline detection processing, customized / personalized deep baseline detection can be performed on the target network assets, and port access / network attacks that are difficult to detect / identify can be captured more accurately.
[0086] Furthermore, during the baseline detection process, the present application can be carried out in units of sessions to identify abnormal sessions in port access behaviors and achieve a high-precision security monitoring effect at a session granularity.
[0087] Correspondingly, as an exemplary embodiment, the foregoing description data may also be configured in units of sessions, which facilitates subsequent data use.
[0088] Correspondingly, here, based on the description data and combined with the baseline threshold, it is determined whether there is a network attack on the target network asset during the monitoring period, which can include:
[0089] Based on the descriptive data and combined with the baseline threshold, determine whether there are any abnormal sessions of an attack nature in the target network assets during the monitoring period.
[0090] In addition, it can be understood that, based on the introduction of the session element, the description data collected above may involve not only the destination IP, source IP, destination port and source port, but also the session, session time and other corresponding contents.
[0091] Furthermore, for the dynamic adjustment mechanism configured for the baseline threshold in the present application, as an exemplary embodiment, the baseline threshold under the dynamic adjustment mechanism can specifically carry out dynamic adjustment processing based on the session data of multiple monitoring time periods, and ignore abnormal session data in the monitoring time period.
[0092] That is to say, in specific operations, based on the valid session data that is retained while ignoring the session data that is determined to be abnormal, i.e., the presence of a network attack, this application believes that there is a correlation between the session data of different monitoring time periods, which can provide an effective data reference for the dynamic adjustment of the baseline threshold, and specifically capture the corresponding deep-level dynamic adjustment connection therefrom, so as to better realize the dynamic adjustment configured for the baseline threshold by this application.
[0093] As an exemplary embodiment, the present application also provides a practical implementation scheme based on a quantitative formula in terms of details. Specifically, the baseline threshold dynamic adjustment mechanism configured in the present application may include the following processing contents:
[0094] Based on the number of visits obtained by grouping different destination IPs, different source IPs, different destination ports and different source ports, determine the number of visits set composed of the number of visits in the latest five consecutive monitoring time periods in time sorting;
[0095] Based on the access count set, the access count baseline threshold is calculated according to the following formula:
[0096] Q i =M i ×k+Q i-1 ×(1-k),
[0097] Among them, i = 1, 2, 3, 4, 5, Q5 is the latest access count baseline threshold output value, Q5 is the specific value of the baseline threshold used to perform the current baseline detection, Q1 = M1, Q5 is iteratively calculated from Q2, M i is the number of visits in the i-th monitoring time period in the visit number set, and k is the adjustment coefficient.
[0098] As an example, in one case, the port access days table can be queried according to the execution cycle time, and grouped according to IP, port and date, and the corresponding access times can be counted. Then, the access times of the corresponding port of the corresponding asset are obtained by grouping by IP and port every day during the execution cycle. The access times are smoothed, and the adjustment coefficient k is set to 0.5 (that is, the adjustment coefficient k can take a specific value such as 0.5). Assuming that the access times for 5 consecutive days are [10, 12, 15, 13, 18], after calculation, the first value may still be 10, the second value is 0.5×12+(1-0.5)×10=11, and the third value is 0.5×15+(1-0.5)×11=13. By analogy, the new sequence finally obtained can show the changing trend of the access times more smoothly, and then the last value of the access times is output as the baseline threshold.
[0099] In addition, it can be understood that, in addition to the specific value of the adjustment coefficient k being adaptively configured according to actual needs, the number of access times in the continuous latest monitoring time period can be other specific numbers other than 5.
[0100] Furthermore, it can be seen from the embodiments here that the monitoring time period involved in the present application can be specifically a daily time period, that is, a 24-hour time period, for example, it can be specifically from 0:00 to 00:00. The setting of this monitoring time period is more in line with the work habits of relevant personnel responsible for the enterprise's network security work, and is convenient for daily checking whether there is abnormal access / network attack on network assets in the enterprise's internal network architecture.
