Application risk detection method and device and storage medium

Abstract

The embodiment of the invention provides an application risk detection method and device and a storage medium. Wherein the potential incidence relation between the applications can be mined based on the topological graph. And when a security event of a vertex in the topological graph at a first moment is detected, determining a first risk value of the vertex, and determining risk conduction values conducted from the vertex to other vertexes in the topological graph at a second moment according to the risk conduction model and the first risk value. And determining the risk values of the plurality of applications at the second moment according to the first risk values and the risk conduction values of the other vertexes. In the implementation mode, based on the risk conduction model, the conduction condition of the risk between the computing nodes after the security event occurs can be analyzed, so that the influence of the security event on the computing nodes with the incidence relation is determined; based on the influence received by the computing node and the relationship between the computing node and the application, the risk corresponding to the application can be analyzed, so that the risk degree of the application after the security event occurs can be accurately perceived.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an application risk detection method, device and storage medium. Background Art

[0002] With the development of Internet technology, more and more applications are being developed to provide a variety of Internet services. Some Internet companies can run a large number of applications, which are manifested as different services, systems, etc. There are more or less connections between these applications, such as calls between services, service access to the underlying database, etc. The security of applications is the basis for providing high-quality Internet services. Therefore, it is very important to perform risk detection on applications. In the prior art, there is a security product for detecting security events targeting applications, such as access attack events, Trojan intrusion events, etc. However, this prior art cannot detect application risks caused by events. Therefore, a new solution needs to be proposed. Summary of the invention

[0003] Multiple aspects of the present application provide an application risk detection method, device and storage medium for detecting application risks to improve the quality of Internet services.

[0004] An embodiment of the present application provides an application risk detection method, including: determining a topology graph corresponding to multiple applications; the multiple applications run on multiple computing nodes; the vertices in the topology graph represent the multiple computing nodes, and the edges in the topology graph represent the association relationship between the multiple computing nodes; when a security event is detected at a first vertex in the topology graph at a first moment, determining a first risk value of the first vertex at the first moment; determining a risk conduction value transmitted from the first vertex to other vertices in the topology graph at a second moment based on a risk conduction model and the first risk value; the risk conduction model is modeled based on risk conduction data samples between computing nodes with an association relationship; and determining the risk values ​​of the multiple applications at the second moment based on the first risk value and the risk conduction values ​​of the other vertices.

[0005] Optionally, determining a topological graph corresponding to multiple applications includes: obtaining computing nodes corresponding to each of the multiple applications to obtain the multiple computing nodes; determining associations among the multiple computing nodes; and constructing the topological graph with the multiple computing nodes as vertices and associations between the multiple computing nodes as edges.

[0006] Optionally, determining the association relationship among the multiple computing nodes includes: obtaining network logs of the multiple computing nodes; obtaining source addresses and destination addresses of network data of the multiple computing nodes based on the network logs of the multiple computing nodes; and for any two computing nodes among the multiple computing nodes, if the destination address of one computing node is the same as the source address of another computing node, determining that the any two computing nodes have an access relationship.

[0007] Optionally, determining the association relationship among the multiple computing nodes based on the source addresses and destination addresses of the multiple computing nodes includes: obtaining application configuration information of the multiple computing nodes; determining applications corresponding to the multiple computing nodes based on the application configuration information of the multiple computing nodes; and for any two computing nodes among the multiple computing nodes, if the applications corresponding to the any two computing nodes are the same, determining that the any two computing nodes have a sibling relationship.

[0008] Optionally, according to the risk transmission model, the risk transmission value of the vertex to other vertices in the topological graph is determined, including: using the risk transmission model to determine the risk time-varying factor of the first vertex at the second moment; determining the second risk value of the first vertex at the second moment according to the first risk value of the first vertex and the risk time-varying factor of the first vertex at the second moment; for any second vertex among the other vertices, obtaining the risk value of the second vertex at the second moment; determining the risk transmission value from the first vertex to the second vertex at the second moment according to the second risk value, the risk value of the second vertex at the second moment and the time difference between the first moment and the second moment.

[0009] Optionally, it also includes: determining the adjacency matrix of the first vertex in the topological graph according to the degree of the first vertex in the topological graph; and calculating the risk time-varying factor of the first vertex at the second moment according to the adjacency matrix of the first vertex and the time value at the second moment.

