Entity image processing method, electronic device, storage medium, and program product

Abstract

Embodiments of the present application provide a kind of entity portrait processing method, electronic equipment, storage medium and program product, the method comprises: obtaining different types of network data;Feature extraction is carried out to network data, and the feature data corresponding to network data is obtained;Using pre-set analysis algorithm, the state analysis is carried out to feature data, the association between different types of network data is determined, and the risk information corresponding to network data is determined;According to the risk score corresponding to risk information using pre-set risk algorithm and network data, the risk score corresponding to risk information is determined;According to feature data, association, risk information and risk score, the entity portrait corresponding to network data is generated, can determine the threat is from which entity after detecting threat, accurately determine the entity that exists threat, improve the accuracy of threat detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an entity portrait processing method, an electronic device, a storage medium and a program product. BACKGROUND

[0002] With the continuous advancement of informatization construction, network information systems are increasingly complex, bringing new challenges to internal network security management. Internal personnel use high-level permissions to operate irregularly, which reduces the credibility of internal network users and entities, and may lead to data leakage. At the same time, hacker attacks, malicious software, viruses and other network security threats have become the main source of internal network security problems, which threaten the security of the internal network at any time and anywhere. Therefore, strengthening internal network security management has become an important part of internal management.

[0003] In order to solve the above network security problems, UEBA is applied to the network security system. UEBA refers to User and Entity Behavior Analytics, which is a security analysis method aimed at detecting user and entity behaviors that pose a threat to enterprise information systems. It analyzes user and entity behavior patterns to identify potential security threats and abnormal activities. This method combines user behavior analysis (WBA) and entity behavior analysis (EBA) to improve threat detection capabilities. After detecting threats, it is difficult to determine which entity the threat comes from. Therefore, how to accurately determine the entity that poses a threat is a problem that needs to be solved urgently. SUMMARY

[0004] Some embodiments of the present application aim to provide an entity portrait processing method, electronic equipment, storage medium and program product. Through the technical solutions of the embodiments of the present application, different types of network data are obtained, wherein the different types of network data at least include user information, device information and business system information. Feature extraction is performed on the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes behavior feature data, network feature data and resource usage feature data. A pre-set analysis algorithm is used to perform state analysis on the feature data, determine the association relationship between different types of network data, and determine risk information corresponding to the network data. The pre-set analysis algorithm at least includes an association analysis algorithm, a security anomaly analysis algorithm and a neural network model. According to the pre-set risk algorithm and the risk information corresponding to the network data, a risk score corresponding to the risk information is determined. The pre-set risk algorithm at least includes an identity score algorithm and an asset score algorithm. According to the feature data, the association relationship, the risk information and the risk score, an entity portrait corresponding to the network data is generated. Based on the UEBA technology, a method for identifying potential security threats and abnormal activities is provided. The data collected from different channels is located to specific entities, and the attributes and businesses of various objects are analyzed to calculate the overall risk score of users, devices and business systems. Finally, an analysis portal in the form of risk ranking is provided to solve the problem that after a threat is detected, potential security threats and abnormal activities cannot be identified from the user and entity perspectives. In this way, after a threat is detected, it can be determined which entity the threat comes from, the entity with the threat is accurately determined, and the accuracy of threat detection is improved.

[0005] In a first aspect, some embodiments of the present application provide an entity portrait processing method, comprising:

[0006] Different types of network data are obtained, wherein the different types of network data at least include user information, device information and business system information.

[0007] Feature extraction is performed on the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes behavior feature data, network feature data and resource usage feature data.

[0008] A pre-set analysis algorithm is used to perform state analysis on the feature data, determine the association relationship between different types of network data, and determine risk information corresponding to the network data. The pre-set analysis algorithm at least includes an association analysis algorithm, a security anomaly analysis algorithm and a neural network model.

[0009] According to the preset risk algorithm and the risk information corresponding to the network data, a risk score corresponding to the risk information is determined; wherein the preset risk algorithm at least includes an identity score algorithm and an asset score algorithm;

[0010] According to the feature data, the correlation relationship, the risk information and the risk score, an entity portrait corresponding to the network data is generated.

[0011] Some embodiments of the present application solve the problem that after a threat is detected, potential security threats and abnormal activities cannot be identified from the perspective of users and entities by identifying potential security threats and abnormal activities based on UEBA technology, positioning data collected from different channels to specific entities, analyzing the attributes and businesses of various objects, calculating the overall risk score of users, devices and business systems, and finally providing an analysis entry in the form of risk ranking.

[0012] Optionally, the different types of network data come from various security device logs, system logs, traffic data and database access record data.

[0013] Some embodiments of the present application implement data collection by receivers, and when adding a log source, a specific receiver needs to be set. The receiver management function realizes the setting of data receiving mode, which is used to connect various security device logs, system logs, traffic data and database access records, and improves the accuracy of data processing.

