Entity portrait processing method, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides an entity portrait processing method, electronic equipment, a storage medium and a program product. The method comprises the following steps: acquiring different types of network data; performing feature extraction on the network data to obtain feature data corresponding to the network data; performing state analysis on the feature data by adopting a preset analysis algorithm, determining an association relationship between different types of network data, and determining risk information corresponding to the network data; according to risk information corresponding to a preset risk algorithm and the network data, determining a risk score corresponding to the risk information; and according to the feature data, the association relationship, the risk information and the risk score, the entity portrait corresponding to the network data is generated, which entity the threat comes from can be determined after the threat is detected, the entity with the threat is accurately determined, and the threat detection accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a method for processing entity portraits, electronic equipment, storage media, and program products. Background Art

[0002] With the continuous advancement of informatization, network information systems are becoming increasingly complex, posing new challenges to intranet security management. Internal personnel exploiting high-level privileges to conduct illegal operations can reduce the trustworthiness of intranet users and entities, potentially leading to data leaks. Furthermore, various network security threats, such as hacker attacks, malware, and viruses, have become the primary source of intranet security issues, threatening intranet security at any time and from any location. Therefore, strengthening intranet security management has become a crucial aspect of internal management.

[0003] To address these network security risks, UEBA (User and Entity Behavior Analytics) is being applied to network security systems. "UEBA" stands for User and Entity Behavior Analytics, a security analytics method designed to detect user and entity behaviors that pose a threat to enterprise information systems. It analyzes user and entity behavior patterns to identify potential security threats and anomalous activity. This approach combines user behavior analytics (WBA) and entity behavior analytics (EBA) to improve threat detection capabilities. After a threat is detected, it's difficult to pinpoint the source of the threat. Therefore, accurately identifying the threatening entity is a pressing issue. Summary of the Invention

[0004] The purpose of some embodiments of the present application is to provide a method for processing entity portraits, an electronic device, a storage medium and a program product. Through the technical solutions of the embodiments of the present application, different types of network data are obtained; wherein the different types of network data include at least user information, device information and business system information; feature extraction is performed on the network data to obtain feature data corresponding to the network data, wherein the feature data includes at least behavioral feature data, network feature data and resource usage feature data; a pre-set analysis algorithm is used to perform state analysis on the feature data, determine the correlation relationship between different types of network data, and determine the risk information corresponding to the network data; wherein the pre-set analysis algorithm includes at least an association analysis algorithm, a security anomaly analysis algorithm and a neural network model; according to the use of the preset risk algorithm and the network The risk information corresponding to the data is used to determine the risk score corresponding to the risk information; wherein, the preset risk algorithm includes at least an identity scoring algorithm and an asset scoring algorithm; according to the feature data, the association relationship, the risk information and the risk score, an entity portrait corresponding to the network data is generated, and a method for identifying potential security threats and abnormal activities based on UEBA technology is used to locate the data collected from different channels to a specific entity, and analyze the attributes and business of various objects, calculate the overall risk score of users, devices and business systems, and finally provide an analysis entry in the form of a risk ranking to solve the problem that after the threat is detected, potential security threats and abnormal activities cannot be identified from the perspective of users and entities. In this way, after the threat is detected, it can be determined which entity the threat comes from, accurately determine the entity where the threat exists, and improve the accuracy of threat detection.

[0005] In a first aspect, some embodiments of the present application provide a method for processing an entity portrait, including:

[0006] Acquire different types of network data; wherein the different types of network data include at least user information, device information and business system information;

[0007] Extracting features from the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes behavior feature data, network feature data, and resource usage feature data;

[0008] Using a pre-set analysis algorithm, perform state analysis on the feature data, determine the association relationship between different types of network data, and determine risk information corresponding to the network data; wherein the pre-set analysis algorithm includes at least an association analysis algorithm, a security anomaly analysis algorithm, and a neural network model;

[0009] Determining a risk score corresponding to the risk information based on a preset risk algorithm and the risk information corresponding to the network data; wherein the preset risk algorithm includes at least an identity scoring algorithm and an asset scoring algorithm;

[0010] An entity portrait corresponding to the network data is generated based on the feature data, the association relationship, the risk information and the risk score.

[0011] Some embodiments of the present application use a method for identifying potential security threats and abnormal activities based on UEBA technology to locate data collected from different channels to specific entities, analyze the attributes and services of various objects, calculate the overall risk scores of users, devices and business systems, and ultimately provide an analysis entry in the form of a risk ranking, thereby solving the problem of being unable to identify potential security threats and abnormal activities from the perspective of users and entities after the threat is detected. In this way, after the threat is detected, it is possible to determine which entity the threat comes from, accurately determine the entity where the threat exists, and improve the accuracy of threat detection.

[0012] Optionally, the different types of network data come from various types of security device logs, system logs, traffic data, and database access record data.

[0013] Some embodiments of the present application are implemented by a receiver through data collection. When adding a log source, it is necessary to set and select a specific receiver. The receiver management function realizes the setting of the data receiving method, which is used to connect to various security device logs, system logs, traffic data, and database access records to improve the accuracy of data processing.

