Transverse penetration behavior detection method and device

Abstract

The invention provides a transverse penetration behavior detection method and device. According to the scheme provided by the invention, the first host and the second host with communication behaviors can be determined based on the data reported by the first host and the second host. Afterwards, for each of the first host and the second host, the risk value of the host can be determined based on the confidence of the alarm event reported by the host. If the risk value of any one of the two hosts is greater than the threshold value, it can be determined that the transverse penetration behavior exists between the two hosts. Due to the fact that communication behaviors exist between the two hosts with the transverse penetration behaviors, and the risk degree of security threats of at least one host is high, the scheme provided by the invention can ensure that the accuracy and reliability of transverse penetration behavior detection are high.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a method and device for detecting lateral penetration behavior. Background Art

[0002] Lateral penetration, also known as lateral movement, is a network attack technique that can, after invading a host within a network, use the trust relationship of the same network (such as shared permissions, passwords, and credentials, etc.) to continue invading other hosts within the network, thereby achieving a larger range of penetration attacks.

[0003] In order to ensure network security, the detection scheme in the related art is to determine the relevant detection rules by analyzing the attack techniques used by the attackers, and detect whether there are behaviors matching the detection rules in the network during the network operation. If the behaviors matching the detection rules are detected, it can be determined that there are lateral penetration behaviors in the network. However, the accuracy of the above detection methods is low. Summary of the invention

[0004] The present application provides a method and device for detecting lateral penetration behavior, which can solve the technical problem of low accuracy of the method for detecting lateral penetration behavior in the related art.

[0005] In a first aspect, a method for detecting lateral penetration behavior is provided, the method comprising: determining the first host and the second host that has communication behavior with the first host based on first data reported by the first host and second data reported by the second host. Afterwards, determining the first risk value of the first host based on the confidence of the first alarm event reported by the first host, the first risk value is used to characterize the risk level of the security threat existing in the first host; determining the second risk value of the second host based on the confidence of the second alarm event reported by the second host, the second risk value is used to characterize the risk level of the security threat existing in the second host. If any of the first risk value and the second risk value is greater than a threshold value, it is determined that there is lateral penetration behavior between the first host and the second host.

[0006] The method provided by the present application can first determine the two hosts that have communication behaviors, and then determine the risk value of the hosts based on the alarm events reported by the two hosts and detect lateral penetration behaviors. Since there will be communication behaviors between the two hosts that have lateral penetration behaviors, and the risk level of security threats to at least one host is high, the method based on the present application can ensure high accuracy and reliability in detecting lateral penetration behaviors.

[0007] Optionally, the first data may include log data and traffic data of the first host, and the second data may include traffic data of the second host. Based on the first data reported by the first host and the second data reported by the second host, the process of determining the first host and the second host that has communication behavior with the first host may include: based on the log data of the first host, determining that the first host is a host with a risk of lateral penetration; and then, based on the traffic data of the first host and the traffic data of the second host, determining the second host that has communication behavior with the first host.

[0008] Since traffic will be generated between two hosts with lateral penetration behavior, after determining that the first host has a lateral penetration risk based on the log data of the first host, the second host that has communication behavior with the first host can be further determined based on the traffic data. Accordingly, the second host is also a host with lateral penetration risk.

[0009] Optionally, based on the log data of the first host, determining that the first host is a host with a risk of lateral penetration may include: processing the log data of the first host and inputting it into a first detection model to obtain an identifier of the first host output by the first detection model. The first detection model is used to detect hosts with lateral penetration behavior, and the first detection model may also be called a lateral penetration detection model.

[0010] The first detection model may be a machine learning model trained by a deep learning algorithm. The machine learning model is used to process log data, which can effectively detect unknown lateral penetration behaviors.

[0011] Optionally, the first data may include traffic data of the first host, and the second data may include traffic data of the second host. Based on the first data reported by the first host and the second data reported by the second host, the process of determining the first host and the second host that has communication behavior with the first host may include: inputting the traffic data of the first host and the traffic of the second host into the second detection model, and obtaining the identifier of the first host and the identifier of the second host output by the second detection model. The second detection model is used to detect two hosts with abnormal traffic, and the second detection model may also be called an abnormal traffic detection model.

[0012] The second detection model may be a machine learning model trained by a deep learning algorithm, and the machine learning model is used to process the traffic data, so as to effectively detect the two hosts with abnormal traffic. In addition, based on the alarm events reported by the first host and the second host, it is determined that there is lateral penetration between the first host and the second host.

[0013] Optionally, the method may also include: sending a first disposal method corresponding to a first risk value of the first host to the first host, the first disposal method being used for the first host to handle the lateral penetration behavior; and sending a second disposal method corresponding to a second risk value of the second host to the second host, the second disposal method being used for the second host to handle the lateral penetration behavior.

[0014] By sending the disposal method to the host for disposal, it can ensure that the host can block the lateral penetration behavior in time to prevent the threat from spreading further in the intranet. In addition, because the disposal method sent corresponds to the risk value of the host, it can effectively reduce the impact on the business while ensuring security.

[0015] Optionally, the method may further include: sending first display information to the first host, the first display information may include at least one of the following information: the type of the first host, the process chain related to the lateral penetration behavior in the first host, the first risk value, and the flow data related to the lateral penetration behavior in the first host. Sending second display information to the second host, the second display information may include at least one of the following information: the type of the second host, the process chain related to the lateral penetration behavior in the second host, the second risk value, and the flow data related to the lateral penetration behavior in the second host. If the type of either the first host or the type of the second host is an attacking host that initiates the lateral penetration behavior, the other host type is an attacked host attacked by the lateral penetration behavior.

[0016] The first display information can be used for display on the web page by the first host, and the second display information can be used for display on the web page by the second host. Thus, it is convenient for users to understand the disposal suggestions of the automatic closed loop, and it is convenient for retrospective analysis and improve operation and maintenance efficiency.

