Internet of Things equipment security event threat level assessment method and device

Abstract

The invention discloses an Internet of Things equipment security event threat level assessment method and device, and the method comprises the steps: obtaining security events, equipment types and working condition parameters of target equipment in a target time period, and carrying out the division according to the timestamps of all security events, thereby obtaining a plurality of time window association groups; taking the security events connected with the same network endpoint as the same threat source event, and generating a plurality of threat source event sets; calculating a threat score of each security event to obtain a comprehensive threat score table; generating a comprehensive situation score table in combination with the security event timestamps, the equipment types and the working condition parameters; calling a preset threat event rule base to perform rule matching, and generating a rule matching result table; and finally, according to the time window association table, the comprehensive threat score table, the comprehensive situation score table and the rule matching result table, determining the threat level of each security event. By comprehensively considering the associated information of the security event in multiple dimensions, a more accurate threat level evaluation result is obtained.

Description

Technical Field

[0001] The present invention relates to the field of security detection of Internet of Things devices, and in particular to a method and device for assessing the threat level of security events of Internet of Things devices. Background Art

[0002] With the continuous improvement of the informationization and intelligence of the power system, the security of the power grid terminal side has become an important issue that cannot be ignored in the operation of the power system. The IoT devices on the power grid terminal side include smart meters, distribution automation equipment, monitoring equipment, etc. These devices are connected to the Internet in large numbers, making the power grid terminal side face more and more network threats and attack risks, such as DDoS attacks, malware propagation, phishing attacks, etc.

[0003] There are many types of IoT devices on the power grid terminal side, and the data formats and contents generated by various IoT devices vary greatly, which makes the detection and analysis of security incidents complicated. Summary of the invention

[0004] The present invention provides a method and device for assessing the threat level of security events in IoT devices. The method can effectively analyze security events in IoT devices and determine the threat level of each security event in the IoT devices.

[0005] An embodiment of the present invention provides a method for assessing the threat level of security events of an Internet of Things device, comprising:

[0006] Obtain security events of the target device within the target time period, the device type of the target device, and the operating parameters of the target device;

[0007] According to the timestamps in the security events, the time-related security events are divided into the same time window association group to obtain a plurality of time window association groups, and all the time window association groups are integrated into a time window association table;

[0008] For each of the time window association groups, taking security events connected through the same network endpoint in the time window association group as the same threat source event, and generating a threat source event set for indicating the same threat source;

[0009] Calculate the threat score of each security event in all threat source event sets and generate a comprehensive threat score table;

[0010] Determine the situation score of each security event according to the timestamp in the security event, the device type and the operating condition parameter, and generate a comprehensive situation score table;

[0011] According to the security events, the comprehensive threat score table and the comprehensive situation score table, a preset threat event rule library is called to perform rule matching on each security event, and a rule matching result table is generated based on successfully matched security events and corresponding matching rules; wherein the threat event rule library includes matching rules for a number of threat events;

[0012] The threat level of each security event is determined according to the time window association table, the comprehensive threat score table, the comprehensive situation score table and the rule matching result table.

[0013] Furthermore, according to the timestamps in the security events, the time-related security events are divided into the same time window association group to obtain a plurality of time window association groups, and all the time window association groups are integrated into a time window association table, including:

[0014] a timestamp identifying the security event;

[0015] Based on the timestamps of the security events, the security events are sorted to obtain a security event sequence;

[0016] Construct a sliding time window; wherein the window size of the sliding time window is T w ; T w is a positive integer;

[0017] Initializing the sliding time window so that an initial position of the sliding time window coincides with an initial position of the security event sequence;

[0018] Based on the sliding time window, traverse each security event in the security event sequence to obtain a plurality of time window association groups; wherein, each time the sliding time window completes a slide, the security events in the sliding time window are associated to generate a time window association group;

[0019] All time window association groups are integrated into a time window association table.

[0020] Furthermore, each of the security events contains a network endpoint connection information; the network endpoint connection information includes the event source IP address, the event target IP address, the event source port number and the event target port number;

[0021] For each of the time window association groups, the security events connected through the same network endpoint in the time window association group are regarded as the same threat source events, and a threat source event set indicating the same threat source is generated, including:

[0022] For each security event in each of the time window association groups, the network endpoint connection information of the current security event is matched with the network endpoint connection information of the remaining security events in the current time window association group; the security events that match the network endpoint connection information of the current security event are treated as the same threat source events, and the same threat source events are associated with the current security event to generate a threat source event set.

[0023] Furthermore, the calculation of the threat score of each security event in the set of all threat source events to generate a comprehensive threat score table includes:

[0024] For each security event in each threat source event set, calling a preset event type severity list, and determining an event severity score of the security event based on the event type of the security event;

[0025] For the network endpoint connection information corresponding to each threat source event set, the number of historical event occurrences and the corresponding impact weight of the current network endpoint connection information are identified in a preset historical event database, and the historical record score of each security event in the threat source event set is determined based on the number of historical event occurrences and the impact weight;

[0026] For each network endpoint connection information corresponding to a threat source event set, a threat index corresponding to the network endpoint connection information is identified in a preset threat intelligence database, and based on the threat index, a threat index of each security event in the threat source event set is determined;

[0027] For each security event in each threat source event set, determine the relevance score of the security event according to the total number of security events associated in the time window association group where the security event is located;

[0028] For each security event in each threat source event set, determine the threat score of the security event according to the event severity score, historical record score, threat index and relevance score corresponding to the security event;

[0029] Generate a comprehensive threat score table based on the threat score of each security incident.