[0014] Optionally, the method further comprises:

[0015] The network data is parsed using a regular feature discrimination method and a keyword feature discrimination method to obtain IP address information of various logs;

[0016] According to a pre-established geographic location database, the IP address information of the various logs is mapped into the geographic location database;

[0017] According to the network data, an entity key field is obtained;

[0018] According to the entity key field, a rich field is generated;

[0019] According to a preset organizational structure, business function and security policy, the category of an entity label is determined;

[0020] According to a preset association rule, the IP address information of the various logs is associated with the entity label.

[0021] Some embodiments of the application adopt a regular feature discrimination mode and a keyword feature discrimination mode, increase IP address collection, geographical location mapping, entity-related key field enrichment, define entity labels, associate IP with labels, and improve the accuracy of data processing.

[0022] Optionally, the feature extraction on the network data to obtain the feature data corresponding to the network data comprises:

[0023] The behavior features, network features, and resource usage features in the network data are extracted by using a preset feature extraction algorithm to obtain the feature data corresponding to the network data, wherein the feature data at least includes operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0024] In the embodiments of the application, after the collected data is processed, data basis is provided, and the processed data is feature-extracted, i.e., the behavior features, network features, and resource usage features are extracted to obtain operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0025] Optionally, the state analysis on the feature data by using a preset analysis algorithm to determine the association relationship between different types of network data and determine the risk information corresponding to the network data comprises:

[0026] The feature data is analyzed by using an association analysis algorithm to obtain the association relationship between different feature data;

[0027] Or

[0028] The feature data is analyzed by using a security anomaly analysis algorithm to obtain the abnormal access information corresponding to the feature data;

[0029] Or

[0030] The feature data is identified by using a neural network model to determine the threat risk type corresponding to the feature data.

[0031] Some embodiments of the application are based on three advanced data analysis engine technologies, i.e., an association analysis engine, a security anomaly analysis engine, and an AI analysis engine, which can deeply mine the association relationship between different data in the internal network and further discover potential threat clues.

[0032] Optionally, the abnormal analysis on the feature data by using a security anomaly analysis algorithm to obtain the abnormal access information corresponding to the feature data comprises:

[0033] The feature data is compared with the preset feature data in the preset feature database;

[0034] If the feature data matches the preset feature data, the feature data is determined to be abnormal access information.

[0035] Optionally, the step of using a neural network model to identify the feature data and determine the threat risk type corresponding to the feature data includes:

[0036] A neural network model is used to identify entity types from the feature data, thereby obtaining information on user threat risk, device threat risk, and business system threat risk.

[0037] Secondly, some embodiments of this application provide a processing apparatus for entity images, including:

[0038] The acquisition module is used to acquire different types of network data; wherein, the different types of network data include at least user information, device information, and business system information;

[0039] An extraction module is used to extract features from the network data to obtain feature data corresponding to the network data, wherein the feature data includes at least behavioral feature data, network feature data, and resource usage feature data;

[0040] The analysis module is used to perform state analysis on the feature data using a pre-set analysis algorithm, determine the correlation between different types of network data, and determine the risk information corresponding to the network data; wherein, the pre-set analysis algorithm includes at least a correlation analysis algorithm, a security anomaly analysis algorithm, and a neural network model;

[0041] The risk module is used to determine a risk score corresponding to the risk information based on the risk information corresponding to the network data using a preset risk algorithm; wherein the preset risk algorithm includes at least an identity scoring algorithm and an asset scoring algorithm.

[0042] The generation module is used to generate an entity profile corresponding to the network data based on the feature data, the correlation, the risk information, and the risk score.

[0043] Some embodiments of the present application solve the problem that after a threat is detected, potential security threats and abnormal activities cannot be identified from the perspective of users and entities by identifying potential security threats and abnormal activities based on UEBA technology, locating data collected from different channels to specific entities, analyzing the attributes and business of various objects, calculating the overall risk score of users, devices and business systems, and finally providing an analysis entry in the form of risk ranking.

[0044] Optionally, the different types of network data come from various security device logs, system logs, traffic data and database access record data.

[0045] Some embodiments of the present application implement data collection by receivers, and when adding a log source, a specific receiver needs to be set. The receiver management function sets the data receiving mode for connecting various security device logs, system logs, traffic data, database access records, and improves the accuracy of data processing.

[0046] Optionally, the obtaining module is configured to:

[0047] The network data is parsed using a regular feature discrimination method and a keyword feature discrimination method to obtain IP address information of various logs;

[0048] According to a pre-established geographic location database, the IP address information of the various logs is mapped into the geographic location database;

[0049] According to the network data, an entity key field is obtained;

[0050] According to the entity key field, a rich field is generated;

[0051] According to a pre-set organizational structure, business function and security policy, the category of an entity label is determined;

[0052] According to a pre-set association rule, the IP address information of the various logs is associated with the entity label.

[0053] Some embodiments of the present application use a regular feature discrimination method and a keyword feature discrimination method to increase IP address collection, geographic location mapping, entity-related key field enrichment, define entity labels, associate IP with labels, and improve the accuracy of data processing.

[0054] Optionally, the extracting module is configured to:

[0055] The preset feature extraction algorithm is used to extract the behavior features, network features and resource usage features in the network data, to obtain feature data corresponding to the network data, wherein the feature data at least includes operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage and CPU usage.