[0017] In a second aspect, a device for detecting lateral penetration behavior is provided. The device for detecting lateral penetration behavior may include at least one module. The at least one module may be used to implement the method for detecting lateral penetration behavior provided in the above aspect.

[0018] In a third aspect, a device for detecting lateral penetration behavior is provided, the device for detecting lateral penetration behavior comprises a processor and a memory. The processor is used to execute instructions stored in the memory to implement the method for detecting lateral penetration behavior provided in the above aspect.

[0019] In a fourth aspect, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed, the method for detecting lateral penetration behavior provided in the above aspects is implemented.

[0020] In a fifth aspect, a computer program product is provided, which includes a program or code, and when the program or code is executed, a method for detecting lateral penetration behavior as provided in the above aspects is implemented.

[0021] In summary, the present application provides a method and device for detecting lateral penetration behavior. The solution provided by the present application can determine the first host and the second host that have communication behavior based on the data reported by the first host and the second host. Afterwards, for each of the first host and the second host, the risk value of the host can be determined based on the confidence of the alarm event reported by the host. If the risk value of any of the two hosts is greater than the threshold, it can be determined that there is lateral penetration behavior between the two hosts. Since there will be communication behavior between the two hosts that have lateral penetration behavior, and the risk level of security threats of at least one host is high, the solution provided by the present application can ensure that the accuracy and reliability of lateral penetration behavior detection are high. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of an application scenario of a method for detecting lateral penetration behavior provided in an embodiment of the present application;

[0023] Figure 2 It is a flow chart of a method for detecting lateral penetration behavior provided in an embodiment of the present application;

[0024] Figure 3 It is a schematic diagram of an application scenario of another method for detecting lateral penetration behavior provided in an embodiment of the present application;

[0025] Figure 4 This is an architecture diagram of a protection system for lateral penetration provided by an embodiment of the present application;

[0026] Figure 5 It is a flow chart of another method for detecting lateral penetration behavior provided in an embodiment of the present application;

[0027] Figure 6 It is a structural schematic diagram of a lateral penetration behavior detection device provided in an embodiment of the present application;

[0028] Figure 7 It is a schematic diagram of the structure of another device for detecting lateral penetration behavior provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The following is a detailed description of the method and device for detecting lateral penetration behavior provided in the embodiments of the present application in conjunction with the accompanying drawings.

[0030] In order to make the technical solutions provided by the embodiments of the present application clearer, relevant terms are first explained before the technical solutions provided by the embodiments of the present application are described in detail.

[0031] Lateral penetration: After a hacker or virus invades a host in a local area network, they use the trust relationship in the same local area network, such as shared permissions, passwords, and credentials, to invade other hosts and conduct a larger-scale penetration attack, also known as lateral movement.

[0032] Alarm event: uniquely identifies an abnormal behavior of the computer operating system, which is also an atomic behavior of a hacker or virus attack, such as Windows remote management (WinRM) remote connection.

[0033] Host security threat risk value: also known as risk value, is used to evaluate the impact of alarm events on host security threats. This risk value can be calculated by querying the alarm events detected in the host within a certain business time, and by the attack stage and event certainty corresponding to the alarm event. Among them, event certainty can also be called the confidence of the alarm event.

[0034] Compromised host: A host that has been controlled by a network intruder in some way, that is, a host that has been penetrated and attacked.

[0035] Lateral penetration is a key part of cyberattacks. Attackers gain persistent access to certain network resources (such as servers and terminal hosts) by stealing usernames and passwords, sending phishing emails, etc., and then infiltrate the intranet by stealing credentials or exploiting vulnerabilities of attacked hosts. They then gain higher privileges in the target network to steal the core network asset data of the enterprise. Collecting personal information, stealing funds, installing other malware, and obtaining intellectual property may be just some of the damages that attackers cause to companies, but the longer attackers lurk in the company network, the greater the risk to customers, finances, and reputation.

[0036] In order to detect lateral penetration in the intranet, we can analyze the attack techniques used by attackers and propose relevant detection rules, such as extracting commands related to lateral penetration and triggered events. Then, we can detect the terminal log data based on the detection rules to determine whether there is lateral penetration in the intranet. However, this method cannot effectively detect unknown lateral penetration, resulting in low detection accuracy and reliability.

[0037] The embodiment of the present application provides a method for detecting lateral penetration behavior. The method can determine the first host and the second host with communication behavior based on the data reported by the host. The first host and the second host can be suspected compromised hosts, that is, hosts with lateral penetration risks. Afterwards, the risk value of the first host can be determined based on the confidence of the alarm event reported by the first host, and the risk value of the second host can be determined based on the confidence of the alarm event reported by the second host. If the risk value of any host is greater than a preset threshold, it can be determined that there is lateral penetration behavior between the two hosts. When detecting lateral penetration behavior, the method provided by the embodiment of the present application can first determine two suspected compromised hosts with communication behavior based on the data reported by the host, and then determine whether there is lateral penetration behavior between the two hosts based on the confidence of the alarm event reported by the two hosts. As a result, the accuracy and reliability of lateral penetration behavior detection are effectively improved.

[0038] Figure 1 is a schematic diagram of an application scenario of a method for detecting lateral penetration behavior provided in an embodiment of the present application, such as Figure 1 As shown, the application scenario may include a cloud platform 01 and multiple hosts 02. Among them, the cloud platform 02 may be a server cluster composed of multiple servers, and the multiple hosts 02 may belong to the same local area network (also called intranet). Host 02 may also be called a terminal device, which may be a personal computer (PC) or a camera or other device. In addition, a detection response client is installed in the host 02, and the detection response client may be an endpoint detection and response (EDR) client or an extended detection and response (XDR) client, etc. The host 02 in the network can detect an alarm event through the detection response client, and report the alarm event and the data associated with the lateral penetration behavior in the host 02 (such as traffic data and log data) to the cloud platform 01. The cloud platform 01 can determine two hosts 02 that are suspected of being lost and have communication behavior based on the data reported by multiple hosts 02, and determine whether there is lateral penetration behavior between the two hosts 02 according to the alarm events reported by the two hosts 02.

