Asset data processing method, device and processing equipment for network assets

Abstract

The invention provides an asset data processing method and device for network assets, and processing equipment, and is used for introducing an SOAR mechanism and an image library on the basis of identified network assets to construct a whole asset model and an asset relationship thereof, so that global display of an access relationship between assets can be realized in a highly visual manner, and the overall performance of the network assets is improved. And corresponding asset vulnerability and risk propagation paths are continuously and deeply mined, so that a very convenient and accurate visual data support is provided for a worker to know global assets and risks existing in different aspects, diversified business requirements can be met, and the method has relatively good application value and reference significance and is worthy of popularization and application. And the network security protection capability of an enterprise is further enhanced.

Description

Technical Field

[0001] The present application relates to the field of network asset management, and specifically to a method, device and processing equipment for processing asset data of network assets. Background Art

[0002] Identifying different types of network assets that exist in an enterprise's internal network architecture, such as network security devices such as gateways, firewalls, and routing switching devices, can obviously provide a good foundation for the enterprise's network security work.

[0003] However, the inventors of this application found that the existing technology focuses on how to more accurately capture the network assets existing in the network architecture, but is accustomed to using conventional means to better carry out network security work based on the identified network assets. This to a certain extent restricts the contribution that network asset identification can make to network security work, and its application value is limited. Summary of the invention

[0004] The present application provides an asset data processing method, apparatus and processing equipment for network assets, which are used to introduce a Security Orchestration Automation and Response (SOAR) mechanism and a gallery to build a full asset model and its asset relationships based on identified network assets, so that a highly visual global display of access relationships between assets can be achieved, and the corresponding asset vulnerabilities and risk propagation paths can be further explored. This provides very convenient and accurate visual data support for staff to understand the risks of global assets and their different aspects, can meet diverse business needs, has good application value and reference significance, and promotes further enhancement of the company's network security protection capabilities.

[0005] In a first aspect, the present application provides a method for processing asset data of a network asset, the method comprising:

[0006] Under the security orchestration automated response task, asset data of the target network assets is collected, wherein the target network assets are specifically network assets that are pre-identified from the company network scope according to the corresponding network asset identification strategy;

[0007] Import asset data into the ES model to configure the initial data model for the target network assets;

[0008] Based on the data content of the access relationship between assets contained in the model, the ES model with imported asset data is converted into a graph library by extracting the corresponding nodes and relationship forms, and the corresponding overall asset view is displayed in a graph structure. In the overall asset view, different network asset ownership areas of different assets are identified, and different assets correspond to different nodes. The access relationship between assets is displayed through connections based on node identification, IP address identification, port identification and access direction identification.

[0009] In a second aspect, the present application provides an asset data processing device for a network asset, the device comprising:

[0010] A collection unit, used to collect asset data of target network assets under the security orchestration automated response task, wherein the target network assets are specifically network assets pre-identified from the company network range according to the corresponding network asset identification strategy;

[0011] The import unit is used to import asset data into the ES model to configure the initial data model of the target network assets;

[0012] The conversion unit is used to convert the ES model with asset data imported into the graph library by extracting the corresponding nodes and relationship forms based on the data content of the access relationship between assets contained in the model, and display the corresponding overall asset view in a graph structure. In the overall asset view, different network asset ownership areas of different assets are identified, different assets correspond to different nodes, and the access relationship between assets is displayed through connections based on node identification, IP address identification, port identification and access direction identification.

[0013] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0014] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0015] From the above content, it can be concluded that the present application has the following beneficial effects:

[0016] For network security work involving network assets, this application introduces SOAR mechanism and gallery to build a full asset model and its asset relationships based on the identified network assets, so that the global display of access relationships between assets can be achieved in a highly visual way, and the corresponding asset vulnerabilities and risk propagation paths can be further explored. This provides very convenient and accurate visual data support for staff to understand the risks of global assets and their different aspects, which can meet diverse business needs, has good application value and reference significance, and promotes further enhancement of the company's network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 A flowchart of a method for processing asset data of network assets of this application;

[0019] Figure 2 An example schematic diagram of the overall asset view of this application;

[0020] Figure 3 This is a schematic diagram of an example of the asset vulnerability deduction results of this application;

[0021] Figure 4 This is a schematic diagram of an example of the risk propagation path deduction results of this application;

[0022] Figure 5 This is another example schematic diagram of the risk propagation path deduction results of this application;

[0023] Figure 6 A schematic diagram of the structure of an asset data processing device for network assets of the present application;

[0024] Figure 7 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0026] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0027] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0028] Before introducing the asset data processing method of network assets provided by this application, the background content involved in this application is first introduced.

