Security event early warning method and device, electronic equipment and storage medium

Abstract

The invention discloses a security event early warning method and device, electronic equipment and a storage medium, and relates to the technical field of security early warning. The method comprises the following steps: acquiring first log data of a target service in real time, and determining a first security feature of the first log data; inputting the first security feature into a pre-trained security event early warning model, and determining a target attack chain matched with the first security feature; determining each second log data associated with the first log data, and determining a second security feature of each second log data; and inputting each second security feature into a pre-trained security event early warning model, determining each reference attack chain matched with each second security feature, and if determining that the target attack chain is matched with the target reference attack chain, generating early warning information of the security event of the target service. According to the scheme provided by the embodiment of the invention, the security event attacking the target service can be quickly and accurately determined, and the accuracy and timeliness of security event early warning are improved.

Description

Technical Field

[0001] The present invention relates to the field of security early warning technology, and in particular to an early warning method, device, electronic equipment and storage medium for security incidents. Background Art

[0002] When the target business implements the corresponding functions, the data interaction behind it is complex, the number of server nodes and services called is large, and there are complex networking and calling relationships between services. In this process, the target business is likely to be attacked by security incidents and there are certain security risks.

[0003] At present, security incidents are mainly defended through static rules or models, but this method is difficult to cope with the ever-changing attack methods, resulting in the failure of security warnings.

[0004] How to quickly and accurately identify security incidents that attack target businesses and improve the accuracy and timeliness of security incident warnings are key research issues in the industry. Summary of the invention

[0005] The present invention provides a security incident early warning method, device, electronic device and storage medium to quickly and accurately determine the security incident of the attack target business, thereby improving the accuracy and timeliness of the security incident early warning.

[0006] According to one aspect of the present invention, a method for early warning of a security incident is provided, the method comprising:

[0007] Acquire first log data of a target business in real time, and determine a first security feature of the first log data;

[0008] Inputting the first security feature into a pre-trained security event warning model to determine a target attack chain matching the first security feature;

[0009] determining each second log data associated with the first log data, and determining a second security feature of each second log data;

[0010] Each of the second security features is input into a pre-trained security incident warning model to determine each reference attack chain that matches each of the second security features. If it is determined that the target attack chain matches the target reference attack chain, warning information of the security incident of the target business is generated.

[0011] According to another aspect of the present invention, there is provided a security event early warning device, the device comprising:

[0012] A first security feature determination module, used to obtain first log data of a target business in real time and determine a first security feature of the first log data;

[0013] a target attack chain determination module, configured to input the first security feature into a pre-trained security event warning model to determine a target attack chain matching the first security feature;

[0014] A second security feature determination module, used to determine each second log data associated with the first log data, and determine a second security feature of each second log data;

[0015] The warning information generation module is used to input each of the second security features into a pre-trained security incident warning model, determine each reference attack chain that matches each of the second security features, and if it is determined that the target attack chain matches the target reference attack chain, generate warning information for the security incident of the target business.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the early warning method for security events described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the early warning method for security events described in any embodiment of the present invention when executed.

[0021] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method for early warning of security events described in any embodiment of the present invention is implemented.

[0022] The technical solution of the embodiment of the present invention determines the first security feature of the first log data by acquiring the first log data of the target business in real time; inputs the first security feature into a pre-trained security incident warning model to determine a target attack chain matching the first security feature; determines each second log data associated with the first log data, and determines the second security feature of each second log data; inputs each second security feature into the pre-trained security incident warning model to determine each reference attack chain matching each second security feature; if it is determined that the target attack chain matches the target reference attack chain, then generates warning information of the security incident of the target business, which can quickly and accurately determine the security incident attacking the target business, and improve the accuracy and timeliness of the security incident warning.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 This is a flow chart of a method for early warning of security events provided according to Embodiment 1 of the present invention;

[0026] Figure 2 is a flow chart of a security incident early warning method provided according to Embodiment 2 of the present invention;

[0027] Figure 3 This is a schematic diagram of the structure of a warning system for security events provided according to Embodiment 2 of the present invention;

[0028] Figure 4 This is a schematic diagram of the structure of a warning device for security events provided according to Embodiment 3 of the present invention;

[0029] Figure 5 It is a structural schematic diagram of an electronic device for implementing the early warning method for security events according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] Embodiment 1

[0033] Figure 1 This is a flowchart of a security incident warning method provided according to the first embodiment of the present invention. This embodiment can be applied to determine the security incident of attacking the target business and to warn the security incident. The method can be executed by a security incident warning device. The security incident warning device can be implemented in the form of hardware and / or software. The security incident warning device can be configured in electronic devices such as computers, servers or tablet computers. Figure 1 As shown, the method includes:

[0034] Step 110: Acquire first log data of the target business in real time, and determine a first security feature of the first log data.