[0010] Optionally, the risk values ​​of the multiple applications at the second moment are determined based on the first risk value and the risk conduction values ​​of the other vertices, including: determining the risk values ​​of the multiple vertices in the topological graph at the second moment based on the first risk value and the risk conduction values ​​of the other vertices; determining the risk values ​​of the applications to which the multiple vertices respectively belong at the second moment based on the corresponding relationship between the multiple applications and the multiple vertices and the risk values ​​of the multiple vertices at the second moment.

[0011] Optionally, after determining the risk values ​​of the multiple applications at the second moment, the method further includes: sorting the risk levels of the multiple applications according to the risk values ​​of the multiple applications at the second moment; and outputting the sorting result of the risk levels.

[0012] An embodiment of the present application also provides an electronic device, comprising: a memory and a processor; the memory is used to store one or more computer instructions; the processor is used to execute the one or more computer instructions to: execute the steps in the method provided in the embodiment of the present application.

[0013] The embodiment of the present application also provides a computer-readable storage medium storing a computer program, which can implement the steps in the method provided in the embodiment of the present application when the computer program is executed by a processor.

[0014] In an embodiment of the present application, in a topological graph corresponding to multiple applications, vertices correspond to multiple computing nodes where multiple applications are located, and the edges in the topological graph represent the association relationship between multiple computing nodes, and the potential association relationship between applications can be mined based on the topological graph. When a security event is detected at a vertex in the topological graph at the first moment, the first risk value of the vertex is determined, and the risk conduction value transmitted from the vertex to other vertices in the topological graph at the second moment is determined based on the risk conduction model and the first risk value. Based on the first risk value and the risk conduction values ​​of other vertices, the risk values ​​of multiple applications at the second moment can be determined. In this embodiment, based on the risk conduction model, the conduction of risks between computing nodes after a security event occurs can be analyzed, thereby determining the impact of the security event on computing nodes with an association relationship; based on the impact received by the computing node and the relationship between the computing node and the application, the risk corresponding to the application can be analyzed, which is conducive to accurately perceiving the risk level of the application after the security event occurs. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0016] Figure 1 A flowchart of an application risk detection method provided for an exemplary embodiment of the present application;

[0017] Figure 2 A schematic diagram of a topology diagram provided for an exemplary embodiment of the present application;

[0018] Figure 3 A schematic diagram of a topological diagram provided for another exemplary embodiment of the present application;

[0019] Figure 4 for Figure 3 Schematic diagram of the risk convergence process of nodes in the schematic topology diagram;

[0020] Figure 5 A schematic diagram of the structure of an electronic device provided as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0022] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two, but does not exclude the inclusion of at least one.

[0023] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0024] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such a product or system. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the product or system including the elements.

[0025] In view of the technical problem that the prior art cannot detect application risks caused by events, a solution is provided in some embodiments of the present application. The technical solutions provided by the embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0026] Figure 1 is a flow chart of an application risk detection method provided by an exemplary embodiment of the present application, the method may include: Figure 1 Steps shown:

[0027] Step 101, determine a topology graph corresponding to a plurality of applications; the plurality of applications run on a plurality of computing nodes; the vertices in the topology graph represent the plurality of computing nodes, and the edges in the topology graph represent association relationships between the plurality of computing nodes.

[0028] Step 102: When a security event of a first vertex in the topological graph at a first moment is detected, a first risk value of the first vertex at the first moment is determined.

[0029] Step 103: Determine the risk transmission value transmitted from the first vertex to other vertices in the topology graph at the second moment based on the risk transmission model and the first risk value; the risk transmission model is modeled based on risk transmission data samples between computing nodes with associated relationships.

[0030] Step 104: Determine the risk values ​​of the multiple applications at the second moment according to the first risk value and the risk transmission values ​​of the other vertices.

[0031] This embodiment is applied to the scenario of risk detection of applications. In some scenarios, an enterprise or organization runs multiple applications, and there is a certain association relationship between the multiple applications, which may include: access relationship or call relationship. Optionally, multiple applications may be independent applications. For example, multiple applications run by an enterprise may include: social media applications, online shopping applications, electronic payment applications, and database applications; wherein the social media application may access the database application to obtain data support. The online shopping application may call the electronic payment application to complete the online payment. Optionally, the multiple applications may also be different applications (or sub-applications) belonging to the same system, which is not limited in this embodiment. For example, the multiple applications may include: a user center sub-application, a points center sub-application, a virtual fitting sub-application, and the like of an online shopping system. Among them, the user center sub-application may call the points center sub-application to display user points. The virtual fitting sub-application may access the points center sub-application to obtain user points, and redeem the number of fittings according to the user points.