[0101] Of course, in addition to the daily time period, it can also be a half-day time period, that is, a 12-hour time period, or a monitoring time period with other time spans, and even if the time span is the same, the specific start time point and end time point involved may also be different.
[0102] In addition, the monitoring time periods may be discontinuous in some cases, which can be flexibly adjusted in actual applications based on specific application requirements.
[0103] At the same time, it can also be seen that the present application scheme is mainly used to monitor abnormal access / network attacks from a retrospective perspective, and for the network security work of an enterprise, other network security mechanisms are usually also provided, such as intrusion prevention systems (IPS), intrusion detection systems (IDS) and other network security facilities to resist or eliminate more urgent security threats in real time. In other words, in actual application, the present application scheme is usually a supplementary scheme to the details of the network security mechanism, thereby strengthening the network security performance at the detail level, thereby promoting the improvement of the overall network security performance.
[0104] After determining that the corresponding port of the target network asset has an abnormality or network attack, it can either respond autonomously according to the pre-configured autonomous response strategy / rules to resist or eliminate the impact, or it can trigger manual response processing, and the corresponding staff will make further analysis and decisions. Correspondingly, the present application method may also involve corresponding response processing.
[0105] For the latter, specifically, as an exemplary embodiment, the method of the present application may further include:
[0106] If, based on the descriptive data and combined with the baseline threshold, it is determined that there are abnormal sessions of an attack nature in the target network assets during the previous monitoring period, an alarm reminder will be issued and the session data of the abnormal session will be pushed to the device on the staff side to prompt manual processing and arrange further response.
[0107] Among them, it can be understood that manual response processing may also involve confirming that the network attack originally determined by the system is not a network attack. At this time, it can be marked to update the abnormal session data originally marked as a network attack to normal session data. At this time, the session data that was originally not included in the dynamic adjustment scope of the baseline threshold is added to the dynamic adjustment scope of the baseline threshold, which has a closed-loop control effect on the dynamic adjustment mechanism of the baseline threshold.
[0108] That is to say, if there is a deviation in the calculation, for example, the number of visits to the port corresponding to the asset increases today, and it is confirmed that it is normal access, then the data of the previous day will be re-counted in the early morning to obtain the latest number of visits to the corresponding port, and then a new baseline threshold will be obtained through the port baseline calculation, so as to dynamically adjust the prediction value and ensure the accuracy of the baseline detection.
[0109] As an example, for the embodiment here, there may be:
[0110] Monitor and warn of access to specific servers in the network. If the number of access sessions suddenly increases, an alarm will be issued. Finally, manual analysis will be conducted to determine whether the specific session is an attack.
[0111] If the access is normal, the baseline detection system will dynamically calculate and adjust the threshold according to the new access value to avoid subsequent alarms;
[0112] If the access is abnormal, it is handled manually, and the marked session is not included in the statistics. The subsequent threshold calculation is maintained within the normal range, and the next attack will not generate an alarm, thereby dynamically adjusting the baseline threshold to ensure the accuracy of baseline detection.
[0113] Therefore, for the above solution content, in general, for the security monitoring goal of network assets, this application introduces a baseline detection mechanism to perform security monitoring on the ports of network assets, and configures a one-to-one adapted and dynamically adjusted baseline threshold for each network asset. This can significantly improve the accuracy of the system baseline detection, effectively avoid many erroneous deviation alarm information in the prior art, accurately capture possible network attacks for different network assets, achieve high-precision security monitoring effects, and thus ensure overall network security.
[0114] The above is an introduction to the network asset security monitoring method provided by this application. In order to facilitate better implementation of the network asset security monitoring method provided by this application, this application also provides a network asset security monitoring device from the perspective of functional modules.
