Network security alarm rule description method and system

Abstract

The invention provides a network security alarm rule description method and system, and belongs to the technical field of network security. The method specifically comprises the following steps: determining the matching degree of different preset network rules and the determination of attention network rules according to the types of historical attack behaviors matched with different preset network rules and the attack times of different types of historical attack behaviors; determining a correlation coefficient of the preset network rule and other preset network rules according to the types of historical attack behaviors simultaneously matched with the preset network rule and other preset network rules and the attack times of different types of historical attack behaviors, and obtaining the preset network rule matched with the network access behavior, and the access risk of the network access behavior is determined on the basis of the matching degree of different matching network rules and the correlation coefficient between the different matching network rules, so that the accuracy of access risk assessment is further improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network security alarm rule description method and system. Background Art

[0002] Currently, the network security warning system uses fixed rules to identify network security threats, which has the following shortcomings: 1. The traditional rule model is not flexible enough. When new network security attacks appear, the system needs to frequently update the rule base. This update operation is very time-consuming and may miss some new network attacks.

[0003] 2. Attack behaviors often have a combination of multiple features. Traditional fixed rule models cannot effectively describe complex attack scenarios and have high missed and false positive rates.

[0004] Therefore, it is necessary to improve the existing technology and provide a method for expressing alarm rules accurately, flexibly and adaptively, as well as a parsing engine to achieve real-time discovery of attack behaviors.

[0005] In view of the above technical problems, the present invention provides a method and system for describing network security alarm rules. Summary of the invention

[0006] To achieve the purpose of the present invention, the present invention adopts the following technical solutions: According to one aspect of the present invention, a method for describing network security alarm rules is provided.

[0007] A network security alarm rule description method, characterized by comprising: S1 determines the matching degree of different preset network rules and focuses on the determination of network rules through the types of historical attack behaviors matched by different preset network rules and the attack times of different types of historical attack behaviors; S2: determining the correlation coefficient between the preset network rule and other preset network rules by the types of historical attack behaviors that are matched simultaneously with the preset network rule and other preset network rules and the attack times of different types of historical attack behaviors, and determining the associated network rule of the concerned network rule based on the correlation coefficient; S3 determines the concerned network rules that match the network access behavior based on the monitoring data of the network traffic, and uses it as the matched concerned network rules, determines the initial access risk based on the matching number and abnormality degree of the matched concerned network rules and the matching data of the associated network rules of different matched associated network rules, and proceeds to the next step when the initial access risk does not meet the requirements; S4 obtains the preset network rule that matches the network access behavior, and uses it as the matching network rule, and determines the access risk of the network access behavior based on the matching degrees of different matching network rules and the correlation coefficients between different matching network rules.

[0008] A further technical solution is that the preset network rule is determined according to the network rule of a preset network rule library.

[0009] A further technical solution is that the matching degree of the preset network rule ranges from 0 to 1, wherein the greater the matching degree of the preset network rule, the more the preset network rule matches the historical attack behavior.

[0010] A further technical solution is that the method for determining the initial access risk is: Determine the matching quantity of the associated network rules of the different matching concerned network rules based on the matching data of the associated network rules of the matching concerned network rules, and determine the matching risk degree values ​​of the different matching concerned network rules in combination with the abnormality degrees of the different matching concerned network rules; The initial access risk is determined by using different matching risk degree values ​​and matching quantities of the matching attention network rules.

[0011] On the other hand, the present invention provides a computer system, comprising: a memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, characterized in that: when the processor runs the computer program, the above-mentioned network security alarm rule description method is executed.

[0012] The beneficial effects of the present invention are: 1. The correlation coefficient between the preset network rules and other preset network rules is determined by matching the types of historical attack behaviors and the number of attacks of different types of historical attack behaviors, so as to evaluate the correlation coefficient between the preset network rules under different historical attack behaviors, thus avoiding the technical problem of slow update speed of the original single reliance on preset combined network rules for access risk identification.