[0032] Among them, the computing node corresponding to the application refers to the computing node used to run the application or part of the application component corresponding to the application. Any computing node may include a conventional physical server, a virtual machine, a virtualized data center, a cloud server, or an elastic computing instance on a cloud server, which is not limited in this embodiment. Usually, an application may correspond to one or more computing nodes. A topological graph is used to express the association relationship between computing nodes corresponding to multiple applications. The topological graph contains vertices, and the vertices are connected by edges. Among them, the vertices correspond to the computing nodes of multiple applications, and the edges between the vertices are used to express the association relationship between the computing nodes.

[0033] In this embodiment, a topology map may be constructed using data such as application information, computing node information, and relationships between computing nodes.

[0034] Optionally, the computing nodes corresponding to the multiple applications can be obtained to obtain multiple computing nodes. The obtained computing nodes can be identified by IP (Internet Protocol) addresses or UUID (Universally Unique Identifier). After obtaining multiple computing nodes, the association relationship between the multiple computing nodes can be determined. With the multiple computing nodes as vertices and the relationship between the multiple computing nodes as edges, a topological graph can be constructed.

[0035] In some embodiments, when determining the association relationship of multiple computing nodes, network logs of the multiple computing nodes may be obtained, and source addresses and destination addresses of the multiple computing nodes may be determined based on the network logs of the multiple computing nodes. The association relationship of the multiple computing nodes may be determined based on the source addresses and destination addresses of the multiple computing nodes.

[0036] Optionally, for any two computing nodes among the multiple computing nodes, if the destination address of one computing node is the same as the source address of another computing node, it is determined that the two computing nodes have an access relationship. For example, if the destination address of computing node A1 is the same as the source address of computing node B1, it is determined that computing node A1 has an access operation on computing node B1 during the process of running the application, that is, computing node A1 has an access relationship with computing node B1. If the destination address of computing node A2 is the same as the source address of computing node B2, it is determined that computing node A2 has an access operation on computing node B2 during the process of running the application, that is, computing node A2 has an access relationship with computing node B2.

[0037] In other embodiments, the application configuration information of the multiple computing nodes may be obtained, and the applications corresponding to the multiple computing nodes may be determined based on the application configuration information of the multiple computing nodes. The application configuration information may be user-configured. The application configuration information is used to specify the computing nodes used to deploy the application. For example, the application configuration information may configure the correspondence between application A and computing nodes A1 and A2, so that application A runs on computing nodes A1 and A2. Based on the application configuration information, it may be determined that the application corresponding to computing nodes A1 and A2 is application A. The application configuration information may be managed by an application deployment management system, so the correspondence between the application and the computing node may be queried through the open interface (Application Programming Interface, OpenAPI) of the deployment management system.

[0038] Optionally, for any two computing nodes among the multiple computing nodes, if the applications corresponding to the any two computing nodes are the same, it is determined that the any two computing nodes have a brother relationship. For example, if computing node A1 belongs to application A, and computing node A1 belongs to application A, it can be determined that computing node A1 and computing node A1 have a brother relationship.

[0039] After determining the computing nodes and the association relationship between the computing nodes based on the above embodiments, the following can be constructed: Figure 2 As shown in the topology diagram. Figure 2 As shown, the vertices corresponding to application A include the vertices of computing node A1 and the vertices of computing node A2. Between the vertices of computing node A1 and computing node A2, a bidirectional edge is used to represent the sibling relationship between computing node A1 and computing node A2. The vertices corresponding to application B include the vertices of computing node B1 and computing node B2. Between the vertices of computing node B1 and computing node B2, a bidirectional edge is used to represent the sibling relationship between computing node B1 and computing node B2. Between the vertices of computing node A1 and computing node B1, a unidirectional edge is used to represent the sibling relationship between computing node A1 and computing node B1. Between the vertices of computing node A2 and computing node B2, a unidirectional edge is used to represent the sibling relationship between computing node A2 and computing node B2. When a security event is detected at any vertex in the topology graph, the propagation result of the application risk caused by the security event between the vertices can be calculated based on the topology graph. For ease of description and distinction, any vertex is described here as the first vertex. The moment when the security event occurs at the first vertex is described as the first moment. The security event of the first vertex may be at least one of an access attack event, a Trojan horse intrusion event, and a vertex failure event.