[0056] After the collected data is processed in the embodiments of the application, data basis is provided, and the processed data is feature-extracted, i.e., the behavior features, network features and resource usage features are extracted, to extract operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage and CPU usage.

[0057] Optionally, the analysis module is configured to:

[0058] The correlation analysis algorithm is used to analyze the feature data, to obtain the correlation between different feature data.

[0059] Or

[0060] The security anomaly analysis algorithm is used to perform anomaly analysis on the feature data, to obtain abnormal access information corresponding to the feature data.

[0061] Or

[0062] The neural network model is used to identify the feature data, to determine the threat risk type corresponding to the feature data.

[0063] Some embodiments of the application are based on three advanced data analysis engine technologies, i.e., a correlation analysis engine, a security anomaly analysis engine and an AI analysis engine, which can deeply mine the correlation between different data in the internal network, and further discover potential threat clues.

[0064] Optionally, the analysis module is configured to:

[0065] The feature data is compared with preset feature data in a preset feature database.

[0066] If the feature data matches the preset feature data, it is determined that the feature data is abnormal access information.

[0067] Optionally, the analysis module is configured to:

[0068] The neural network model is used to identify the entity type of the feature data, to obtain the user threat risk situation, the device threat risk situation and the threat risk situation of the business system.

[0069] In a third aspect, some embodiments of the present application provide an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the processing method of the entity portrait according to any one of the embodiments of the first aspect when executing the program.

[0070] In a fourth aspect, some embodiments of the present application provide a computer readable storage medium, which stores a computer program, and the program is executable on a processor to implement the processing method of the entity portrait according to any one of the embodiments of the first aspect.

[0071] In a fifth aspect, some embodiments of the present application provide a computer program product, which comprises a computer program, and the computer program is executable on a processor to implement the processing method of the entity portrait according to any one of the embodiments of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0072] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the following will briefly introduce the drawings needed to be used in some embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0073] Figure 1 A flowchart of a processing method of an entity portrait provided by an embodiment of the present application;

[0074] Figure 2 A flowchart of another processing method of an entity portrait provided by an embodiment of the present application;

[0075] Figure 3 A flowchart of data acquisition provided by an embodiment of the present application;

[0076] Figure 4 A flowchart of data processing provided by an embodiment of the present application;

[0077] Figure 5 A flowchart of portrait construction provided by an embodiment of the present application;

[0078] Figure 6 A structural diagram of a processing device of an entity portrait provided by an embodiment of the present application;

[0079] Figure 7 A schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0080] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in some embodiments of the present application.

[0081] It should be noted that similar reference numbers and letters represent similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", and the like are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0082] With the continuous advancement of informatization construction, network information systems are increasingly complex, bringing new challenges to internal network security management. Internal personnel use high-level permissions to violate regulations, which reduces the credibility of internal network users and entities, and may lead to data leakage. At the same time, hacker attacks, malicious software, viruses and other network security threats have become the main source of internal network security problems, which threaten the security of the internal network at any time and anywhere. Therefore, strengthening the internal network security management has become an important part of internal management.

[0083] In order to solve the above network security problems, UEBA is applied to the network security system. UEBA refers to User and Entity Behavior Analytics, which is a security analysis method aiming to detect user and entity behaviors that pose a threat to enterprise information systems. It analyzes user and entity behavior patterns to identify potential security threats and abnormal activities. This method combines user behavior analysis (WBA) and entity behavior analysis (EBA) to improve threat detection capabilities. After detecting a threat, it is difficult to determine which entity the threat comes from. Therefore, how to accurately determine the entity that poses a threat is a problem that needs to be solved. In view of this, some embodiments of the present application provide a processing method of entity portrait, the method comprising: acquiring different types of network data; wherein the different types of network data at least include user information, device information and business system information; performing feature extraction on the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes behavior feature data, network feature data and resource usage feature data; using a pre-set analysis algorithm to perform state analysis on the feature data, determine the association relationship between different types of network data, and determine the risk information corresponding to the network data; wherein the pre-set analysis algorithm at least includes an association analysis algorithm, a security anomaly analysis algorithm and a neural network model; determining a risk score corresponding to the risk information according to the pre-set risk algorithm and the risk information corresponding to the network data; wherein the pre-set risk algorithm at least includes an identity score algorithm and an asset score algorithm; generating an entity portrait corresponding to the network data according to the feature data, the association relationship, the risk information and the risk score, based on the UEBA technology, identifying potential security threats and abnormal activities, collecting data from different channels, locating to specific entities, analyzing the attributes and businesses of various objects, calculating the overall risk score of users, devices and business systems, and finally providing an analysis entry in the form of risk ranking, solving the problem that after a threat is detected, it is difficult to identify potential security threats and abnormal activities from the perspective of users and entities. In this way, after detecting a threat, it can be determined which entity the threat comes from, the entity that poses a threat can be accurately determined, and the accuracy of threat detection is improved.