[0030] Furthermore, the operating condition parameters include: equipment deployment parameters and a set of equipment historical security events;

[0031] The determining of the situation score of each security event according to the timestamp in the security event, the device type and the operating condition parameter, and generating a comprehensive situation score table includes:

[0032] Determine the time context score of each security event based on the timestamp in each security event and the preset running time assignment table;

[0033] For each of the security events, determining a device type of a target device executing the security event; determining a device type context score of the security event based on the device type and a preset device type assignment table;

[0034] Determine the deployment scenario score of each security event according to the device deployment parameters and a preset device deployment environment assignment table;

[0035] Determine, based on the device's historical security event set, a historical occurrence context score for each security event;

[0036] For each of the security events, a context score of the security event is obtained by integrating the time context score, the device type context score, the deployment context score and the historical occurrence context score of the security event;

[0037] The situational scores of each security incident are integrated into a comprehensive situational score table.

[0038] Further, according to the security events, the comprehensive threat score table and the comprehensive situation score table, a preset threat event rule library is called to perform rule matching on each security event, and based on the successfully matched security events and the corresponding matching rules, a rule matching result table is generated, including:

[0039] For each security event in the comprehensive threat score table, according to the security event, the threat score of the security event in the comprehensive threat score table, and the situation score of the security event in the comprehensive situation score table, each rule in the threat event rule base is matched one by one, and the successfully matched rule is associated with the security event to obtain the rule matching information of the security event;

[0040] Generate a rule matching result table based on the rule matching information of each security event.

[0041] Furthermore, the method for assessing the threat level of security incidents of IoT devices further includes:

[0042] For each of the security events, according to the threat level of the security event, a preset threat policy library is called to obtain a target threat policy that matches the threat level of the security event; according to the target threat policy, a target device that executes the security event is adjusted.

[0043] Furthermore, the event types of the security events include traffic logs, system logs, alarm events and file activities.

[0044] An embodiment of the present invention further provides an IoT device security event threat level assessment device, comprising: a data acquisition module, a time window association table generation module, a threat source event set generation module, a comprehensive threat score table generation module, a comprehensive situation score table generation module, a rule matching result table generation module, and a threat level determination module;

[0045] The data acquisition module is used to acquire security events of the target device within a target time period, the device type of the target device, and the operating parameters of the target device;

[0046] The time window association table generation module is used to divide the time-related security events into the same time window association group according to the timestamps in the security events, obtain a plurality of time window association groups, and integrate all the time window association groups into a time window association table;

[0047] The threat source event set generation module is used to, for each of the time window association groups, take the security events connected through the same network endpoint in the time window association group as the same threat source event, and generate a threat source event set indicating the same threat source;

[0048] The comprehensive threat score table generation module is used to calculate the threat score of each security event in all threat source event sets and generate a comprehensive threat score table;

[0049] The comprehensive situational scoring table generation module is used to determine the situational score of each security event according to the timestamp in the security event, the device type and the operating condition parameter, and generate a comprehensive situational scoring table;

[0050] The rule matching result table generating module is used to call a preset threat event rule library to perform rule matching on each security event according to the security event, the comprehensive threat score table and the comprehensive situation score table, and generate a rule matching result table based on successfully matched security events and corresponding matching rules; wherein the threat event rule library includes matching rules for a number of threat events;

[0051] The threat level determination module is used to determine the threat level of each security event according to the time window association table, the comprehensive threat score table, the comprehensive situation score table and the rule matching result table.

[0052] Furthermore, the IoT device security incident threat level assessment device further includes: a target device adjustment module;

[0053] The target device adjustment module is used to call a preset threat policy library for each security event according to the threat level of the security event to obtain a target threat policy that matches the threat level of the security event; and adjust the target device that executes the security event according to the target threat policy.

[0054] The following beneficial effects are achieved by implementing the present invention:

[0055] The present invention provides a method and device for assessing the threat level of security events of an Internet of Things device. The method first obtains the security events, device type and operating condition parameters of a target device within a target time period, divides a number of time window association groups according to the timestamp of the security events, takes the security events connected to the same network endpoint as the same threat source event to generate a threat source event set, calculates the threat score of each security event to generate a comprehensive threat score table, combines the timestamp, device type and operating condition parameters to determine the situation score to generate a comprehensive situation score table, then calls a preset threat event rule library to perform rule matching to generate a rule matching result table, and finally determines the threat level of each security event according to the above tables;

