Network attack path surveying and mapping method and system, storage medium and equipment

Abstract

The invention provides a network attack path surveying and mapping method, which comprises the following steps of: collecting network information from each node of a server, and analyzing and processing the network information; judging attacked nodes of the server according to the analyzed and processed network information, and constructing a time list of the nodes of the server and a network flow connection graph between the nodes of the server; and in the constructed time list of the nodes of the server and the network flow connection graph between the nodes of the server, tagging attacked nodes in the nodes of the server, and drawing a network attack path graph. According to the method, the time sequence model is constructed by finding out the statistical characteristics and development regularity of the time sequence in the server node, comprehensive security analysis and efficient attack detection are provided, and an attack judgment function is extensible. And finally, the attack path is drawn into a visual result, so that security testers can quickly position and clean problems.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a network attack path mapping method, system, storage medium and device. Background Art

[0002] As global cyberspace conflicts continue to escalate and the complexity of cyber attacks aimed at stealing sensitive data and destroying critical information infrastructure continues to rise, advanced persistent threats, as one of the important means of cyber attacks, are a complex and persistent means of cyber attacks. This type of attack is characterized by strong concealment, long duration and great destructive power.

[0003] However, existing security technologies have the following problems: Network attack defense technology based on traffic analysis uses traffic as the data source and needs to be connected in parallel or in series to the network. When there is a lack of traffic monitoring equipment, it is difficult to obtain traffic data and cannot process encrypted traffic. The terminal server is a black box and cannot be deeply analyzed by the attacker's operations inside the terminal; security technology based on host protection and reinforcement takes a single host as the theme, and can implement host reinforcement, anti-virus, check system vulnerabilities and other protection measures, but it cannot be associated with other terminal nodes in the network, and the protection range is a single point; security equipment provides too much data, and extracting effective information from massive data centers for attack analysis requires high requirements for security operation and maintenance personnel; in production and office environments, there are often situations such as server sharing, and legitimate users will also introduce unsafe factors. Security equipment lacks protection effect for security risks introduced by legitimate users, such as weak password accounts. These make the security operation and management of servers very complicated. The above problems lead to the inability of security personnel to quickly collect effective information, accurately depict the attack path, determine the affected scope and what operations the attacker has done in the network when a network attack occurs. Secondly, it is difficult to discover security risks introduced by legitimate users during daily security operation and maintenance. Summary of the invention

[0004] In view of the shortcomings of the prior art, the present invention provides a network attack path mapping method, the method comprising:

[0005] Collect network information from each server node, and analyze and process the network information;

[0006] According to the analyzed and processed network information, the attacked server node is determined, and a time list of each server node and a network traffic connection diagram between each server node are constructed;

[0007] In the constructed time list of each server node and the network traffic connection diagram between each server node, mark the attacked nodes in each server node and draw a network attack path diagram.

[0008] Furthermore, the information includes: system logs, network traffic and process information.

[0009] Furthermore, the analyzing and processing of the network information includes: analyzing and processing the network traffic conditions between server nodes and analyzing and processing the node snapshots of the server nodes.

[0010] Furthermore, the network traffic between server nodes is analyzed and processed, including:

[0011] Use a two-dimensional matrix to analyze and process the network traffic between server nodes and create a list of network traffic between server nodes;

[0012] Based on the collected network information and the list of network traffic conditions between server nodes, a network traffic connection diagram between server nodes is drawn.

[0013] Furthermore, the node snapshot of the server node is analyzed and processed, including:

[0014] Select a server node as the troubleshooting point, take the troubleshooting point as the starting point, and trace back the node snapshot on the timeline of the current server node;

[0015] Use judgment functions to analyze node snapshots, determine whether the server node is attacked based on the analysis results, and build a server node time list;

[0016] According to the above judgment method, all server nodes are traversed, and the earliest attacked time node among all server nodes is selected as the attack starting point.

