Precise association method and device for network end relationship in XDR

Abstract

The invention discloses a network end relation accurate association method and device in XDR. The method comprises the following steps: receiving an equipment unique identification request of an EDR terminal and an equipment unique identification request of NDR equipment; corresponding equipment unique identifiers are respectively distributed to the corresponding NDR equipment and the EDR terminal; grouped device identification information is obtained from the NDR device, each group of device identification information comprises a unique device identification of the NDR device and unique device identifications of a plurality of EDR terminals, and the unique device identification of the NDR device is the unique device identification of the NDR device. The equipment unique identifier of the EDR terminal is obtained by monitoring corresponding NDR equipment and analyzing a TLS extension field according to a preset TLS custom handshake extension field, and the TLS extension field is constructed by the EDR management center according to the preset TLS custom handshake extension field and the equipment unique identifier of the EDR terminal. According to the invention, the rapid association and security analysis of the equipment and the host are realized, the detection and response efficiency of security events is improved, and the management and maintenance work in a complex network environment is simplified.

Description

Technical Field

[0001] The present invention relates to the field of computer information security technology, and in particular to a method and device for accurately associating network-end relationships in XDR. Background Art

[0002] With the rapid development of information technology, enterprises are facing increasingly complex and hidden network security threats. Traditional Security Operations Center (SOC) tools are often limited to a single data source or security control point, such as Endpoint Detection and Response (EDR) or Network Detection and Response (NDR), which leads to fragmentation and inadequacy of threat detection and response capabilities. SOC is the core of the enterprise security team, responsible for 24 / 7 monitoring, analysis and response to potential security threats, while EDR and NDR focus on monitoring and response of terminal devices and network traffic, respectively. EDR solutions are mainly used to detect, investigate, and respond to malicious activities on endpoints (such as computers, servers, mobile devices, etc.), while NDR focuses on network-level traffic monitoring and analysis of potential attack patterns and abnormal behaviors.

[0003] To solve this problem, Extended Detection and Response (XDR) technology came into being. XDR is an integrated security architecture that integrates data and functions from multiple security control points, including telemetry data from the cloud, network, and end, to provide more comprehensive threat detection and automated response capabilities. The advantage of XDR is that it can unify analysis and response across multiple security levels (endpoints, networks, emails, clouds, etc.), no longer limited to a single control point, thereby improving the overall vision and efficiency of security monitoring.

[0004] However, in the XDR environment, how to effectively correlate and identify the behaviors and activities of devices at different security control points remains a challenging problem. In the multi-level and multi-dimensional security data, how to extract and correlate relevant threat information from cross-platform data has become the key to improving the effectiveness of XDR.

[0005] Existing, traditional device association schemes often rely on single identifiers, such as MAC addresses (Media Access Control Address), IP addresses (Internet Protocol Address), etc., which may lead to misjudgment or incomplete information in dynamic and complex network environments. MAC address is a unique identifier for network hardware, often used to identify devices in local area networks, while IP address is the key to identifying and locating devices on the Internet, but in a dynamic IP environment, the device IP may change, causing misidentification and disruption of the monitoring system. In addition, the precise association of device behavior and activities between different control points is critical for effective security incident response and threat detection, especially in the face of increasingly complex attack methods. Summary of the invention

[0006] The present invention proposes a method and device for accurately associating network-end relationships in XDR, so as to solve the problem that it is difficult to accurately associate devices in existing XDRs with more complex network environments.

[0007] The present invention achieves the above-mentioned purpose through the following technical solutions: The present invention provides a method for accurately associating network-end relationships in XDR, comprising: Receive a device unique identification request from an EDR terminal and a device unique identification request from an NDR device; In response to a device unique identification request from the EDR terminal and a device unique identification request from the NDR device, a corresponding device unique identification is allocated to the corresponding NDR device and EDR terminal respectively; Acquire grouped device identification information from the NDR device, each group of the device identification information includes a unique device identification of the NDR device and unique device identifications of multiple EDR terminals, the unique device identification of the NDR device is the unique device identification of the NDR device itself, the unique device identification of the EDR terminal is obtained by monitoring the corresponding NDR device and parsing the TLS extension field according to the preset TLS custom handshake extension field, and the TLS extension field is constructed by the EDR management center according to the preset TLS custom handshake extension field and the unique device identification of the EDR terminal.