[0013] 2. The initial access risk is determined based on the matching number of the matching focus network rules, the degree of abnormality, and the matching data of the associated network rules of different matching associated network rules, thereby realizing the assessment of the initial access risk of the network access behavior from the perspective of matching focus network rules, fully considering the differences in the number of matching network rules and the degree of abnormality when the network access behavior is abnormal, and also considering the association between the matching network rules when the network access behavior is abnormal.

[0014] 3. By determining the access risk of network access behavior based on the matching degree of different matching network rules and the correlation coefficient between different matching network rules, it is possible to evaluate the access risk from the perspective of matching network rules that match network access behavior. This fully considers the differences in the matching degrees of different matching network rules under different access risks and abnormal access behaviors, as well as the differences in the correlation coefficients between matching network rules under different abnormal access behaviors, thereby achieving accurate identification of network access risks.

[0015] Other features and advantages will be described in the following description, and partly become apparent from the description, or understood by practicing the invention. The purpose and other advantages of the invention are realized and obtained by the structures particularly pointed out in the description and the drawings.

[0016] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and other features and advantages of the present invention will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings.

[0018] Figure 1 It is a flow chart of a method for describing network security alarm rules; Figure 2 is a flow chart of a method for determining a matching degree of a preset network rule; Figure 3 It is a framework diagram of a computer system. DETAILED DESCRIPTION

[0019] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that the present invention will be comprehensive and complete and fully convey the concepts of the example embodiments to those skilled in the art. The same reference numerals in the figures represent the same or similar structures, and thus their detailed description will be omitted.

[0020] The terms "a", "an", "the", and "said" are used to indicate the presence of one or more elements / components / etc.; the terms "comprising" and "having" are used to express an open-ended inclusive meaning and mean that additional elements / components / etc. may be present in addition to the listed elements / components / etc.

[0021] Example 1 To solve the above problems, according to one aspect of the present invention, Figure 1According to one aspect of the present invention, a method for describing network security alarm rules is provided, which is characterized by specifically comprising: S1 determines the matching degree of different preset network rules and focuses on the determination of network rules through the types of historical attack behaviors matched by different preset network rules and the attack times of different types of historical attack behaviors; Furthermore, the preset network rule is determined according to the network rule of a preset network rule library.

[0022] Specific examples, such as Figure 2 As shown, the method for determining the matching degree of the preset network rule is: S11 determines the matching duration of the preset network rule based on the historical network data, and uses the duration of the historical attack behavior in the matching duration as the matching attack duration, S12 divides the matching duration into a general matching duration and a complete matching duration according to the rule matching degree of the preset network rules of different matching durations in the matching duration, obtains the matching attack duration in the complete matching duration, the type of historical attack behavior in the matching attack duration, and the number of attacks of different types of historical attack behaviors, and determines the matching degree of the preset network rules in the complete matching duration in combination with the type of historical attack behavior matched by the preset network rules in the matching attack duration in the complete matching duration and the number of attacks of different types of historical attack behaviors; S13 obtains the matching attack duration in the general matching duration, the type of historical attack behavior in the matching attack duration, and the number of attacks of different types of historical attack behaviors, and determines the matching degree of the preset network rules in the general matching duration in combination with the type of historical attack behavior matching the preset network rules in the matching attack duration in the general matching duration and the number of attacks of different types of historical attack behaviors, and determines the matching degree of the preset network rules through the matching degree of the preset network rules in the general matching duration and the matching degree of the preset network rules in the complete matching duration.

[0023] Optionally, the above step S11 includes the following contents: S111 determines the matching duration of the preset network rule based on the historical network data, and takes the duration of the historical attack behavior in the matching duration as the matching attack duration, and determines whether the proportion of the matching attack duration is greater than the preset duration proportion. If so, proceed to the next step, if not, proceed to step S12; S112 determines whether all historical attack behaviors in the matching market match the preset network rules. If so, the preset network rules are used as the focus network rules, and the matching degree of the preset network rules is determined by the preset matching degree. If not, enter step S12.

[0024] It can be understood that the matching degree of the preset network rule ranges from 0 to 1, wherein the greater the matching degree of the preset network rule, the more the preset network rule matches the historical attack behavior.

