A cyber attack path mapping method, system, storage medium and device

Abstract

The application provides a network attack path mapping method, which comprises collecting network information from each node of a server, and analyzing and processing the network information; judging the attacked node of the server according to the analyzed and processed network information, and constructing a time list of each node of the server and a network traffic connection diagram between each node of the server; marking the attacked node in each node of the server in the constructed time list of each node of the server and the network traffic connection diagram between each node of the server, and drawing a network attack path diagram. The application finds out the statistical characteristics and development regularity of the time sequence of the server nodes, constructs a time sequence model, provides comprehensive security analysis and efficient attack detection, and the attack judgment function is extensible. Finally, the attack path is drawn into a visual result so as to quickly locate and clean up problems by a security tester.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and particularly relates to a network attack path mapping method and system, a storage medium and equipment. BACKGROUND

[0002] In the context of the continuous escalation of global cyberspace conflicts, the complexity of network attacks aimed at stealing sensitive data and destroying critical information infrastructure continues to rise. As one of the important means of network attacks, advanced persistent threats are a complex and persistent network attack method. This attack method has the characteristics of strong concealment, long duration and great destructive power.

[0003] However, the existing security technology has the following problems: the network attack defense technology based on traffic analysis takes traffic as the data source, and needs to be connected in parallel or in series to the network. When there is a lack of traffic monitoring equipment, it is difficult to obtain traffic data, and encrypted traffic cannot be processed. The terminal server is a black box, and the operations performed by the attacker inside the terminal cannot be analyzed in depth. The security technology based on host protection and reinforcement takes a single host as the theme, and can implement host reinforcement, antivirus, system vulnerability checking and other protection measures, but cannot be associated with other terminal nodes in the network, and the protection range is single-point. The data provided by the security device is too much, and it is difficult for security operation and maintenance personnel to extract effective information from the mass data center for attack analysis. In production and office environments, there are often situations such as server sharing, and legitimate users may also introduce security risks. The security device lacks protection effect for security risks introduced by legitimate users, such as weak password accounts. These make the security operation and management of servers very complex. The above problems result in that when a network attack occurs, security personnel cannot quickly collect effective information, accurately depict the attack path, determine the affected range, and determine what operations the attacker has performed in the network. Secondly, it is difficult to find security risks introduced by legitimate users in the daily security operation process. SUMMARY

[0004] The present application provides a network attack path mapping method, which comprises,

[0005] Collecting network information from each node of the server, and analyzing and processing the network information;

[0006] According to the analyzed and processed network information, determining the attacked node of the server, and constructing a server node time list and a network traffic connection diagram between each node of the server;

[0007] In the constructed server node time list and network traffic connection diagram between each node of the server, mark the attacked node in each node of the server, and draw a network attack path diagram.

[0008] Further, the information includes: system logs, network traffic and process information.

[0009] Further, the analyzing and processing the network information includes: analyzing and processing network traffic between server nodes and analyzing and processing node snapshots of the server nodes.

[0010] Further, the analyzing and processing network traffic between server nodes includes:

[0011] using a two-dimensional matrix to analyze and process network traffic between server nodes, and establishing a network traffic between server nodes list;

[0012] According to the collected network information, combined with the network traffic between server nodes list, a network traffic between server nodes connection diagram is drawn.

[0013] Further, the analyzing and processing node snapshots of the server nodes includes:

[0014] Select a certain server node as a troubleshooting point, and backtrack the node snapshots on the current server node timeline from the troubleshooting point as the starting point;

[0015] Using a judgment function to analyze the node snapshots, determining whether the server node is attacked according to the analysis result, and constructing a server node time list;

[0016] According to the above judgment method, traverse all server nodes, and select the earliest attacked time node in all server nodes as the attack starting point.

[0017] Further, the using a judgment function to analyze the node snapshots includes:

[0018] When the output value of the judgment function is true, mark the server node as attacked;

[0019] When the output value of the judgment function is false, stop the loop, record the current time node, and take it as the earliest attack time of the current server node.