[0040] When a security event of the first vertex at the first moment is detected, the risk value of the first vertex at the first moment can be determined. The risk value of the first vertex at the first moment is described as a first risk value. In some embodiments, the first risk value can be determined according to the type of security event. For example, the types of access attack events include: SQL (Structured Query Language) injection attack, cross-site scripting attack, CSRF (Cross-site request forgery) attack, DDOS (Distributed denial of service) attack, brute force attack, etc. The above different types of attacks can have different degrees of impact on the computing nodes, so different risk values ​​can be set for the above different types of attacks. In other embodiments, the first risk value can be determined according to the loss caused when the security event occurs at a historical moment. In this implementation, when a security event occurs at a historical moment, the loss caused by the security event to the application can be counted, and the risk value corresponding to the security event can be determined based on the counted loss. The loss can be the number of computing nodes that have a downtime phenomenon after the security event occurs, and can be the access delay duration caused after the security event occurs, etc., which is not limited in this embodiment.

[0041] After a security incident occurs at the first vertex, as time goes by, the risk generated by the security incident is transmitted from the first vertex to other vertices that have a relationship with the first vertex, and from other vertices to vertices associated with them, until gradually convergence. In this embodiment, a risk transmission model can be used to calculate the result of risk transmission over time after a security incident occurs.

[0042] Among them, the risk transmission model is a model about the association between time and computing nodes, which is used to describe the law of risk transmission between computing nodes with an association relationship after a security incident occurs. The risk transmission model can be obtained by modeling based on risk transmission data samples between computing nodes with an association relationship. Optionally, in the process of modeling, multiple computing nodes with an association relationship are determined, and access attacks on different computing nodes are simulated. When simulating an access attack on any computing node, it can be detected whether other computing nodes with an association relationship with the computing node receive the attack caused by the access attack. According to the time dimension, the number of access attacks on the computing node and the number of attacks on other computing nodes are counted, and based on the counted number of access attacks, the law of the number of access attacks changing over time between computing nodes is calculated as a risk transmission data sample. Based on a large amount of risk transmission sample data, a risk transmission model can be established. In some optional embodiments, the risk transmission model can be exemplified using the following formula 1:

[0043]

[0044] Among them, f j (t) represents the risk value of computing node j at time t, f i (t) represents the risk value of computing node i at time t, and Δt represents the transmission time. M(i,j,t,Δt) represents the risk value transmitted from computing node j to computing node i within Δt at time t.

[0045] The following is an illustrative example of the risk transmission value calculation process based on the risk transmission model.

[0046] Optionally, in the risk conduction model, the risk value of any vertex in the topology graph at any time after the security incident occurs can be calculated, wherein any time after the security incident occurs is described as the second time.

[0047] For the first vertex, after a security incident occurs, the risk of the first vertex changes over time. Moreover, after a security incident occurs, the risk caused by the security incident can be transmitted to other vertices through the association relationship between the first vertex and other vertices. In this embodiment, the second risk value of the first vertex at the second moment can be determined based on the first risk value of the first vertex and the risk time-varying factor of the first vertex at the second moment. The following will take the second vertex in the topological graph as an example to illustrate the implementation method of calculating the risk transmission value from the first vertex to the second vertex.

[0048] Optionally, the risk value of the second vertex at the second moment may be obtained. The risk value of the second vertex at the second moment may be determined based on the risk value of the second vertex at the first moment and the risk time-varying factor of the second vertex at the second moment. Based on the second risk value, the risk value of the second vertex at the second moment, and the time difference between the first moment and the second moment, the risk transmission value transmitted from the first vertex to the second vertex at the second moment may be determined.