[0084] As shown in Figure 1 some embodiments of the present application provide a processing method of entity portrait, the method comprising:

[0085] S101, acquiring different types of network data; wherein the different types of network data at least include user information, device information and business system information;

[0086] Specifically, the terminal device acquires different types of network data from various security device logs, system logs, traffic data, and database access records, wherein the network data includes information of various entities, such as user information, device information, and business system information. The network data is processed, for example, by using a regular feature-based and keyword feature-based judgment method to determine the two data categories, to process and analyze the original data to obtain IP addresses, geographical location mappings, entity-related key field enrichment, and defined entity labels, and to associate the IP addresses with the entity labels. Then, a data category storage strategy is set, including a physical storage partition strategy, a number of copies, a refresh time interval, a number of shards, and the like.

[0087] S102, feature extraction is performed on the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes behavior feature data, network feature data, and resource usage feature data;

[0088] Specifically, the terminal device extracts the behavior features, network features, and resource usage features from the processed network data, that is, extracts the operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0089] S103, a pre-set analysis algorithm is used to perform state analysis on the feature data to determine the association relationship between different types of network data and determine risk information corresponding to the network data; wherein the pre-set analysis algorithm at least includes an association analysis algorithm, a security anomaly analysis algorithm, and a neural network model;

[0090] Specifically, the terminal device can deeply mine the association relationship between different data in the internal network based on three advanced data analysis engine technologies, namely, an association analysis engine, a security anomaly analysis engine, and an AI analysis engine, that is, the association relationship between different types of network data is obtained, and potential threat clues are discovered; a baseline is formed based on historical access communication data of the internal network, and abnormal access communication in the internal network is discovered in a timely manner; a prediction model is established by learning a large amount of historical data of the internal network, and the internal network security threat is deeply and intelligently mined and analyzed to identify the threat risk situation of users, devices, and business systems.

[0091] S104, according to the pre-set risk algorithm and the risk information corresponding to the network data, a risk score corresponding to the risk information is determined; wherein the pre-set risk algorithm at least includes an identity score algorithm and an asset score algorithm;

[0092] Specifically, after obtaining the risk information corresponding to the network data, the terminal device performs risk scoring on the risk information by using a preset risk algorithm, including performing calculation on the risk information corresponding to the network data by using an identity scoring algorithm to obtain the risk score corresponding to the risk information, and performing calculation on the risk information corresponding to the network data by using an asset scoring algorithm to obtain the risk score corresponding to the risk information.

[0093] S105, generating an entity portrait corresponding to the network data according to the feature data, the association relationship, the risk information and the risk score.

[0094] Specifically, after obtaining the feature data of the network, the association information between the feature data, the risk information of the feature data and the risk score, the terminal device generates an entity portrait of different entities, for example, a user entity portrait, a device entity portrait and a business system entity portrait. In this way, the entity portrait can be obtained to determine whether a network threat occurs, and the entity with a risk can be located.

[0095] Some embodiments of the present application solve the problem that after a threat is detected, potential security threats and abnormal activities cannot be identified from the user and entity perspectives by identifying potential security threats and abnormal activities based on UEBA technology, locating data collected from different channels to specific entities, analyzing the attributes and businesses of various objects, calculating the overall risk score of users, devices and business systems, and finally providing an analysis entry in the form of risk ranking.

[0096] Another embodiment of the present application further supplements the processing method of the entity portrait provided in the above embodiment.

[0097] As shown in Figure 2 The present application provides a method for identifying potential security threats and abnormal activities, which includes the following five steps:

[0098] (1) data collection;

[0099] (2) feature extraction;

[0100] (3) analysis engine;

[0101] (4) risk scoring;

[0102] (5) portrait construction.

[0103] In the data collection of step (1), the specific steps of the data collection are as follows: determining a data source, and the specific data collection is realized by a receiver. When a log source is added, a specific receiver needs to be selected and set. A receiver management function is used to set a data receiving mode for connecting various types of security device logs, system logs, traffic data, and database access records. Figure 3 As shown in FIG. 2, different types of network data come from various types of security device logs, system logs, traffic data, and database access record data.

[0104] In some embodiments of the present application, the data collection is realized by a receiver. When a log source is added, a specific receiver needs to be selected and set. A receiver management function is used to set a data receiving mode for connecting various types of security device logs, system logs, traffic data, and database access records, thereby improving the accuracy of data processing.

[0105] Optionally, the method further comprises:

[0106] The network data is parsed by using a regular feature discrimination method and a keyword feature discrimination method to obtain IP address information of various types of logs.

[0107] Specifically, the regular feature discrimination method is also called regular expression (in code, it is often abbreviated as regex, regexp, or RE). It is a text pattern that includes ordinary characters (for example, letters between a and z) and special characters (called "meta characters"). Regular expressions use a single string to describe and match a series of strings that match a certain syntax rule, and are usually used to retrieve and replace text that matches a certain pattern (rule).

[0108] As another optional implementation method, the keyword feature discrimination method is to set a keyword in advance, and the network data is parsed by using the keyword to obtain IP address information of various types of logs.

[0109] According to a pre-established geographic location database, the IP address information of various types of logs is mapped into the geographic location database.