[0029] The asset data processing method, device and computer-readable storage medium of network assets provided in the present application can be applied to processing equipment to introduce SOAR mechanism and gallery to build a full asset model and its asset relationship based on the identified network assets, so as to realize the global display of access relationship between assets in a highly visual way, and further explore the corresponding asset vulnerabilities and risk propagation paths in depth, so as to provide very convenient and accurate visual data support for staff to understand the risks of global assets and their different aspects, which can meet diverse business needs, has good application value and reference significance, and promotes further enhancement of the enterprise's network security protection capabilities.

[0030] The asset data processing method of network assets mentioned in this application can be executed by an asset data processing device of the network assets, or a server, physical host or user equipment (UE) and other different types of processing equipment that integrate the asset data processing device of the network assets. Among them, the asset data processing device of the network assets can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, tablet computer, laptop computer, desktop computer or personal digital assistant (PDA), and the processing device can be set in the form of a device cluster.

[0031] It can be understood that in specific applications, the processing device is usually a network node in the internal network architecture of the enterprise. It can be an original network node in the network architecture or a newly added network node for configuring the present application scheme. In addition, in some cases, it can also be a third-party device outside the internal network architecture of the enterprise. The third-party device provides third-party services through the present application scheme, which is also possible in actual situations.

[0032] At the same time, considering that the present application usually carries out data processing based on existing asset data, generally speaking, it is sufficient to meet the required data processing capabilities. The specific equipment type and equipment deployment form of the processing equipment are relatively flexible, and the present application does not make too many restrictions.

[0033] Of course, if the specific collection and processing of asset data is also involved, further adaptation and adjustment will be required for the device type and deployment form of the processing equipment, combined with the application scenarios of the enterprise's internal network architecture.

[0034] Next, we will introduce the asset data processing method of network assets provided by this application.

[0035] First, see Figure 1 , Figure 1 A flow chart of the asset data processing method of the network assets of the present application is shown. The asset data processing method of the network assets provided by the present application may specifically include the following steps S101 to S103:

[0036] Step S101, under the security orchestration automated response task, collecting asset data of target network assets, wherein the target network assets are specifically network assets pre-identified from the company network scope according to the corresponding network asset identification strategy;

[0037] It is understandable that asset discovery technology is not the focus of the present application. The focus of the present application is on the basis of identified network assets. Therefore, in specific applications, the collection and processing of asset data here, whether it is directly extracting asset data that has been collected in advance, or receiving asset data that has been collected in advance by other devices, or collecting asset data in real time by itself, or having other devices collect asset data in real time, can be achieved through relevant existing technologies.

[0038] As an example, for real assets in the network, they can be acquired dynamically using probes or imported using static data.

[0039] Specifically, you can use specific ready-made tools such as ARP discovery. Of course, you can also use improved or self-developed tools to achieve the goal of asset discovery.

[0040] Among them, network assets can be both physical hardware devices and related application services at the software level, and their specific definitions can be flexibly adjusted according to specific needs.

[0041] In addition, it can be noted that in specific operations, the collection of asset data here is subject to a limitation on the scope of network assets. Specifically, the target network assets can be the entire network involved in the company / enterprise by default, or they can be narrowed down to a local network in the entire network. This is all possible, thereby effectively controlling the scope of asset data processing in this application scheme.

[0042] At the same time, it can also be seen that this application is initiated by a security orchestration automated response task, which involves the application of the security orchestration automated response mechanism, namely the SOAR mechanism. In layman's terms, SOAR is the visual orchestration of security script processes through interface-based graphic drag and drop. It can customize the specific security resources for orchestration action linkage, and provide built-in actions required by the orchestration process, such as manual approval, timed execution, and loop judgment, to assist security personnel in establishing a reasonable workflow. In this way, while following the SOAR concept, this application solution can be more concise and efficient in promoting corresponding task processing in actual applications.

[0043] Among them, the security orchestration automated response task can be initiated manually, forwarded by other devices, or initiated locally according to preset initiation policies / rules. All of these are possible.

[0044] As an example, the collection and processing of asset data in step S101 and the subsequent step S102 of importing the asset data into the ES model can be implemented through the collection script corresponding to SOAR.

[0045] In addition, in specific operations, this application takes into account that the access relationship between asset data and its assets changes in real time, but the frequency of change is not high. In order to facilitate collection and display, this application can specifically agree to use days as the dimension, collect once a day, and collect multiple times, with the latest one as the basis. Therefore, the asset data collected on the day can also be deleted here to avoid duplication.

[0046] Step S102, importing asset data into the ES model to implement configuration of an initial data model for target network assets;

[0047] Among them, the ES model, namely the Elasticsearch model, is an open source search and analysis engine based on Apache Lucene, mainly used for distributed, multi-tenant full-text search. It is a document-oriented NoSQL database designed for efficient storage, search and analysis of large-scale data. It stores data as JSON documents and uses inverse indexing technology to enable it to achieve real-time search functions in massive data environments, which is more suitable for the application of this application scheme here.