[0035] Among them, the target business can be any business deployed in the target business system; illustratively, the target business system can be any system, for example, a shopping system, a query system or a search engine, etc., which is not limited in this embodiment; the target business system can include multiple businesses; illustratively, for a shopping system, it can include an order generation business, an order evaluation business or a payment business, etc., which is not limited in this embodiment.

[0036] It is understandable that, in the process of realizing the corresponding functions, the target business will involve the application of network equipment (for example, firewalls, routers, switches, etc.), host systems, applications, security devices or databases and other devices; accordingly, in this embodiment, the first log data of the target business acquired in real time can be any one of the log data such as network device log data, host system log data, application log data, security device log data or database access log data, which is not limited in this embodiment.

[0037] Optionally, in this embodiment, after obtaining the first log data of the target business, the first log data can be further parsed, and the first security feature of the first log data can be determined based on the parsing result; in this embodiment, the first security feature can be represented by a vector or matrix.

[0038] Optionally, in this embodiment, determining the first security feature of the first log data may include: parsing the first log data to obtain multiple content data matching the first log data; filtering each content data based on preset filtering rules to obtain the first security feature; or, inputting the first log data into a pre-fine-tuned target large model to obtain the first security feature.

[0039] In an optional implementation of the present embodiment, after the first log data of the target business is acquired in real time, the first log data can be parsed and processed to obtain multiple content data matching the first log data; exemplarily, the time information of the first log data can be obtained, for example, the time when the first log data was generated; the behavior information of the first log data can also be obtained, for example, the specific behavior of the user in the first log data; the network information of the first log data can also be obtained, for example, the source address, destination address, source port, destination port or transmission protocol of the first log data, which is not limited in the present embodiment.

[0040] Furthermore, the content data obtained through analysis can be filtered based on preset filtering rules to obtain the first security feature of the first log data; wherein the preset filtering rules can be time information filtering rules, behavior information filtering rules, or network information filtering rules, which are not limited in this embodiment.

[0041] In an optional implementation of the present embodiment, after the first log data of the target business is acquired in real time, the acquired first log data can be input into the pre-fine-tuned target big model, and the features of the first log data can be extracted through the target big model to output the first security feature; wherein, the target big model can be a natural language processing big model or other logical big model, which is not limited in the present embodiment.

[0042] The advantage of such a setting is that the first security feature of the first log data can be determined quickly and accurately, thereby providing assistance for early warning of subsequent security events.

[0043] Step 120: Input the first security feature into a pre-trained security event warning model to determine a target attack chain that matches the first security feature.

[0044] In this embodiment, after obtaining the first security feature of the first log data, the first security feature can be further input into a pre-trained security event warning model, and the target attack chain matching the first security feature can be determined through the security event warning model.

[0045] Among them, the security incident warning model can be a pre-trained machine learning model, which can be a classification model, a clustering model or an association mining model, which is not limited in this embodiment.

[0046] Optionally, in this embodiment, the security incident warning model can be trained through the following steps: obtaining log data of different devices in the target business system, and determining target log data in each of the log data, and determining a training data set based on the target log data; preprocessing each target log data in the training data set to obtain a target training data set; determining the target security features of each target log data in the target training data set, and inputting each of the target security features into the target machine learning model for iterative training; when the iteration stop condition is met, the security incident warning model is obtained.

[0047] Among them, the target business system can be a business processing system that includes multiple businesses, such as a shopping system, a query system or a search engine, etc., which is not limited in this embodiment; the target business system can include different devices, such as servers, host systems, routers, switches or databases, etc.

[0048] In an optional implementation of the present embodiment, log data generated by different devices in the target business system within the historical event period can be obtained, for example, all log data related to the target business system in the past one or three years; further, the obtained log data can be screened to obtain target log data, wherein the target log data is the log data generated within a short period of time before the target system is attacked by a security incident (for example, 30 seconds, 1 minute or 5 minutes, etc., which are not limited in the present embodiment), when the target system is attacked by a security incident, and within a short period of time after the target system is attacked by a security incident; further, the target log data can be added to a target database or folder to obtain a training data set.