[0039] Figure 2 1 is a flow chart of a method for detecting lateral penetration behavior provided in an embodiment of the present application. The method can be applied to a device for detecting lateral penetration behavior. The detection device can be deployed in a device such as Figure 1 In the cloud platform shown. Figure 2 , the method comprising:

[0040] Step 101: Determine a first host and a second host that is in communication with the first host based on first data reported by the first host and second data reported by the second host.

[0041] In an embodiment of the present application, multiple hosts in a network (such as an intranet) can report data to a detection device during operation, and the data may include data related to lateral penetration behavior. For example, the data may at least include traffic data of the host, or the data may also include log data of the host. Among them, the traffic data may include at least one of the following: the communication period between the host and other hosts, the number of communications, the source host, the destination host, the communication protocol, and the length of the communication field. The log data may include at least one of the following: Windows logs, files, processes, and registries. The multiple hosts may include a first host and a second host. The detection device can receive first data reported by the first host and second data reported by the second host. The detection device can determine the first host and the second host that has communication behavior with the first host based on the first data and the second data.

[0042] The first host and the second host may be suspected compromised hosts determined by the detection device, that is, hosts with lateral penetration risks. The above step 101 can also be understood as: the detection device can determine the first host and the second host with lateral penetration risks and communication behaviors from the multiple hosts based on the data reported by the multiple hosts in the network.

[0043] Step 102: Determine a first risk value of the first host based on the confidence level of the first alarm event reported by the first host.

[0044] In an embodiment of the present application, the first host can also perform security threat monitoring during operation, and can report the detected first alarm event to the detection device. The first alarm event may include information such as the event identifier of the alarm event and the confidence of the alarm event. The detection device can then determine the first risk value of the first host based on the confidence of the first alarm event. The first risk value is used to characterize the risk level of the security threat existing in the first host, and the first risk value may be positively correlated with the confidence of the first alarm event.

[0045] An attacker's network attack chain may include multiple attack stages, including lateral penetration stages and other attack stages. For example, the adversarial tactics, techniques and common knowledge (ATT&CK) framework defines 14 attack stages in the network attack chain: reconnaissance, resource development, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exflitration, and impact. The host can report different alarm events at different attack stages, and one or more alarm events can be reported at each attack stage. Accordingly, the first alarm event reported by the first host and received by the detection device may include multiple alarm events at different attack stages, and the detection device may calculate the first risk value using a risk analysis algorithm based on the confidences of the multiple alarm events at different attack stages. The first risk value may be positively correlated with the confidences of the multiple alarm events.

[0046] For example, assume that the first host reports n1 alarm events. According to the attack techniques in the ATT&CK framework, the n1 alarm events are divided into m1 different attack stages. For example, there are k alarm events in the i-th attack stage, and the confidence of the k alarm events is {P i，1 ,......,P i，k}, then the confidence of the i-th attack stage can be Furthermore, the first risk value R1 of the first host may be: Here, n1 is an integer greater than 0, k is a positive integer not greater than n1, and j is a positive integer not greater than k; m1 is an integer greater than 1, and i is a positive integer not greater than m1.

[0047] Step 103: Determine a second risk value of the second host based on the confidence level of the second alarm event reported by the second host.

[0048] In an embodiment of the present application, the second host can also perform security threat monitoring during operation, and can report the detected second alarm event to the detection device. The second alarm event may include information such as event identification and confidence. The detection device can then determine the second risk value of the second host based on the confidence of the second alarm event. The second risk value is used to characterize the risk level of the security threat existing in the second host, and the second risk value is positively correlated with the confidence of the second alarm event. The second alarm event reported by the second host received by the detection device may also include multiple alarm events at different attack stages. The detection device can calculate the second risk value based on the confidence of the multiple alarm events at different attack stages using a risk analysis algorithm. The second risk value is positively correlated with the confidence of the multiple alarm events.

[0049] For example, suppose the second host reports n2 alarm events. According to the attack techniques in the ATT&CK framework, the n2 alarm events are divided into m2 different attack stages. For example, there are k alarm events in the i-th attack stage, and the confidence of the k alarm events is {P i，1 ,......,P i，k}, then the confidence of the i-th attack stage is Then the second risk value R2 of the second host is: Here, n2 is an integer greater than 0, k is a positive integer not greater than n2, and j is a positive integer not greater than k; m2 is an integer greater than 1, and i is a positive integer not greater than m2.

[0050] The alarm events reported by each host in the network can be stored in the cloud knowledge base, and after the detection device determines the first host and the second host, it can request and obtain the alarm events reported by the two hosts from the cloud knowledge base based on the identifiers of the two hosts. The identifier of the host can be the Internet protocol (IP) address of the host.

[0051] Step 104: If any one of the first risk value and the second risk value is greater than a threshold, it is determined that lateral penetration behavior exists between the first host and the second host.

[0052] In the embodiment of the present application, after the detection device determines the risk value of the first host and the second host, if it detects that the risk value of any host is greater than the threshold, it can be determined that there is lateral penetration between the first host and the second host. The threshold can be a pre-selected risk threshold in the detection device, and the threshold can be determined according to the security performance requirements of the network. For example, in the protection network mode, the threshold can be lower than the threshold of the normal business mode, such as the threshold of the normal business mode can be 90%, and the threshold of the protection network mode can be set to 85%.

[0053] Step 105: Send a first handling method corresponding to the first risk value of the first host to the first host.

[0054] After detecting that there is lateral penetration between the first host and the second host, the detection device may also determine a first handling method corresponding to the first risk value based on the first risk value of the first host, and issue the first handling method to the first host. The first handling method is used for the first host to handle the lateral penetration behavior.