[0048] It is understandable that the asset data collected above involves a variety of data contents and may also involve different data formats. For this, it can be summarized and sorted and then stored in the ES model (also called asset model, ES asset model).

[0049] The asset data model obtained by importing asset data into the ES model includes a series of data contents of network assets. The asset data collected by each system needs to be filled and stored in the corresponding format.

[0050] Among them, based on data storage needs, in addition to storing the ES model, the collected asset data can also be stored additionally, for example, it can be stored in a Mysql database. Mysql is an open source relational database management system that uses structured query language to manage and query data. It has the advantages of high performance, high reliability and ease of use, and is suitable for use as the data warehouse involved here.

[0051] Among them, corresponding to the application of access relations between assets involved in the subsequent process, in the process of storing asset data into the ES model, it also involves: Cartesian product splitting of asset data, obtaining the access relations between each asset (or asset IP) according to the access policy system, and storing the access relation data into the ES model.

[0052] Among them, Cartesian Product is an important concept in set theory, which refers to the set of all possible ordered pairs between two sets. In database and graph database queries, Cartesian Product represents all possible results of combining any pair of elements from two sets without any restrictions.

[0053] In specific operations, the access relationship between each asset IP can be obtained separately. Considering that the logic takes a long time, it can also be designed as follows: first create a new access path query task, then obtain the task status, query once every 10 minutes to determine whether the task status is completed. If not, wait for the next query. If completed, all access relationship (access path) results are entered into the ES model.

[0054] Step S103, based on the data content of the access relationship between assets contained in the model, the ES model with the asset data imported is converted into a graph library by extracting the corresponding nodes and relationship forms, and the corresponding overall asset view is displayed in a graph structure, wherein different network asset ownership areas of different assets are identified in the overall asset view, different assets correspond to different nodes, and the access relationship between assets is displayed through lines based on node identification, IP address identification, port identification and access direction identification.

[0055] It can be understood that, based on the asset data content collected by the ES model configured previously, the present application can focus on the access relationship between assets contained in the model itself (already obtained before importing the model) or focus on the access relationship between assets mined based on the asset data content involved in the model (involving further analysis and processing based on the ES model, which is another access relationship processing method that can be adopted) to further transform the asset data content (model data) stored in the ES model into a data form, crop and convert it into the node and relationship form corresponding to the gallery, so that it can be stored in the gallery model to obtain a gallery model that is easy to display with high visibility, and the gallery model can display the corresponding overall asset view through a graph structure.

[0056] Among them, the graph library is a graph database, which can also be called a graph library model. As an example, Neo4j can be used, which is a high-performance NOSQL graph database. It stores structured data on the network instead of in a table. The network (called a graph from a mathematical point of view) is a flexible data structure that can apply a more agile and rapid development model.

[0057] A node can be understood as an entity in a graph database. It has multiple attributes and is generally represented by an ellipse.

[0058] A relationship can be understood as the relationship between nodes. There can be multiple relationships between two nodes. Relationships have directions. a-[relationship 1]->b and a<-[relationship 1]-[b] are different relationships.

[0059] In this way, the library model obtained by converting and cropping the previous asset model specifically obtains a model that includes nodes such as IP and port, as well as relationships such as IP access IP and IP enabled port. At the image level, that is, the overall asset view, it can be specifically displayed through network asset attribution areas (which can be represented by graphics such as ellipses, and can be specifically divided into specific areas such as development and testing domains, office domains, and data center domains), node identifiers, IP address identifiers (which can identify specific IP addresses, and IP identifiers can also be combined with node identifiers into an image identifier), port identifiers (which can identify specific ports) and access direction identifiers (which can be arrow identifiers).

[0060] Specifically, for easier understanding, you can also combine Figure 2 An example schematic diagram of the overall asset view of the present application is shown to provide a more vivid understanding.

[0061] At the same time, as an example, the processing of the gallery model in step S103 here can also be implemented through the gallery entry script corresponding to SOAR.

[0062] In addition, corresponding to the visualization application that the configured gallery model may involve, the specific application of this application may also involve the display processing of its overall asset view.

[0063] In this regard, the present application can display the overall asset view corresponding to the gallery model through a display screen contained locally in the device (specifically, a touch screen), an external display screen device, or other devices with a display screen.

[0064] In this case, through the above solution settings, complex asset associations and access paths can be efficiently represented and queried, enhancing the visualization and operability of asset data. On-site personnel or remote personnel (involving web services) can easily view asset conditions with highly visual characteristics, especially the global display of access relationships between assets, which is convenient for staff to control the situation of network security work, make judgments and decisions, and better deploy further network security work.

[0065] Among them, it can be understood that the overall resource view can also be configured with interactive functions, so that by clicking on image identifiers such as node identifiers, IP address identifiers, port identifiers and access direction identifiers in the view, the corresponding data recorded in the gallery model of the corresponding element can be opened, or by clicking on components such as image identifiers, the overall or partial image display effect of the overall resource view can be switched, thereby further providing a better user experience.