[0049] Furthermore, each target log data in the acquired training data set can be preprocessed; in the present embodiment, each target log data in the training data set can be cleaned, standardized or formatted; illustratively, noise data or duplicate log data can be removed; each target log data can also be converted into a unified format; each target log data can also be converted into the format required by a subsequent machine learning model, for example, each target log data can be converted into structured data, etc.

[0050] Furthermore, the target security features of each target log data in the target training data set can be determined. For example, keywords in each target log data can be extracted to obtain entity features that match the target log data; features such as behavior patterns in the target log data can also be extracted; each target log data can also be analyzed to extract statistical features of the target log data, such as the mean or variance; further, entity features, behavior pattern features or statistical features can be determined as target security features of each target log data.

[0051] Furthermore, the target security features of the target log data can be input into the target machine learning model for iterative training. When the iteration stop conditions are met, for example, the number of iterations reaches a set threshold, or the output accuracy reaches a set threshold, a security incident warning model can be obtained; in this embodiment, the target machine learning model can be one or more of a classification model, a clustering model, or an association mining model, which is not limited in this embodiment.

[0052] In an optional implementation of the present embodiment, after determining the first security feature of the first log data, the first security feature can be further input into the security incident warning model trained through the above steps, and the security incident warning model extracts the feature information of the first security feature, and matches the extracted feature information with the feature information of each attack chain trained in the model, so as to determine the target attack chain that matches the first security feature; it can be understood that, in the present embodiment, the number of target attack chains that match the first security feature can be one or more. For example, the target attack chains that match the first security feature output by the security incident warning model can include: attack chain A, attack chain B, and attack chain C.

[0053] Step 130: Determine each second log data associated with the first log data, and determine a second security feature of each second log data.

[0054] Among them, each second log data associated with the first log data can be multiple log data generated by the target business after the first log data is generated, for example, 10, 20 or 50 log data, etc., which is not limited in this embodiment; illustratively, the generation time of the first log data is 10:00:00, then the generation time of the second log data can be 10:00:00-10:00:50.

[0055] In this embodiment, in addition to determining the second log data associated with the first log data based on time information, the second log data can also be determined by determining the source address, destination address, source port, destination port or transmission protocol of the first log data. For example, log data with the same transmission protocol as the first log data can be determined as the second log data; log data with the same destination address and destination port as the first log data can also be determined as the second log data.

[0056] In an optional implementation of this embodiment, after each second log data associated with the first log data is determined, the second security feature of each second log data may be further determined.

[0057] In an optional implementation of the present embodiment, after determining to obtain each second log data associated with the first log data, the second log data can be further parsed and processed to obtain multiple content data matching the second log data; illustratively, the time information of the second log data can be obtained, for example, the time when the second log data was generated; the behavior information of the second log data can also be obtained, for example, the specific behavior of the user in the second log data; the network information of the second log data can also be obtained, for example, the source address, destination address, source port, destination port or transmission protocol of the second log data, which is not limited in the present embodiment.

[0058] Furthermore, the content data obtained through analysis can be filtered based on preset filtering rules to obtain the second security feature of the second log data; wherein the preset filtering rules can be time information filtering rules, behavior information filtering rules, or network information filtering rules, which are not limited in this embodiment.

[0059] In an optional implementation of the present embodiment, after the second log data of the target business is acquired in real time, the acquired second log data can be input into the pre-fine-tuned target big model, and the features of the second log data can be extracted through the target big model to output the second security feature; wherein, the target big model can be a natural language processing big model or other logical big model, which is not limited in the present embodiment.

[0060] Step 140: Input each of the second security features into a pre-trained security incident warning model, determine each reference attack chain that matches each of the second security features, and if it is determined that the target attack chain matches the target reference attack chain, generate warning information for the security incident of the target business.

[0061] Optionally, in this embodiment, after determining the second security feature of each second log data, each determined second security feature can be further input into a pre-trained security incident warning model, and each reference attack chain matching each second security feature can be determined through the security incident warning model; further, it can be determined whether there is a target reference attack chain consistent with the target attack chain in the reference attack chain; if so, it can be determined that the target attack chain matches the target reference attack chain, and then warning information of the security incident of the target business can be further generated to prompt relevant personnel to review or process the warning information, thereby ensuring the safe operation of the target business.