[0020] Further, the drawing a network attack path diagram includes:

[0021] In the network traffic between server nodes connection diagram, mark the attacked server nodes;

[0022] Delete the server nodes in the network traffic between server nodes connection diagram that are not attacked, only keep the attacked server nodes, and construct an attacked server node network traffic connection diagram;

[0023] Based on the server node time list, draw a time connection diagram between the attacked server nodes;

[0024] Combine the network traffic connection diagram and time connection diagram of the attacked server node, and remove the time connections without traffic to draw a network attack path diagram.

[0025] A network attack path mapping system, comprising: a network information analysis and processing module, a list or connection diagram construction module, and an attack path diagram drawing module;

[0026] The network information analysis and processing module is used to collect network information from each server node and analyze and process the network information;

[0027] The list or connection diagram construction module determines the attacked node of the server based on the analyzed and processed network information, and constructs a time list of each server node and a network traffic connection diagram between each server node;

[0028] The attack path diagram drawing module is used to mark the attacked nodes in each server node in the constructed server node time list and the network traffic connection diagram between each server node, and draw a network attack path diagram.

[0029] A computer-readable storage medium stores a computer program, wherein the computer program implements any of the above-mentioned method steps when executed by a processor.

[0030] An electronic device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0031] Memory for storing computer programs;

[0032] The processor is configured to implement any of the above-described method steps when executing a program stored in the memory.

[0033] Compared with the prior art, the present invention has the following advantages:

[0034] 1. This invention proposes to construct a time series model by identifying the statistical characteristics and development regularities of time series in server nodes. This model provides comprehensive security analysis, efficient attack detection, and scalable attack judgment functions. Ultimately, the attack path is visualized to enable security testers to quickly locate and resolve issues.

[0035] 2. It reduces the technical difficulty in the process of security operation and maintenance, and makes it easy to understand the security status of the server during daily operation and maintenance, thereby improving server security.

[0036] Other features and advantages of the present application will be set forth in the descriptions that follow, and in part will be apparent from the description, or can be learned by practice of the application. The purposes and other advantages of the present application will be realized and attained by the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0038] Figure 1 A network attack path mapping method flow chart is shown.

[0039] Figure 2 A network attack path mapping system schematic diagram is shown.

[0040] Figure 3 An attack path simulation diagram in the embodiment of the present application is shown.

[0041] Figure 4 An attack time sequence diagram in the embodiment of the present application is shown.

[0042] Figure 5 A server node time list in the embodiment of the present application is shown.

[0043] Figure 6 A network flow list between server nodes in the embodiment of the present application is shown.

[0044] Figure 7 A network flow connection diagram between server nodes in the embodiment of the present application is shown.

[0045] Figure 8 A network flow connection diagram between server nodes in the embodiment of the present application is shown.

[0046] Figure 9 An attacked server node network flow diagram in the embodiment of the present application is shown.

[0047] Figure 10 A time connection diagram between attacked server nodes in the embodiment of the present application is shown.

[0048] Figure 11 A network attack path schematic diagram in the embodiment of the present application is shown. DETAILED DESCRIPTION

[0049] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0050] As shown in Figure 1 A network attack path mapping method, the steps of which include:

[0051] S1, collecting information from monitored server nodes, and analyzing and processing the collected information,

[0052] Optionally, the information includes system logs, network traffic and process information, etc.

[0053] S2, judging the attacked nodes of the server according to the analyzed and processed network information, and constructing a server node time list and a network traffic connection diagram between server nodes.

[0054] S2.1, generating a time-based node snapshot by distributing the server nodes and marking them according to time.

[0055] S2.2, periodically taking snapshots of the target nodes and concatenating them according to time to form a server node timeline.

[0056] S2.3, analyzing and processing the network traffic between server nodes.

[0057] S2.3.1, using a two-dimensional matrix to analyze and process the network traffic between server nodes, and establishing a network traffic list between server nodes.