[0056] Therefore, by associating security events with similar timestamps of different target devices, the association of various security events is achieved in the time dimension; next, based on the association in the time dimension, the security events with the same network endpoints are further associated to form threat source events, which means that if multiple security events occur on the same network endpoint, they are likely to be caused by the same threat source. By correlating and analyzing these events, potential threat sources can be identified and threat scores can be calculated; at the same time, based on the attribute data and operating parameters of the target device, the situational score of the security event is calculated. This score takes into account the specific situation and operating status of the device, which helps to more comprehensively evaluate the severity of the security event and the impact on the device. Then, under the comprehensive time dimension, device situational dimension, device attribute dimension and device operating condition dimension, the security event is matched with rules, thereby associating the security event with the threat event; finally, according to the time window association table, the comprehensive threat score table, the comprehensive situational score table and the rule matching result table, the threat level of each security event is determined, so that the assessment of the threat level is more accurate and reasonable. In summary, by comprehensively considering information on multiple dimensions such as time, connection port, device context, device attributes and device operating conditions, a more accurate and reasonable threat level assessment result can be obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the implementation manner will be briefly introduced below. Obviously, the drawings described below are only some implementation manners of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0058] Figure 1 It is a flowchart of a method for assessing the threat level of security incidents of an Internet of Things device provided by a certain embodiment of the present application;

[0059] Figure 2 It is a structural diagram of a device for assessing the threat level of security events of an Internet of Things device provided by a certain embodiment of the present application;

[0060] Figure 3 It is a structural diagram of an IoT device security incident threat level assessment device provided by another embodiment of the present application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0063] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0064] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0065] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0066] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0067] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0068] See also Figure 1 , is a flowchart of a method for assessing the threat level of security events of an Internet of Things device provided by an embodiment of the present invention, comprising:

[0069] S1. Obtain security events of a target device within a target time period, the device type of the target device, and operating parameters of the target device;

[0070] In a preferred embodiment, the event types of the security events include traffic logs, system logs, alarm events, and file activities;

[0071] Specifically, the device types of the target devices include core routers, switches, surveillance cameras, etc.;

[0072] Specifically, the security event contains key attributes such as timestamp, event source IP address, event target IP address, event source port number, event target port number, and security event type;

[0073] Specifically, the original security events obtained are denoised to filter out duplicate events, invalid events, and low-credibility events that may be caused by false alarms; in the cleaning process, abnormal data that is obviously inconsistent with common sense is identified and removed according to predefined rules to ensure the data quality of subsequent analysis, and missing or abnormal timestamp data is processed through completion or correction to ensure the accuracy of the timestamp.

[0074] S2. According to the timestamps in the security events, the time-related security events are divided into the same time window association group to obtain a plurality of time window association groups, and all the time window association groups are integrated into a time window association table;

[0075] In a preferred embodiment, the time-related security events are divided into the same time window association group according to the timestamps in the security events to obtain a plurality of time window association groups, and all the time window association groups are integrated into a time window association table, including:

[0076] a timestamp identifying the security event;

[0077] Based on the timestamps of the security events, the security events are sorted to obtain a security event sequence;

[0078] Construct a sliding time window; wherein the window size of the sliding time window is T w ; T w is a positive integer;

[0079] Initializing the sliding time window so that an initial position of the sliding time window coincides with an initial position of the security event sequence;

[0080] Based on the sliding time window, traverse each security event in the security event sequence to obtain a plurality of time window association groups; wherein, each time the sliding time window completes a slide, the security events in the sliding time window are associated to generate a time window association group;

[0081] Integrate all time window association groups into a time window association table;

[0082] Specifically, according to the timestamps of the security events, the security events from different security devices are sorted in ascending order to generate a security event sequence S;

[0083] Schematically, construct a window size of T w A sliding time window is generated, and the sliding time window is initialized so that an initial position of the sliding time window coincides with an initial position of the security event sequence;

[0084] Specifically, the sliding time window starts from the first security event event1 of the security event sequence S, and associates the security events within the sliding time window to form a time window association group G. k ;

[0085] In the time window associated with the group G k Security event i i ) and security events j ) should satisfy the following time window formula:

[0086] Timestamp i -Timestamp j ≤T W ;

[0087] Where: Timestamp i Indicates the timestamp of security event i; Timestamp j The timestamp of security event j; T w Indicates the window size;

[0088] For all time window association groups G k Perform statistics and generate an event window association table, where each row represents a time window association group;

[0089] Specifically, the time window association table includes an association group ID, an event ID list, a start time, an end time, and a device ID list;

[0090] In this embodiment, in many network attacks, different attack behaviors often occur continuously in a short period of time. Traditional security analysis methods often only focus on a single event and ignore the temporal correlation between events. In actual applications, events detected by different devices may have a certain correlation in time. Therefore, this application is based on a sliding time window to correlate security events with similar time, which becomes an important means to improve the accuracy of threat level assessment.