[0062] The technical solution of this embodiment is to obtain the first log data of the target business in real time, determine the first security feature of the first log data; input the first security feature into a pre-trained security event warning model, and determine a target attack chain that matches the first security feature; determine each second log data associated with the first log data, and determine the second security feature of each second log data; input each second security feature into the pre-trained security event warning model, and determine each reference attack chain that matches each second security feature. If it is determined that the target attack chain matches the target reference attack chain, then generate warning information of the security event of the target business, which can quickly and accurately determine the security event that attacks the target business, and improve the accuracy and timeliness of the security event warning.

[0063] Embodiment 2

[0064] Figure 2 1 is a flowchart of a security incident warning method provided according to Embodiment 2 of the present invention. This embodiment is a further refinement of the above technical solution. The technical solution in this embodiment can be combined with each optional solution in one or more of the above embodiments. Figure 2 As shown, the method includes:

[0065] Step 210: Acquire first log data of the target business in real time, and determine a first security feature of the first log data.

[0066] Step 220: Process the first security feature through the security event warning model to determine each reference feature matching the first security feature; determine the target attack chain matching each reference feature, and output identification information of each target attack chain.

[0067] The identification information of each target attack chain may be information such as an ID or a name of each target attack chain that can uniquely identify each target attack chain.

[0068] Optionally, in this embodiment, after determining the first security feature of the first log data, the first security feature can be processed by the security event warning model, for example, feature extraction is performed on the first security feature through the security event warning model to determine each reference feature that matches the first security feature, for example, each reference feature whose similarity with the first security feature is greater than a set threshold (for example, 0.9 or 0.95, etc.) is determined; further, an attack chain matching each reference feature can be determined, that is, the attack chain to which each reference feature belongs, and each attack chain can be determined as a target attack chain; further, identification information of each target attack chain can be obtained and the identification information can be output.

[0069] Step 230: Determine each second log data associated with the first log data, and determine a second security feature of each second log data.

[0070] Optionally, in this embodiment, determining each second log data associated with the first log data may include: determining a first generation time of the first log data, determining a target time period that matches the first generation time; obtaining each log data generated by the target business within the target time period, and determining each log data generated by the target business within the target time period as each second log data.

[0071] Among them, the target time period matching the first generation time can be a time period including the first generation time, which can be five minutes, ten minutes or half an hour, etc., which is not limited in this embodiment; optionally, in this embodiment, after parsing the first log data to obtain the first generation time, the first generation time can be used as the starting point, and the subsequent five-minute time period can be determined as the target time period; the first generation time can be used as the midpoint, and the time period before the first three minutes and the time period after the last three minutes can be determined as the target time period; the first generation time can also be used as the end point, and the time period before the ten minutes can be determined as the target time period.

[0072] In an optional implementation of this embodiment, after the target time period is determined, all log data related to the target business within the target time period may be further acquired, and the log data may be determined as second log data associated with the first log data.

[0073] Step 240: Process each of the second security features through the security incident warning model, and determine each associated feature that matches each of the second security features; determine a reference attack chain that matches each of the associated features, and output identification information of each of the reference attack chains.

[0074] Optionally, in this embodiment, after determining each second log data associated with the first log data and determining the second security feature of each second log data, the second security feature can be processed through the security event warning model, for example, feature extraction is performed on the second security feature through the security event warning model to determine each associated feature that matches the second security feature, for example, each associated feature whose similarity with the second security feature is greater than a set threshold (for example, 0.9 or 0.95, etc.) is determined; further, the attack chain matching each associated feature can be determined, that is, the attack chain to which each associated feature belongs, and each attack chain can be determined as a reference attack chain; further, the identification information of each reference attack chain can be obtained and the identification information can be output.

[0075] Step 250: determine the similarity between the identification information of each reference attack chain and the identification information of the target attack chain, and obtain each similarity calculation result; when the target similarity calculation result meets a preset similarity condition, determine that the target attack chain matches the target reference attack chain.

[0076] The target similarity calculation result is a similarity calculation result between the identification information of the target attack chain and the identification information of the target reference supply chain.

[0077] The similarity condition may be that the similarity calculation result is greater than or equal to a set similarity threshold, and the set similarity threshold may be 0.8, 0.9 or 0.95, etc., which is not limited in this embodiment.