[0025] In another possible embodiment, the method for determining the matching degree of the preset network rule is: Determine the matching duration of the preset network rule based on historical network data, and use the duration of the historical attack behavior in the matching duration as the matching attack duration, and divide the matching duration into general matching duration and complete matching duration according to the rule matching degree of the preset network rules of different matching durations in the matching duration; Acquire the matching attack duration in the complete matching duration, the type of historical attack behavior in the matching attack duration, and the number of attacks of different types of historical attack behaviors, and determine the matching degree of the preset network rule in the complete matching duration in combination with the type of historical attack behavior matching the preset network rule in the matching attack duration in the complete matching duration and the number of attacks of different types of historical attack behaviors; Acquire the matching attack duration in the general matching duration, the type of historical attack behavior in the matching attack duration, and the number of attacks of different types of historical attack behaviors, and determine the matching degree of the preset network rule in the general matching duration in combination with the type of historical attack behavior matching the preset network rule in the matching attack duration in the general matching duration and the number of attacks of different types of historical attack behaviors; The matching degree of the preset network rule is determined by the matching degree of the preset network rule in the general matching duration and the matching degree of the preset network rule in the complete matching duration.

[0026] S2: determining the correlation coefficient between the preset network rule and other preset network rules by the types of historical attack behaviors that are matched simultaneously with the preset network rule and other preset network rules and the attack times of different types of historical attack behaviors, and determining the associated network rule of the concerned network rule based on the correlation coefficient; Specifically, the method of calculating the correlation coefficient between the preset network rule and other preset network rules is as follows: S21 determines the historical duration of simultaneous matching of the preset network rule and other preset network rules based on the historical network traffic data, and uses the historical duration of association between the preset network rule and other preset network rules; S22: obtaining the duration of historical attack behaviors that are matched simultaneously with the preset network rule and other preset network rules in the historical association duration, and using it as the associated attack behavior duration, and determining the basic association coefficient between the preset network rule and other preset network rules according to the duration ratio; S23 uses the historical attack behaviors that match the preset network rules and other preset network rules at the same time as the screened historical attack behaviors, and determines the weight values ​​of different types of screened historical attack behaviors through the attack duration and attack times of different types of screened historical attack behaviors, and determines the correlation coefficient between the preset network rules and other preset network rules through the number and the basic correlation coefficient of the weight values ​​of different types of screened historical attack behaviors.

[0027] Optionally, the above step S22 includes the following contents: S221 obtains the duration of historical attack behaviors that are matched simultaneously with the preset network rule and other preset network rules in the historical association duration, and uses it as the associated attack behavior duration, and determines whether the duration ratio of the associated attack behavior duration is greater than the preset duration ratio. If so, the association coefficient of the preset network rule and other preset network rules is determined according to the duration ratio. If not, proceed to the next step; S222 determines the basic correlation coefficient between the preset network rule and other preset network rules through the duration ratio, and judges whether the historical attack behaviors within the duration of the associated attack behaviors all match the preset network rule and other preset network rules. If so, determines the correlation coefficient between the preset network rule and other preset network rules through the duration ratio. If not, proceeds to the next step.

[0028] It should be noted that the preset duration ratio is determined according to the duration of the associated attack behavior, wherein the longer the duration of the associated attack behavior is, the smaller the preset duration ratio is.

[0029] Specifically, the method for determining the correlation coefficient between the preset network rule and other preset network rules is as follows: Determine the historical duration of simultaneous matching of the preset network rule and other preset network rules based on the historical network traffic data, and use it as the historical association duration of the preset network rule and other preset network rules; When the proportion of the duration of historical attack behaviors in the historical association duration is less than the preset attack duration proportion, determining the association coefficient between the preset network rule and other preset network rules by using the preset association coefficient; When the proportion of the duration of historical attack behaviors in the historical association duration is not less than the preset attack duration proportion, the duration of historical attack behaviors that are matched simultaneously by the preset network rule and other preset network rules in the historical association duration is obtained, and the duration is used as the association attack behavior duration; when the association attack behavior duration is greater than the preset duration, the association coefficient of the preset network rule and other preset network rules is determined according to the duration proportion; When the duration of the associated attack behavior is not greater than the preset duration: The historical attack behaviors that match the preset network rules and other preset network rules at the same time are used as the screened historical attack behaviors, and the weight values ​​of different types of screened historical attack behaviors are determined by the attack duration and attack number of different types of screened historical attack behaviors, and the correlation coefficient of the preset network rules and other preset network rules is determined by the number and the basic correlation coefficient of the weight values ​​of different types of screened historical attack behaviors.