[0066] Further, refer to Table 1 below:

[0067] Table 1 - Asset Data Examples

[0068]

[0069]

[0070] As an exemplary embodiment, the asset data collected by the present application may specifically involve primary public fields and secondary public fields, wherein the primary public fields involve the first host name, the first IP address, the first MAC address, the asset ID, the first source system, the data source type, the collection time, the basic information, the open port, and the access relationship;

[0071] The secondary public fields corresponding to the basic information include the second host name, second IP address, second MAC address, second source system, department, user, telephone number, last online time, operating system, operating system version, hardware type, physical address, and management person in charge;

[0072] The secondary public fields corresponding to the open ports involve the third source system, the first port, the port protocol, and the port binding IP address;

[0073] The secondary public fields corresponding to the access relationship include source domain name, source IP address, destination domain name, destination IP address, destination port, port and communication protocol (such as ANY (any type), TCP, UDP, ICMP, etc.).

[0074] It is easy to see that the first-level field is located in the first column on the left side of Table 1, and the second-level field is located in the second column on the left side of Table 1. At the same time, there are some fields with the same name in different field positions. Considering that the specific field objects behind them may be the same or different, prefixes such as first, second, third, and fourth are used to effectively distinguish them.

[0075] In addition to the primary and secondary fields, it can be seen from Table 1 that asset data can also involve notes (involving aspects such as field types) and ES types corresponding to the ES model (involving STRING, IP, DATE, INT, etc.). Of course, in actual applications, other specific contents may also be involved in response to different application requirements.

[0076] It can be understood that the embodiments herein provide a set of specific implementation solutions for the specific contents that the asset data of this application may involve.

[0077] Furthermore, the present application scheme may also involve the handling of vulnerabilities in network assets to meet the needs of network security work and better reflect the security risks associated with vulnerabilities in network assets in depth.

[0078] In this regard, as another exemplary embodiment, the method of the present application may further include:

[0079] Perform vulnerability scanning on target network assets to obtain corresponding vulnerability data;

[0080] In this case, correspondingly, step S102 of importing the asset data into the ES model may include:

[0081] Import asset data and vulnerability data into the ES model.

[0082] It is understandable that, in specific operations, vulnerability scanning processing is similar to asset discovery processing, which is itself a relatively mature technical concept with a large number of existing technologies. Therefore, it is usually possible to directly adopt relevant existing solutions / tools to complete the scanning goal of the vulnerabilities existing in the target network assets. Of course, in some cases, it is also possible to adopt improved scanning solutions or novel self-developed solutions.

[0083] In this way, the ES model, i.e. the asset model, can include data content related to vulnerabilities. The subsequent access relationships between assets and the gallery model can also involve data content related to vulnerabilities. This adds the dimension of vulnerability to the details, enriches the content of the asset model, gallery model and the overall asset view, and continues to strengthen the effect of the solution that can be achieved.

[0084] Corresponding to the introduction of the vulnerability here, referring to the aforementioned Table 1, as another exemplary embodiment, the first-level public field corresponding to the vulnerability data of the present application may specifically involve the vulnerability, and the second-level public field corresponding to the vulnerability may specifically involve the fourth source system, vulnerability name, risk level (such as high, medium, and low risk levels), CVE number, threat score, CNNVD number, CNCVE number, CNVD number, port, and scan time.

[0085] Among them, the CVE number, CNNVD number, CNCVE number and CNVD number are vulnerability numbers (vulnerability identifiers) corresponding to different types of vulnerability databases or vulnerability determination benchmarks.

[0086] In addition, vulnerability data may also involve other content such as notes and ES types.

[0087] Similar to the previous example, the implementation example here is the specific content that the asset data of this application may involve, and continues to improve a set of specific implementation supporting solutions.

[0088] In this case, for the gallery model obtained by converting and cutting the previous asset model, a model containing nodes such as IP, vulnerability and port is obtained, as well as relationships such as IP access IP, IP enabled port and port vulnerability.

[0089] Among them, for the contents of the two aspects of the library model, nodes and relationships, as an example, you can refer to the following Table 2 and Table 3, as well as the corresponding brief descriptions:

[0090] 1. The entire model is divided into two types: nodes and relationships

[0091] 2. The attribute with * represents a unique identifier. When storing nodes and relationships, this data is used as the basis for merge (merge means that when storing data, it automatically determines whether to create or update based on whether the node or relationship exists)

[0092] 3. All nodes and relationships must have a name attribute for display. Other colors and icons can be set later.

[0093] 4. All nodes and relationships are automatically attached with an attribute gather_time (collection time) for daily data isolation. Accordingly, when querying, all nodes and relationships must also automatically carry the current query date.