[0008] Specifically, the corresponding unique device identifiers are respectively assigned to the corresponding NDR devices and EDR terminals, including: Generate a first API interface according to the device unique identification request of the EDR terminal, send a batch or a corresponding device unique identification to the EDR management center through the first API interface, and the EDR management center is used to assign the received corresponding device unique identification to each EDR terminal managed by it, and permanently save the corresponding relationship between the EDR terminal and the corresponding device unique identification; A second API interface is generated according to a device unique identification request of the NDR device, and a corresponding device unique identification is assigned to the NDR device through the second API interface. The NDR device is used to obtain the corresponding device unique identification from the XDR device and permanently store it without having obtained the device unique identification from the XDR device.

[0009] Specifically, the steps for setting the TLS custom handshake extension field are as follows: Determine the format and meaning of the extended field, the extended field includes a protocol header, a protocol header check code, an encryption algorithm, an extended data length, and extended data, the extended data includes the device unique identifier, the device unique identifier is one or more of a device ID, authentication information, and a security policy version; Determine a data encryption algorithm, where the data encryption algorithm is one of plain text transmission, Base64, AES encryption, DES encryption, and RSA encryption.

[0010] Specifically, the EDR management center constructs the TLS extension field according to the preset TLS custom handshake extension field and the device unique identifier of the EDR terminal, including: Randomly generate an integer, and obtain 4 bytes to fill the protocol header according to the integer; Calculate and fill the protocol header check code according to the protocol header; Fill the protocol header check code according to the encryption code corresponding to the determined encryption algorithm; Packing together the device unique identifiers corresponding to the EDR terminals of one or more EDR terminals, encrypting them using the encryption algorithm and the corresponding secret key, and then filling in the extended data; The extended data length is calculated according to the extended data and filled with the extended data length to complete the construction of the TLS extension field.

[0011] Specifically, the NDR device parses the TLS extension field according to the preset TLS custom handshake extension field to obtain the device unique identifier of the EDR terminal; Reading the protocol header; Read the protocol header for verification; Determine whether the extension data is custom extension data, if so proceed to the next step, otherwise ignore the TLS extension field; Reading the encryption algorithm; Read the customized extended data length; The customized extended data is read, and the original data of the TLS extension field is obtained by decrypting it with the corresponding encryption algorithm.

[0012] Specifically, the NDR device monitors and parses the TLS extension field, including: The NDR device bypasses the monitoring of the heartbeat interface of the EDR terminal; When the NDR device detects that the EDR management center sends the TLS extension field to the EDR terminal, the NDR monitors and obtains the TLS extension field from the heartbeat interface of the EDR terminal; The NDR device parses the TLS extension field according to the preset TLS custom handshake extension field to obtain and save the device unique identifier of the EDR terminal; The TLS extension field is constructed according to the preset TLS custom handshake extension field and the device unique identifier of the corresponding EDR terminal after the EDR management center responds to the heartbeat request sent by the EDR terminal.

[0013] Specifically, the NDR device monitors and parses the TLS extension field, including: The NDR device monitors the heartbeat request sent by the EDR management center to the XDR device; The NDR device obtains the TLS extension field according to the heartbeat request sent by the EDR management center; Among them, the TLS extension field is constructed by the EDR management center by batch-packing the device unique identifiers of multiple EDR terminals according to the preset TLS custom handshake extension field, and the EDR management center sends a heartbeat request to the XDR device after constructing the TLS extension field.

[0014] Specifically, it also includes: According to the device identification information of the acquired group, basic information and security information of the EDR terminal and NDR device in the same group are acquired; Perform correlation analysis on the basic information and security information of the EDR terminal and NDR device in the same group to obtain a correlation analysis result.

[0015] Another aspect of the present invention also discloses a device for accurately associating network-end relationships in XDR, comprising: A receiving module, the receiving module is used to receive a device unique identification request from an EDR terminal and a device unique identification request from an NDR device; An allocation module, the allocation module is used to respond to the device unique identification request of the EDR terminal and the device unique identification request of the NDR device, and allocate corresponding device unique identifications to the corresponding NDR device and EDR terminal respectively; An acquisition module is used to acquire grouped device identification information from the NDR device, each group of the device identification information includes a device unique identifier of the NDR device and device unique identifiers of multiple EDR terminals, the device unique identifier of the NDR device is the device unique identifier of the NDR device itself, the device unique identifier of the EDR terminal is obtained by monitoring the corresponding NDR device and parsing the TLS extension field according to the preset TLS custom handshake extension field, and the TLS extension field is constructed by the EDR management center according to the preset TLS custom handshake extension field and the device unique identifier of the EDR terminal.