[0055] In an embodiment of the present application, a correspondence between risk values ​​and disposal methods may be pre-stored in the detection device, wherein different risk values ​​(or risk values ​​of different levels) may correspond to different disposal methods. For example, referring to Table 1, the risk value of the host may be divided into three levels: high, medium, and low. Among them, the disposal methods corresponding to the high-level risk value may include: IP blocking and virus detection; the disposal methods corresponding to the medium-level risk value may include: virus detection; the disposal methods corresponding to the low-level risk value may include: ending the process. Ending a process is also called terminating a process, that is, clearing the process from the memory.

[0056] Table 1

[0057] Risk Value Level Disposal method high IP blocking, virus detection middle Virus detection Low Ending a process

[0058] For example, assuming that the level of the first risk value of the first host is high, the first disposal method sent by the detection device to the first host may include: IP blocking and virus killing, and the disposal method carries the IP to be blocked. After receiving the first disposal method, the first host can block the IP address indicated by the detection device and perform virus killing operations.

[0059] Step 106: Send a second handling method corresponding to the second risk value of the second host to the second host.

[0060] The detection device can also determine a second disposal method corresponding to the second risk value based on the second risk value of the second host, and send the second disposal method to the second host. The second disposal method can be used for the second host to dispose of the lateral penetration behavior. For example, the detection device can determine the second disposal method based on the corresponding relationship shown in Table 1.

[0061] For example, assuming that the level of the second risk value of the second host is low, the second disposal method sent by the detection device to the second host may include: ending the process, and the disposal method may carry the process identifier (PID) of the process to be ended, and the process identifier may also be called a process controller. After receiving the second disposal method, the second host may end the process indicated by the detection device.

[0062] Based on the above steps 105 and 106, it can be known that the detection device can provide different disposal methods (i.e., disposal suggestions or disposal strategies) to the host based on the different risk values ​​of the host. Thus, it can be ensured that the host can deal with potential risks in a timely and effective manner (for example, it can prevent attackers from invading the intranet again), and it can be ensured that the relevant disposal has little impact on customer business.

[0063] Step 107: Send the first display information to the first host.

[0064] After the above step 104, the detection device can also send the first display information to the first host. The first display information may include at least one of the following information: the type of the first host, the process chain related to the lateral penetration behavior in the first host, the first risk value, and the flow data related to the lateral penetration behavior in the first host (also referred to as flow analysis data). After the first host receives the first display information, it can be displayed on its World Wide Web (web) page so that the user can intuitively understand the attacker's attack chain and the risks caused by the lateral penetration of the intranet. Among them, the flow data related to the lateral penetration behavior may refer to the flow data generated by the lateral penetration behavior, which may include communication time period, number of communications, protocol, source host, destination host, and the length of the communication field.

[0065] Step 108: Send the second display information to the second host.

[0066] After the above step 104, the detection device can also send second display information to the second host. The second display information can include at least one of the following information: the type of the second host, the process chain related to the lateral penetration behavior in the second host, the second risk value, and the flow data related to the lateral penetration behavior in the second host. After receiving the second display information, the second host can also display it on its web page so that the user can intuitively understand the attack chain of the attacker's lateral penetration in the intranet and the risks caused.

[0067] In an embodiment of the present application, if the type of any one of the first host type and the second host type is an attacking host that initiates the lateral penetration behavior, then the other host type is an attacked host attacked by the lateral penetration behavior. The detection device can determine the type of the first host and the type of the second host based on the traffic data of the first host and the second host, respectively. For example, the source host of the traffic data is the attacking host, and the destination host is the attacked host. In addition, the first display information sent by the detection device can also include the identifier of the second host and the type of the second host, and the second display information can also include the identifier of the first host and the type of the first host. In this way, it is convenient for users to intuitively understand the attack direction of the lateral penetration behavior.

[0068] Optionally, after the first host receives the first disposal method sent by the detection device, it can also be displayed on its web page, and after the second host receives the second disposal method sent by the detection device, it can also be displayed on its web page. In this way, it is convenient for users to understand the disposal suggestions of the automatic closed loop, and it is convenient for retrospective analysis to improve operation and maintenance efficiency.

[0069] Optionally, after the first host receives the first disposal method issued by the detection device, it can execute the first disposal method and report the disposal result to the detection device. After the second host receives the second disposal method issued by the detection device, it can execute the second disposal method and report the disposal result to the detection device. The disposal result may include: disposal completed (i.e., disposal successful) or disposal failed. If the first host or the second host has been attacked by lateral penetration behavior, the host may not be able to execute the disposal method issued by the detection device, and accordingly, the disposal result reported by the host may be disposal failure, or the host will not report the disposal result to the detection device.

[0070] If the detection device receives a treatment result reported by any host, and the treatment result indicates that the lateral penetration behavior has been treated, the risk value of any host can be updated to an initial value. The initial value is less than the threshold, and the risk value of the host is the initial value, which can indicate that there is no risk of lateral penetration in the host. For example, the initial value can be 0.

[0071] In an embodiment of the present application, after the host completes the handling of the lateral penetration behavior, the detection device can also update the risk value of the host to the initial value to ensure the normal call of the risk value by other businesses to avoid affecting the normal business of the host.

[0072] If the detection device does not receive the processing result of a host, and if the received processing result indicates that the lateral penetration behavior has failed to be processed, there is no need to update the risk value of the host.

[0073] In the above step 101, the detection device can determine the first host and the second host that has communication behavior with the first host in different ways. The implementation process of step 101 is introduced below.

[0074] As a first possible implementation, the first data reported by the first host may include log data and flow data of the first host, and the second data reported by the second host may include flow data of the second host. Accordingly, step 101 may include:

[0075] Step 1011: Based on the log data of the first host, determine that the first host is a host with a risk of lateral penetration.