[0014] Optionally, the method further includes:

[0015] The network data is analyzed using regular feature recognition and keyword feature recognition to obtain IP address information of various logs;

[0016] According to a pre-established geographic location database, the IP address information of the various logs is mapped into the geographic location database;

[0017] According to the network data, obtaining entity key fields;

[0018] Generate enriched fields according to the entity key fields;

[0019] Determine the entity tag category based on the preset organizational structure, business functions, and security policies;

[0020] According to the preset association rules, the IP address information of the various logs is associated with the entity tags.

[0021] Some embodiments of the present application adopt regular feature identification methods and keyword feature identification methods to increase IP address collection, geographic location mapping, entity-related key field enrichment, define entity tags, associate IP with tag content, and improve the accuracy of data processing.

[0022] Optionally, extracting features from the network data to obtain feature data corresponding to the network data includes:

[0023] A preset feature extraction algorithm is used to extract behavioral features, network features, and resource usage features from the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0024] In the embodiment of the present application, after the collected data is accessed and processed, a data basis is provided, and feature extraction is performed on the processed data, that is, behavioral features, network features, and resource usage features are extracted, and operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage are extracted.

[0025] Optionally, the using of a preset analysis algorithm to perform status analysis on the characteristic data, determine associations between different types of network data, and determine risk information corresponding to the network data, includes:

[0026] Analyzing the characteristic data using an association analysis algorithm to obtain association relationships between different characteristic data;

[0027] or

[0028] Performing an anomaly analysis on the characteristic data using a security anomaly analysis algorithm to obtain abnormal access information corresponding to the characteristic data;

[0029] or

[0030] A neural network model is used to identify the characteristic data and determine the threat risk type corresponding to the characteristic data.

[0031] Some embodiments of the present application are based on three advanced data analysis engine technologies: correlation analysis engine, security anomaly analysis engine and AI analysis engine, which can deeply explore the correlation relationship between different data in the internal network and discover potential threat clues.

[0032] Optionally, the adopting a security anomaly analysis algorithm to perform an anomaly analysis on the feature data to obtain abnormal access information corresponding to the feature data includes:

[0033] comparing the feature data with preset feature data in a preset feature database;

[0034] If the characteristic data matches the preset characteristic data, it is determined that the characteristic data is abnormal access information.

[0035] Optionally, the adopting a neural network model to identify the characteristic data and determine the threat risk type corresponding to the characteristic data includes:

[0036] A neural network model is used to identify the entity type of the feature data to obtain the user threat risk situation, the device threat risk situation and the business system threat risk situation.

[0037] In a second aspect, some embodiments of the present application provide a device for processing an entity portrait, including:

[0038] An acquisition module, configured to acquire different types of network data; wherein the different types of network data include at least user information, device information, and business system information;

[0039] an extraction module, configured to extract features from the network data to obtain feature data corresponding to the network data, wherein the feature data includes at least behavioral feature data, network feature data, and resource usage feature data;

[0040] an analysis module configured to perform a status analysis on the feature data using a pre-set analysis algorithm, determine associations between different types of network data, and determine risk information corresponding to the network data; wherein the pre-set analysis algorithm includes at least an association analysis algorithm, a security anomaly analysis algorithm, and a neural network model;

[0041] a risk module, configured to determine a risk score corresponding to the risk information based on a preset risk algorithm and the risk information corresponding to the network data; wherein the preset risk algorithm includes at least an identity scoring algorithm and an asset scoring algorithm;

[0042] A generation module is used to generate an entity portrait corresponding to the network data based on the feature data, the association relationship, the risk information and the risk score.

[0043] Some embodiments of the present application use a method for identifying potential security threats and abnormal activities based on UEBA technology to locate data collected from different channels to specific entities, analyze the attributes and services of various objects, calculate the overall risk scores of users, devices and business systems, and ultimately provide an analysis entry in the form of a risk ranking, thereby solving the problem of being unable to identify potential security threats and abnormal activities from the perspective of users and entities after the threat is detected. In this way, after the threat is detected, it is possible to determine which entity the threat comes from, accurately determine the entity where the threat exists, and improve the accuracy of threat detection.

[0044] Optionally, the different types of network data come from various types of security device logs, system logs, traffic data, and database access record data.

[0045] Some embodiments of the present application are implemented by a receiver through data collection. When adding a log source, it is necessary to set and select a specific receiver. The receiver management function realizes the setting of the data receiving method, which is used to connect to various security device logs, system logs, traffic data, and database access records to improve the accuracy of data processing.

[0046] Optionally, the acquisition module is used to:

[0047] The network data is analyzed using regular feature recognition and keyword feature recognition to obtain IP address information of various logs;

[0048] According to a pre-established geographic location database, the IP address information of the various logs is mapped into the geographic location database;

[0049] According to the network data, obtaining entity key fields;

[0050] Generate enriched fields according to the entity key fields;

[0051] Determine the entity tag category based on the preset organizational structure, business functions, and security policies;

[0052] According to the preset association rules, the IP address information of the various logs is associated with the entity tags.