[0049] In some optional embodiments, partial derivative calculation may be performed based on the difference between the second risk value and the risk value of the second vertex at the second moment, and the risk transmission value transmitted from the first vertex to the second vertex at the second moment may be calculated based on the result of the partial derivative calculation and the time difference between the first moment and the second moment. As shown in Formula 1, the risk value transmitted from vertex j to vertex i within time Δt may be expressed as: Among them, f j (t) represents the risk value of vertex j at time t, f i (t) represents the risk value of vertex i at time t, Δt represents the time difference between the first moment and the second moment. M(i,j,t,Δt) represents the risk value transferred from vertex j to vertex i within Δt time at time t.

[0050] Among them, the risk time-varying factor is used to describe the changing trend of the risk value with the event. In some embodiments, the risk time-varying factor can be a fixed value set according to experience; in other embodiments, the risk time-varying factor can be a variable that changes with time. For example, the risk time-varying factor can be determined according to a linear function or a nonlinear function with respect to time. The following will take the risk time-varying factor implemented as a nonlinear variable with respect to time as an example for explanation.

[0051] Optionally, the adjacency matrix of the first vertex in the topological graph can be determined according to the degree of the first vertex in the topological graph, and the risk time-varying factor of the first vertex at the second moment can be calculated according to the adjacency matrix of the first vertex and the time value at the second moment.

[0052] The risk time-varying factor T may be a function h(t, H) about the adjacency matrix H and the time value t, and the risk time-varying factor may be expressed as T=h(t, H). h(t, H) may be an exponential function. For example, in some embodiments, h(t, H)=e αtH , that is, T = e αtH . Among them, α is a constant coefficient, which can be set according to experience, and e is a natural constant. Accordingly, the risk value of any vertex at time t can be expressed as:

[0053] f(t)=e αtH f(0) Formula 2

[0054] Wherein, f(0) is the risk value at the time when the security incident occurs (i.e., the first moment), which can be described as the initial risk value. Based on the above formula 2, the trend of the risk value changing over time after the incident occurs can be determined.

[0055] The adjacency matrix is ​​used to store the data of the relationship between vertices in the topological graph (i.e., the edges between vertices) in a two-dimensional array. The degree of the first vertex in the topological graph refers to the number of edges connected to the first vertex in the topological graph. For example, Figure 2 As shown, computing node A2 is connected with two edges, one of which is connected to computing node A1, and the other is connected to computing node B2, so the degree of computing node A2 is 2. Wherein, the topological graph is a directed graph, so the degree of any vertex may include in-degree and out-degree. In-degree is the number of in-edges pointing to the vertex, and out-degree is the number of out-edges away from the vertex. In some embodiments, since the risk is conducted in the direction from the departure vertex to the arrival vertex, the adjacency matrix of the first vertex in the topological graph can be determined according to the in-degree of the first vertex in the topological graph.

[0056] The following formula will be used to illustrate the adjacency matrix. As shown in the following formula 1, the adjacency matrix can be expressed as:

[0057]

[0058] Among them, v i ,v j Represent the vertices v in the topological graph respectively i and vertex v j .d(v i ) represents the vertex v i E represents the set of edges in the topological graph. As shown in the above formula 3, if the vertex v i and vertex v j There is an edge between the vertices v i The adjacency matrix of j The value of the corresponding element is 1. When i==j, vertex v i The adjacency matrix of j The value of the corresponding element is vertex v i Negative value of degree.

[0059] Based on the foregoing embodiments, after a security incident occurs at the first vertex, the risk transmission value transmitted from the first vertex to any other vertex in the topology graph can be calculated, and the risk values ​​of multiple applications at the second moment can be determined based on the risk transmission value of any other vertex.

[0060] Optionally, the risk values ​​of multiple vertices in the topological graph at the second moment can be determined based on the first risk value and the risk conduction values ​​of the other vertices; the risk values ​​of the applications to which the multiple vertices belong at the second moment can be determined based on the corresponding relationship between the multiple applications and the multiple vertices and the risk values ​​of the multiple vertices at the second moment.

[0061] For example, in Figure 2 In the schematic topology diagram, the risk value of application vertex A at the second moment can be determined based on the risk value of computing node A1 at the second moment and the risk value of computing node A2 at the second moment. Similarly, the risk value of application vertex B at the second moment can be determined based on the risk value of computing node B1 at the second moment and the risk value of computing node B2 at the second moment.

[0062] In some optional embodiments, after determining the risk values ​​of multiple vertices, risk ranking results of the multiple vertices can be output according to the risk values ​​of the multiple vertices to intuitively display the main risk points, thereby providing users with a decision-making basis for risk response.