[0091] S3. For each of the time window association groups, taking security events connected through the same network endpoint in the time window association group as the same threat source event, and generating a threat source event set for indicating the same threat source;

[0092] In a preferred embodiment, each of the security events contains a network endpoint connection information; the network endpoint connection information includes the event source IP address, the event target IP address, the event source port number and the event target port number;

[0093] For each of the time window association groups, the security events connected through the same network endpoint in the time window association group are regarded as the same threat source events, and a threat source event set indicating the same threat source is generated, including:

[0094] For each security event in each of the time window association groups, the network endpoint connection information of the current security event is matched with the network endpoint connection information of the remaining security events in the current time window association group; the security events that match the network endpoint connection information of the current security event are regarded as the same threat source events, and the same threat source events are associated with the current security event to generate a threat source event set;

[0095] Specifically, for each time window association group G k , the security events connected through the same network endpoint in the time window association group are regarded as the same threat source events, with security event i (event i ) and security events j ) is used as an example to determine the security event i(event i ) and security events j ) are events from the same threat source:

[0096]

[0097] Where: src ip Indicates the source IP address of the security event; dst ip Indicates the event target IP address of the security event; src port Indicates the event source port number of the security event; dst port Indicates the event target port number of the security event; Match(event i ,event j ) indicates the matching result. If it is 1, it means that the two security events are from the same threat source, otherwise they are not from the same threat source;

[0098] For each security event in each of the time window association groups, the network endpoint connection information of the current security event is matched with the network endpoint connection information of the remaining security events in the current time window association group, and the security events that match the network endpoint connection information of the current security event are regarded as the same threat source event, and the same threat source event is associated with the current security event to generate a threat source event set;

[0099] Based on the above method, several threat source event sets are obtained;

[0100] In this embodiment, after associating security events in the time dimension, the method further determines whether there are security events from different devices involving the same target by matching the network endpoint connection attributes of the events (such as IP address, port number). Through this embodiment, the correlation between events can be further confirmed from the network level, thereby enhancing the accuracy of threat detection and solving the problem that a single device is difficult to comprehensively detect threats at the network level.

[0101] S4. Calculate the threat score of each security event in all threat source event sets and generate a comprehensive threat score table;

[0102] In a preferred embodiment, the step of calculating the threat score of each security event in all threat source event sets and generating a comprehensive threat score table includes:

[0103] For each security event in each threat source event set, calling a preset event type severity list, and determining an event severity score of the security event based on the event type of the security event;

[0104] For the network endpoint connection information corresponding to each threat source event set, the number of historical event occurrences and the corresponding impact weight of the current network endpoint connection information are identified in a preset historical event database, and the historical record score of each security event in the threat source event set is determined based on the number of historical event occurrences and the impact weight;

[0105] For each network endpoint connection information corresponding to a threat source event set, a threat index corresponding to the network endpoint connection information is identified in a preset threat intelligence database, and based on the threat index, a threat index of each security event in the threat source event set is determined;

[0106] For each security event in each threat source event set, determine the relevance score of the security event according to the total number of security events associated in the time window association group where the security event is located;

[0107] For each security event in each threat source event set, determine the threat score of the security event according to the event severity score, historical record score, threat index and relevance score corresponding to the security event;

[0108] Generate a comprehensive threat score table based on the threat score of each security incident;

[0109] Specifically, for each security event in each threat source event set, a preset event type severity list is called, and according to the event type of the security event, an event severity score, i.e., a Severity value, of the security event is determined;

[0110] Specifically, the preset historical event database is queried to count the number of historical events of each network endpoint connection information (i.e., the total number of security events that have occurred in the history of the IP address / port number recorded in the current network endpoint connection information) and the corresponding impact, and the historical record score of each threat source event set is calculated, i.e., Historical Record Value, and the Historical Record The value is also assigned to each security event in the current threat source event set, thereby obtaining the Historical Record value;

[0111] Specifically, for each threat source event set corresponding to the network endpoint connection information, extract its event source IP address (src ip ), event target IP address (dst ip ), event source port number (src port ), event destination port number (dst port ) and other information, matching the network endpoint connection information with the threat IP address and threat port number recorded in a preset threat intelligence database;

[0112] Specifically, the scoring rules of the threat index are as follows:

[0113] If the IP address or port number in the network endpoint connection information is marked as high risk in the threat intelligence database, the threat index Threat of the security event corresponding to the network endpoint connection information is Level is recorded as 5; if the IP address or port number in the network endpoint connection information is marked as medium risk in the threat intelligence database, the threat index Threat of the security event corresponding to the network endpoint connection information is Level is recorded as 3; if the IP address or port number in the network endpoint connection information is marked as low risk or not in the list in the threat intelligence database, the threat index Threat of the security event corresponding to the network endpoint connection information is Level is recorded as 1;

[0114] It should be noted that if a security incident involves multiple IP addresses or port numbers at the same time, the one with the highest threat index will be taken as the final Threat Index. Level .

[0115] Specifically, for each security event in each threat source event set, the relevance score of the security event is determined according to the total number of security events associated in the time window association group in which the security event is located. The relevance of the security event depends on the total number of security events in the time window association group and whether the same IP address or port number is involved. The stronger the relevance, the higher the score.