[0053] Some embodiments of the present application adopt regular feature identification methods and keyword feature identification methods to increase IP address collection, geographic location mapping, entity-related key field enrichment, define entity tags, associate IP with tag content, and improve the accuracy of data processing.

[0054] Optionally, the extraction module is used to:

[0055] A preset feature extraction algorithm is used to extract behavioral features, network features, and resource usage features from the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0056] In the embodiment of the present application, after the collected data is accessed and processed, a data basis is provided, and feature extraction is performed on the processed data, that is, behavioral features, network features, and resource usage features are extracted, and operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage are extracted.

[0057] Optionally, the analysis module is used to:

[0058] Analyzing the characteristic data using an association analysis algorithm to obtain association relationships between different characteristic data;

[0059] or

[0060] Performing an anomaly analysis on the characteristic data using a security anomaly analysis algorithm to obtain abnormal access information corresponding to the characteristic data;

[0061] or

[0062] A neural network model is used to identify the characteristic data and determine the threat risk type corresponding to the characteristic data.

[0063] Some embodiments of the present application are based on three advanced data analysis engine technologies: correlation analysis engine, security anomaly analysis engine and AI analysis engine, which can deeply explore the correlation relationship between different data in the internal network and discover potential threat clues.

[0064] Optionally, the analysis module is used to:

[0065] comparing the feature data with preset feature data in a preset feature database;

[0066] If the characteristic data matches the preset characteristic data, it is determined that the characteristic data is abnormal access information.

[0067] Optionally, the analysis module is used to:

[0068] A neural network model is used to identify the entity type of the feature data to obtain the user threat risk situation, the device threat risk situation and the business system threat risk situation.

[0069] In a third aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the method for processing an entity portrait as described in any embodiment of the first aspect can be implemented.

[0070] In a fourth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the entity portrait processing method as described in any embodiment of the first aspect.

[0071] In a fifth aspect, some embodiments of the present application provide a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, it can implement the entity portrait processing method as described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the following is a brief introduction to the drawings required for use in some embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0073] Figure 1 A flowchart of a method for processing an entity portrait provided in an embodiment of the present application;

[0074] Figure 2 A flowchart of another entity portrait processing method provided in an embodiment of the present application;

[0075] Figure 3 A schematic diagram of the data collection process provided in the embodiment of the present application;

[0076] Figure 4 A schematic diagram of the data processing flow provided in the embodiment of the present application;

[0077] Figure 5 A schematic diagram of the process of constructing a portrait provided in an embodiment of the present application;

[0078] Figure 6 A schematic diagram of the structure of an entity portrait processing device provided in an embodiment of the present application;

[0079] Figure 7 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0080] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0081] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0082] With the continuous advancement of informatization, network information systems are becoming increasingly complex, posing new challenges to intranet security management. Internal personnel exploiting high-level privileges to conduct illegal operations can reduce the trustworthiness of intranet users and entities, potentially leading to data leaks. Furthermore, various network security threats, such as hacker attacks, malware, and viruses, have become the primary source of intranet security issues, threatening intranet security at any time and from any location. Therefore, strengthening intranet security management has become a crucial aspect of internal management.

[0083] To address these network security risks, UEBA is being applied to network security systems. "UEBA," which stands for User and Entity Behavior Analytics, is a security analytics approach designed to detect user and entity behaviors that pose threats to enterprise information systems. It analyzes user and entity behavior patterns to identify potential security threats and anomalous activity. This approach combines user behavior analytics (WBA) and entity behavior analytics (EBA) to improve threat detection capabilities. After a threat is detected, it is impossible to determine which entity the threat comes from. Therefore, how to accurately determine the entity that poses a threat is a problem that urgently needs to be solved. In view of this, some embodiments of the present application provide a method for processing entity portraits, which includes obtaining different types of network data; wherein different types of network data include at least user information, device information, and business system information; performing feature extraction on the network data to obtain feature data corresponding to the network data, wherein the feature data includes at least behavioral feature data, network feature data, and resource usage feature data; using a pre-set analysis algorithm to perform state analysis on the feature data, determine the correlation between different types of network data, and determine the risk information corresponding to the network data; wherein the pre-set analysis algorithm includes at least an association analysis algorithm, a security anomaly analysis algorithm, and a neural network model; based on Based on the risk information corresponding to the preset risk algorithm and network data, the risk score corresponding to the risk information is determined; wherein, the preset risk algorithm includes at least an identity scoring algorithm and an asset scoring algorithm; based on the characteristic data, correlation relationship, risk information and risk score, an entity portrait corresponding to the network data is generated, and based on UEBA technology, a method for identifying potential security threats and abnormal activities is used to locate the data collected from different channels to specific entities, and analyze the attributes and business of various objects, calculate the overall risk score of users, devices and business systems, and finally provide an analysis entry in the form of a risk ranking to solve the problem that after the threat is detected, it is impossible to identify potential security threats and abnormal activities from the perspective of users and entities. In this way, after the threat is detected, it is possible to determine which entity the threat comes from, accurately determine the entity where the threat exists, and improve the accuracy of threat detection.

