Information security threat judgment method and information security threat judgment device

Abstract

The invention discloses an information security threat judgment method and an information security threat judgment device, which are suitable for a network system comprising a terminal, a core network and a server. The information security threat judgment method is executed by the information security threat judgment device and comprises the following steps: receiving information of an abnormal event occurring in a network system; executing the fruit tree checking program to generate a plurality of tracing reasons according to the abnormal event, deploying a virtual terminal and a virtual server to communicate through a core network to verify whether each tracing reason can cause the abnormal event or not, and further generating a checking result; and executing a judgment chain program to judge the abnormal event as a non-information security threat event or an information security threat event according to the check result.

Description

Technical Field

[0001] The present invention relates to a threat judgment method and a threat judgment device, and in particular to an information security threat judgment method and an information security threat judgment device. Background Art

[0002] After the fifth-generation mobile communication technology (5G) network adopts an open architecture, any network element that meets the standards and interface specifications can be networked, and the abnormal status of the entire 5G network can be detected from different perspectives through external systems.

[0003] In addition, the information security central control platform of the 5G network usually receives a large number of abnormal event warnings, but only a small number of abnormal events are truly caused by information security threats. Therefore, there is an urgent need in the art for a method and device that can effectively identify information security threats. Summary of the invention

[0004] The technical problem to be solved by the present disclosure is to provide an information security threat judgment method and an information security threat judgment device to address the deficiencies in the prior art, which can judge abnormal events as non-information security threat events or information security threat events.

[0005] In order to solve the above technical problems, one of the technical solutions adopted by the present disclosure is to provide an information security threat judgment method, which is applicable to a network system including a terminal, a core network and a server. The information security threat judgment method is executed by an information security threat judgment device and includes the following steps: receiving information about abnormal events occurring in the network system; executing a causal tree verification program to generate multiple tracing causes based on the abnormal events and deploying virtual terminals and virtual servers to communicate through the core network to verify whether each tracing cause will cause an abnormal event, thereby generating a verification result; and executing a judgment chain program to judge the abnormal event as a non-information security threat event or an information security threat event based on the verification result.

[0006] Preferably, the causal tree checking procedure includes: executing an analysis procedure for an abnormal event to generate a plurality of tracing causes according to a set of checking rules; and executing a verification procedure for each tracing cause to verify whether the tracing cause will cause the abnormal event.

[0007] Preferably, the verification procedure executed for each tracing cause includes an end-to-end probing procedure, and the end-to-end probing procedure includes: configuring the probe management module to register a virtual terminal with the core network; configuring the probe management module to deploy virtual terminals and virtual servers to communicate through the core network based on abnormal events and tracing causes; configuring the virtual terminals to send uplink data; configuring the virtual servers to analyze uplink data and report first probing data to the probe management module; configuring the virtual servers to send downlink data; configuring the virtual terminals to analyze downlink data and report second probing data to the probe management module; and configuring the probe management module to report the first probing data and the second probing data to the processor, and the processor verifies whether the tracing cause will cause an abnormal event based on the first probing data and the second probing data.

[0008] Preferably, the causal tree verification procedure also includes: obtaining a set of tracing causes that have been verified to cause abnormal events, and deriving at least one tracing event based on the tracing cause set; executing an analysis procedure for the tracing event to regenerate multiple tracing causes based on the verification rule set; and executing a verification procedure again for each tracing cause to verify whether the tracing cause will cause an abnormal event.

[0009] Preferably, the verification procedure executed for each tracing cause also includes a key data reading procedure, and the key data reading procedure includes: obtaining configuration data and real-time operation data of the core network; and verifying whether the tracing cause will cause an abnormal event based on the configuration data and the real-time operation data.

[0010] Preferably, the judgment chain program includes: executing a marking program to judge and mark abnormal events as non-information security threat events or information security threat events based on the inspection results; executing a training program to use information security threat events as labels and the overall operation data of the network system during abnormal events as training data to train the machine learning model; and executing a feedback program to update the inspection rule set in the analysis program according to the machine learning model.