[0063] The following will be combined Figure 3 The topology diagram shown is used as an example. Figure 3As shown, the vertices associated with vertex A1 include: vertex B1, vertex C1, vertex C2, and vertex C3. Assume that at time t0, vertex A1 has a first security event, and vertex B1 has a second security event, where the risk level of the first security event is greater than the risk level of the second security event. At time t0, the risk value of vertex A1 is greater than the risk value of vertex B1. Figure 3 As shown in the figure, the edge between vertex A1 and vertex B1 points from vertex A1 to vertex B1. Therefore, over time, the risk value of vertex A1 is transferred to vertex B1. After a certain period of time, the risk value of vertex B1 gradually increases, and the risk value of vertex A1 gradually decreases over time. As the risk is transmitted, the risk of vertex B1 is higher in the final convergence state. If application A is running on vertex A1 and application B is running on vertex B1, then in the convergence state, the risk value of application B is higher. Therefore, the output risk ranking from high to low can be: application B, application A, application C. Based on this method, by mining the relationship between vertices and calculating the risk transfer value between vertices, the risk value of the application can be obtained more accurately, thereby accurately reflecting the security risk of the application after the incident occurs, and helping to grasp the attack path of the intruder.

[0064] In this embodiment, in the topological graph corresponding to multiple applications, the vertices correspond to the multiple computing nodes where the multiple applications are located, and the edges in the topological graph represent the association relationship between the multiple computing nodes, so that the potential association relationship between the applications can be mined based on the topological graph. When a security event is detected at a vertex in the topological graph at the first moment, the first risk value of the vertex is determined, and the risk conduction value transmitted from the vertex to other vertices in the topological graph at the second moment is determined based on the risk conduction model and the first risk value. Based on the first risk value and the risk conduction values ​​of other vertices, the risk values ​​of multiple applications at the second moment can be determined. In this embodiment, based on the risk conduction model, the transmission of risks between computing nodes after the security incident occurs can be analyzed, so as to determine the impact of the security incident on the computing nodes with the association relationship; based on the impact received by the computing nodes and the relationship between the computing nodes and the applications, the risks corresponding to the applications can be analyzed, which is conducive to accurately perceiving the risk level of the applications after the security incident occurs.

[0065] It should be noted that the execution subject of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 101 to 104 can be device A; for another example, the execution subject of steps 101 and 102 can be device A, and the execution subject of step 103 can be device B; and so on.

[0066] In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel, and the sequence numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0067] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0068] Figure 5 A schematic diagram of the structure of an electronic device provided by an exemplary embodiment of the present application is shown. Figure 5 As shown, the electronic device includes: a memory 501 , a processor 502 and a communication component 503 .

[0069] The memory 501 is used to store computer programs and can be configured to store various other data to support operations on the electronic device. Examples of such data include instructions for any application program or method operating on the electronic device.

[0070] Processor 502, coupled to memory 501, is used to execute a computer program in memory 501, so as to: determine a topology graph corresponding to a plurality of applications; the plurality of applications run on a plurality of computing nodes; the vertices in the topology graph represent the plurality of computing nodes, and the edges in the topology graph represent association relationships between the plurality of computing nodes; when a security event is detected at a first vertex in the topology graph at a first moment, determine a first risk value of the first vertex at the first moment; determine a risk conduction value transmitted from the first vertex to other vertices in the topology graph at a second moment based on a risk conduction model and the first risk value; the risk conduction model is modeled based on risk conduction data samples between computing nodes with association relationships; determine the risk values ​​of the plurality of applications at the second moment based on the first risk value and the risk conduction values ​​of the other vertices.

[0071] Optionally, when determining the topological graph corresponding to multiple applications, the processor 502 is specifically used to: obtain the computing nodes corresponding to each of the multiple applications to obtain the multiple computing nodes; determine the association relationship between the multiple computing nodes; and construct the topological graph with the multiple computing nodes as vertices and the association relationship between the multiple computing nodes as edges.

[0072] Optionally, when determining the association relationship among the multiple computing nodes, the processor 502 is specifically used to: obtain network logs of the multiple computing nodes; obtain source addresses and destination addresses of network data of the multiple computing nodes based on the network logs of the multiple computing nodes; and for any two computing nodes among the multiple computing nodes, if the destination address of one computing node is the same as the source address of another computing node, determine that the any two computing nodes have an access relationship.