[0084] like Figure 1 As shown, an embodiment of the present application provides a method for processing an entity portrait, the method comprising:

[0085] S101. Acquire different types of network data; wherein the different types of network data include at least user information, device information, and business system information;

[0086] Specifically, terminal devices acquire different types of network data, which comes from various security device logs, system logs, traffic data, and database access records. This network data includes information about various entities, such as user information, device information, and business system information. This network data is processed, for example, using two data category determination methods, regular features and keyword features, to process and parse the raw data, obtain IP addresses, geographic location mappings, enrich entity-related key fields, define entity tags, and associate IP addresses with entity tags. The data category storage policy is then set, including the physical storage partitioning policy, number of replicas, refresh interval, number of shards, and so on.

[0087] S102: Extract features from the network data to obtain feature data corresponding to the network data, wherein the feature data includes at least behavioral feature data, network feature data, and resource usage feature data;

[0088] Specifically, the terminal device performs feature extraction on the processed network data, that is, extracts behavioral features, network features, and resource usage features, and extracts operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0089] S103. Using a pre-set analysis algorithm, perform a state analysis on the feature data to determine the association between different types of network data and determine risk information corresponding to the network data; wherein the pre-set analysis algorithm includes at least an association analysis algorithm, a security anomaly analysis algorithm, and a neural network model;

[0090] Specifically, based on three advanced data analysis engine technologies: correlation analysis engine, security anomaly analysis engine, and AI analysis engine, terminal devices can deeply mine the correlation between different data in the internal network, that is, obtain the correlation between different types of network data, and then discover potential threat clues; based on the historical access and communication data of the internal network, self-learn to form a baseline and promptly discover abnormal access and communication in the internal network; by learning a large amount of historical data of the internal network to establish a predictive model, conduct in-depth intelligent mining and analysis of internal network security threats, and identify the threat risks of users, equipment and business systems.

[0091] S104. Determine a risk score corresponding to the risk information based on a preset risk algorithm and the risk information corresponding to the network data; wherein the preset risk algorithm includes at least an identity scoring algorithm and an asset scoring algorithm;

[0092] Specifically, after obtaining the risk information corresponding to the network data, the terminal device uses a preset risk algorithm to score the risk information, including using an identity scoring algorithm to calculate the risk information corresponding to the network data to obtain a risk score corresponding to the risk information; and also using an asset scoring algorithm to calculate the risk information corresponding to the network data to obtain a risk score corresponding to the risk information.

[0093] S105. Generate an entity portrait corresponding to the network data based on the feature data, association relationship, risk information and risk score.

[0094] Specifically, the terminal device obtains network feature data, correlation information between feature data, risk information of feature data, and risk scores, and generates entity profiles for different entities, such as user entity profiles, device entity profiles, and business system entity profiles. The resulting entity profiles can be used to determine whether network threats exist and locate risky entities.

[0095] Some embodiments of the present application use a method for identifying potential security threats and abnormal activities based on UEBA technology to locate data collected from different channels to specific entities, analyze the attributes and services of various objects, calculate the overall risk scores of users, devices and business systems, and ultimately provide an analysis entry in the form of a risk ranking, thereby solving the problem of being unable to identify potential security threats and abnormal activities from the perspective of users and entities after the threat is detected. In this way, after the threat is detected, it is possible to determine which entity the threat comes from, accurately determine the entity where the threat exists, and improve the accuracy of threat detection.

[0096] Another embodiment of the present application further supplements the entity portrait processing method provided in the above embodiment.

[0097] like Figure 2 As shown, the present invention provides a method for identifying potential security threats and abnormal activities, including the following five steps:

[0098] (1) Data collection;

[0099] (2) Feature extraction;

[0100] (3)Analysis engine;

[0101] (4) Risk score;

[0102] (5) Portrait construction.

[0103] Among them, the specific steps of "data collection" in step (1) data collection are: determining the data source, the specific data collection work is implemented by the receiver, when adding a log source, it is necessary to set and select a specific receiver, and the receiver management function realizes the setting of data receiving method, which is used to connect various security device logs, system logs, traffic data, and database access records. Figure 3 As shown, different types of network data come from various security device logs, system logs, traffic data, and database access record data.

[0104] Some embodiments of the present application are implemented by a receiver through data collection. When adding a log source, it is necessary to set and select a specific receiver. The receiver management function realizes the setting of the data receiving method, which is used to connect to various security device logs, system logs, traffic data, and database access records to improve the accuracy of data processing.

[0105] Optionally, the method further includes:

[0106] Adopting regular feature recognition and keyword feature recognition methods to analyze network data and obtain IP address information of various logs;

[0107] Specifically, regular expressions (often abbreviated as regex, regexp, or RE) are used to identify regular features. They are text patterns that include common characters (for example, letters from a to z) and special characters (called metacharacters). Regular expressions use a single string to describe and match a series of strings that match a specific syntactic rule. They are typically used to retrieve and replace text that matches a specific pattern (rule).