[0116] Specifically, the scoring rules for relevance scoring are as follows:

[0117] For each security event, calculate the number of remaining security events in the associated group of the time window where the current security event is located. If the number of remaining security events in the associated group of the time window where the current security event is located is 3 or more, the association score of the current security event is Association. Score 5; if the number of remaining security events in the association group of the time window where the current security event is located is 1-2, then the association score of the current security event is Association Score is 3; if the number of remaining security events in the association group of the time window where the current security event is located is 0, the association score of the current security event is Score is 1.

[0118] It should be noted that if a security event is associated with other security events in multiple different time window association groups, the highest association score is taken as the final Association Score ;

[0119] Specifically, after determining the event severity score, historical record score, threat index and relevance score of each security event according to the above method, the threat score Threat of the security event is calculated. score , the specific calculation formula is as follows:

[0120]

[0121] Where: α, β, γ, δ represent the weight coefficients of the preset scores / indexes respectively; Threat Level Indicates the threat index; Severity indicates the severity score of the incident; Historical Record Indicates historical record score; Association Score represents the relevance score;

[0122] Then, based on the threat scores of each security incident, a comprehensive threat score table is generated;

[0123] In this embodiment, the method generates a comprehensive threat score table by calculating the threat score of each security event. This threat score takes into account the severity, relevance and potential impact of the event, and provides a quantitative basis for subsequent security event threat level assessment.

[0124] S5. Determine the situation score of each security event according to the timestamp in the security event, the device type and the operating condition parameter, and generate a comprehensive situation score table;

[0125] In a preferred embodiment, the operating condition parameters include: equipment deployment parameters and a set of equipment historical security events;

[0126] The determining of the situation score of each security event according to the timestamp in the security event, the device type and the operating condition parameter, and generating a comprehensive situation score table includes:

[0127] Determine the time context score of each security event based on the timestamp in each security event and the preset running time assignment table;

[0128] For each of the security events, determining a device type of a target device executing the security event; determining a device type context score of the security event based on the device type and a preset device type assignment table;

[0129] Determine the deployment scenario score of each security event according to the device deployment parameters and a preset device deployment environment assignment table;

[0130] Determine, based on the device's historical security event set, a historical occurrence context score for each security event;

[0131] For each of the security events, a context score of the security event is obtained by integrating the time context score, the device type context score, the deployment context score and the historical occurrence context score of the security event;

[0132] Integrate the situational scores of each security incident into a comprehensive situational score table;

[0133] Specifically, the time context score of each security event is determined according to the timestamp in each security event and a preset runtime assignment table, and the runtime assignment table is specifically as follows:

[0134] If the timestamp in the security incident is within the working hours but not during the peak hours (i.e., the three intervals of 8:00-9:00, 11:00-14:00, and 16:00-18:00), the score is 3;

[0135] If the timestamp in the security event is in the peak period (i.e., 9:00-11:00 and 14:00-16:00), the score is 4;

[0136] If the timestamp in the security event is in the non-working range, the score is 1.

[0137] Specifically, for each of the security events, the device type of the target device executing the security event is determined, and the device type context score of the security event is determined according to the device type and a preset device type assignment table, and the device type assignment table is specifically as follows:

[0138] If the target device is a critical device type (such as a core router, switch, or load balancer), the score is 5;

[0139] If the target device is a general device (such as a surveillance camera), the score is 3;

[0140] If the target device is an edge device (such as an intelligent transportation terminal device), the score is 1.

[0141] Specifically, the deployment scenario score of each security event is determined according to the device deployment parameters and a preset device deployment environment value table, and the device deployment environment value table is specifically as follows:

[0142] If the device deployment parameter indicates that the target device is deployed near a critical facility (such as a power control center), the score is 5;

[0143] If the device deployment parameter indicates that the target device is deployed in a general urban area, the score is 3;

[0144] If the device deployment parameter indicates that the target device is deployed in a rural area or an area far away from critical facilities, a score of 2 is assigned.

[0145] Specifically, according to the device historical security event set, the historical occurrence context score of each security event is determined, and the specific score determination rules are as follows:

[0146] If the timestamp of the security incident is used as the starting point, and the same security incident as the security incident occurs more than 3 times within 3 months from the starting point, the score is 5;

[0147] Taking the timestamp of the security incident as the starting point, if the same security incident as the security incident occurs 1-3 times within 3 months from the starting point, the score is 3;

[0148] Taking the timestamp of the security incident as the starting point, if the number of security incidents identical to the security incident occurring is 0 within 3 months before the starting point, the score is 1.

[0149] Therefore, according to the above scoring rules / assignment table, the situational score of each security incident is determined, and the specific situational score calculation formula is as follows:

[0150]

[0151] Where: Context Score represents the situation score; λ1, λ2, λ3 and λ4 represent the preset weight coefficients; Time Context Represents the temporal context score; Spatial Context represents the deployment scenario score;

[0152] Device Context Indicates the device type context score; Historical Context Indicates the historical occurrence situation score;

[0153] The situational scores of each security incident are integrated into a comprehensive situational score table.