[0110] According to the network data, an entity key field is obtained.

[0111] According to the entity key field, a rich field is generated.

[0112] Specifically, by using the field extraction method, data field normalization and data field enrichment can be performed.

[0113] The custom field extraction process should be performed at search time, so as to exert the flexibility of read-time modeling. In a few cases, we need to perform custom field extraction and indexing at data import time. Data normalization: field extraction, format conversion, and structured data acquisition to support subsequent analysis and calculation processes, such as key-value pair extraction, regular expression extraction, separator extraction, and the like; data enrichment: filling more data information through existing data content, such as enriching data fields through lookup tables; data desensitization: desensitizing sensitive information such as passwords, mobile phone numbers, and addresses contained in network data; data filtering: filtering out key data for focused analysis.

[0114] According to the preset organizational structure, business function and security policy, the category of the entity label is determined;

[0115] According to the preset association rule, the IP address information of each type of log is associated with the entity label.

[0116] Specifically, the specific steps of the "data processing" in the data collection step (1) are as follows: using the regular feature and keyword feature judgment two data classification determination methods to process and analyze the original data, collecting IP address information from various logs, using a professional IP address geographic location database to map the collected IP addresses to geographic locations; extracting direct or indirect key fields related to entities such as user names, device IDs, and MAC addresses from logs, developing rules to generate new enriched fields based on existing log fields; defining the category of the entity label according to the organizational structure, business function, and security policy of the enterprise, and associating the IP address with the entity label by establishing an association rule, as shown in Figure 4 .

[0117] Some embodiments of the present application use regular feature discrimination and keyword feature discrimination to increase IP address collection, geographic location mapping, entity-related key field enrichment, entity label definition, and IP and label association content, thereby improving the accuracy of data processing.

[0118] Optionally, feature extraction is performed on the network data to obtain feature data corresponding to the network data, including:

[0119] A preset feature extraction algorithm is used to extract behavior features, network features, and resource usage features in the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0120] The collected data is processed in the embodiments of the application, and data basis is provided. Feature extraction is performed on the processed data, that is, behavior features, network features, and resource usage features are extracted, and operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage are extracted.

[0121] Optionally, a preset analysis algorithm is used to perform state analysis on the feature data, to determine the association relationship between different types of network data, and to determine risk information corresponding to the network data, including:

[0122] The feature data is analyzed by using the association analysis algorithm to obtain the association relationship between different feature data.

[0123] Or

[0124] The feature data is analyzed by using the security anomaly analysis algorithm to obtain abnormal access information corresponding to the feature data.

[0125] Or

[0126] The feature data is identified by using the neural network model to determine the threat risk type corresponding to the feature data.

[0127] The association analysis algorithm is a preset association relationship between features.

[0128] The security anomaly analysis algorithm is a preset feature database. The obtained feature data is compared with the preset feature data in the database, and then the risk of the feature data of the network data is analyzed.

[0129] The neural network model can be a network based on deep learning, such as an artificial neural network algorithm or a random forest algorithm, which is not limited in the application. The neural network module is used to determine the threat risk type of the network data.

[0130] Some embodiments of the application are based on three advanced data analysis engine technologies, including an association analysis engine, a security anomaly analysis engine, and an AI analysis engine. The association relationship between different data in the internal network can be deeply mined, and potential threat clues can be found.

[0131] Optionally, the feature data is analyzed by using the security anomaly analysis algorithm to obtain abnormal access information corresponding to the feature data, including:

[0132] The feature data and the preset feature data in the preset feature database are compared.

[0133] If the feature data and the preset feature data match, it is determined that the feature data is abnormal access information.

[0134] Optionally, the feature data is identified by using a neural network model to determine the threat risk type corresponding to the feature data, including:

[0135] The feature data is identified by using a neural network model to determine the entity type, and the user threat risk situation, the device threat risk situation, and the threat risk situation of the business system are obtained.

[0136] Specifically, the specific steps of the "data management" in the data collection of step (1) are: setting the data category storage strategy, including physical storage partition strategy, number of copies, refresh time interval, number of fragments, etc.

[0137] After the collected data is processed in step (1), it provides a data basis for step (2) as input. Step (2) extracts behavior features, network features, and resource usage features, including operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0138] Step (3) analysis engine, based on three advanced data analysis engine technologies: correlation analysis engine, security anomaly analysis engine, and AI analysis engine, can deeply mine the correlation between different data in the internal network, and further discover potential threat clues; based on the historical access communication data of the internal network, the baseline is formed through self-learning, and the abnormal access communication in the internal network is discovered in time; through learning a large number of historical data of the internal network, a prediction model is established, and the threat risk situation of the user, the device, and the business system is deeply and intelligently analyzed.