[0017] Furthermore, the analyzing the node snapshot by using the judgment function includes:

[0018] When the output value of the judgment function is true, the server node is marked as attacked;

[0019] When the output value of the judgment function is false, the loop is stopped, the current time node is recorded, and it is used as the earliest attack time of the current server node.

[0020] Furthermore, the drawing of the network attack path diagram includes:

[0021] In the network traffic connection diagram between server nodes, mark the attacked server node;

[0022] Delete the server nodes that have not been attacked in the network traffic connection diagram between server nodes, keep only the attacked server nodes, and construct the network traffic connection diagram of the attacked server nodes;

[0023] Based on the server node time list, draw a time connection diagram between the attacked server nodes;

[0024] Combine the network traffic connection diagram and time connection diagram of the attacked server node, and remove the time connections without traffic to draw a network attack path diagram.

[0025] A network attack path mapping system, the system comprising: a network information analysis and processing module, a list or connection diagram construction module and an attack path diagram drawing module;

[0026] The network information analysis and processing module is used to collect network information from each node of the server, and analyze and process the network information;

[0027] The list or connection diagram construction module determines the attacked node of the server according to the analyzed and processed network information, and constructs a time list of each node of the server and a network flow connection diagram between each node of the server;

[0028] The attack path diagram drawing module is used to mark the attacked nodes in each server node in the constructed server node time list and the network traffic connection diagram between each server node, and draw a network attack path diagram.

[0029] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, any of the method steps described above is implemented.

[0030] An electronic device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0031] Memory, used to store computer programs;

[0032] The processor is used to implement any of the above-mentioned method steps when executing the program stored in the memory.

[0033] Compared with the prior art, the present invention has the following advantages:

[0034] 1. The present invention proposes to find out the statistical characteristics and development regularity of the time series in the server node, build a time series model, provide comprehensive security analysis, efficient attack detection, and expandable attack judgment function. Finally, the attack path is drawn into a visual result so that security testers can quickly locate and clear problems.

[0035] 2. It reduces the technical difficulty in the process of security operation and maintenance, and makes it easy to understand the security status of the server during daily operation and maintenance, thereby improving server security.

[0036] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A schematic flow chart of a network attack path mapping method is shown.

[0039] Figure 2 A schematic diagram of a network attack path mapping system is shown.

[0040] Figure 3 A simulated attack path diagram in an embodiment of the present invention is shown.

[0041] Figure 4 A time sequence diagram of simulated attacks in an embodiment of the present invention is shown.

[0042] Figure 5 A server node time list in an embodiment of the present invention is shown.

[0043] Figure 6 A list of network traffic between server nodes in an embodiment of the present invention is shown.

[0044] Figure 7 A network traffic connection diagram between server nodes in an embodiment of the present invention is shown.

[0045] Figure 8 A network traffic connection diagram between annotated server nodes in an embodiment of the present invention is shown.

[0046] Fig. 9 A network traffic diagram of an attacked server node in an embodiment of the present invention is shown.

[0047] Fig.10 A time connection diagram between attacked server nodes in an embodiment of the present invention is shown.

[0048] Fig.11 A schematic diagram of a network attack path in an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] like Figure 1 As shown, a network attack path mapping method comprises the following steps:

[0051] S1. Collect information from each node of the monitored server, and analyze and process the collected information.

[0052] Optionally, the information includes system logs, network traffic, process information, etc.

[0053] S2. According to the analyzed and processed network information, determine the attacked node of the server, and build a time list of each node of the server and a network traffic connection diagram between each node of the server.

[0054] S2.1. By distributing and deploying each server node, marking them according to time, a time-series-based node snapshot is generated.

[0055] S2.2. Take snapshots of the target nodes periodically and connect them in series according to time to form a timeline for each node on the server.

[0056] S2.3. Analyze and process the network traffic between server nodes.

[0057] S2.3.1. Use a two-dimensional matrix to analyze and process the network traffic between server nodes and establish a list of network traffic between server nodes.