[0154] S6. According to the security events, the comprehensive threat score table and the comprehensive situation score table, call a preset threat event rule library to perform rule matching on each security event, and generate a rule matching result table based on successfully matched security events and corresponding matching rules; wherein the threat event rule library includes matching rules for a number of threat events;

[0155] In a preferred embodiment, according to the security events, the comprehensive threat score table and the comprehensive situation score table, a preset threat event rule library is called to perform rule matching on each security event, and based on the successfully matched security events and the corresponding matching rules, a rule matching result table is generated, including:

[0156] For each security event in the comprehensive threat score table, according to the security event, the threat score of the security event in the comprehensive threat score table, and the situation score of the security event in the comprehensive situation score table, each rule in the threat event rule base is matched one by one, and the successfully matched rule is associated with the security event to obtain the rule matching information of the security event;

[0157] Generate a rule matching result table based on the rule matching information of each security event;

[0158] Indicatively, each rule in the preset threat event rule base k ) consists of multiple conditions (Condition m ), each condition contains one or more attribute matching requirements; each rule has a unique rule and rule description

[0159] Examples of rule condition expressions are as follows:

[0160] Condition m :if(Attribute1 Operator Value1)AND(Attribute2 OperatorValue2)...;

[0161] Where: Attribute nIndicates the data to be judged of the security event (such as event source IP address, event target IP address, event source port number, event target port number, threat score, situation score, etc.); Operator indicates a logical operator (such as "<", ">", "=", etc.); Value n Condition m ) corresponding to the specific value;

[0162] Specifically, the rule matching process is as follows:

[0163] For the rule Rule in the threat event rule base k , traverse each security event in the comprehensive threat score table, and find the event that satisfies the rule Rule k All conditions in Condition n The security event and the rule k Corresponding rules Use Boolean logic operations to match conditions. Assume that the current security event event i Satisfy the Rule k If all conditions are met, the security event event is marked. i To match the event, and set the rule k Corresponding rules Make associations;

[0164] Schematically, the matching process is shown in the following formula:

[0165]

[0166] Where: Security event event i Rule k The matching result, if 1 means the match is successful, 0 means no match; Condition m (event i ) indicates a security event event i A Boolean value indicating whether the mth condition is satisfied, 1 if satisfied, 0 if not;

[0167] Specifically, the following are examples of relevant rules:

[0168] Rule 1: When the threat score is greater than or equal to 8 and the situation score is greater than or equal to 5, it is considered a high-risk event:

[0169] Rule 2: When the source IP address of a security incident appears in the blacklist and the port number is a common attack port (such as 80, 443), it is considered a malicious access.

[0170] Thus, according to the rule matching information of each security event, a rule matching result table is generated;

[0171] Specifically, the structure of the rule matching result table is as follows:

[0172] Column 1: Matching rule ID (Rule_ID);

[0173] Column 2: Matching event ID (Event_ID);

[0174] Column 3: Threat score of the matching event (Threat_Score);

[0175] Column 4: Context score of the matching event (Context_Score);

[0176] Column 5: Detailed description of the match condition (Match_Description), such as "satisfies threat score and situational score conditions" or "matches blacklisted IP and attack port";

[0177] In this embodiment, a predefined threat event rule library is used to perform matching analysis on the data in the comprehensive threat score table and the situational comprehensive situation score table, and the generated rule matching result table can mark the security events that meet the predefined rules.

[0178] S7, determining the threat level of each security event according to the time window association table, the comprehensive threat score table, the comprehensive situation score table and the rule matching result table;

[0179] Specifically, the time window association table, the comprehensive threat score table, the comprehensive situation score table and the rule matching result table are input into a pre-built machine learning model, so that the machine learning model can determine the potential threat probability of each security event according to the input data; it should be noted that the machine learning model adopts an LSTM model, and the machine learning model is trained with a number of historical real security events and corresponding historical threat events as training samples, and the specific training principle is not repeated here;

[0180] Then, according to the potential threat probability of each security event, the comprehensive threat score table and the comprehensive situation score table are combined to determine the threat level of each security event. The specific threat level calculation formula is as follows:

[0181] TL = α·TS + β·CI + γ·TP;

[0182] Where: TL (Threat Level) represents the threat level; TS (Threat score ) represents the threat score; TP represents the potential threat probability; CI (ContextScore ) represents the situation score; α, β and γ represent the preset weight coefficients.

[0183] In a preferred embodiment, the method for assessing the threat level of security events of IoT devices further includes:

[0184] For each of the security events, according to the threat level of the security event, calling a preset threat policy library to obtain a target threat policy that matches the threat level of the security event; adjusting the target device that executes the security event according to the target threat policy;

[0185] Specifically, according to the threat level TL of the security event, a target threat strategy corresponding to the security event is determined, and a target device for executing the security event is adjusted based on the target threat strategy;

[0186] Specifically, when TL≥0.75, it is determined to be a high threat level, and the corresponding target threat strategy is a high threat strategy; similarly, when 0.5≤TL<0.75, it is determined to be a medium threat level, and the corresponding target threat strategy is a medium threat strategy; similarly, when TL<0.5, it is determined to be a low threat level, and the corresponding target threat strategy is a low threat strategy;