[0139] Step (4) risk scoring generates overall risk scores for users, devices, and business systems by using a scoring algorithm. The scoring algorithm based on weights is used for calculation, and the input data includes user-related user authentication logs and user behavior logs, device-related network traffic monitoring data and device logs, and business system-related business system operation logs and system interface call records. The scoring algorithm based on weights assigns weights to different types of data features, and determines the score according to the frequency and severity. At the same time, a combination of qualitative and quantitative methods is used, qualitatively classifying different types of abnormal behaviors and assigning corresponding risk level ranges, and quantitatively adjusting the score according to quantitative indicators such as the number of abnormal behaviors and frequency. Finally, the overall risk scores of users, devices, and business systems are output, and the analysis entry is provided in the form of risk ranking.

[0140] Step (5) portrait construction aggregates the feature extraction information of step (2) and locates to entities such as users, devices, and business systems, aggregates abnormal and threat alerts in the internal network, correlates risk scores, and constructs entity portraits, as shown in Figure 5 .

[0141] The application can be applied to quickly find risks existing in internal users, devices, service systems and other entities.

[0142] The present example is based on the method of constructing entity portrait analysis of abnormal behavior by UEBA technology, and the business application optimization method proposed by the application is described. In the intranet environment, based on the security device and traffic information, in-depth mining and analysis are carried out to analyze whether the user has abnormal behavior.

[0143] According to the method in the detailed description of the application, the specific process is as follows:

[0144] According to the score, the risk degree of the user and the device is displayed, and the activity data collected from different channels is positioned to specific entities. The data analysis engine performs correlation analysis from the perspective of entities, and performs behavior analysis based on individual history and group behavior deviation to find and generate alarm events. The portrait analysis dynamically calculates the overall risk score of the entity in a long period, and finally provides an analysis entry for the user in the form of risk ranking.

[0145] 1. User portrait

[0146] The user portrait realizes information query of all users, risk scores, organizations and groups, supports risk analysis and threat discovery of user behavior, and supports user profile, risk preview, user portrait, network activity and communication relationship analysis.

[0147] The risk preview displays abnormal events in a visual chart in a time dimension, displays the time sequence distribution of alarm events in the recent history period by a chart, and can perform correlation analysis on the detailed information of the alarm event, and supports displaying the alarm events generated in the last 10 days and the correlation relationship graph of the same alarm events generated by other users.

[0148] The user portrait displays the behavior profile of the user in a certain time range, supports portrait analysis of user behavior, displays the commonly used resources involved by the chart method, including resource statistics display of commonly used accounts, commonly used devices and commonly used IP; display the active time, including the monthly activity degree and 24-hour activity degree; display the activity area, including the commonly active geographic location and commonly active security domain; display the email communication, including the company mailbox and non-company mailbox; display the internal resource use, including the resource operation sequence, business system resource operation, database operation influence row number and file transfer number; display the daily active situation.

[0149] The network activity directly displays the statistical data of the user's network behavior including access domain name, application protocol use, access to business systems, access to security domains, access to URLs, access to databases, access to device IP / port, etc. according to the data obtained by training the corresponding task in the index engine, and performs portrait analysis of the user's network activity through multiple dimensions, which facilitates the administrator to supervise the user's network behavior.

[0150] 2、Device Profile

[0151] Device Profile provides information query of all devices, observation table, risk score, organization, group, including device risk score statistics, device IP, responsible person, affiliated organization, time period score curve, detailed information, observation table setting, etc.

[0152] Device Overview visualizes device abnormal event in time dimension, displays the time sequence distribution of alarm events in the recent history period in the form of time axis, and can perform correlation analysis on the detailed information of the alarm event, display the correlation relationship diagram of the alarm events generated in the recent 10 days and other devices also generating the same alarm events.

[0153] Device Profile displays information of commonly used resources such as commonly used access ports, commonly used browsers, commonly used accounts, deployed business systems, commonly used users, commonly used IPs, supports time dimension active subject information display of daily active situation, and supports display of 30-day traffic distribution situation diagram. External connection behavior includes active external connection behavior and passive external connection behavior, the active external connection behavior includes access to intranet IP, access to business system, access to database, access to security domain behavior display, and the passive external connection behavior includes intranet source IP, intranet access port, and extranet source IP information statistics.

[0154] 3、Business System Profile

[0155] Business System Profile provides information query of all business systems, observation table, risk score, organization, business system type, including alarm number statistics, system name, device IP, affiliated organization, time period score curve, detailed information, observation table setting, etc.

[0156] Business System Overview searches for risk systems in the form of organization, business system type, and fuzzy search, and filters according to event first-class classification, including attack, violation, and exception.

[0157] Operation and maintenance analysis displays user operation and maintenance analysis, newly discovered account, account that has occurred operation and maintenance behavior in the recent 7 days but has not occurred operation and maintenance behavior in history, displays the communication relationship with other business systems in the recent 30 days, and the dimensions include source business system name, server IP, client IP, protocol, and number of times.

[0158] The main technical effects of the application are as follows: user abnormal behavior threat is located to a specific entity, and user, device, and business system multi-dimensional profiles are formed; user, device, and business system risk scores are dynamically generated in a long period, and are quantitatively displayed in the form of risk ranking.