[0058] S2.3.2, according to the information collected in step S1, combining the established network traffic list between server nodes, and drawing a network traffic connection diagram between server nodes.

[0059] S2.4, analyzing and processing the node snapshot of the server node.

[0060] S2.4.1, selecting a certain server node as a point of investigation, and backtracking the node snapshot on the node timeline from the point of investigation as the starting point.

[0061] S2.4.2, determining whether the server node is attacked by using a judgment function, and constructing a server node time list according to the judgment result.

[0062] Optionally, when the output value of the judgment function is true, the server node is marked as attacked.

[0063] When the output value of the judgment function is false, the loop is stopped, the current time node is recorded, and it is used as the earliest attack time of the current server node.

[0064] S2.4.3. According to the above judgment method, traverse all server nodes and select the earliest attacked time node among all server nodes as the attack starting point.

[0065] S3. Draw a network attack path map.

[0066] S3.1. In the network traffic connection diagram between server nodes, mark the attacked server node.

[0067] S3.2. Delete the server nodes that have not been attacked in the network traffic connection diagram between server nodes, retain only the attacked server nodes, and construct a network traffic connection diagram for the attacked server nodes.

[0068] S3.3. Based on the node timeline constructed in step S2, draw a time connection diagram of the attacked server node.

[0069] S3.4. Combine the network traffic connection diagram and time connection diagram of the attacked server node, and remove the time connections without traffic to draw a network attack path diagram.

[0070] In another embodiment of the present invention, an example environment is established, which includes 9 server nodes, namely a1, a2, ..., a9, and a hacker is simulated to perform a penetration attack on the example environment.

[0071] Optionally, the attack path of the penetration attack is as follows Figure 3 and Figure 4 As shown in the figure, the attack first attacks node a2, then node a6, and then uses node a6 as a switch to attack nodes a3 and a7. Finally, node a7 attacks node a4, and node a3 attacks node a8.

[0072] S1. Collect information about 9 server nodes during the attack process and form a node snapshot.

[0073] Optionally, during the attack, each node samples 10 snapshots, for a total of 90 snapshots.

[0074] S2. Analyze and process the collected information and construct the timeline of each server node.

[0075] S2.1, analyze and process the node snapshots of the 9 server nodes through the judgment function, organize and record the processing results, and establish a server node time list, such as Figure 5As shown, the node time represents the snapshot time, and the list content represents the judgment result output by the judgment function (0 represents no attack, and 1 represents compromised).

[0076] S2.2, analyze and process the network traffic between the 9 server nodes, organize and record the processing results, and establish a list of network traffic between server nodes, such as Figure 6 As shown; draw the network traffic connection diagram between server nodes, such as Figure 7 shown.

[0077] S2.3, Figure 5 The attacked server nodes shown in are marked in the network traffic connection diagram between server nodes, as shown in Figure 8 shown.

[0078] S3, such as Figures 9-11 As shown, in the network traffic connection diagram between server nodes, the server nodes that have not been attacked are deleted, and only the attacked server nodes are retained to construct the network traffic connection diagram of the attacked server nodes;

[0079] Based on the node timeline constructed in step S2, a time connection diagram of the attacked server node is drawn;

[0080] Combine the network traffic connection diagram and time connection diagram of the attacked server node, and remove the time connections without traffic to draw a network attack path diagram.

[0081] like Figure 2 As shown, a network attack path mapping system includes: a network information analysis and processing module, a list or connection diagram construction module and an attack path diagram drawing module.

[0082] Optionally,

[0083] The network information analysis and processing module is used to collect network information from each server node and analyze and process the network information.

[0084] The list or connection diagram construction module determines the attacked node of the server based on the analyzed and processed network information, and constructs a time list of each server node and a network traffic connection diagram between each server node.

[0085] The attack path diagram drawing module is used to mark the attacked nodes in each server node in the constructed server node time list and the network traffic connection diagram between each server node, and draw a network attack path diagram.