[0094] Table 2 - Examples of content involved in nodes

[0095]

[0096] Table 3 - Examples of content involved in relationships

[0097]

[0098]

[0099] Furthermore, in addition to enhancing the effect of the solution by increasing the data dimension of the content, the present application may also involve further data analysis and processing to continue to enhance the effect of the solution.

[0100] In this regard, refer to Figure 3 An example schematic diagram of the asset vulnerability deduction result of the present application is shown. As another exemplary embodiment, the method of the present application may also include:

[0101] Based on the gallery, asset vulnerability deduction is performed based on the access relationship between assets. The obtained asset vulnerability deduction results (risk items) can be displayed in the overall asset view. Among them, the asset vulnerability deduction results are based on the display content of the connection, and the specific configuration content can be as follows:

[0102] 1) Solid red line, which meets the first condition of accessible port at access control level and the second condition of port vulnerability, corresponding to the high risk situation of target IP;

[0103] 2) Solid black line, meets the first condition but does not meet the second condition, corresponding to the target IP has no risk;

[0104] 3) The dashed black line satisfies the first condition and the third condition that the port is not enabled, corresponding to the target IP without risk;

[0105] 4) Solid gray line, the default connection line, is applicable to connections other than the above three access relationships.

[0106] For the above four connection settings, they can be determined through the following processing content:

[0107] a. Start, solid gray line: Determine whether the relationship between the nodes of the query result is an access relationship type. If so, execute the following process. If not, mark this connection line as a solid gray line;

[0108] b. Dashed black line: Determine whether the access relationship has enabled the port. If not, mark this connection line as a dashed black line. If so, determine whether the access relationship matches the port. If not, mark this connection line as a dashed black line. If it matches, execute the following process;

[0109] c. Solid black line, solid red line: Determine whether the port enabled by the access relationship has a vulnerability. If there is a vulnerability, mark this connection line as a solid red line. If there is no vulnerability, mark this connection line as a solid black line.

[0110] As an example, this application can use built-in queries to query the vulnerability paths between different assets or groups based on the results of the gallery model modeling, and specifically divide them into two categories: risk-free and risky, to provide a basis for network security decision-making.

[0111] In addition, as an example, the following query statement can be used to trigger the asset vulnerability deduction process here:

[0112] MATCH(sourceIp:ip)-[accessRel:access]->(targetIp:ip)

[0113] OPTIONAL MATCH(targetIp)-[r:enable]->(port:port|vul_port)

[0114] OPTIONAL MATCH(port)-[v:existence]->(vul:vulnerability)

[0115] RETURN sourceIp,accessRel,targetIp,r,port,v,vul

[0116] The corresponding statement descriptions are:

[0117] This query statement is the access relationship between two IP nodes in the asset. It can also optionally retrieve the ports enabled by the targetIp and the existing vulnerabilities, and display solid red lines, solid black lines, dashed black lines, and solid gray lines based on the access relationship algorithm.

[0118] In this way, through the setting of this embodiment, the present application can combine the visualization settings of the four connections to characterize the processing results of the asset vulnerability deduction logic designed by the present application in a specific application, taking into account a high degree of visualization on the basis of in-depth asset vulnerability analysis, and can provide very practical data support for network security work, with better application value.

[0119] In addition, this application can also carry out risk propagation path deduction and processing for vulnerability exploitation based on the selected source IP and available ports.

[0120] Specifically, refer to Figure 4 and Figure 5 The example schematic diagram of the risk propagation path deduction result of the present application is shown. As another exemplary embodiment, the method of the present application may also include:

[0121] Based on the gallery, risk propagation path deduction for vulnerability exploitation is performed, and the obtained risk propagation path deduction results can be displayed in the overall asset view. Among them, in the risk propagation path deduction results, the multi-hop path involved between the source IP address and the destination IP address is specifically limited to a maximum of 5 hops.

[0122] In this way, the present application can provide a dynamic early warning function by simulating the vulnerability propagation path, so that the defender can identify high-risk nodes and critical paths before the vulnerability is exploited and take timely measures.

[0123] In addition, as an example, the risk propagation path deduction process here can be triggered by the following query statement:

[0124]

[0125] The corresponding statement descriptions are:

[0126] This query statement checks the multi-hop (up to 5 hops) path from sourceIp to targetIp for the access relationship link, ensuring that the path meets the requirements of the port number, port range, and protocol. At the same time, it limits the source IP to 192.168.215.41, the port to 8081, and the vulnerability on the target port (the specific IP and port can be adjusted according to the actual situation). This query is suitable for analyzing assets under the specified port to verify whether there are available vulnerabilities and the path to exploit.

[0127] In this way, through the setting of this embodiment, the present application can be combined with the visualization setting to characterize the processing results of the risk propagation path deduction logic designed by the present application in the specific application, taking into account a high degree of visualization on the basis of in-depth risk propagation path analysis, and can also provide very practical data support for network security work, and has better application value.