[0078] Optionally, in this embodiment, after determining the identification information of each target attack chain and the identification information of each reference attack chain, the identification information of each target attack chain and the identification information of each reference attack chain can be respectively represented by vectors to obtain each target attack chain vector and each reference attack chain vector; further, the similarity between each target attack chain vector and each reference attack chain vector can be respectively calculated to obtain each similarity calculation result.

[0079] Furthermore, it can be determined whether there is a target similarity greater than or equal to a set threshold in each similarity calculation result; if so, it can be determined that the target reference attack chain corresponding to the target similarity calculation result matches the target attack chain.

[0080] Step 260: Generate warning information of the security incident of the target business.

[0081] Optionally, in this embodiment, after determining that the target attack chain matches the target reference attack chain, early warning information of the security incident of the target business can be further generated; wherein the early warning information may include early warning levels, for example, high, medium, and low; it may also include early warning content, for example, attack type, attack target, or attack tool; it may also include early warning measures, for example, isolating the network or updating vulnerability patches.

[0082] The scheme of this embodiment, after determining each reference attack chain that matches each second security feature, may also include: determining the similarity between the identification information of each reference attack chain and the identification information of the target attack chain to obtain each similarity calculation result; when the target similarity calculation result meets the preset similarity condition, determining that the target attack chain matches the target reference attack chain, can quickly determine whether the target business is threatened by a security incident, thereby improving the accuracy and timeliness of security incident warnings.

[0083] Figure 31 is a schematic diagram of the structure of a security incident early warning system provided according to Embodiment 2 of the present invention, which mainly includes the following:

[0084] Data collection module 310: responsible for collecting security event data from multiple sources.

[0085] Data preprocessing module 320: responsible for cleaning, standardizing and formatting the collected security event data for subsequent analysis and processing.

[0086] Feature extraction module 330: responsible for extracting features from the pre-processed security event data, such as attack type, attack target, attack tool, etc.

[0087] Machine learning module 340: responsible for using machine learning algorithms to learn and analyze features and establish a security incident warning model.

[0088] Early warning module 350: responsible for evaluating new security event data according to the early warning model and generating early warning information.

[0089] Adaptive module 360: responsible for automatically adjusting early warning strategies according to environmental changes and security event updates, such as adjusting model parameters, updating feature libraries, etc.

[0090] In specific implementations, the data collection module can use a variety of technical means to collect security event data, such as: automatically capturing security event information released on open source websites, social media, forums and other public channels; obtaining professional security event data from different platforms; analyzing the log data of network devices and security devices to extract potential security event information.

[0091] The data preprocessing module mainly includes the following steps:

[0092] Data cleaning: remove noise data, duplicate data, etc. to improve data quality;

[0093] Data standardization: converting data into a unified format to facilitate subsequent processing;

[0094] Data formatting: Converting data into the format required by the machine learning model.

[0095] The feature extraction module can use a variety of technical means to extract features. For example, it uses natural language processing technology to analyze text data and extract features such as keywords and entities; analyzes network behavior data and extracts features such as attack behavior patterns; and analyzes data to extract statistical features such as mean and variance.

[0096] The machine learning module can use a variety of machine learning algorithms, such as classification algorithms: used to identify attack types and attack targets in security event data; clustering algorithms: used to classify security event data into different categories, such as attack sources and attack targets; association rule mining algorithms: used to discover associations in security event data, such as the association between attack methods and attack targets.

[0097] The early warning module evaluates new security incident data according to the early warning model and generates early warning information. The early warning information includes the following: Early warning level: According to the severity and urgency of the security incident, the early warning is divided into different levels, such as low, medium, and high; Early warning content: Describes the specific content of the security incident, such as the attack type, attack target, and attack tool; Early warning measures: Propose corresponding defense measures, such as isolating the network, updating vulnerability patches, etc.

[0098] The adaptive module can automatically adjust the warning strategy according to environmental changes and security event updates. For example, according to new security event data, adjust the parameters of the machine learning model to improve the accuracy of the model; add new security event data to the feature library to enrich the content of the feature library; adjust the warning rules: according to the new threat environment, adjust the warning rules to improve the accuracy and timeliness of the warning.