[0076] In an embodiment of the present application, after receiving the log data of the first host, the detection device can determine that the first host is a host with a risk of lateral penetration based on features related to lateral penetration behavior in the log data.

[0077] Optionally, a first detection model may be deployed in the detection device, and the detection device may input the log data of the first host into the first detection model, for example, the log data may be processed and then input into the first detection model, and the processing may include data format conversion, etc. The first detection model may then output the identifier of the first host. The first detection model may be a model for detecting hosts with lateral penetration behavior, and the first detection model may also be called a lateral penetration detection model.

[0078] The first detection model may be a model trained using a deep learning method. For example, the detection device may extract features related to lateral penetration behavior from a data set (such as log data of an attacking host and an attacked host), and use a deep learning method to perform model training on the extracted features to obtain the first detection model. Using the first detection model to process log data can effectively detect unknown lateral penetration behaviors.

[0079] The attacking host refers to the host that initiates the lateral penetration behavior, and the attacked host refers to the host that is attacked by the lateral penetration behavior. Deep learning methods may include artificial neural networks (ANN), recurrent neural networks (RNN), long short-term memory recursive neural networks (LSTM) or graph neural networks (GNN). Features related to lateral penetration behavior may include command features, security log event features, and registry features.

[0080] Optionally, the detection device can input the log data reported by each host in the network (such as an enterprise intranet) into the first detection model, and the first detection model can then output an alarm message. The alarm message may include the identifier of the suspected compromised host (such as the first host), and the identifier of the host may include the IP address of the host. Of course, in addition to the identifier of the host, the alarm message may also include other information related to the lateral penetration behavior detected by the first detection model, such as the time period T of the lateral penetration, the protocol and port of the suspected compromised host, and other information. Among them, the suspected compromised host can also be called an alarm host.

[0081] Example, reference Figure 3 , the network may include M hosts from host 1 to host M, where M is an integer greater than 1. The M hosts may report their respective log data to the detection device, which may then process the received log data through a lateral penetration detection model and output alarm information.

[0082] In addition to the first detection model, the detection device may also determine the first host with lateral penetration risk in other ways. For example, the detection device may also determine the first host by rule matching.

[0083] Step 1012: Based on the traffic data of the first host and the traffic data of the second host, determine the second host that has communication behavior with the first host.

[0084] In the embodiment of the present application, after the detection device determines the suspected compromised first host, it can determine the second host that has communication behavior with the first host based on the traffic data reported by the first host and the traffic data reported by the second host. For example, the detection device can determine the second host that has communication behavior with the first host based on the traffic data reported by each host in the network through the IP association analysis algorithm. The second host is also a host with a risk of lateral penetration.

[0085] Optionally, if the alarm information output by the first detection model also includes a time period T of lateral penetration, the detection device can determine the second host that communicates with the first host based on the traffic data of the first host and the second host in the time period T.

[0086] In the above step 1011, the alarm information output by the first detection model may also include the identifiers of other suspected compromised hosts, for example, the identifier of the second host. The detection device may determine the first host and the second host that have communication behavior based on the flow data of each suspected compromised host determined by the first detection model.

[0087] Example, reference Figure 3, assuming that the first host is host A, the detection device can determine the second host, namely host B, that has communication behavior with host A by performing IP association analysis on the traffic data of host A and host B. Afterwards, the detection device can obtain the alarm events reported by the two hosts at each attack stage from the cloud knowledge base based on the identifiers of host A and host B (such as IP addresses), and calculate the risk value of each host respectively. If the risk value of any host is greater than the threshold, the detection device can determine that there is lateral penetration between the two hosts, and can output lateral penetration alarm information. For example, the detection device can output lateral penetration alarm information to host A and host B respectively, or the detection device can output lateral penetration alarm information to the control device in the intranet.

[0088] As a second possible implementation, the first data reported by the first host may include the traffic data of the first host, and the second data reported by the second host may include the traffic data of the second host. Accordingly, step 101 may include: inputting the traffic data of the first host and the traffic of the second host into the second detection model, and obtaining the identifier of the first host and the identifier of the second host output by the second detection model.

[0089] The second detection model is used to detect the first host and the second host with abnormal traffic, and the second detection model can be called an abnormal traffic detection model. The second detection model can also be a model trained by a deep learning method. For example, the detection device can perform model training on the traffic data between hosts in the intranet (i.e., the sample data set) to obtain a second detection model (abnormal traffic detection model). The white traffic defined in the sample data set can be the traffic generated by normal software, and the abnormal traffic refers to traffic that is different from the white traffic, such as blasting traffic, scanning traffic, worm traffic, and traffic generated by lateral penetration.

[0090] Optionally, in the second implementation, the detection device may input the traffic data of each host in the network into the second detection model to obtain the identification of the first host with abnormal traffic and the identification of the second host output by the second detection model.

[0091] The traffic data reported by each host in the network can be stored in the traffic database. Accordingly, in the above two implementations, the detection device can obtain the traffic data of the relevant host from the traffic database based on the host identifier (such as IP address) and determine the first host and the second host with communication behavior.

[0092] The order of the steps of the lateral penetration behavior detection method provided in the embodiment of the present application can be adjusted appropriately, and the steps can be increased or decreased accordingly. For example, the above steps 105 and 106, and / or steps 107 and 108 can be deleted according to the situation; or, the above steps 107 and 108 can be performed before step 106.

[0093] In summary, the embodiment of the present application provides a method for detecting lateral penetration behavior, which can determine the first host and the second host that have communication behavior based on the data reported by the first host and the second host. Afterwards, for each of the first host and the second host, the risk value of the host can be determined based on the confidence of the alarm event reported by the host. If the risk value of any of the two hosts is greater than the threshold, it can be determined that there is lateral penetration behavior between the first host and the second host. Since there will be communication behavior between the two hosts that have lateral penetration behavior, and the risk level of security threats of at least one host is relatively high, the method provided in the embodiment of the present application can ensure that the accuracy and reliability of lateral penetration behavior detection are high.