[0073] Optionally, when determining the association relationship among the multiple computing nodes based on the source addresses and destination addresses of the multiple computing nodes, the processor 502 is specifically used to: obtain application configuration information of the multiple computing nodes; determine applications corresponding to the multiple computing nodes based on the application configuration information of the multiple computing nodes; and for any two computing nodes among the multiple computing nodes, if the applications corresponding to the any two computing nodes are the same, determine that the any two computing nodes have a sibling relationship.

[0074] Optionally, when the processor 502 determines the risk transmission value of the vertex to other vertices in the topological graph according to the risk transmission model, it is specifically used to: determine the risk time-varying factor of the first vertex at the second moment by using the risk transmission model; determine the second risk value of the first vertex at the second moment according to the first risk value of the first vertex and the risk time-varying factor of the first vertex at the second moment; for any second vertex among the other vertices, obtain the risk value of the second vertex at the second moment; determine the risk transmission value from the first vertex to the second vertex at the second moment according to the second risk value, the risk value of the second vertex at the second moment and the time difference between the first moment and the second moment.

[0075] Optionally, the processor 502 is further used to: determine the adjacency matrix of the first vertex in the topological graph based on the degree of the first vertex in the topological graph; and calculate the risk time-varying factor of the first vertex at the second moment based on the adjacency matrix of the first vertex and the time value at the second moment.

[0076] Optionally, when the processor 502 determines the risk values ​​of the multiple applications at the second moment based on the first risk value and the risk conduction values ​​of the other vertices, it is specifically used to: determine the risk values ​​of the multiple vertices in the topological graph at the second moment based on the first risk value and the risk conduction values ​​of the other vertices; determine the risk values ​​of the applications to which the multiple vertices respectively belong at the second moment based on the corresponding relationship between the multiple applications and the multiple vertices and the risk values ​​of the multiple vertices at the second moment.

[0077] Optionally, after determining the risk values ​​of the multiple applications at the second moment, the processor 502 is further configured to: sort the risk levels of the multiple applications according to the risk values ​​of the multiple applications at the second moment; and output the sorting result of the risk levels.

[0078] Further, if Figure 5 As shown, the electronic device also includes: a power supply component 504, a display component 505, an audio component 506 and other components. Figure 5 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 5 Components shown.

[0079] Among them, the memory 501 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0080] The communication component 503 is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as Wi-Fi (wireless network communication technology), 2G (such as Global System for Mobile Communications (GSM)), 3G (such as Wideband Code Division Multiple Access (WCDMA), 4G (such as Long Term Evolution (LTE)), 4G+ (such as upgraded Long Term Evolution (LTE-Advanced, LTE-A)) or 5G (Fifth Generation Mobile Communication Technology), or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component can be implemented based on Near Field Communication (NFC) technology, Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology and other technologies.

[0081] The power supply component 504 is used to provide power to various components of the device where the power supply component is located. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing and distributing power to the device where the power supply component is located.

[0082] The display component 505 includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor can not only sense the boundaries of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0083] The audio component 506 may be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal may be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0084] In this embodiment, in the topological graph corresponding to multiple applications, the vertices correspond to the multiple computing nodes where the multiple applications are located, and the edges in the topological graph represent the association relationship between the multiple computing nodes, so that the potential association relationship between the applications can be mined based on the topological graph. When a security event is detected at a vertex in the topological graph at the first moment, the first risk value of the vertex is determined, and the risk conduction value transmitted from the vertex to other vertices in the topological graph at the second moment is determined based on the risk conduction model and the first risk value. Based on the first risk value and the risk conduction values ​​of other vertices, the risk values ​​of multiple applications at the second moment can be determined. In this embodiment, based on the risk conduction model, the conduction of risks between computing nodes after the security event occurs can be analyzed, so as to determine the impact of the security event on the computing nodes with the association relationship; based on the impact received by the computing node and the relationship between the computing node and the application, the risk corresponding to the application can be analyzed, so as to facilitate accurate perception of the risk level of the application after the security event occurs.

[0085] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed, can implement each step that can be executed by an electronic device in the above method embodiment.