[0128] It can be noted that the overall asset view can also correspond to different display requirements, and different pages exist for display, that is, they are displayed through different pages, rather than having to present all the content that can be presented on the same page.

[0129] Based on the deep data mining in the above two aspects, it is easy to understand and can also give targeted path switching and protection suggestions to effectively alleviate asset vulnerability, reduce risk transmission, and provide more specific decision-making suggestions.

[0130] In this regard, in actual operations, artificial intelligence (AI) technology can be used to complete the work, and powerful machine learning models (which may include deep neural network models) can be used to more efficiently and accurately handle the data processing work involved.

[0131] In addition, based on the rich asset conditions covering different aspects contained in the gallery model, this application can also support customized queries to query asset conditions in different aspects, so as to provide more flexible and rich business scenarios and meet diverse business needs.

[0132] Correspondingly, as another exemplary embodiment, the method of the present application may further include:

[0133] Receive the access path involved in the first designated IP or query the access path between the second designated IP;

[0134] Based on the gallery, query the access path involved in the first specified IP or the access path between the second specified IPs;

[0135] Feedback the query results to the query party that initiated the query command.

[0136] Among them, the second specified IP includes the IPs at both ends, namely the source IP (sourceIp) and the destination IP (targetIp). The query instruction can also identify the corresponding path length range. The path length range can use the default range or specify a specific range in real time. The range can be quantified by distance quantification elements such as the number of nodes.

[0137] Specifically, as an example, the following query statement can be used to trigger the query of the access relationship (all search) involved in the specified IP:

[0138] MATCH(sourceIp:ip)-[accessRel:access]->(targetIp:ip)

[0139] WHERE sourceIp.ip='192.168.1.1'

[0140] RETURN sourceIp,accessRel,targetIp

[0141] UNION

[0142] MATCH(sourceIp:ip)-[accessRel:access]->(targetIp:ip)

[0143] WHERE targetIp.ip='192.168.1.1'

[0144] RETURN sourceIp,accessRel,targetIp

[0145] The corresponding statement descriptions are:

[0146] This query statement is to comprehensively retrieve the access paths related to the specified IP (the specific IP can be adjusted according to the actual situation), including the access initiated by the specified IP to other nodes and the records of other nodes accessing the specified IP.

[0147] Specifically, as an example, the following query statement can be used to trigger the query of the access relationship between the specified IP addresses:

[0148] MATCH path = (sourceIp:ip)-[accessRel:access*..6]->(targetIp:ip)

[0149] WHERE sourceIp.ip='192.168.1.1'and targetIp.ip='192.168.1.2'

[0150] RETURN path

[0151] The corresponding statement descriptions are:

[0152] This query statement is used to find all access paths from the specified source IP to the target IP (the specific IP can be adjusted according to the actual situation), and the path length range is 1 to 6.

[0153] In the embodiment here, it can be understood that the query instruction can specifically query directly the two access paths involved in the assets. Of course, in specific applications, queries can also be conducted on other aspects of the asset conditions involved in the gallery model. This can be adaptively adjusted according to actual needs, such as the asset vulnerability and risk propagation paths involved in the previous embodiments, so as to meet the diverse and flexible application needs of the staff responsible for network security work.

[0154] Finally, for the above solution content, overall, for network security work involving network assets, this application introduces SOAR mechanism and gallery on the basis of identified network assets to build a full asset model and its asset relationship, so that the global (full map) display of the access relationship between assets can be realized in a highly visual way, and the corresponding asset vulnerabilities and risk propagation paths are further explored. This provides very convenient and accurate visual data support for staff to understand the risks of global assets and their different aspects, which can meet diverse business needs, has good application value and reference significance, and promotes further enhancement of the company's network security protection capabilities.

[0155] The above is an introduction to the asset data processing method for network assets provided by this application. In order to facilitate better implementation of the asset data processing method for network assets provided by this application, this application also provides an asset data processing device for network assets from the perspective of functional modules.

[0156] See also Figure 6 , Figure 6 This is a schematic diagram of a structure of an asset data processing device for network assets of the present application. In the present application, the asset data processing device 600 for network assets may specifically include the following structure:

[0157] The collection unit 601 is used to collect asset data of target network assets under the security orchestration automated response task, wherein the target network assets are specifically network assets pre-identified from the company network range according to the corresponding network asset identification strategy;

[0158] An import unit 602 is used to import asset data into the ES model to implement configuration of an initial data model for target network assets;

[0159] The conversion unit 603 is used to convert the ES model with asset data imported into the graph library by extracting the corresponding nodes and relationship forms based on the data content of the access relationship between assets contained in the model, and display the corresponding overall asset view in a graph structure, wherein different network asset attribution areas of different assets are identified in the overall asset view, different assets correspond to different nodes, and the access relationship between assets is displayed through lines based on the node identifier, IP address identifier, port identifier and access direction identifier.