[0016] The beneficial effects of the present invention are: The proposed method for accurately associating network-end relationships in XDR can achieve rapid association and security analysis of devices and hosts through automation and system integration, and improve the efficiency of detecting and responding to security incidents. At the same time, the unified unique device identification and group data definition simplifies the management and maintenance work in complex network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A network deployment diagram of a method for accurately associating network-end relationships in XDR in an embodiment of the present application; Figure 2 This is a schematic diagram of the heartbeat request processing flow of the EDR terminal in an embodiment of the present application; Figure 3 This is a flow chart of the NDR device monitoring and parsing the TLS extension field in an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0019] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0021] In the description of the present invention, it should be understood that the terms "upper", "lower", "inside", "outside", "left", "right", etc. indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings, or are directions or positional relationships in which the product of the invention is usually placed when in use, or are directions or positional relationships commonly understood by those skilled in the art. These directions or positional relationships are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as a limitation on the present invention.

[0022] Furthermore, the terms “first”, “second”, etc. are merely used for distinguishing descriptions and should not be understood as indicating or implying relative importance.

[0023] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms such as "setting" and "connection" should be understood in a broad sense. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0024] In the present invention, the term "XDR" means extended detection and response; "EDR" means terminal detection and response; "NDR" means network detection and response. "EDR-CENTER" in the figure means EDR management center.

[0025] The specific implementation modes of the present invention are described in detail below in conjunction with the accompanying drawings.

[0026] The present invention involves the collaborative work of the three systems of XDR, EDR and NDR in its application: The XDR system is responsible for uniformly assigning unique identifiers to NDR devices and EDR terminal devices, ensuring that NDR devices and each EDR terminal have unique identifiers; The NDR system parses traffic in a bypass manner, automatically discovers each EDR device and host connected to the network, and obtains the unique device ID of each EDR terminal connected to the network. In addition, the unique device ID of the NDR device and the unique device IDs of multiple EDR terminals detected are defined as a group and reported to the XDR system regularly; The XDR device receives the device identification information of the packet from the NDR, manages and stores it; The XDR system collects NDR and EDR system data, and correlates and analyzes the NDR and EDR basic information and security information collected in the same group to discover potential security threats or abnormal behaviors.

[0027] To implement the above technical solution, the present invention refers to the TLS handshake phase, and realizes data transmission and detection through custom extension fields. During the TLS handshake, the client and the server can exchange custom TLS extension fields (Client hello custom extension). These fields can be used to pass additional information, such as device unique identification, security policies, or other information that needs to be transmitted and identified in encrypted communications. The TLS custom handshake extension fields are pre-customized by NDR, EDR, and XDR. The specific customization content is as follows: Determine the format and meaning of the extension field. The extension field includes the protocol header, protocol header checksum, encryption algorithm, data length, and data content. The data part is user-defined and may include device ID, authentication information, security policy version, etc. The TLS custom handshake extension field is shown in Table 1 below: Table 1 Extension Type Protocol Header Protocol header check Encryption Algorithm Extended data length Extended data >62 and <=2569, the default value is 66 Byte (4) Byte (2) Byte (1) Byte (2) Byte (0 ... 2^16 - 9) The explanation of each part of the TLS custom handshake extension field is shown in Table 2 below: Table 2: name illustrate Extension Type The extension type is limited to >62 and <=2569, and 66 is selected by default Protocol Header Occupies 4 bytes, marking the protocol Protocol header check Occupies 2 bytes, verifies data validity Encryption Algorithm Occupies 1 byte, default is Base64, refer to the dictionary "Encryption Algorithm" Extended data length Occupies 2 bytes, the length of the extended data Extended data Occupies 0 - 2^16-9 bytes, user-defined content Ensure that when transmitting these extended fields, the data is properly encrypted and authenticated to prevent man-in-the-middle attacks or data tampering. Therefore, the extended data part can be encrypted before transmission. This solution lists several encryption algorithms for reference. For example: plain text transmission, Base64, AES encryption, DES encryption, RSA encryption. As shown in Table 3: Table 3: Encryption algorithm encoding illustrate 0 Plain text transmission 1 Base64 encoding 2 AES encryption 3 DES encryption 4 RSA encryption like Figure 1 As shown: A101, first, EDR, NDR, and XDR jointly determine the TLS custom extension field according to the previous protocol description. Both EDR and NDR need to confirm the user extension data, encryption / decryption method, and secret key. Both parties must keep the secret key safe and store it on the NDR and EDR management center sides respectively. XDR confirms that it provides a network API interface to the outside, including: an API interface for generating a unique device identifier, an API interface for collecting unique identifiers of grouped devices, and a heartbeat interface for monitoring the NDR management center, where the heartbeat interface of the NDR management center is used to send data to XDR.