[0030] S3 determines the concerned network rules that match the network access behavior based on the monitoring data of the network traffic, and uses it as the matched concerned network rules, determines the initial access risk based on the matching number and abnormality degree of the matched concerned network rules and the matching data of the associated network rules of different matched associated network rules, and proceeds to the next step when the initial access risk does not meet the requirements; It should be noted that the method for determining the initial access risk is: Determine the matching quantity of the associated network rules of the different matching concerned network rules based on the matching data of the associated network rules of the matching concerned network rules, and determine the matching risk degree values ​​of the different matching concerned network rules in combination with the abnormality degrees of the different matching concerned network rules; The initial access risk is determined by using different matching risk degree values ​​and matching quantities of the matching attention network rules.

[0031] Furthermore, the value range of the initial access risk is between 0 and 1, wherein the greater the initial access risk is, the greater the risk of the network access behavior corresponding to the network traffic is.

[0032] S4 obtains the preset network rule that matches the network access behavior, and uses it as the matching network rule, and determines the access risk of the network access behavior based on the matching degrees of different matching network rules and the correlation coefficients between different matching network rules.

[0033] Specifically, the method for determining the access risk of the network access behavior is as follows: When it is determined that the network access behavior does not have risks through the matching degrees of different matching network rules and the number of matching network rules, the access risk of the network access behavior is determined through the matching degrees of the matching network rules and the number of matching network rules; When it is determined that the network access behavior is risky based on the matching degrees of different matching network rules and the number of matching network rules: Determine the correlation coefficient between the network matching rule and the remaining network matching rules and the correlation matching rule of the network matching rule by using the correlation coefficient between different network matching rules, and determine the risk assessment value of different network matching rules in combination with the matching degree of the network matching rule; When the sum of the number of risk assessment values ​​of the network matching rule does not meet the requirement, determining the access risk of the network access behavior by the sum of the number of risk assessment values ​​of the network matching rule; When the number and risk assessment values ​​of the network matching rules meet the requirements, the risk matching rules are determined according to the risk assessment values ​​of the network matching rules, and the access risk of the network access behavior is determined based on the number of risk matching rules and the risk assessment values ​​of different risk matching rules, the number of network matching rules and the number of risk assessment values.

[0034] Furthermore, when the access risk of the network access behavior does not meet the requirements, a network alarm signal is generated, and the combined risk rules of the network rule library are updated based on the identification result of the access risk of the network access behavior.

[0035] Example 2 On the other hand, Figure 3 As shown, the present invention provides a computer system, comprising: a memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, characterized in that: the processor executes the above-mentioned network security alarm rule description method when running the computer program.

[0036] Through the above embodiments, the present application achieves the following technical effects: 1. The correlation coefficient between the preset network rules and other preset network rules is determined by matching the types of historical attack behaviors and the number of attacks of different types of historical attack behaviors, so as to evaluate the correlation coefficient between the preset network rules under different historical attack behaviors, thus avoiding the technical problem of slow update speed of the original single reliance on preset combined network rules for access risk identification.

[0037] 2. The initial access risk is determined based on the matching number of the matching focus network rules, the degree of abnormality, and the matching data of the associated network rules of different matching associated network rules, thereby realizing the assessment of the initial access risk of the network access behavior from the perspective of matching focus network rules, fully considering the differences in the number of matching network rules and the degree of abnormality when the network access behavior is abnormal, and also considering the association between the matching network rules when the network access behavior is abnormal.