[0160] In an exemplary embodiment, the asset data involves a primary public field and a secondary public field, the primary public field involves a first host name, a first IP address, a first MAC address, an asset ID, a first source system, a data source type, a collection time, basic information, an open port, and an access relationship;

[0161] The secondary public fields corresponding to the basic information include the second host name, second IP address, second MAC address, second source system, department, user, telephone number, last online time, operating system, operating system version, hardware type, physical address, and management person in charge;

[0162] The secondary public fields corresponding to the open ports involve the third source system, the first port, the port protocol, and the port binding IP address;

[0163] The secondary public fields corresponding to the access relationship include source domain name, source IP address, destination domain name, destination IP address, destination port, port and communication protocol.

[0164] In yet another exemplary embodiment, the apparatus further includes a scanning unit 604, configured to:

[0165] Perform vulnerability scanning on target network assets to obtain corresponding vulnerability data;

[0166] The import unit 602 is specifically used for:

[0167] Import asset data and vulnerability data into the ES model.

[0168] In another exemplary embodiment, the first-level public field corresponding to the vulnerability data involves the vulnerability, and the second-level public field corresponding to the vulnerability involves the fourth source system, vulnerability name, risk level, CVE number, threat score, CNNVD number, CNCVE number, CNVD number, port and scan time.

[0169] In yet another exemplary embodiment, the apparatus further includes a deduction unit 605, configured to:

[0170] Based on the gallery, asset vulnerability deduction is performed based on the access relationship between assets. The obtained asset vulnerability deduction results are displayed in the overall asset view. Among them, the asset vulnerability deduction results are based on the display content of the connection. The specific configuration content is as follows:

[0171] 1) Solid red line, which meets the first condition of accessible port at access control level and the second condition of port vulnerability, corresponding to the high risk situation of target IP;

[0172] 2) Solid black line, meets the first condition but does not meet the second condition, corresponding to the target IP has no risk;

[0173] 3) The dashed black line satisfies the first condition and the third condition that the port is not enabled, corresponding to the target IP without risk;

[0174] 4) Solid gray line, the default connection line, is applicable to connections other than the above three access relationships.

[0175] In yet another exemplary embodiment, the apparatus further includes a deduction unit 605, configured to:

[0176] Based on the gallery, risk propagation path deduction for vulnerability exploitation is performed, and the obtained risk propagation path deduction results are displayed in the overall asset view. Among them, in the risk propagation path deduction results, the multi-hop path involved between the source IP address and the destination IP address is specifically limited to a maximum of 5 hops.

[0177] In yet another exemplary embodiment, the apparatus further includes a query unit 606, configured to:

[0178] Receiving a query instruction for querying an access path involved in a first designated IP address or querying an access path between second designated IP addresses;

[0179] Based on the gallery, query the access path involved in the first specified IP or the access path between the second specified IPs;

[0180] Feedback the query results to the query party that initiated the query command.

[0181] This application also provides a processing device from the perspective of hardware structure, see Figure 7 , Figure 7 701, a memory 702, and an input / output device 703. The processor 701 is used to execute the computer program stored in the memory 702 to implement the following Figure 1 The steps of the asset data processing method of the network asset in the corresponding embodiment; or, the processor 701 is used to execute the computer program stored in the memory 702 to implement the following Figure 6 Corresponding to the functions of each unit in the embodiment, the memory 702 is used to store the processor 701 executing the above Figure 1 The computer program required by the asset data processing method of the network assets in the corresponding embodiment.

[0182] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 702, and executed by the processor 701 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0183] The processing device may include, but is not limited to, a processor 701, a memory 702, and an input / output device 703. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 701, the memory 702, the input / output device 703, etc. are connected via a bus.

[0184] The processor 701 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0185] The memory 702 can be used to store computer programs and / or modules. The processor 701 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 702 and calling the data stored in the memory 702. The memory 702 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0186] When the processor 701 is used to execute the computer program stored in the memory 702, the following functions can be implemented:

[0187] Under the security orchestration automated response task, asset data of the target network assets is collected, wherein the target network assets are specifically network assets that are pre-identified from the company network scope according to the corresponding network asset identification strategy;

[0188] Import asset data into the ES model to configure the initial data model for the target network assets;

[0189] Based on the data content of the access relationship between assets contained in the model, the ES model with imported asset data is converted into a graph library by extracting the corresponding nodes and relationship forms, and the corresponding overall asset view is displayed in a graph structure. In the overall asset view, different network asset ownership areas of different assets are identified, and different assets correspond to different nodes. The access relationship between assets is displayed through connections based on node identification, IP address identification, port identification and access direction identification.