[0094] The present application also provides a system for protecting against lateral penetration behavior, such as Figure 4 As shown, the system may include: a data acquisition module deployed in the host, and a detection module, a verification module, a risk analysis module and a disposal module deployed in the cloud platform. The functions of each module are introduced below:

[0095] Data collection module: It is connected to the detection module in the cloud platform, and the data collection module can be the EDR or XDR in the host. The data collection module can collect the log data and traffic data of the host and report it to the cloud platform. The log data can include Windows logs, files, processes, and registry, etc.

[0096] Detection module: It can also be called lateral penetration detection module, which can process the data collected by the data acquisition module and input it into the lateral penetration detection model. If the lateral penetration detection model outputs alarm information, the alarm information is input into the verification module.

[0097] Verification module: It can also be called traffic verification module. During the lateral penetration process, traffic will be generated between the attacking host and the attacked host. Therefore, after receiving the alarm information, the verification module can determine the suspected compromised first host based on the alarm information, and use the IP association analysis algorithm to analyze the traffic data reported by each host to determine the second host that has communication behavior with the first host.

[0098] Analysis module: also known as host security threat risk analysis module, this module can request the cloud knowledge base for the alarm information of the first host and the second host in other attack stages based on the IP of the two hosts. Afterwards, the security threat risk level of each host can be determined through the risk analysis algorithm. The security threat risk level can be characterized by a security threat risk value or a security threat risk level. If the security threat risk level of any host is greater than the threshold, it can be determined that the host has been compromised, and it can be determined that lateral penetration behavior does exist in the intranet.

[0099] Disposal module: used to determine the corresponding disposal strategy according to the different risk levels and lateral penetration alarm information corresponding to the host, and send the disposal strategy to the host. After the host executes the disposal strategy, it can send the disposal result back to the disposal module, and the disposal module can then send the disposal result to the risk analysis module. The risk analysis module can update the security threat risk level of the host based on the disposal result. In this way, a closed loop of disposal and repair can be achieved.

[0100] The following is Figure 4 Taking the system architecture shown in FIG. 1 as an example, the detection method of lateral penetration behavior provided in the embodiment of the present application is introduced. Figure 5 As shown, the method includes:

[0101] Step 1: Build a cloud feature library. In the embodiment of the present application, the cloud feature library stores features associated with lateral penetration behavior, such as command features, login features, and event features. The cloud feature library can be used to train a lateral penetration detection model.

[0102] Step 2: Manually verify and update the cloud feature library. In the embodiment of the present application, the operation and maintenance personnel can also manually verify and update the features in the cloud feature library to ensure that the reliability and accuracy of the lateral penetration detection model are high.

[0103] Step 3: The data collection module (e.g., EDR) in the host reports the host data to the detection module in the system. The data may also be referred to as terminal behavior information, for example, the data may include log data and traffic data.

[0104] Step 4: The detection module processes the log data through a deep learning detection algorithm and outputs an alarm message. The alarm message may include the IP address of the suspected compromised host, the time period T of the lateral penetration, the protocol and port information of the suspected compromised host, etc.

[0105] Step 5: The verification module obtains the flow data of the T period from the flow database.

[0106] Step 6: The verification module uses an IP association algorithm to determine a second host that has communication behavior with the first host, and sends the IPs of the two hosts to the risk analysis module.

[0107] Step 7: The risk analysis module obtains the alarm events reported by the first host and the second host from the cloud knowledge base based on the IP addresses of the first host and the second host, and calculates the risk values ​​of the first host and the second host respectively.

[0108] Step 8: The risk analysis module returns the risk values ​​of the first host and the second host to the detection module.

[0109] Step 9: If the detection module determines that the risk value of any host is greater than the threshold, the detection module sends the information of the first host and the second host, as well as the process connections in the first host and the second host related to the lateral penetration behavior, to the disposal module.

[0110] Step 10: The processing module pushes the display information to the web page of the host.

[0111] The displayed information may include process connections related to the lateral penetration behavior, risk values ​​of hosts, traffic data related to the lateral penetration behavior (i.e., traffic analysis data), and disposal methods provided by the disposal module, etc. The disposal method may also be referred to as disposal suggestions or disposal commands.

[0112] Step 11: The disposal module sends the corresponding disposal method to the host according to the different risk values ​​corresponding to the host.

[0113] After receiving the disposal method, the EDR in the host can execute it and feed back the disposal result to the disposal module to realize the disposal and repair closed loop.

[0114] Based on the above method, it can be seen that the method provided by the embodiment of the present application can perform reliability analysis on the lateral penetration alarm information output by the first detection model. The reliability analysis is mainly divided into two parts: one is to analyze whether there is communication between the hosts; the other is to analyze whether at least one of the two hosts has been compromised.

[0115] The method can analyze from the perspective of protocols, frameworks, tools and vulnerabilities used in lateral penetration, extract relevant features of lateral penetration behavior from the data set, and perform model training on the extracted features to obtain a first detection model. After the detection device inputs the log data reported by the host into the first detection model, if the first detection model outputs an alarm message, the alarm message can be verified and analyzed through observation data (i.e., traffic data) to determine the second host that has communication behavior with the first host. Afterwards, combined with the cloud knowledge base, the risk values ​​of the first host and the second host are calculated respectively. When the risk value of either the first host or the second host is greater than the security threshold used in the business, it is determined that either host has been lost, that is, there is lateral penetration behavior between the intranet hosts. In addition, the method provided in the embodiment of the present application can also give different disposal suggestions based on the above risk value, and push the page display. Thus, the visualization and automatic blocking disposal of the lateral diffusion path can be realized to prevent the further spread of the threat in the intranet.