[0058] S2.3.2. Based on the information collected in step S1 and in combination with the established network traffic list between server nodes, draw a network traffic connection diagram between server nodes.

[0059] S2.4. Analyze and process the node snapshot of the server node.

[0060] S2.4.1. Select a server node as the troubleshooting point, take the troubleshooting point as the starting point, and trace back the node snapshot on the node timeline.

[0061] S2.4.2. Use the judgment function to determine whether the server node is attacked, and build a server node time list based on the judgment result.

[0062] Optionally, when the judgment function output value is true, the server node is marked as attacked;

[0063] When the output value of the judgment function is false, the loop is stopped, the current time node is recorded, and it is used as the earliest attack time of the current server node.

[0064] S2.4.3. According to the above judgment method, traverse all server nodes and select the earliest attacked time node among all server nodes as the attack starting point.

[0065] S3. Draw a network attack path map.

[0066] S3.1. In the network traffic connection diagram between server nodes, mark the attacked server node.

[0067] S3.2. Delete the server nodes that have not been attacked in the network traffic connection diagram between server nodes, retain only the attacked server nodes, and construct the network traffic connection diagram of the attacked server nodes.

[0068] S3.3. Draw a time connection diagram of the attacked server node based on the node timeline constructed in step S2.

[0069] S3.4. Combine the network traffic connection diagram and time connection diagram of the attacked server node, and remove the time connections without traffic to draw a network attack path diagram.

[0070] In another embodiment of the present invention, an example environment is established, which includes 9 server nodes, namely a1, a2, ..., a9, and a hacker is simulated to perform a penetration attack on the example environment.

[0071] Optionally, the attack path of the penetration attack is as follows Figure 3 and Figure 4 As shown in the figure, first attack the invaded node a2, then attack the node a6, use the node a6 as a shift to attack the nodes a3 and a7, and finally attack the node a4 from the node a7, and attack the node a8 from the node a3.

[0072] S1. Collect information of 9 server nodes during the attack process and form a node snapshot.

[0073] Optionally, during the attack, each node samples 10 snapshots, for a total of 90 snapshots.

[0074] S2. Analyze and process the collected information and construct the timeline of each server node.

[0075] S2.1. Analyze and process the node snapshots of the 9 server nodes through the judgment function, sort out and record the processing results, and establish a server node time list, such as Figure 5As shown, the node time represents the snapshot time, and the list content represents the judgment result output by the judgment function (0 represents no attack, and 1 represents compromised).

[0076] S2.2, analyze and process the network traffic between the 9 server nodes, organize and record the processing results, and establish a list of network traffic between server nodes, such as Figure 6 As shown; draw the network traffic connection diagram between server nodes, such as Figure 7 shown.

[0077] S2.3. Figure 5 The attacked server nodes shown in are marked in the network traffic connection diagram between server nodes, as shown in Figure 8 shown.

[0078] S3, such as Figure 9-11 As shown, in the network traffic connection diagram between server nodes, the server nodes that have not been attacked are deleted, and only the attacked server nodes are retained to construct the network traffic connection diagram of the attacked server nodes;

[0079] According to the node timeline constructed in step S2, a time connection diagram of the attacked server node is drawn;

[0080] Combine the network traffic connection diagram and time connection diagram of the attacked server node, and remove the time connections without traffic to draw a network attack path diagram.

[0081] like Figure 2 As shown, a network attack path mapping system includes: a network information analysis and processing module, a list or connection diagram construction module and an attack path diagram drawing module.

[0082] Optionally,

[0083] The network information analysis and processing module is used to collect network information from each node of the server and analyze and process the network information.

[0084] The list or connection diagram construction module determines the attacked node of the server based on the analyzed and processed network information, and constructs a time list of each server node and a network traffic connection diagram between each server node.