[0099] The early warning method for security incidents involved in this embodiment can be applied to various security scenarios, for example, network security defense, identifying and warning of security incidents such as network attacks and malware intrusions; security operations, monitoring the network environment, timely discovering security risks, and taking corresponding defense measures; security incident analysis, analyzing security incident data, and understanding the current security threat situation.

[0100] The solution of the embodiment of the present invention can automatically adjust the early warning strategy according to environmental changes and security event updates, thereby improving the accuracy and timeliness of early warnings; it can integrate security event data from multiple sources for comprehensive analysis and evaluation; it can effectively reduce false alarm and missed alarm rates, thereby improving the accuracy of early warnings.

[0101] Embodiment 3

[0102] Figure 4 Schematic diagram of a security incident warning device according to Embodiment 3 of the present invention. Figure 4 As shown, the device includes: a first security feature determination module 410, a target attack chain determination module 420, a second security feature determination module 430 and a warning information generation module 440.

[0103] The first security feature determination module 410 is used to obtain first log data of a target business in real time and determine a first security feature of the first log data;

[0104] A target attack chain determination module 420 is used to input the first security feature into a pre-trained security event warning model to determine a target attack chain matching the first security feature;

[0105] A second security feature determination module 430, configured to determine each second log data associated with the first log data, and determine a second security feature of each second log data;

[0106] The warning information generation module 440 is used to input each of the second security features into the pre-trained security incident warning model, determine each reference attack chain that matches each of the second security features, and if it is determined that the target attack chain matches the target reference attack chain, generate warning information for the security incident of the target business.

[0107] The solution of this embodiment is to obtain the first log data of the target business in real time through the first security feature determination module, and determine the first security feature of the first log data; input the first security feature into the pre-trained security event warning model through the target attack chain determination module, and determine the target attack chain matching the first security feature; determine each second log data associated with the first log data through the second security feature determination module, and determine the second security feature of each second log data; input each second security feature into the pre-trained security event warning model through the warning information generation module, and determine each reference attack chain matching each second security feature. If it is determined that the target attack chain matches the target reference attack chain, then generate warning information of the security event of the target business, which can quickly and accurately determine the security event attacking the target business, and improve the accuracy and timeliness of the security event warning.

[0108] In an optional implementation of this embodiment, the early warning device for security events further includes a security event early warning model training module, which is used to obtain log data of different devices in the target business system, determine target log data in each of the log data, and determine a training data set based on the target log data;

[0109] Preprocessing each target log data in the training data set to obtain a target training data set;

[0110] Determine the target security feature of each target log data in the target training data set, and input each target security feature into the target machine learning model for iterative training;

[0111] When the iteration stop condition is met, the security incident warning model is obtained;

[0112] Among them, the target machine learning model includes at least one of the following: a classification model, a clustering model or an association mining model.

[0113] In an optional implementation of this embodiment, the first security feature determination module 410 is specifically configured to parse the first log data to obtain a plurality of content data matching the first log data;

[0114] Screening each of the content data based on a preset screening rule to obtain the first security feature;

[0115] Alternatively, the first log data is input into a pre-fine-tuned target macro model to obtain the first security feature.

[0116] In an optional implementation of this embodiment, the target attack chain determination module 420 is specifically configured to process the first security feature through the security event warning model to determine each reference feature matching the first security feature;

[0117] Determine a target attack chain that matches each of the reference features, and output identification information of each of the target attack chains.

[0118] In an optional implementation of this embodiment, the second security feature determination module 430 is further used to determine a first generation time of the first log data, and determine a target time period matching the first generation time;

[0119] Each log data generated by the target business within the target time period is acquired, and each log data generated by the target business within the target time period is determined as each second log data.

[0120] In an optional implementation of this embodiment, the warning information generation module 440 is specifically used to process each of the second security features through the security event warning model, and respectively determine each associated feature matching each of the second security features;

[0121] A reference attack chain matching each of the associated features is determined, and identification information of each of the reference attack chains is output.

[0122] In an optional implementation of this embodiment, the warning information generating module 440 is further specifically used to determine the similarity between the identification information of each reference attack chain and the identification information of the target attack chain, and obtain the similarity calculation results;

[0123] When the target similarity calculation result meets the preset similarity condition, determining that the target attack chain matches the target reference attack chain;

[0124] The target similarity calculation result is a similarity calculation result between the identification information of the target attack chain and the identification information of the target reference supply chain.