[0187] Specifically, the high-threat strategy includes: (1) immediately triggering the active defense mechanism of the security device, such as blocking the network connection of a specific IP or port; (2) sending an emergency alert to the security management center; (3) triggering intranet traffic monitoring and isolating the relevant traffic of the high-threat event to a separate VLAN or network area;

[0188] Specifically, the threat strategy includes: (1) triggering the log analysis system to conduct detailed behavior log tracking; (2) notifying the security operation team to conduct manual inspection and analysis; (3) recording relevant events and entering the observation list to closely monitor the subsequent behavior of related IPs and ports;

[0189] Specifically, the low-threat strategy includes: (1) only logging and automatic system monitoring; (2) not taking active defense measures for the time being, but maintaining monitoring of relevant IP addresses;

[0190] Specifically, the generated target threat strategy can be automatically sent to the corresponding target device through an API interface or script to ensure that the target threat strategy can be quickly executed.

[0191] See also Figure 2, is a device for assessing the threat level of security events of an Internet of Things device provided by an embodiment of the present invention, comprising: a data acquisition module, a time window association table generation module, a threat source event set generation module, a comprehensive threat score table generation module, a comprehensive situation score table generation module, a rule matching result table generation module and a threat level determination module;

[0192] The data acquisition module is used to acquire security events of the target device within a target time period, the device type of the target device, and the operating parameters of the target device;

[0193] The time window association table generation module is used to divide the time-related security events into the same time window association group according to the timestamps in the security events, obtain a plurality of time window association groups, and integrate all the time window association groups into a time window association table;

[0194] The threat source event set generation module is used to, for each of the time window association groups, take the security events connected through the same network endpoint in the time window association group as the same threat source event, and generate a threat source event set indicating the same threat source;

[0195] The comprehensive threat score table generation module is used to calculate the threat score of each security event in all threat source event sets and generate a comprehensive threat score table;

[0196] The comprehensive situational scoring table generation module is used to determine the situational score of each security event according to the timestamp in the security event, the device type and the operating condition parameter, and generate a comprehensive situational scoring table;

[0197] The rule matching result table generating module is used to call a preset threat event rule library to perform rule matching on each security event according to the security event, the comprehensive threat score table and the comprehensive situation score table, and generate a rule matching result table based on successfully matched security events and corresponding matching rules; wherein the threat event rule library includes matching rules for a number of threat events;

[0198] The threat level determination module is used to determine the threat level of each security event according to the time window association table, the comprehensive threat score table, the comprehensive situation score table and the rule matching result table.

[0199] See also Figure 3 ,In a preferred embodiment, the IoT device security event threat level assessment device further includes: a target device adjustment module;

[0200] The target device adjustment module is used to call a preset threat policy library for each security event according to the threat level of the security event to obtain a target threat policy that matches the threat level of the security event; and adjust the target device that executes the security event according to the target threat policy.

[0201] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for assessing the threat level of security incidents of IoT devices, characterized in that: include: Obtain security events of the target device within the target time period, the device type of the target device, and the operating parameters of the target device; According to the timestamps in the security events, the time-related security events are divided into the same time window association group to obtain a plurality of time window association groups, and all the time window association groups are integrated into a time window association table; For each of the time window association groups, taking security events connected through the same network endpoint in the time window association group as the same threat source event, and generating a threat source event set for indicating the same threat source; Calculate the threat score of each security event in all threat source event sets and generate a comprehensive threat score table; Determine the situation score of each security event according to the timestamp in the security event, the device type and the operating condition parameter, and generate a comprehensive situation score table; According to the security events, the comprehensive threat score table and the comprehensive situation score table, a preset threat event rule library is called to perform rule matching on each security event, and a rule matching result table is generated based on successfully matched security events and corresponding matching rules; wherein the threat event rule library includes matching rules for a number of threat events; The threat level of each security event is determined according to the time window association table, the comprehensive threat score table, the comprehensive situation score table and the rule matching result table.

2. The method for assessing the threat level of security incidents of IoT devices according to claim 1, characterized in that: The method further comprises dividing the time-related security events into the same time window association group according to the timestamps in the security events, obtaining a plurality of time window association groups, and integrating all the time window association groups into a time window association table, including: a timestamp identifying the security event; Based on the timestamps of the security events, the security events are sorted to obtain a security event sequence; Construct a sliding time window; wherein the window size of the sliding time window is T w ; T w is a positive integer; Initializing the sliding time window so that an initial position of the sliding time window coincides with an initial position of the security event sequence; Based on the sliding time window, traverse each security event in the security event sequence to obtain a plurality of time window association groups; wherein, each time the sliding time window completes a slide, the security events in the sliding time window are associated to generate a time window association group; All time window association groups are integrated into a time window association table.

3. The method for assessing the threat level of security incidents of IoT devices according to claim 1, characterized in that: Each of the security events contains a network endpoint connection information; the network endpoint connection information includes the event source IP address, the event target IP address, the event source port number and the event target port number; For each of the time window association groups, the security events connected through the same network endpoint in the time window association group are regarded as the same threat source events, and a threat source event set indicating the same threat source is generated, including: For each security event in each of the time window association groups, the network endpoint connection information of the current security event is matched with the network endpoint connection information of the remaining security events in the current time window association group; the security events that match the network endpoint connection information of the current security event are treated as the same threat source events, and the same threat source events are associated with the current security event to generate a threat source event set.