[0159] The application focuses on the perspective of users and entity assets, discovers potential risks and portraits analysis scenarios, after massive log data is located to specific entities, generates overall risk scores for internal entities through a risk scoring algorithm, provides an analysis entry in the form of risk ranking, reflects risk levels and ranking, realizes risk quantification, and intuitively displays accurate positioning and evaluation of risks. Based on three advanced data analysis engine technologies of correlation analysis engine, security anomaly analysis engine and AI analysis engine, the correlation between different data in the internal network is deeply mined, and potential threat clues are found; the baseline is formed by self-learning based on the historical access communication data of the internal network, and abnormal access communication in the internal network is found in time; a prediction model is established by learning a large amount of historical data of the internal network, the internal network security threat is deeply and intelligently mined and analyzed, and the internal network security threat discovery and analysis problem is efficiently solved

[0160] It should be noted that each implementable manner in the embodiment can be implemented alone or in any combination without conflict.

[0161] Another embodiment of the application provides a processing device for entity portrait, which is used to execute the processing method for entity portrait provided by the above embodiment.

[0162] As shown in Figure 6 The structure schematic diagram of the processing device for entity portrait provided by the embodiment of the application is shown. The processing device for entity portrait includes an acquisition module 601, an extraction module 602, an analysis module 603, a risk module 604 and a generation module 605, wherein:

[0163] The acquisition module 601 is used to acquire different types of network data; wherein the different types of network data at least include user information, device information and business system information;

[0164] The extraction module 602 is used to perform feature extraction on the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes behavior feature data, network feature data and resource usage feature data;

[0165] The analysis module 603 is used to perform state analysis on the feature data by using a pre-set analysis algorithm, to determine the correlation between different types of network data, and to determine risk information corresponding to the network data; wherein the pre-set analysis algorithm at least includes a correlation analysis algorithm, a security anomaly analysis algorithm and a neural network model;

[0166] The risk module 604 is used to determine a risk score corresponding to the risk information according to a pre-set risk algorithm and the risk information corresponding to the network data; wherein the pre-set risk algorithm at least includes an identity scoring algorithm and an asset scoring algorithm;

[0167] The generating module 605 is configured to generate an entity portrait corresponding to the network data according to the feature data, the correlation, the risk information, and the risk score.

[0168] Some embodiments of the present application solve the problem that after a threat is detected, potential security threats and abnormal activities cannot be identified from the perspective of users and entities by identifying potential security threats and abnormal activities based on UEBA technology, locating data collected from different channels to specific entities, analyzing the attributes and businesses of various objects, calculating the overall risk score of users, devices, and business systems, and finally providing an analysis entry in the form of a risk ranking.

[0169] As to the apparatus in the present embodiment, the specific manners in which various modules perform operations have been described in detail in the embodiments relating to the method, and thus will not be described here in detail.

[0170] Another embodiment of the present application further supplements the processing apparatus of the entity portrait provided in the above embodiments.

[0171] Optionally, the different types of network data come from various security device logs, system logs, traffic data, and database access record data.

[0172] In some embodiments of the present application, the data collection is realized by a receiver, and when a log source is added, a specific receiver needs to be selected and set. The receiver management function realizes the setting of the data receiving mode, and is used to connect various security device logs, system logs, traffic data, and database access records, thereby improving the accuracy of data processing.

[0173] Optionally, the obtaining module is configured to:

[0174] The network data is parsed using the regular feature discrimination method and the keyword feature discrimination method to obtain IP address information of various logs;

[0175] According to the pre-established geographic location database, the IP address information of various logs is mapped into the geographic location database;

[0176] According to the network data, an entity key field is obtained;

[0177] According to the entity key field, a rich field is generated;

[0178] According to the preset organizational structure, business function, and security policy, the category of the entity label is determined;

[0179] According to the preset correlation rule, the IP address information of various logs is associated with the entity label.

[0180] Some embodiments of the present application adopt a regular feature discrimination method and a keyword feature discrimination method, increase IP address collection, geographical location mapping, entity-related key field enrichment, define entity labels, associate IP with label content, and improve the accuracy of data processing.

[0181] Optionally, the extraction module is configured to:

[0182] The preset feature extraction algorithm is used to extract the behavior features, network features, and resource usage features in the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0183] After the collected data is processed in the embodiments of the present application, the data basis is provided, and the processed data is subjected to feature extraction, i.e., the behavior features, network features, and resource usage features are extracted to obtain operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage, and CPU usage.

[0184] Optionally, the analysis module is configured to:

[0185] The correlation analysis algorithm is used to analyze the feature data to obtain the correlation between different feature data;

[0186] or

[0187] The security anomaly analysis algorithm is used to analyze the feature data to obtain abnormal access information corresponding to the feature data;

[0188] or

[0189] The neural network model is used to identify the feature data to determine the threat risk type corresponding to the feature data.

[0190] Some embodiments of the present application are based on three advanced data analysis engine technologies, i.e., a correlation analysis engine, a security anomaly analysis engine, and an AI analysis engine, which can deeply mine the correlation between different data in the internal network and further discover potential threat clues.

[0191] Optionally, the analysis module is configured to:

[0192] The feature data and the preset feature data in the preset feature database are compared;

[0193] If the feature data and the preset feature data match, it is determined that the feature data is abnormal access information.