[0108] As another optional implementation method, the keyword feature identification method is to pre-set keywords and use the keywords to parse the network data to obtain the IP address information of various logs;

[0109] Based on the pre-established geographic location database, the IP address information of various logs is mapped to the geographic location database;

[0110] Get entity key fields based on network data;

[0111] Generate enriched fields based on entity key fields;

[0112] Specifically, through field extraction, data fields can be regularized and enriched.

[0113] The custom field extraction process should be performed during search time, which can give full play to the flexibility of read-time modeling. In rare cases, we need to extract and index custom fields when importing data. Data regularization: Extract fields and convert formats of semi-structured logs to obtain structured data to support subsequent analysis and calculation processes, such as key-value pair extraction, regular expression extraction, delimiter extraction, etc. Data enrichment: Fill in more data information through existing data content, such as enriching data fields through lookup tables. Data desensitization: Desensitize sensitive information such as passwords, mobile phone numbers, addresses, etc. contained in network data. Data filtering: Filter out key data and focus on analysis.

[0114] Determine the entity tag category based on the preset organizational structure, business functions, and security policies;

[0115] According to the preset association rules, the IP address information of various logs is associated with the entity tags.

[0116] Specifically, the specific steps of "data processing" described in step (1) data collection are: using two data category determination methods based on regular features and keyword features to process and parse the original data, collect IP address information from various types of collected logs, use a professional IP address geographic location database to map the collected IP addresses to geographic locations; extract direct or indirect key fields related to the entity from the log, such as user name, device ID, MAC address information, etc., and formulate rules to generate new enriched fields based on existing log fields; define the category of entity tags based on factors such as the company's organizational structure, business functions, and security policies, and associate IP addresses with entity tags by establishing association rules, as shown in the following example. Figure 4 shown.

[0117] Some embodiments of the present application adopt regular feature identification methods and keyword feature identification methods to increase IP address collection, geographic location mapping, entity-related key field enrichment, define entity tags, associate IP with tag content, and improve the accuracy of data processing.

[0118] Optionally, feature extraction is performed on the network data to obtain feature data corresponding to the network data, including:

[0119] A preset feature extraction algorithm is used to extract behavioral features, network features, and resource usage features from network data to obtain feature data corresponding to the network data. The feature data includes at least operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0120] In the embodiment of the present application, after the collected data is accessed and processed, a data basis is provided, and feature extraction is performed on the processed data, that is, behavioral features, network features, and resource usage features are extracted, and operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage are extracted.

[0121] Optionally, a pre-set analysis algorithm is used to perform status analysis on the characteristic data, determine the association relationship between different types of network data, and determine risk information corresponding to the network data, including:

[0122] Use association analysis algorithm to analyze feature data and obtain the association relationship between different feature data;

[0123] or

[0124] Use a security anomaly analysis algorithm to perform an anomaly analysis on the feature data to obtain abnormal access information corresponding to the feature data;

[0125] or

[0126] A neural network model is used to identify feature data and determine the threat risk type corresponding to the feature data.

[0127] Among them, the association analysis algorithm is the association relationship between pre-set features;

[0128] The security anomaly analysis algorithm is a pre-set feature database that compares the acquired feature data with the preset feature data in the database, and then conducts risk assessment on the feature data of the network data.

[0129] The neural network model can be a network based on deep learning, such as an artificial neural network algorithm or a random forest algorithm, etc., which is not specifically limited in this application. The neural network module is used to determine the threat risk type of network data.

[0130] Some embodiments of the present application are based on three advanced data analysis engine technologies: correlation analysis engine, security anomaly analysis engine and AI analysis engine, which can deeply explore the correlation relationship between different data in the internal network and discover potential threat clues.

[0131] Optionally, a security anomaly analysis algorithm is used to perform an anomaly analysis on the characteristic data to obtain abnormal access information corresponding to the characteristic data, including:

[0132] comparing the feature data with preset feature data in a preset feature database;

[0133] If the characteristic data matches the preset characteristic data, it is determined that the characteristic data is abnormal access information.

[0134] Optionally, a neural network model is used to identify the characteristic data to determine the threat risk type corresponding to the characteristic data, including:

[0135] A neural network model is used to identify entity types of feature data to obtain user threat risk conditions, device threat risk conditions, and business system threat risk conditions.

[0136] Specifically, the specific steps of "data management" in step (1) data collection are: setting the data category storage strategy, including physical storage partition strategy, number of copies, refresh time interval, number of shards, etc.

[0137] After the collected data is accessed and processed in step (1), it provides a data basis as input for step (2). Step (2) extracts behavioral features, network features, and resource usage features, and extracts operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0138] Step (3) The analysis engine is based on three advanced data analysis engine technologies: correlation analysis engine, security anomaly analysis engine and AI analysis engine. It can deeply mine the correlation relationship between different data in the internal network and then discover potential threat clues; it forms a baseline based on the historical access communication data of the internal network and timely discovers abnormal access communications in the internal network; it establishes a prediction model by learning a large amount of historical data of the internal network, conducts deep intelligent mining and analysis of internal network security threats, and identifies the threat risk situation of users, equipment and business systems.