4. The method for assessing the threat level of security incidents of IoT devices according to claim 1, characterized in that: The calculation of the threat score of each security event in all threat source event sets to generate a comprehensive threat score table includes: For each security event in each threat source event set, calling a preset event type severity list, and determining an event severity score of the security event based on the event type of the security event; For the network endpoint connection information corresponding to each threat source event set, the number of historical event occurrences and the corresponding impact weight of the current network endpoint connection information are identified in a preset historical event database, and the historical record score of each security event in the threat source event set is determined based on the number of historical event occurrences and the impact weight; For each network endpoint connection information corresponding to a threat source event set, a threat index corresponding to the network endpoint connection information is identified in a preset threat intelligence database, and based on the threat index, a threat index of each security event in the threat source event set is determined; For each security event in each threat source event set, determine the relevance score of the security event according to the total number of security events associated in the time window association group where the security event is located; For each security event in each threat source event set, determine the threat score of the security event according to the event severity score, historical record score, threat index and relevance score corresponding to the security event; Generate a comprehensive threat score table based on the threat score of each security incident.

5. The method for assessing the threat level of security incidents of IoT devices according to claim 1, characterized in that: The operating condition parameters include: equipment deployment parameters and a set of historical equipment security events; The determining of the situation score of each security event according to the timestamp in the security event, the device type and the operating condition parameter, and generating a comprehensive situation score table includes: Determine the time context score of each security event based on the timestamp in each security event and the preset running time assignment table; For each of the security events, determining a device type of a target device executing the security event; determining a device type context score of the security event based on the device type and a preset device type assignment table; Determine the deployment scenario score of each security event according to the device deployment parameters and a preset device deployment environment assignment table; Determine, based on the device's historical security event set, a historical occurrence context score for each security event; For each of the security events, a context score of the security event is obtained by integrating the time context score, the device type context score, the deployment context score and the historical occurrence context score of the security event; The situational scores of each security incident are integrated into a comprehensive situational score table.

6. The method for assessing the threat level of security incidents of IoT devices according to claim 1, characterized in that: According to the security events, the comprehensive threat score table and the comprehensive situation score table, calling a preset threat event rule library to perform rule matching on each security event, and generating a rule matching result table based on successfully matched security events and corresponding matching rules, including: For each security event in the comprehensive threat score table, according to the security event, the threat score of the security event in the comprehensive threat score table, and the situation score of the security event in the comprehensive situation score table, each rule in the threat event rule base is matched one by one, and the successfully matched rule is associated with the security event to obtain the rule matching information of the security event; Generate a rule matching result table based on the rule matching information of each security event.

7. The method for assessing the threat level of security incidents of IoT devices according to claim 1, characterized in that: Also includes: For each of the security events, according to the threat level of the security event, a preset threat strategy library is called to obtain a target threat strategy that matches the threat level of the security event; According to the target threat policy, a target device for executing the security event is adjusted.

8. The method for assessing the threat level of security incidents of an Internet of Things device according to any one of claims 1 to 7, characterized in that: The event types of the security events include traffic logs, system logs, alarm events and file activities.

9. A device for assessing the threat level of security events of an Internet of Things device, characterized in that: include: Data acquisition module, time window association table generation module, threat source event set generation module, comprehensive threat score table generation module, comprehensive situation score table generation module, rule matching result table generation module and threat level determination module; The data acquisition module is used to acquire security events of the target device within a target time period, the device type of the target device, and the operating parameters of the target device; The time window association table generation module is used to divide the time-related security events into the same time window association group according to the timestamps in the security events, obtain a plurality of time window association groups, and integrate all the time window association groups into a time window association table; The threat source event set generation module is used to, for each of the time window association groups, take the security events connected through the same network endpoint in the time window association group as the same threat source event, and generate a threat source event set indicating the same threat source; The comprehensive threat score table generation module is used to calculate the threat score of each security event in all threat source event sets and generate a comprehensive threat score table; The comprehensive situational scoring table generation module is used to determine the situational score of each security event according to the timestamp in the security event, the device type and the operating condition parameter, and generate a comprehensive situational scoring table; The rule matching result table generating module is used to call a preset threat event rule library to perform rule matching on each security event according to the security event, the comprehensive threat score table and the comprehensive situation score table, and generate a rule matching result table based on successfully matched security events and corresponding matching rules; wherein the threat event rule library includes matching rules for a number of threat events; The threat level determination module is used to determine the threat level of each security event based on the time window association table, the comprehensive threat score table, the comprehensive situation score table and the rule matching result table.

10. The device for assessing the threat level of security events of an Internet of Things device according to claim 9, characterized in that: Also includes: Target device adjustment module; The target device adjustment module is used to call a preset threat policy library for each of the security events according to the threat level of the security event to obtain a target threat policy that matches the threat level of the security event; According to the target threat policy, a target device for executing the security event is adjusted.

Images