[0086] Based on the above disclosure, the present application also provides an electronic device accordingly. The electronic device of the present application comprises at least one processor and at least one storage medium electrically connected with the processor, wherein the storage medium stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method as described above.

[0087] Based on the same inventive concept, the present application also provides a storage medium storing instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method as described above.

[0088] It should be noted that the electrical connection between the above-mentioned various units does not necessarily mean the connection between the lines, and the indirect connection mode can also be applied to the embodiments of the present application as long as the purpose of the present application is achieved.

[0089] The above description and drawings sufficiently illustrate the embodiments of the present application to enable one skilled in the art to practice them. Other embodiments can include structural and other changes. The embodiments are merely representative of the possible variations. Individual components and functions are optional unless explicitly required, and the order of operations can be changed. Parts and features of some embodiments can be included in or replace parts and features of other embodiments. The embodiments of the present application are not limited to the structures described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A network attack path mapping method, characterized in that: The method comprises, Collecting network information from each server node, and analyzing and processing the network information; Based on the analyzed and processed network information, the server node that was attacked is determined, and a time list of each server node and a network traffic connection diagram between each server node are constructed; In the constructed server node time list and the network traffic connection diagram between the server nodes, mark the attacked nodes in each server node and draw a network attack path diagram; Drawing a network attack path diagram includes: In the network traffic connection diagram between server nodes, mark the attacked server node; Delete the server nodes that have not been attacked in the network traffic connection diagram between server nodes, retain only the attacked server nodes, and construct the network traffic connection diagram of the attacked server nodes; Based on the server node time list, draw a time connection diagram between the attacked server nodes; Combine the network traffic connection diagram and time connection diagram of the attacked server node, and remove the time connections without traffic to draw a network attack path diagram.

2. The network attack path mapping method according to claim 1, characterized in that: The information includes: system logs, network traffic and process information.

3. The network attack path mapping method according to claim 1, characterized in that: The analyzing and processing of the network information includes: analyzing and processing the network traffic situation between server nodes and analyzing and processing the node snapshots of the server nodes.

4. The network attack path mapping method according to claim 3, characterized in that: Analyze and process network traffic between server nodes, including: Use a two-dimensional matrix to analyze and process the network traffic between server nodes and create a list of network traffic between server nodes; Based on the collected network information and the list of network traffic conditions between server nodes, a network traffic connection diagram between server nodes is drawn.

5. The network attack path mapping method according to claim 3, characterized in that: Analyze and process the node snapshot of the server node, including: Select a server node as the troubleshooting point, use the troubleshooting point as the starting point, and trace back the node snapshot on the current server node timeline; Use the judgment function to analyze the node snapshot, determine whether the server node is attacked based on the analysis results, and build a server node time list; According to the above judgment method, all server nodes are traversed, and the earliest attacked time node among all server nodes is selected as the attack starting point.

6. The network attack path mapping method according to claim 5, characterized in that: The use of a judgment function to analyze a node snapshot includes: When the output value of the judgment function is true, the server node is marked as attacked; When the output value of the judgment function is false, the loop is stopped, the current time node is recorded, and it is used as the earliest attack time of the current server node.

7. A network attack path mapping system, characterized in that: Using the method of claim 1, the system comprises: a network information analysis and processing module, a list or connection diagram construction module, and an attack path diagram drawing module; The network information analysis and processing module is used to collect network information from each server node and analyze and process the network information; The list or connection diagram construction module determines the attacked node of the server based on the analyzed and processed network information, and constructs a time list of each server node and a network traffic connection diagram between each server node; The attack path diagram drawing module is used to mark the attacked nodes in each server node in the constructed server node time list and the network traffic connection diagram between each server node, and draw a network attack path diagram.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of any one of claims 1 to 6 are implemented.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory for storing computer programs; A processor, configured to implement the method steps described in any one of claims 1 to 6 when executing a program stored in a memory.

Images