[0116] The present application embodiment provides a device for detecting lateral penetration behavior, which can be applied to Figure 1 The cloud platform in the scenario shown can be used to implement the detection method of lateral penetration behavior provided by the above method embodiment. Figure 6 As shown, the detection device for the lateral penetration behavior includes:

[0117] The first determination module 201 is used to determine the first host and the second host that has communication behavior with the first host based on the first data reported by the first host and the second data reported by the second host. The function of the first determination module 201 can refer to the relevant description of step 101 in the above method embodiment.

[0118] The risk analysis module 202 is used to determine a first risk value of the first host based on the confidence of the first alarm event reported by the first host, and the first risk value is used to characterize the risk level of the security threat existing in the first host; and to determine a second risk value of the second host based on the confidence of the second alarm event reported by the second host, and the second risk value is used to characterize the risk level of the security threat existing in the second host. The functional implementation of the risk analysis module 202 can refer to the relevant description of steps 102 and 103 in the above method embodiment.

[0119] The second determination module 203 is used to determine that there is lateral penetration between the first host and the second host if any of the first risk value and the second risk value is greater than a threshold. The function of the second determination module 203 can refer to the relevant description of step 104 in the above method embodiment.

[0120] Optionally, the first data may include log data and flow data of the first host, and the second data may include flow data of the second host. The first determination module 201 may be used to: determine the first host as a host with a risk of lateral penetration based on the log data of the first host; and then, determine the second host that has a communication behavior with the first host based on the flow data of the first host and the flow data of the second host.

[0121] Optionally, the first determination module 201 may be used to input the log data of the first host into a first detection model to obtain an identifier of the first host output by the first detection model. The first detection model is used to detect hosts with lateral penetration behaviors.

[0122] Optionally, the first data may include traffic data of the first host, and the second data may include traffic data of the second host. The first determination module 201 may be used to: input the traffic data of the first host and the traffic of the second host into a second detection model, obtain the identifier of the first host and the identifier of the second host output by the second detection model, and the second detection model is used to detect two hosts with abnormal traffic.

[0123] Optionally, continue to refer to Figure 6 , the device may further include a first sending module 204. The first sending module 204 may be used to: send a first disposal method corresponding to the first risk value of the first host to the first host, the first disposal method is used for the first host to dispose of the lateral penetration behavior; send a second disposal method corresponding to the second risk value of the second host to the second host, the second disposal method is used for the second host to dispose of the lateral penetration behavior. The function of the first sending module 204 can refer to the relevant description of step 105 and step 106 in the above method embodiment.

[0124] Optionally, continue to refer to Figure 6 , the device may further include a second sending module 205. The second sending module 205 may be used to: send first display information to the first host, the first display information including at least one of the following information: the type of the first host, the process chain related to the lateral penetration behavior in the first host, the first risk value, and the flow data related to the lateral penetration behavior in the first host; send second display information to the second host, the second display information including at least one of the following information: the type of the second host, the process chain related to the lateral penetration behavior in the second host, the second risk value, and the flow data related to the lateral penetration behavior in the second host.

[0125] Wherein, if either the type of the first host or the type of the second host is an attacking host that initiates the lateral penetration behavior, then the other host type is an attacked host that is attacked by the lateral penetration behavior. The function of the second sending module 205 can refer to the relevant description of step 107 and step 108 in the above method embodiment.

[0126] In summary, an embodiment of the present application provides a device for detecting lateral penetration behavior, which can determine the first host and the second host that have communication behavior based on the data reported by the first host and the second host. Afterwards, for each of the first host and the second host, the risk value of the host can be determined based on the confidence of the alarm event reported by the host. If the risk value of any of the two hosts is greater than the threshold, it can be determined that there is lateral penetration behavior between the first host and the second host. Since there will be communication behavior between the two hosts that have lateral penetration behavior, and the risk level of security threat of at least one host is high, the device provided by the embodiment of the present application can ensure high accuracy and reliability of lateral penetration behavior detection.

[0127] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described lateral penetration behavior detection device and each module can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0128] The detection device for lateral penetration behavior provided in the embodiment of the present application can also be implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), wherein the PLD can be a complex programmable logical device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. In addition, the method provided in the above method embodiment can also be implemented by software. When the method provided in the above method embodiment is implemented by software, each functional module in the detection device for lateral penetration behavior can also be a software module.

[0129] Figure 7 is a schematic diagram of the structure of another lateral penetration behavior detection device provided in an embodiment of the present application. The detection device can be applied to, for example, Figure 1 In the cloud platform 01 shown, the method provided by the above method embodiment can be implemented. Figure 7The lateral penetration behavior detection device includes: a processor 301, a memory 302, a network interface 303 and a bus 304. The memory 302 stores a computer program 3021, and the computer program 3021 is used to implement various application functions. The processor 301 is used to execute the computer program 3021 to implement the lateral penetration behavior detection method provided by the above method embodiment. For example, the processor 301 can be used to execute the computer program 3021 to implement the above method embodiment. Figure 6 The functions of each module are shown.

[0130] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), ASIC, FPGA, graphics processing unit (GPU), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0131] The memory 302 may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Among them, the nonvolatile memory may be a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DRRAM).

[0132] There may be multiple network interfaces 303, and the network interfaces 303 are used to achieve communication connection (which may be wired or wireless) with other devices, wherein the other devices may be devices such as terminals, servers or VMs.

[0133] The bus 304 is used to connect the processor 301, the memory 302 and the network interface 303. In addition to the data bus, the bus 304 may also include a power bus, a control bus and a status signal bus, etc. However, for the sake of clarity, various buses are labeled as bus 304 in the figure.

[0134] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed, a method for detecting lateral penetration behavior as provided in the above method embodiment is implemented.

[0135] An embodiment of the present application also provides a computer program product, which includes a program or code, and when the program or code is executed, it implements the detection method of lateral penetration behavior provided in the above method embodiment.