[0115] See also Figure 6 , Figure 6 This is a schematic diagram of the structure of the network asset security monitoring device of the present application. In the present application, the network asset security monitoring device 600 may specifically include the following structure:
[0116] An acquisition unit 601 is used to acquire a security monitoring task for a target network asset in a network architecture, wherein the security monitoring task is used to monitor whether there is a network attack on a port access behavior for the target network asset within a monitoring period;
[0117] A collection unit 602 is used to collect description data of port access behavior of a target network asset during a monitoring period, wherein the description data quantifies the characteristics of the port access behavior through multiple indicators;
[0118] The judgment unit 603 is used to judge whether there is a network attack on the target network asset within the monitoring time period based on the description data and in combination with the baseline threshold, wherein the baseline threshold is specifically adapted one-to-one to the target network asset, and the baseline threshold is specifically dynamically adjusted using a dynamic adjustment mechanism.
[0119] In an exemplary embodiment, the multiple indicators specifically include destination IP, source IP, destination port and source port.
[0120] In combination with the first possible implementation of the second aspect of the present application, in a second possible implementation of the second aspect of the present application, the description data is configured in units of sessions;
[0121] The judging unit 603 is specifically configured to:
[0122] Based on the descriptive data and combined with the baseline threshold, determine whether there are any abnormal sessions of an attack nature in the target network assets during the monitoring period.
[0123] In another exemplary embodiment, the baseline threshold is dynamically adjusted under the dynamic adjustment mechanism based on the session data of multiple monitoring time periods, and the abnormal session data in the monitoring time period is ignored.
[0124] In another exemplary embodiment, the dynamic adjustment process includes the following processing contents:
[0125] Based on the number of visits obtained by grouping different destination IPs, different source IPs, different destination ports and different source ports, determine the number of visits set composed of the number of visits in the latest five consecutive monitoring time periods in time sorting;
[0126] Based on the access count set, the access count baseline threshold is calculated according to the following formula:
[0127] Q i =M i ×k+Q i-1 ×(1-k),
[0128] Among them, i = 1, 2, 3, 4, 5, Q5 is the latest visit count baseline threshold output value, Q1 = M1, Q5 is iteratively calculated from Q2, M i is the number of visits in the i-th monitoring time period in the visit number set, and k is the adjustment coefficient.
[0129] In yet another exemplary embodiment, the monitoring time period is specifically a daily time period.
[0130] In yet another exemplary embodiment, the apparatus further includes a response unit 604, configured to:
[0131] If, based on the descriptive data and combined with the baseline threshold, it is determined that there are abnormal sessions of an attack nature in the target network assets during the previous monitoring period, an alarm reminder will be issued and the session data of the abnormal session will be pushed to the device on the staff side to prompt manual processing and arrange further response.
[0132] This application also provides a processing device from the perspective of hardware structure, see Figure 7 , Figure 7 701, a memory 702, and an input / output device 703. The processor 701 is used to execute the computer program stored in the memory 702 to implement the following Figure 1 The steps of the network asset security monitoring method in the corresponding embodiment; or, the processor 701 is used to execute the computer program stored in the memory 702 to implement the following Figure 6 Corresponding to the functions of each unit in the embodiment, the memory 702 is used to store the processor 701 executing the above Figure 1 The computer program required by the network asset security monitoring method in the corresponding embodiment.
[0133] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 702, and executed by the processor 701 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.
[0134] The processing device may include, but is not limited to, a processor 701, a memory 702, and an input / output device 703. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 701, the memory 702, the input / output device 703, etc. are connected via a bus.
[0135] The processor 701 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.
[0136] The memory 702 can be used to store computer programs and / or modules. The processor 701 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 702 and calling the data stored in the memory 702. The memory 702 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.
[0137] When the processor 701 is used to execute the computer program stored in the memory 702, the following functions can be implemented:
[0138] Obtaining a security monitoring task for a target network asset in a network architecture, wherein the security monitoring task is used to monitor whether there is a network attack on a port access behavior for the target network asset within a monitoring period;
[0139] Collecting descriptive data of port access behavior of target network assets during the monitoring period, wherein the descriptive data quantifies the characteristics of port access behavior through multiple indicators;
[0140] Based on the descriptive data and combined with the baseline threshold, it is determined whether there is a network attack on the target network assets during the monitoring period. The baseline threshold is specifically adapted one-to-one to the target network assets, and the baseline threshold is dynamically adjusted using a dynamic adjustment mechanism.