[0038] 3. By determining the access risk of network access behavior based on the matching degree of different matching network rules and the correlation coefficient between different matching network rules, it is possible to evaluate the access risk from the perspective of matching network rules that match network access behavior. This fully considers the differences in the matching degrees of different matching network rules under different access risks and abnormal access behaviors, as well as the differences in the correlation coefficients between matching network rules under different abnormal access behaviors, thereby achieving accurate identification of network access risks.

[0039] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0040] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0041] The above description is only one or more embodiments of this specification and is not intended to limit this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification shall be included in the scope of the claims of this specification.

Claims

1. A network security alarm rule description method, characterized in that: Specifically include: Determine the matching degree of different preset network rules and determine the network rules by the types of historical attack behaviors matched by different preset network rules and the attack times of different types of historical attack behaviors; Determine the correlation coefficient between the preset network rule and other preset network rules by the types of historical attack behaviors that are matched simultaneously with the preset network rule and other preset network rules and the attack times of different types of historical attack behaviors, and determine the associated network rule of the concerned network rule based on the correlation coefficient; Determine the network rules of interest that match the network access behavior based on the monitoring data of network traffic, and use them as matching network rules of interest, determine the initial access risk based on the matching number and abnormality of the matching network rules of interest, and the matching data of the associated network rules of different matching associated network rules, and proceed to the next step when the initial access risk does not meet the requirements; A preset network rule matching the network access behavior is obtained and used as a matching network rule, and the access risk of the network access behavior is determined based on the matching degrees of different matching network rules and the correlation coefficients between different matching network rules.

2. The network security alarm rule description method according to claim 1, characterized in that: The preset network rule is determined according to the network rule of the preset network rule library.

3. The network security alarm rule description method according to claim 1, characterized in that: The matching degree of the preset network rule has a value range between 0 and 1, wherein the greater the matching degree of the preset network rule is, the more the preset network rule matches the historical attack behavior.

4. The network security alarm rule description method according to claim 1, characterized in that: The method for determining the correlation coefficient between the preset network rule and other preset network rules is: Determine the historical duration of simultaneous matching of the preset network rule and other preset network rules based on the historical network traffic data, and use it as the historical association duration of the preset network rule and other preset network rules; When the proportion of the duration of historical attack behaviors in the historical association duration is less than the preset attack duration proportion, determining the association coefficient between the preset network rule and other preset network rules by using the preset association coefficient; When the proportion of the duration of historical attack behaviors in the historical association duration is not less than the preset attack duration proportion, the duration of historical attack behaviors that are matched simultaneously by the preset network rule and other preset network rules in the historical association duration is obtained, and the duration is used as the association attack behavior duration; when the association attack behavior duration is greater than the preset duration, the association coefficient of the preset network rule and other preset network rules is determined according to the duration proportion; When the duration of the associated attack behavior is not greater than the preset duration: The historical attack behaviors that match the preset network rules and other preset network rules at the same time are used as the screened historical attack behaviors, and the weight values ​​of different types of screened historical attack behaviors are determined by the attack duration and attack number of different types of screened historical attack behaviors, and the correlation coefficient of the preset network rules and other preset network rules is determined by the number and the basic correlation coefficient of the weight values ​​of different types of screened historical attack behaviors.

5. The network security alarm rule description method according to claim 4, characterized in that: The preset duration ratio is determined according to the duration of the associated attack behavior, wherein the longer the duration of the associated attack behavior is, the smaller the preset duration ratio is.

6. The network security alarm rule description method according to claim 1, characterized in that: The method for determining the initial access risk is: Determine the matching quantity of the associated network rules of the different matching concerned network rules based on the matching data of the associated network rules of the matching concerned network rules, and determine the matching risk degree values ​​of the different matching concerned network rules in combination with the abnormality degrees of the different matching concerned network rules; The initial access risk is determined by using different matching risk degree values ​​and matching quantities of the matching attention network rules.

7. The network security alarm rule description method according to claim 1, characterized in that: The value range of the initial access risk is between 0 and 1, wherein the greater the initial access risk is, the greater the risk of the network access behavior corresponding to the network traffic is.

8. A computer system comprising: A memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, characterized in that: when the processor runs the computer program, a network security alarm rule description method as described in any one of claims 1-7 is executed.

Images