[0139] Step (4) Risk Scoring: By using a scoring algorithm, an overall risk score is generated for users, devices, and business systems. The calculation is performed using a weighted scoring algorithm. The input data includes user authentication logs and user behavior logs related to users, network traffic monitoring data and device logs related to devices, and business system operation logs and system interface call records related to business systems. The weighted scoring algorithm assigns weights to different types of data features and determines the score based on their frequency and severity. At the same time, a combination of qualitative and quantitative methods is used to qualitatively classify different types of abnormal behaviors and assign corresponding risk level ranges. Quantitatively, the score is adjusted based on quantitative indicators such as the number and frequency of abnormal behaviors. Finally, the overall risk score of users, devices, and business systems is output, and an analysis entry is provided in the form of a risk ranking.

[0140] Step (5) Profile construction aggregates the feature extraction information from step (2) and locates entities such as users, devices, and business systems, aggregates anomalies and threat alerts in the internal network, associates risk scores, and constructs entity profiles, such as Figure 5 shown.

[0141] The present invention can be applied to quickly discover risks existing in entities such as internal users, equipment, and business systems.

[0142] This example uses UEBA technology to build an entity portrait analysis method for abnormal behavior. It describes the use of the business application optimization method proposed in this invention to conduct in-depth mining and analysis based on security equipment and traffic information in an intranet environment to analyze whether users have abnormal behavior.

[0143] According to the method described in detail in the present invention, the specific process is as follows:

[0144] Scores indicate the risk level of users and devices, locating activity data collected from various channels to specific entities. The data analysis engine uses entity-based correlation analysis and behavioral analysis based on individual history and group behavior deviations to identify and generate alerts. Profile analysis dynamically and periodically calculates the overall risk score of an entity, ultimately providing users with an analytical entry point in the form of a risk ranking.

[0145] 1. User portrait

[0146] User profiling enables information query on all users, risk scores, organizations, and groups. It supports analysis of user profiles, risk previews, user profiles, network activities, and communication relationships, and conducts risk analysis and threat discovery on user behaviors.

[0147] Risk preview uses time dimension to visualize abnormal events in charts, showing the time series distribution of alarm events in the recent historical period, and can analyze the correlation of detailed information of alarm events. It supports displaying the correlation relationship map of alarm events generated in the past 10 days and the same alarm events generated by other users.

[0148] User portraits display the user's behavioral profile within a certain time frame, support portrait analysis of user behavior, and display the commonly used resources involved in a graphical manner, including resource statistics of commonly used accounts, commonly used devices, and commonly used IP addresses; display active time, including monthly activity and 24-hour activity; display activity areas, including common activity geographic locations, common activity security domains, etc.; display email communications, including company mailboxes and non-company mailboxes, etc.; display internal resource usage, including resource operation sequences, business system resource operations, number of rows affected by database operations, number of file transfers, etc.; display daily activity status.

[0149] Based on the data obtained from the corresponding task training in the indicator engine, network activities provide an intuitive display of statistical data on users' network behaviors, including access domain names, application protocol usage, access to business systems, access to security domains, access to URLs, access to databases, access to device IPs / ports, etc. Through multi-dimensional portrait analysis of user network activities, administrators can easily supervise user network behavior.

[0150] 2. Device portrait

[0151] Device profiling queries information on all devices, observation tables, risk scores, organizations, and groups, including device risk score statistics, device IP, responsible person, affiliated organization, time period score curve, detailed information, observation table settings, etc.

[0152] The device overview uses a time dimension to visualize abnormal device events in a graphical form, showing the temporal distribution of alarm events in the most recent historical period in a timeline format. It can also perform correlation analysis on detailed alarm event information, displaying a correlation graph of alarm events generated in the past 10 days and the same alarm events generated by other devices.

[0153] Device profiling displays information on commonly used resources, including commonly accessed ports, browsers, accounts, deployed business systems, users, and IP addresses. It also displays the activity of active entities within the timeframe of daily activity and displays a 30-day traffic distribution chart. External connections include both active and passive. Active external connections include access to intranet IP addresses, business systems, databases, and security domains. Passive external connections include statistics on intranet source IP addresses, intranet access ports, and external source IP addresses.

[0154] 3. Business system portrait

[0155] Business system portraits provide information queries on all business systems, observation tables, risk scores, organizations, and business system types, including alarm count statistics, system name, device IP, affiliated organization, time period score curve, detailed information, observation table settings, etc.

[0156] The business system overview searches risk systems by organizational structure, business system type, and fuzzy search method, and filters by first-level event classification, including attacks, violations, and anomalies.

[0157] Operation and maintenance analysis displays user operation and maintenance analysis, newly discovered accounts, accounts that have undergone operation and maintenance activities in the past 7 days but have no history of operation and maintenance activities, and communication relationships with other business systems in the past 30 days. Dimensions include source business system name, server IP, client IP, protocol, and number of times.

[0158] The main technical effects of the present invention are as follows: abnormal user behavior threats are located at specific entities, forming multi-dimensional portraits of users, devices, and business systems; risk scores for users, devices, and business systems are dynamically generated over a long period of time and quantitatively displayed in the form of risk rankings.