[0190] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the asset data processing device, processing equipment and corresponding units of the network assets described above can refer to the following. Figure 1 The description of the asset data processing method of the network assets in the corresponding embodiment will not be repeated here.

[0191] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0192] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 The steps of the asset data processing method of the network asset in the corresponding embodiment, the specific operation can refer to the following Figure 1 The description of the asset data processing method of the network assets in the corresponding embodiment will not be repeated here.

[0193] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0194] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the asset data processing method of the network asset in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the asset data processing method of network assets in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0195] The asset data processing method, apparatus, processing equipment and computer-readable storage medium of the network assets provided by the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the core idea of ​​the present application; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for processing asset data of a network asset, characterized in that: The method comprises: Under the security orchestration automated response task, asset data of the target network assets are collected, wherein the target network assets are specifically network assets pre-identified from the company network scope according to the corresponding network asset identification strategy; Importing the asset data into the ES model to implement configuration of an initial data model for the target network asset; Based on the data content of the access relationship between assets contained in the model, the ES model that has imported the asset data is converted into a graph library by extracting the corresponding nodes and relationship forms, and the corresponding overall asset view is displayed in a graph structure, wherein different network asset attribution areas with different asset attributions are identified in the overall asset view, and the different assets correspond to different nodes. The access relationship between the assets is displayed through lines based on the node identifier, IP address identifier, port identifier and access direction identifier.

2. The method according to claim 1, characterized in that The asset data involves primary public fields and secondary public fields, wherein the primary public fields involve a first host name, a first IP address, a first MAC address, an asset ID, a first source system, a data source type, a collection time, basic information, an open port, and an access relationship; The secondary public fields corresponding to the basic information include a second host name, a second IP address, a second MAC address, a second source system, a department, a user, a telephone number, a last online time, an operating system, an operating system version, a hardware type, a physical address, and a person in charge of management; The secondary public field corresponding to the open port involves a third source system, a first port, a port protocol, and a port-bound IP address; The secondary public fields corresponding to the access relationship involve source domain name, source IP address, destination domain name, destination IP address, destination port, port and communication protocol.

3. The method according to claim 2, characterized in that The method further comprises: Perform vulnerability scanning on the target network assets to obtain corresponding vulnerability data; The importing of the asset data into the ES model comprises: The asset data and the vulnerability data are imported into the ES model.

4. The method according to claim 3, characterized in that The first-level public field corresponding to the vulnerability data involves vulnerabilities, and the second-level public field corresponding to the vulnerability involves a fourth source system, vulnerability name, risk level, CVE number, threat score, CNNVD number, CNCVE number, CNVD number, port and scan time.

5. The method according to claim 4, characterized in that The method further comprises: Based on the gallery, asset vulnerability deduction processing is performed on the access relationship between the assets, and the obtained asset vulnerability deduction result is displayed in the overall asset view, wherein the asset vulnerability deduction result is based on the display content of the connection, and specifically includes the following configuration contents: 1) Solid red line, which meets the first condition of accessible port at access control level and the second condition of port vulnerability, corresponding to the high risk situation of target IP; 2) Solid black line: meets the first condition but does not meet the second condition, corresponding to the target IP having no risk; 3) The dashed black line satisfies the first condition and the third condition that the port is not enabled, corresponding to the target IP having no risk; 4) Solid gray line, the default connection line, is applicable to connections other than the above three access relationships.

6. The method according to claim 1, characterized in that The method further comprises: Based on the gallery, risk propagation path deduction processing is performed for vulnerability exploitation, and the obtained risk propagation path deduction result is displayed in the overall asset view, wherein in the risk propagation path deduction result, the multi-hop path involved between the source IP address and the destination IP address is specifically limited to a maximum of 5 hops.

7. The method according to claim 1, characterized in that The method further comprises: Receiving a query instruction for querying an access path involved in a first designated IP address or querying an access path between second designated IP addresses; Based on the gallery, query the access path involved in the first designated IP or the access path between the second designated IPs; Feedback the query result to the query party that initiated the query instruction.

8. An asset data processing device for network assets, characterized in that: The device comprises: A collection unit, used to collect asset data of target network assets under the security orchestration automated response task, wherein the target network assets are specifically network assets pre-identified from the company network range according to the corresponding network asset identification strategy; An importing unit, used to import the asset data into the ES model to implement configuration of an initial data model for the target network asset; A conversion unit is used to convert the ES model into which the asset data is imported into a graph library by extracting corresponding nodes and relationship forms based on the data content of the access relationship between assets contained in the model, and to display the corresponding overall asset view in a graph structure, wherein different network asset attribution areas to which different assets belong are identified in the overall asset view, and the different assets correspond to different nodes. The access relationship between the assets is displayed through lines based on node identification, IP address identification, port identification and access direction identification.

9. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 7 when calling the computer program in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images