[0028] A102, such as Figure 2 As shown, the EDR management center is initialized. The main task of the EDR management center is to continuously monitor and record various information of EDR terminal devices. The EDR management center requests the API interface generated by the device unique identifier from XDR to obtain a batch or one identifier, which is assigned to each terminal it manages, and the correspondence between the EDR terminal and the device unique identifier is permanently and securely stored locally.

[0029] A103, NDR initialization. If NDR has not obtained the device unique identifier from XDR, it first requests the API interface generated by the device unique identifier from the XDR system to obtain a device unique identifier as its own device unique identifier, and permanently and securely stores it locally.

[0030] A104, such as Figure 2 As shown, the NDR device is deployed in the switch bypass to listen and parse the interface traffic packets determined by the EDR terminal or the EDR management center, and use the predetermined encryption algorithm and secret key to decrypt the extension field. The decrypted data is reorganized into a readable format to further confirm the uniqueness of the device information and finally analyze and process it, and the correspondence between the EDR terminal and the device unique identification, that is, the local device mapping table, is permanently and securely stored locally. The steps for the EDR management center to construct the TLS extension field and the NDR to parse the TLS extension field are as follows: The EDR Management Center builds the TLS extension field in the following steps: Generate a random integer and get 4 bytes H1=Byte[0], H2=Byte[1], H3=Byte[2], H4=Byte[3] to fill the "protocol header" bit; Calculate Byte[0] = H1 ^ H3, Byte[2] = H2 ^ H4, and fill the "check code" bits with Byte[0] and Byte[1]; Fill the "encryption algorithm" field with the encryption code corresponding to the encryption algorithm determined by the three parties; Pack the unique device identifiers of one or more EDR terminals together, encrypt them using a determined encryption algorithm and secret key, and then fill in the "extended data" bit; Calculate the extended data length and fill in the "extended data length" bit; Finally, the construction of the TLS extension field is completed.

[0031] NDR parsing of TLS extension fields includes the following steps: Read the agreed TLS extension type custom extension data; Read 4 bytes as the protocol header Byte[4], H1=Byte[0], H1=Byte[1], H2=Byte[2], H3=Byte[3]; Read 2 bytes as the protocol header check Byte[2], C0=Byte[0], C1=Byte[1]; If H0^H2^C0==0X00 && H1^H3^C1==0x00, it means it is custom extended data, otherwise please ignore the data packet; Read 1 byte as encryption algorithm Byte [1], the value is Algorithm = 0x(Byte [0]); Read 2 bytes as the custom extended data length Byte[2], the value is Length=0x(Byte[0]Byte[1]); Read Length bytes as custom extended data Byte[Length], and decrypt using the corresponding encryption algorithm Algorithm to obtain the original data.

[0032] like Figure 1 As shown, the NDR device bypasses monitoring and parsing the TLS extension field in the following two cases: A1041) One is the situation where the EDR management center is deployed on the "right side" of the switch. The EDR terminal sends a heartbeat to the EDR management center, and the NDR device bypasses the monitoring and parsing of the EDR terminal heartbeat interface, parses the TLS custom extension field, obtains a unique device identifier, and stores / updates the local cache data of the corresponding terminal on the NDR device. The EDR terminal itself does not participate in the construction of the TLS custom extension field. The EDR terminal sends a heartbeat request to the EDR management center, and the EDR management center calculates and constructs the TLS extension field of the corresponding terminal (which contains the identification information of the terminal) based on the content determined by the three parties, and returns it to the corresponding EDR terminal. The subsequent EDR terminal only needs to carry the TLS extension field when sending a heartbeat request to the EDR management center, and the NDR device can monitor and parse to obtain the unique device identifier of the EDR terminal; A1042) Another case where the EDR management center is deployed on the "left side" of the switch. The EDR management center manages all relevant EDR terminal information. According to the content determined by the three parties, the EDR management center batches the device unique identifiers of multiple EDR terminals together to construct a TLS extension field and sends a heartbeat request to the XDR. The NDR device can monitor and parse to obtain the device unique identifiers of multiple EDR terminals.

[0033] In some embodiments, the method further includes obtaining the basic information and security information of the EDR terminal and NDR device in the same group according to the device identification information of the acquired group; performing correlation analysis on the basic information and security information of the EDR terminal and NDR device in the same group to obtain a correlation analysis result. The correlation analysis process is an existing correlation analysis process in the existing XDR and will not be described in detail here.