[0159] This application focuses on discovering potential risks and conducting profiling analysis scenarios from the perspective of users and physical assets. After locating massive log data to specific entities, an overall risk score is generated for the internal entity through a risk scoring algorithm, and an analysis entry is provided in the form of a risk ranking to reflect the risk level and ranking, thereby achieving risk quantification and intuitively displaying the precise location and assessment of risks. Based on the three advanced data analysis engine technologies of the correlation analysis engine, security anomaly analysis engine, and AI analysis engine, the correlation between different data in the internal network is deeply mined to discover potential threat clues; based on the historical access communication data of the internal network, a baseline is formed by self-learning to promptly discover abnormal access communications in the internal network; by learning a large amount of historical data of the internal network and establishing a predictive model, internal network security threats are deeply and intelligently mined and analyzed to efficiently solve the problem of discovering and analyzing internal network security threats.

[0160] It should be noted that each implementable method in this embodiment can be implemented separately, or can be implemented in combination in any combination without conflict, and this application does not limit it.

[0161] Another embodiment of the present application provides an entity portrait processing device for executing the entity portrait processing method provided in the above embodiment.

[0162] like Figure 6 FIG. 6 is a schematic diagram of the structure of the entity portrait processing device provided in an embodiment of the present application. The entity portrait processing device includes an acquisition module 601, an extraction module 602, an analysis module 603, a risk module 604, and a generation module 605, wherein:

[0163] The acquisition module 601 is used to acquire different types of network data; wherein the different types of network data include at least user information, device information and business system information;

[0164] The extraction module 602 is used to extract features from the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes behavior feature data, network feature data and resource usage feature data;

[0165] The analysis module 603 is used to use a pre-set analysis algorithm to perform state analysis on the feature data, determine the association relationship between different types of network data, and determine the risk information corresponding to the network data; wherein the pre-set analysis algorithm includes at least an association analysis algorithm, a security anomaly analysis algorithm, and a neural network model;

[0166] The risk module 604 is used to determine a risk score corresponding to the risk information based on a preset risk algorithm and the risk information corresponding to the network data; wherein the preset risk algorithm includes at least an identity scoring algorithm and an asset scoring algorithm;

[0167] The generation module 605 is used to generate an entity portrait corresponding to the network data based on the feature data, association relationship, risk information and risk score.

[0168] Some embodiments of the present application use a method for identifying potential security threats and abnormal activities based on UEBA technology to locate data collected from different channels to specific entities, analyze the attributes and services of various objects, calculate the overall risk scores of users, devices and business systems, and ultimately provide an analysis entry in the form of a risk ranking, thereby solving the problem of being unable to identify potential security threats and abnormal activities from the perspective of users and entities after the threat is detected. In this way, after the threat is detected, it is possible to determine which entity the threat comes from, accurately determine the entity where the threat exists, and improve the accuracy of threat detection.

[0169] Regarding the device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method and will not be elaborated here.

[0170] Another embodiment of the present application further supplements the description of the entity portrait processing device provided in the above embodiment.

[0171] Optionally, different types of network data come from various security device logs, system logs, traffic data, and database access record data.

[0172] Some embodiments of the present application are implemented by a receiver through data collection. When adding a log source, it is necessary to set and select a specific receiver. The receiver management function realizes the setting of the data receiving method, which is used to connect to various security device logs, system logs, traffic data, and database access records to improve the accuracy of data processing.

[0173] Optionally, obtain a module for:

[0174] Adopting regular feature recognition and keyword feature recognition methods to analyze network data and obtain IP address information of various logs;

[0175] Based on the pre-established geographic location database, the IP address information of various logs is mapped to the geographic location database;

[0176] Get entity key fields based on network data;

[0177] Generate enriched fields based on entity key fields;

[0178] Determine the entity tag category based on the preset organizational structure, business functions, and security policies;

[0179] According to the preset association rules, the IP address information of various logs is associated with the entity tags.

[0180] Some embodiments of the present application adopt regular feature identification methods and keyword feature identification methods to increase IP address collection, geographic location mapping, entity-related key field enrichment, define entity tags, associate IP with tag content, and improve the accuracy of data processing.

[0181] Optionally, an extraction module is used to:

[0182] A preset feature extraction algorithm is used to extract behavioral features, network features, and resource usage features from network data to obtain feature data corresponding to the network data. The feature data includes at least operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0183] In the embodiment of the present application, after the collected data is accessed and processed, a data basis is provided, and feature extraction is performed on the processed data, that is, behavioral features, network features, and resource usage features are extracted, and operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage are extracted.

[0184] Optionally, the analysis module is configured to:

[0185] Use association analysis algorithm to analyze feature data and obtain the association relationship between different feature data;

[0186] or

[0187] Use a security anomaly analysis algorithm to perform an anomaly analysis on the feature data to obtain abnormal access information corresponding to the feature data;

[0188] or

[0189] A neural network model is used to identify feature data and determine the threat risk type corresponding to the feature data.

[0190] Some embodiments of the present application are based on three advanced data analysis engine technologies: correlation analysis engine, security anomaly analysis engine and AI analysis engine, which can deeply explore the correlation relationship between different data in the internal network and discover potential threat clues.