[0194] Optionally, the analysis module is configured to:

[0195] The neural network model is used to identify the entity types of the feature data, to obtain the user threat risk situation, the device threat risk situation, and the threat risk situation of the business system.

[0196] As to the apparatus in the embodiment, the specific manners in which various modules perform operations have been described in detail in the embodiments of the method, and thus will not be described in detail here.

[0197] It should be noted that the implementable manners in the embodiment can be implemented individually, or can be implemented in any combination manner without conflict.

[0198] The embodiment of the application further provides a computer readable storage medium, which has a computer program stored thereon, and the program is executed by a processor to implement the operation of the method corresponding to any embodiment of the processing method of the entity portrait provided in the above embodiment.

[0199] The embodiment of the application further provides a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the operation of the method corresponding to any embodiment of the processing method of the entity portrait provided in the above embodiment.

[0200] As shown in Figure 7 Some embodiments of the application provide an electronic device 700, which includes a memory 710, a processor 720, and a computer program stored in the memory 710 and executable on the processor 720, wherein the processor 720 reads the program from the memory 710 through a bus 730 and executes the program to implement the method of any embodiment included in the processing method of the entity portrait.

[0201] The processor 720 can process digital signals and can include various computing structures, such as a complex instruction set computer structure, a reduced instruction set computer structure, or a structure implementing a combination of multiple instruction sets. In some examples, the processor 720 can be a microprocessor.

[0202] The memory 710 can be used to store instructions executed by the processor 720 or data related to the execution of the instructions. These instructions and / or data can include code for implementing some or all of the functions of one or more modules described in the embodiments of the application. The processor 720 of the embodiments of the disclosure can be used to execute the instructions in the memory 710 to implement the method shown above. The memory 710 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memories well known to those skilled in the art.

[0203] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0204] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, and thus, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings.

[0205] It should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one from another entity or action without necessarily requiring or implying any actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

Claims

1. A method of processing a solid image, characterized by, The method comprises: acquiring different types of network data; wherein the different types of network data at least include user information, device information and service system information; performing feature extraction on the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes behavior feature data, network feature data and resource usage feature data; using a pre-set analysis algorithm to perform state analysis on the feature data, determine the association relationship between different types of network data, and determine the risk information corresponding to the network data; wherein the pre-set analysis algorithm at least includes an association analysis algorithm, a security anomaly analysis algorithm and a neural network model; determining a risk score corresponding to the risk information according to a pre-set risk algorithm and the risk information corresponding to the network data; wherein the pre-set risk algorithm at least includes an identity score algorithm and an asset score algorithm; generating an entity portrait corresponding to the network data according to the feature data, the association relationship, the risk information and the risk score; the different types of network data come from various security device logs, system logs, traffic data and database access record data; using a regular feature discrimination method and a keyword feature discrimination method to analyze the network data to obtain IP address information of various logs; mapping the IP address information of various logs into a pre-established geographic location database according to the geographic location database; obtaining entity key fields according to the network data; generating rich fields according to the entity key fields; determining the category of entity labels according to pre-set organizational structure, business function and security policy; associating the IP address information of various logs with the entity labels according to pre-set association rules.

2. The method of claim 1, wherein The feature extraction on the network data to obtain feature data corresponding to the network data comprises: using a pre-set feature extraction algorithm to extract behavior features, network features and resource usage features in the network data to obtain feature data corresponding to the network data, wherein the feature data at least includes operation frequency, operation time distribution, operation type, access IP address, protocol usage, memory usage and CPU usage.

3. The method of claim 1, wherein The use of a pre-set analysis algorithm to perform state analysis on the feature data to determine the association relationship between different types of network data and determine the risk information corresponding to the network data comprises: using an association analysis algorithm to analyze the feature data to obtain the association relationship between different feature data; or using a security anomaly analysis algorithm to perform anomaly analysis on the feature data to obtain abnormal access information corresponding to the feature data; or using a neural network model to identify the feature data to determine the threat risk type corresponding to the feature data.

4. The method of claim 3, wherein The use of a security anomaly analysis algorithm to perform anomaly analysis on the feature data to obtain abnormal access information corresponding to the feature data comprises: comparing the feature data with pre-set feature data in a pre-set feature database; If the feature data matches the preset feature data, the feature data is determined as abnormal access information.

5. The method of claim 3, wherein The neural network model is used to identify the feature data, and a threat risk type corresponding to the feature data is determined. The neural network model is used to identify the entity type of the feature data, and user threat risk information, device threat risk information, and business system threat risk information are obtained.

6. An electronic device, comprising: The computer readable storage medium stores a computer program, and the processor executes the program to implement the entity portrait processing method of any one of claims 1-5.

7. A computer readable storage medium characterized in that, The computer readable storage medium stores a computer program, and the processor executes the program to implement the entity portrait processing method of any one of claims 1-5.

8. A computer program product comprising a computer program, wherein, The computer program is executed by the processor to implement the entity portrait processing method of any one of claims 1-5.

Images