[0034] Another aspect of the present invention also discloses a device for accurately associating network-end relationships in XDR, comprising: A receiving module, the receiving module is used to receive a device unique identification request from an EDR terminal and a device unique identification request from an NDR device; An allocation module, the allocation module is used to respond to the device unique identification request of the EDR terminal and the device unique identification request of the NDR device, and allocate corresponding device unique identifications to the corresponding NDR device and EDR terminal respectively; An acquisition module is used to acquire grouped device identification information from the NDR device, each group of the device identification information includes a device unique identifier of the NDR device and device unique identifiers of multiple EDR terminals, the device unique identifier of the NDR device is the device unique identifier of the NDR device itself, the device unique identifier of the EDR terminal is obtained by monitoring the corresponding NDR device and parsing the TLS extension field according to the preset TLS custom handshake extension field, and the TLS extension field is constructed by the EDR management center according to the preset TLS custom handshake extension field and the device unique identifier of the EDR terminal.

[0035] The advantages of the present invention compared to the prior art are: 1. Design and application of custom TLS handshake extension: One of the key technical points of this invention is to use custom extension (Client Hello Custom Extension) to transmit user extension data during the TLS handshake phase. This design innovatively embeds device identification data into the TLS handshake message, so that specific information can be transmitted in encrypted traffic without decryption. This technology can not only identify and associate devices in complex XDR environments, but also cope with diversified and dynamic changes in network architecture, thus laying a solid foundation for the secure association of devices.

[0036] 2. Customization of TLS handshake extension fields: By customizing TLS extension fields, the present invention can transmit specific user data, including device identifiers, context information, etc., thereby helping NDR and EDR systems to accurately associate different devices, especially in large-scale distributed environments, to achieve unique identification and management of devices. This customized extension field design can cope with a variety of network conditions and is the core means to achieve multi-device collaborative security detection.

[0037] 3. Bypass monitoring and association analysis mechanism of the NDR system: The present invention parses network traffic in a bypass manner, automatically discovers and identifies each EDR terminal and host connected to the network, and obtains the unique identifier of each terminal. The NDR system associates its own unique identifier with multiple detected terminal device identifiers, defines them as a group, and reports them to the XDR system regularly. This mechanism embeds identification data during the TLS handshake phase, allowing the NDR to accurately identify the device without decrypting the communication content, thereby achieving efficient cross-system collaboration and accurate association of devices, taking into account both security and privacy protection, and is highly innovative and valuable in application, and should be protected.

[0038] 4. EDR-NDR association and collaborative design in XDR environment: This invention realizes the association and collaborative work of EDR and NDR systems in XDR environment, and shares key information between different devices through custom TLS extension fields, thereby forming an efficient cross-system linkage response mechanism. This method significantly improves the efficiency of collaboration between multiple devices and multiple systems, and provides strong support for security operations.

[0039] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for accurately associating network-end relationships in XDR, characterized in that: include: Receive a device unique identification request from an EDR terminal and a device unique identification request from an NDR device; In response to a device unique identification request from the EDR terminal and a device unique identification request from the NDR device, a corresponding device unique identification is allocated to the corresponding NDR device and EDR terminal respectively; Acquire grouped device identification information from the NDR device, each group of the device identification information includes a unique device identification of the NDR device and unique device identifications of multiple EDR terminals, the unique device identification of the NDR device is the unique device identification of the NDR device itself, the unique device identification of the EDR terminal is obtained by monitoring the corresponding NDR device and parsing the TLS extension field according to the preset TLS custom handshake extension field, and the TLS extension field is constructed by the EDR management center according to the preset TLS custom handshake extension field and the unique device identification of the EDR terminal.

2. According to claim 1, a method for accurately associating network-end relationships in XDR is characterized in that: Allocating corresponding unique device identifiers to the corresponding NDR devices and EDR terminals respectively includes: Generate a first API interface according to the device unique identification request of the EDR terminal, send a batch or a corresponding device unique identification to the EDR management center through the first API interface, and the EDR management center is used to assign the received corresponding device unique identification to each EDR terminal managed by it, and permanently save the corresponding relationship between the EDR terminal and the corresponding device unique identification; A second API interface is generated according to a device unique identification request of the NDR device, and a corresponding device unique identification is assigned to the NDR device through the second API interface. The NDR device is used to obtain the corresponding device unique identification from the XDR device and permanently store it without having obtained the device unique identification from the XDR device.