[0141] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the network asset security monitoring device, processing equipment and its corresponding units described above can refer to the following. Figure 1 The description of the network asset security monitoring method in the corresponding embodiment will not be repeated here in detail.
[0142] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.
[0143] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1The steps of the network asset security monitoring method in the corresponding embodiment, the specific operations can refer to the following Figure 1 The description of the network asset security monitoring method in the corresponding embodiment will not be repeated here.
[0144] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.
[0145] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the network asset security monitoring method in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the network asset security monitoring method in the corresponding embodiment are detailed in the previous description and will not be repeated here.
[0146] The network asset security monitoring method, device, processing equipment and computer-readable storage medium provided by the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the core idea of the present application; at the same time, for technical personnel in this field, according to the idea of the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.
Claims
1. A network asset security monitoring method, characterized in that: The method comprises: Acquire a security monitoring task for a target network asset in a network architecture, wherein the security monitoring task is used to monitor whether there is a network attack on a port access behavior for the target network asset within a monitoring time period; Collecting description data of the port access behavior of the target network asset during the monitoring period, wherein the description data quantifies the characteristics of the port access behavior through multiple indicators; On the basis of the description data and in combination with a baseline threshold, it is determined whether the target network asset has the network attack during the monitoring period, wherein the baseline threshold is specifically adapted one-to-one to the target network asset, and the baseline threshold is specifically dynamically adjusted using a dynamic adjustment mechanism.
2. The method according to claim 1, characterized in that In the description data, the multiple indicators specifically include destination IP, source IP, destination port and source port.
3. The method according to claim 2, characterized in that The description data is configured in units of sessions; The determining, based on the description data and in combination with a baseline threshold, whether the target network asset has been subjected to the network attack during the monitoring period includes: Based on the description data and in combination with a baseline threshold, it is determined whether there are any abnormal sessions of an attack nature on the target network asset during the monitoring time period.
4. The method according to claim 3, characterized in that Under the dynamic adjustment mechanism, the baseline threshold is dynamically adjusted based on the session data of multiple monitoring time periods, and abnormal session data in the monitoring time period is ignored.
5. The method according to claim 4, characterized in that The dynamic adjustment process includes the following processing contents: Based on the access counts obtained by grouping different destination IPs, different source IPs, different destination ports and different source ports, determine the access count set composed of the access counts of the latest five consecutive monitoring time periods in time sorting; Based on the access count set, the access count baseline threshold is calculated according to the following formula: Q i =M i ×k+Q i-1 ×(1-k), Among them, i = 1, 2, 3, 4, 5, Q5 is the latest visit count baseline threshold output value, Q1 = M1, Q5 is iteratively calculated from Q2, M i is the number of visits in the i-th monitoring time period in the visit number set, and k is the adjustment coefficient.
6. The method according to claim 4, characterized in that The monitoring time period is specifically a daily time period.
7. The method according to claim 4, characterized in that The method further comprises: If, based on the descriptive data and combined with the baseline threshold, it is determined that the target network asset has an abnormal session of an attack nature during the previous monitoring time period, an alarm reminder will be issued and the session data of the abnormal session will be pushed to the equipment on the staff side to prompt manual processing and arrange further response.
8. A network asset security monitoring device, characterized in that: The device comprises: An acquisition unit, used to acquire a security monitoring task for a target network asset in a network architecture, wherein the security monitoring task is used to monitor whether there is a network attack on a port access behavior for the target network asset within a monitoring time period; A collection unit, used to collect description data of the port access behavior of the target network asset during the monitoring period, wherein the description data quantifies the characteristics of the port access behavior through multiple indicators; A judgment unit is used to judge whether the target network asset has the network attack within the monitoring time period based on the description data and in combination with a baseline threshold, wherein the baseline threshold is specifically adapted one-to-one to the target network asset, and the baseline threshold is specifically dynamically adjusted using a dynamic adjustment mechanism.
9. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 7 when calling the computer program in the memory.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.