[0136] In the embodiments of the present application, the terms "first", "second" and "third" are used for descriptive purposes only and should not be understood as indicating or implying relative importance. In the embodiments of the present application, the term "at least one" refers to one or more, and "multiple" refers to two or more. In the embodiments of the present application, the term "and / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the previously associated objects are in an "or" relationship.

[0137] The above is only an optional implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for detecting lateral penetration behavior, characterized in that: The method comprises: Determine the first host and a second host that has communication behavior with the first host based on first data reported by the first host and second data reported by the second host; Determining a first risk value of the first host based on the confidence of the first alarm event reported by the first host, where the first risk value is used to characterize the risk level of the security threat existing in the first host; Determine, based on the confidence level of the second alarm event reported by the second host, a second risk value of the second host, where the second risk value is used to characterize the risk level of the security threat existing in the second host; If any risk value of the first risk value and the second risk value is greater than a threshold, it is determined that lateral penetration behavior exists between the first host and the second host.

2. The method according to claim 1, characterized in that The first data includes log data and traffic data of the first host, the second data includes traffic data of the second host, and determining the first host and the second host that has communication behavior with the first host based on the first data reported by the first host and the second data reported by the second host includes: Determining, based on the log data of the first host, that the first host is a host with a risk of lateral penetration; Based on the traffic data of the first host and the traffic data of the second host, a second host that communicates with the first host is determined.

3. The method according to claim 2, characterized in that The determining, based on the log data of the first host, that the first host is a host with a risk of lateral penetration includes: The log data of the first host is input into a first detection model to obtain an identifier of the first host output by the first detection model, where the first detection model is used to detect a host with lateral penetration behavior.

4. The method according to claim 1, characterized in that: The first data includes traffic data of the first host, the second data includes traffic data of the second host, and determining the first host and the second host that has communication behavior with the first host based on the first data reported by the first host and the second data reported by the second host includes: The flow data of the first host and the flow of the second host are input into a second detection model, and the identifier of the first host and the identifier of the second host are output by the second detection model. The second detection model is used to detect two hosts with abnormal flow.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Sending a first handling method corresponding to a first risk value of the first host to the first host, where the first handling method is used for the first host to handle the lateral penetration behavior; A second handling method corresponding to a second risk value of the second host is issued to the second host, where the second handling method is used for the second host to handle the lateral penetration behavior.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Sending first display information to the first host, the first display information including at least one of the following information: a type of the first host, a process chain related to the lateral penetration behavior in the first host, the first risk value, and traffic data related to the lateral penetration behavior in the first host; Sending second display information to the second host, the second display information including at least one of the following information: a type of the second host, a process chain related to the lateral penetration behavior in the second host, the second risk value, and traffic data related to the lateral penetration behavior in the second host; If either of the type of the first host and the type of the second host is an attacking host that initiates the lateral penetration behavior, then the other host type is an attacked host that is attacked by the lateral penetration behavior.

7. A device for detecting lateral penetration behavior, characterized in that: The device comprises: A first determination module, configured to determine the first host and a second host that has a communication behavior with the first host based on first data reported by the first host and second data reported by the second host; a risk analysis module, configured to determine a first risk value of the first host based on a confidence level of a first alarm event reported by the first host, the first risk value being used to characterize a risk level of a security threat existing in the first host; and, based on a confidence level of a second alarm event reported by the second host, determine a second risk value of the second host, the second risk value being used to characterize a risk level of a security threat existing in the second host; The second determination module is configured to determine that lateral penetration behavior exists between the first host and the second host if any one of the first risk value and the second risk value is greater than a threshold.

8. The device according to claim 7, characterized in that The first data includes log data and flow data of the first host, the second data includes flow data of the second host, and the first determining module is used to: Determining, based on the log data of the first host, that the first host is a host with a risk of lateral penetration; Based on the traffic data of the first host and the traffic data of the second host, a second host that communicates with the first host is determined.

9. The device according to claim 8, characterized in that The first determining module is used to: The log data of the first host is input into a first detection model to obtain an identifier of the first host output by the first detection model, where the first detection model is used to detect a host with lateral penetration behavior.

10. The device according to claim 7, characterized in that The first data includes traffic data of the first host, the second data includes traffic data of the second host, and the first determining module is used to: The flow data of the first host and the flow of the second host are input into a second detection model, and the identifier of the first host and the identifier of the second host are output by the second detection model. The second detection model is used to detect two hosts with abnormal flow.

11. The device according to any one of claims 7 to 10, characterized in that: The device also includes a first sending module, configured to: Sending a first handling method corresponding to a first risk value of the first host to the first host, where the first handling method is used for the first host to handle the lateral penetration behavior; A second handling method corresponding to a second risk value of the second host is issued to the second host, where the second handling method is used for the second host to handle the lateral penetration behavior.

12. The device according to any one of claims 7 to 10, characterized in that: The device also includes a second sending module, configured to: Sending first display information to the first host, the first display information including at least one of the following information: a type of the first host, a process chain related to the lateral penetration behavior in the first host, the first risk value, and traffic data related to the lateral penetration behavior in the first host; Sending second display information to the second host, the second display information including at least one of the following information: a type of the second host, a process chain related to the lateral penetration behavior in the second host, the second risk value, and traffic data related to the lateral penetration behavior in the second host; If either of the type of the first host and the type of the second host is an attacking host that initiates the lateral penetration behavior, then the other host type is an attacked host that is attacked by the lateral penetration behavior.

13. A device for detecting lateral penetration behavior, characterized in that: The method comprises a memory and a processor, wherein the processor is used to execute instructions stored in the memory to implement the method according to any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 6 is implemented.

15. A computer program product, characterized in that The computer program product comprises a program or a code, and when the program or the code is executed, the method according to any one of claims 1 to 6 is implemented.

Images