3. According to claim 1, a method for accurately associating network-end relationships in XDR is characterized in that: The steps for setting the TLS custom handshake extension field are as follows: Determine the format and meaning of the extended field, the extended field includes a protocol header, a protocol header check code, an encryption algorithm, an extended data length, and extended data, the extended data includes the device unique identifier, the device unique identifier is one or more of a device ID, authentication information, and a security policy version; Determine a data encryption algorithm, where the data encryption algorithm is one of plain text transmission, Base64, AES encryption, DES encryption, and RSA encryption.

4. According to claim 3, a method for accurately associating network-end relationships in XDR is characterized in that: The EDR management center constructs the TLS extension field according to the preset TLS custom handshake extension field and the device unique identifier of the EDR terminal, including: Randomly generate an integer, and obtain 4 bytes to fill the protocol header according to the integer; Calculate and fill the protocol header check code according to the protocol header; Fill the protocol header check code according to the encryption code corresponding to the determined encryption algorithm; Packing together the device unique identifiers corresponding to the EDR terminals of one or more EDR terminals, encrypting them using the encryption algorithm and the corresponding secret key, and then filling in the extended data; The extended data length is calculated according to the extended data and filled with the extended data length to complete the construction of the TLS extension field.

5. According to claim 4, a method for accurately associating network-end relationships in XDR is characterized in that: The NDR device parses the TLS extension field according to the preset TLS custom handshake extension field to obtain the device unique identifier of the EDR terminal; Reading the protocol header; Read the protocol header for verification; Determine whether the extension data is custom extension data, if so proceed to the next step, otherwise ignore the TLS extension field; Reading the encryption algorithm; Read the customized extended data length; The customized extended data is read, and the original data of the TLS extension field is obtained by decrypting it with the corresponding encryption algorithm.

6. The method for accurately associating network-end relationships in XDR according to claim 1, characterized in that: The NDR device monitors and parses the TLS extension field, including: The NDR device bypasses the monitoring of the heartbeat interface of the EDR terminal; When the NDR device detects that the EDR management center sends the TLS extension field to the EDR terminal, the NDR monitors and obtains the TLS extension field from the heartbeat interface of the EDR terminal; The NDR device parses the TLS extension field according to the preset TLS custom handshake extension field to obtain and save the device unique identifier of the EDR terminal; The TLS extension field is constructed according to the preset TLS custom handshake extension field and the device unique identifier of the corresponding EDR terminal after the EDR management center responds to the heartbeat request sent by the EDR terminal.

7. The method for accurately associating network-end relationships in XDR according to claim 1, characterized in that: The NDR device monitors and parses the TLS extension field, including: The NDR device monitors the heartbeat request sent by the EDR management center to the XDR device; The NDR device obtains the TLS extension field according to the heartbeat request sent by the EDR management center; The NDR device parses the TLS extension field according to the preset TLS custom handshake extension field to obtain and save the device unique identifier of the EDR terminal; Among them, the TLS extension field is constructed by the EDR management center by batch-packing the device unique identifiers of multiple EDR terminals according to the preset TLS custom handshake extension field, and the EDR management center sends a heartbeat request to the XDR device after constructing the TLS extension field.

8. The method for accurately associating network-end relationships in XDR according to claim 1, characterized in that: Also includes: According to the device identification information of the acquired group, basic information and security information of the EDR terminal and NDR device in the same group are acquired; Perform correlation analysis on the basic information and security information of the EDR terminal and NDR device in the same group to obtain a correlation analysis result.

9. A device for accurately associating network-end relationships in XDR, characterized in that: include: A receiving module, the receiving module is used to receive a device unique identification request from an EDR terminal and a device unique identification request from an NDR device; An allocation module, the allocation module is used to respond to the device unique identification request of the EDR terminal and the device unique identification request of the NDR device, and allocate corresponding device unique identifications to the corresponding NDR device and EDR terminal respectively; An acquisition module is used to acquire grouped device identification information from the NDR device, each group of the device identification information includes a device unique identifier of the NDR device and device unique identifiers of multiple EDR terminals, the device unique identifier of the NDR device is the device unique identifier of the NDR device itself, the device unique identifier of the EDR terminal is obtained by monitoring the corresponding NDR device and parsing the TLS extension field according to the preset TLS custom handshake extension field, and the TLS extension field is constructed by the EDR management center according to the preset TLS custom handshake extension field and the device unique identifier of the EDR terminal.

Images