[0085] The attack path diagram drawing module is used to mark the attacked nodes in each server node in the constructed server node time list and the network traffic connection diagram between each server node, and draw a network attack path diagram.

[0086] Based on the above disclosed content, the present invention also provides an electronic device accordingly. The electronic device of an embodiment of the present invention includes at least one electrically connected processor and at least one storage medium, the storage medium is electrically connected to the processor, wherein the storage medium stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the method as described above.

[0087] Based on the same inventive concept, the present invention also provides a storage medium, which stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method as described above.

[0088] It should be noted that the electrical connection between the above-mentioned units does not necessarily mean the connection between lines. An indirect connection method can be applied to the embodiments of the present invention as long as the purpose of the present invention is achieved.

[0089] The above description and the accompanying drawings fully illustrate the embodiments of the present invention so that those skilled in the art can practice them. Other embodiments may include structural and other changes. The embodiments represent only possible variations. Unless explicitly required, individual components and functions are optional, and the order of operations may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. The embodiments of the present invention are not limited to the structures described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A network attack path mapping method, characterized in that: The method comprises, Collect network information from each server node, and analyze and process the network information; According to the analyzed and processed network information, the attacked server node is determined, and a time list of each server node and a network traffic connection diagram between each server node are constructed; In the constructed time list of each server node and the network traffic connection diagram between each server node, mark the attacked nodes in each server node and draw a network attack path diagram.

2. The network attack path mapping method according to claim 1, characterized in that: The information includes: system logs, network traffic and process information.

3. The network attack path mapping method according to claim 1, characterized in that: The analyzing and processing of the network information includes: analyzing and processing the network traffic conditions between server nodes and analyzing and processing the node snapshots of the server nodes.

4. The network attack path mapping method according to claim 3 is characterized in that: Analyze and process network traffic between server nodes, including: Use a two-dimensional matrix to analyze and process the network traffic between server nodes and create a list of network traffic between server nodes; Based on the collected network information and the list of network traffic conditions between server nodes, a network traffic connection diagram between server nodes is drawn.

5. The network attack path mapping method according to claim 3 is characterized in that: Analyze and process the node snapshots of server nodes, including: Select a server node as the troubleshooting point, take the troubleshooting point as the starting point, and trace back the node snapshot on the timeline of the current server node; Use judgment functions to analyze node snapshots, determine whether the server node is attacked based on the analysis results, and build a server node time list; According to the above judgment method, all server nodes are traversed, and the earliest attacked time node among all server nodes is selected as the attack starting point.

6. The network attack path mapping method according to claim 5, characterized in that: The step of analyzing the node snapshot using the judgment function includes: When the output value of the judgment function is true, the server node is marked as attacked; When the output value of the judgment function is false, the loop is stopped, the current time node is recorded, and it is used as the earliest attack time of the current server node.

7. The network attack path mapping method according to claim 1, characterized in that: The drawing of the network attack path diagram includes: In the network traffic connection diagram between server nodes, mark the attacked server node; Delete the server nodes that have not been attacked in the network traffic connection diagram between server nodes, keep only the attacked server nodes, and construct the network traffic connection diagram of the attacked server nodes; Based on the server node time list, draw a time connection diagram between the attacked server nodes; Combine the network traffic connection diagram and time connection diagram of the attacked server node, and remove the time connections without traffic to draw a network attack path diagram.

8. A network attack path mapping system, characterized in that: The system comprises: a network information analysis and processing module, a list or connection diagram construction module and an attack path diagram drawing module; The network information analysis and processing module is used to collect network information from each node of the server, and analyze and process the network information; The list or connection diagram construction module determines the attacked node of the server according to the analyzed and processed network information, and constructs a time list of each node of the server and a network flow connection diagram between each node of the server; The attack path diagram drawing module is used to mark the attacked nodes in each server node in the constructed server node time list and the network traffic connection diagram between each server node, and draw a network attack path diagram.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 6 are implemented.

10. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 6 when executing a program stored in a memory.

Images