[0125] The early warning device for security incidents provided in the embodiment of the present invention can execute the early warning method for security incidents provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0126] In the technical solution of the embodiment of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of log data involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0127] Embodiment 4

[0128] Figure 5 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0129] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0130] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0131] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a warning method for security events, the method comprising: acquiring the first log data of the target business in real time, determining the first security feature of the first log data; inputting the first security feature into a pre-trained security event warning model, determining a target attack chain matching the first security feature; determining each second log data associated with the first log data, and determining the second security feature of each second log data; inputting each second security feature into a pre-trained security event warning model, determining each reference attack chain matching each second security feature, and if it is determined that the target attack chain matches the target reference attack chain, then generating warning information for the security event of the target business.

[0132] In some embodiments, the early warning method of security events may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the early warning method of security events described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the early warning method of security events in any other appropriate manner (e.g., by means of firmware).

[0133] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0134] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0135] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0136] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0137] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0138] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0139] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0140] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A security incident early warning method, characterized in that: include: Acquire first log data of a target business in real time, and determine a first security feature of the first log data; Inputting the first security feature into a pre-trained security event warning model to determine a target attack chain matching the first security feature; determining each second log data associated with the first log data, and determining a second security feature of each second log data; Each of the second security features is input into a pre-trained security incident warning model to determine each reference attack chain that matches each of the second security features. If it is determined that the target attack chain matches the target reference attack chain, warning information of the security incident of the target business is generated.

2. The early warning method for security incidents according to claim 1, characterized in that: The security incident warning model is trained through the following steps: Obtain log data of different devices in a target business system, determine target log data in each of the log data, and determine a training data set based on the target log data; Preprocessing each target log data in the training data set to obtain a target training data set; Determine a target security feature of each target log data in the target training data set, and input each target security feature into a target machine learning model for iterative training; When the iteration stop condition is met, the security incident warning model is obtained; Among them, the target machine learning model includes at least one of the following: a classification model, a clustering model or an association mining model.

3. The early warning method for security incidents according to claim 1, characterized in that: The determining a first security feature of the first log data includes: Parsing the first log data to obtain a plurality of content data matching the first log data; Screening each of the content data based on a preset screening rule to obtain the first security feature; Alternatively, the first log data is input into a pre-fine-tuned target macro model to obtain the first security feature.

4. The early warning method for security incidents according to claim 1, characterized in that: The step of inputting the first security feature into a pre-trained security event warning model to determine a target attack chain matching the first security feature includes: Processing the first security feature through the security event warning model to determine reference features matching the first security feature; Determine a target attack chain that matches each of the reference features, and output identification information of each of the target attack chains.

5. The early warning method for security incidents according to claim 1, characterized in that: The determining each second log data associated with the first log data includes: Determine a first generation time of the first log data, and determine a target time period matching the first generation time; Each log data generated by the target business within the target time period is acquired, and each log data generated by the target business within the target time period is determined as each second log data.

6. The early warning method for security incidents according to claim 1, characterized in that: The step of inputting each of the second security features into a pre-trained security event warning model to determine each reference attack chain matching each of the second security features includes: Processing each of the second security features through the security event warning model, and respectively determining each associated feature matching each of the second security features; A reference attack chain matching each of the associated features is determined, and identification information of each of the reference attack chains is output.

7. The early warning method for security incidents according to claim 6, characterized in that: After determining each reference attack chain matching each second security feature, the method further includes: Determine the similarity between the identification information of each reference attack chain and the identification information of the target attack chain, and obtain similarity calculation results; When the target similarity calculation result meets the preset similarity condition, determining that the target attack chain matches the target reference attack chain; The target similarity calculation result is a similarity calculation result between the identification information of the target attack chain and the identification information of the target reference supply chain.

8. A security incident early warning device, characterized in that: include: A first security feature determination module, used to obtain first log data of a target business in real time and determine a first security feature of the first log data; a target attack chain determination module, configured to input the first security feature into a pre-trained security event warning model to determine a target attack chain matching the first security feature; A second security feature determination module, used to determine each second log data associated with the first log data, and determine a second security feature of each second log data; The warning information generation module is used to input each of the second security features into a pre-trained security incident warning model, determine each reference attack chain that matches each of the second security features, and if it is determined that the target attack chain matches the target reference attack chain, generate warning information for the security incident of the target business.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the early warning method for security events described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the early warning method for security events according to any one of claims 1 to 7 when executed.

Images