[0086] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM (Compact Disc Read-Only Memory, read-only optical disc read-only memory), optical storage, etc.) containing computer-usable program codes.

[0087] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0088] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0089] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0090] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interface, network interface and memory.

[0091] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0092] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, Parallel Random Access Machine (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic cassettes, disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0093] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0094] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. An application risk detection method, characterized in that: include: Determine the topology diagrams corresponding to multiple applications; The multiple applications are run on multiple computing nodes; The vertices in the topological graph represent the multiple computing nodes, and the edges in the topological graph represent the association relationships between the multiple computing nodes; When a security event of a first vertex in the topological graph at a first moment is detected, determining a first risk value of the first vertex at the first moment; Determine, according to the risk transmission model and the first risk value, a risk transmission value transmitted from the first vertex to other vertices in the topological graph at a second moment; The risk transmission model is obtained by modeling the risk transmission data samples between the computing nodes having the associated relationship; The risk values ​​of the multiple applications at the second moment are determined according to the first risk value and the risk transmission values ​​of the other vertices.

2. The method according to claim 1, characterized in that Determine the topology diagrams corresponding to multiple applications, including: Obtain computing nodes corresponding to each of the multiple applications to obtain the multiple computing nodes; Determining an association relationship among the plurality of computing nodes; The topology graph is constructed with the multiple computing nodes as vertices and the association relationships between the multiple computing nodes as edges.

3. The method according to claim 2, characterized in that Determining the association relationship between the multiple computing nodes includes: Obtaining network logs of the multiple computing nodes; Acquire source addresses and destination addresses of network data of the plurality of computing nodes according to the network logs of the plurality of computing nodes; For any two computing nodes among the plurality of computing nodes, if a destination address of one computing node is the same as a source address of another computing node, it is determined that the any two computing nodes have an access relationship.

4. The method according to claim 3, characterized in that Determining, according to the source addresses and the destination addresses of the multiple computing nodes, an association relationship between the multiple computing nodes, includes: Obtaining application configuration information of the multiple computing nodes; Determining applications corresponding to the multiple computing nodes according to the application configuration information of the multiple computing nodes; For any two computing nodes among the multiple computing nodes, if the applications corresponding to the any two computing nodes are the same, it is determined that the any two computing nodes have a sibling relationship.

5. The method according to any one of claims 1 to 4, characterized in that: Determining, according to the risk transmission model, the risk transmission value of the vertex to other vertices in the topological graph includes: Determine the risk time-varying factor of the first vertex at the second moment by using the risk conduction model; Determine a second risk value of the first vertex at the second moment according to the first risk value of the first vertex and the risk time-varying factor of the first vertex at the second moment; For any second vertex among the other vertices, obtaining a risk value of the second vertex at a second moment; A risk conduction value directed from the first vertex to the second vertex at the second moment is determined according to the second risk value, the risk value of the second vertex at the second moment, and the time difference between the first moment and the second moment.

6. The method according to claim 5, characterized in that Determining the risk time-varying factor of the first vertex at the second moment by using the risk conduction model includes: Determine an adjacency matrix of the first vertex in the topological graph according to the degree of the first vertex in the topological graph by using the risk transmission model; A risk time-varying factor of the first vertex at the second moment is calculated according to the adjacency matrix of the first vertex and the time value at the second moment.

7. The method according to claim 5, characterized in that Determining the risk values ​​of the multiple applications at the second moment according to the first risk value and the risk conduction values ​​of the other vertices includes: Determine, according to the first risk value and the risk conduction values ​​of the other vertices, the risk values ​​of the plurality of vertices in the topological graph at a second moment; The risk values ​​of the applications to which the multiple vertices respectively belong at the second moment are determined according to the corresponding relationships between the multiple applications and the multiple vertices and the risk values ​​of the multiple vertices at the second moment.

8. The method according to claim 5, characterized in that After determining the risk values ​​of the plurality of applications at the second moment, the method further includes: sorting the risk levels of the multiple applications according to the risk values ​​of the multiple applications at the second moment; Output the ranking result of the risk levels.

9. An electronic device, characterized in that: include: Memory and processor; The memory is used to store one or more computer instructions; The processor is configured to execute the one or more computer instructions to: perform the steps in the method according to any one of claims 1-8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it can implement the application risk detection method described in any one of claims 1 to 8.

Images