[0191] Optionally, the analysis module is configured to:

[0192] comparing the feature data with preset feature data in a preset feature database;

[0193] If the characteristic data matches the preset characteristic data, it is determined that the characteristic data is abnormal access information.

[0194] Optionally, the analysis module is configured to:

[0195] A neural network model is used to identify entity types of feature data to obtain user threat risk conditions, device threat risk conditions, and business system threat risk conditions.

[0196] Regarding the device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method and will not be elaborated here.

[0197] It should be noted that each implementable method in this embodiment can be implemented separately, or can be implemented in combination in any combination without conflict, and this application does not limit it.

[0198] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the operation of the method corresponding to any embodiment of the entity portrait processing method provided in the above embodiments can be implemented.

[0199] An embodiment of the present application also provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to the method of any embodiment of the entity portrait processing method provided in the above embodiments.

[0200] like Figure 7 As shown, some embodiments of the present application provide an electronic device 700, which includes: a memory 710, a processor 720, and a computer program stored in the memory 710 and executable on the processor 720, wherein the processor 720 reads the program from the memory 710 through the bus 730 and executes the program to implement a method of any embodiment of the entity portrait processing method as described above.

[0201] Processor 720 can process digital signals and can include various computing architectures, such as a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements a combination of multiple instruction sets. In some examples, processor 720 can be a microprocessor.

[0202] The memory 710 can be used to store instructions executed by the processor 720 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all functions of one or more modules described in the embodiments of this application. The processor 720 of the embodiment of the present disclosure can be used to execute the instructions in the memory 710 to implement the method shown above. The memory 710 includes dynamic random access memory, static random access memory, flash memory, optical storage, or other memory known to those skilled in the art.

[0203] The above are merely examples of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application. It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined or explained in subsequent figures.

[0204] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0205] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

Claims

1. A method for processing an entity portrait, characterized in that: The method comprises: Acquire different types of network data; wherein the different types of network data include at least user information, device information and business system information; Extracting features from the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes behavior feature data, network feature data, and resource usage feature data; Using a pre-set analysis algorithm, the state analysis of the characteristic data is performed to determine the association relationship between different types of network data, and to determine the risk information corresponding to the network data; wherein the pre-set analysis algorithm at least includes an association analysis algorithm, a security anomaly analysis algorithm and a neural network model; Determine a risk score corresponding to the risk information based on a preset risk algorithm and the risk information corresponding to the network data; wherein the preset risk algorithm includes at least an identity scoring algorithm and an asset scoring algorithm; An entity portrait corresponding to the network data is generated based on the feature data, the association relationship, the risk information and the risk score.

2. The method for processing entity portrait according to claim 1, characterized in that: The different types of network data come from various security device logs, system logs, traffic data and database access record data.

3. The method for processing entity portrait according to claim 2, characterized in that: The method further comprises: The network data is analyzed by using a regular feature identification method and a keyword feature identification method to obtain IP address information of various logs; According to a pre-established geographic location database, mapping the IP address information of the various logs into the geographic location database; According to the network data, obtaining entity key fields; Generate enriched fields according to the entity key fields; Determine the category of entity tags based on the preset organizational structure, business functions, and security policies; According to the preset association rules, the IP address information of the various logs is associated with the entity tag.

4. The method for processing entity portrait according to claim 1, characterized in that: The extracting features of the network data to obtain feature data corresponding to the network data includes: A preset feature extraction algorithm is used to extract behavioral features, network features, and resource usage features in the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

5. The method for processing entity portrait according to claim 1, characterized in that: The method of using a preset analysis algorithm to perform state analysis on the characteristic data, determining the association between different types of network data, and determining risk information corresponding to the network data includes: Analyzing the characteristic data by using an association analysis algorithm to obtain association relationships between different characteristic data; or Performing an abnormality analysis on the characteristic data using a security abnormality analysis algorithm to obtain abnormal access information corresponding to the characteristic data; or A neural network model is used to identify the characteristic data to determine the threat risk type corresponding to the characteristic data.

6. The method for processing entity portrait according to claim 5, characterized in that: The adopting a security anomaly analysis algorithm to perform an anomaly analysis on the feature data to obtain abnormal access information corresponding to the feature data includes: comparing the feature data with preset feature data in a preset feature database; If the characteristic data matches the preset characteristic data, it is determined that the characteristic data is abnormal access information.

7. The method for processing entity portrait according to claim 5, characterized in that: The adopting a neural network model to identify the characteristic data and determine the threat risk type corresponding to the characteristic data includes: A neural network model is used to identify the entity type of the feature data to obtain user threat risk conditions, device threat risk conditions and business system threat risk conditions.

8. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the entity portrait processing method described in any one of claims 1 to 7 when executing the program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the program is executed by a processor, the method for processing an entity portrait as described in any one of claims 1 to 7 can be implemented.

10. A computer program product, comprising a computer program, wherein: When the computer program is executed by a processor, it can implement the entity portrait processing method described in any one of claims 1 to 7.

Images