[0011] Preferably, in response to one of the traceable causes that may cause the abnormal event being verified to be related to an information security threat, the marking program determines and marks the abnormal event as an information security threat event based on the verification result.

[0012] In order to solve the above-mentioned technical problems, another technical solution adopted by the present disclosure is to provide an information security threat judgment device, which is applicable to a network system including a terminal, a core network and a server, and includes a storage device and a processor. The storage device is configured to store information about abnormal events that occur in the network system. The processor is electrically connected to the storage device and is configured to perform the following steps: execute a causal tree verification program to generate multiple tracing causes based on abnormal events and deploy virtual terminals and virtual servers to communicate through the core network to verify whether each tracing cause will cause an abnormal event, thereby generating a verification result; and execute a judgment chain program to judge the abnormal event as a non-information security threat event or an information security threat event based on the verification result.

[0013] Preferably, the processor executes the causal tree checking program including the following steps: executing an analysis program for an abnormal event to generate multiple tracing causes according to a set of checking rules; and executing a verification program for each tracing cause to verify whether the tracing cause will cause the abnormal event.

[0014] Preferably, the verification program executed by the processor for each tracing cause includes an end-to-end probing program, and the end-to-end probing program includes: configuring the probe management module to register the virtual terminal with the core network; configuring the probe management module to deploy the virtual terminal and the virtual server to communicate through the core network according to the abnormal event and the tracing cause; configuring the virtual terminal to send uplink data; configuring the virtual server to analyze the uplink data and report the first probing data to the probe management module; configuring the virtual server to send downlink data; configuring the virtual terminal to analyze the downlink data and report the second probing data to the probe management module; and configuring the probe management module to report the first probing data and the second probing data to the processor, and the processor verifies whether the tracing cause will cause the abnormal event based on the first probing data and the second probing data.

[0015] Preferably, the processor executes the causal tree checking program and also includes the following steps: obtaining a set of tracing causes that are verified to cause abnormal events, and deriving at least one tracing event based on the tracing cause set; executing an analysis program for the tracing event to regenerate multiple tracing causes based on the checking rule set; and executing a verification program again for each tracing cause to verify whether the tracing cause will cause an abnormal event.

[0016] Preferably, the verification procedure executed by the processor for each tracing cause also includes a key data reading procedure, and the key data reading procedure includes: obtaining configuration data and real-time operation data of the core network; and verifying whether the tracing cause will cause an abnormal event based on the configuration data and the real-time operation data.

[0017] Preferably, the processor executes the judgment chain program including the following steps: executing a marking program to judge and mark abnormal events as non-information security threat events or information security threat events based on the inspection results; executing a training program to train a machine learning model using information security threat events as labels and the overall operation data of the network system during abnormal events as training data; and executing a feedback program to update the inspection rule set in the analysis program based on the machine learning model.

[0018] Preferably, in response to one of the traceable causes that may cause the abnormal event being verified to be related to an information security threat, the processor determines and marks the abnormal event as an information security threat event based on the verification result.

[0019] To further understand the features and technical contents of the present disclosure, please refer to the following detailed description and drawings of the present disclosure. However, the drawings provided are only for reference and illustration and are not intended to limit the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a functional block diagram of the information security threat judgment device of the embodiment disclosed in the present invention.

[0021] Figure 2 It is a flowchart of the steps of the information security threat judgment method of the embodiment of the present disclosure.

[0022] Figure 3 It is a flowchart of the steps of the causal tree checking procedure of the embodiment of the present disclosure.

[0023] Figure 4 It is a schematic diagram of the processor of the information security threat judgment device of the disclosed embodiment being configured to execute a causal tree checking program.

[0024] Figure 5 is a flowchart of the steps of the end-to-end probing procedure of the embodiment of the present disclosure.

[0025] Figure 6 It is a schematic diagram of a processor of the information security threat judgment device according to an embodiment of the present disclosure being configured to execute an end-to-end detection program.

[0026] Figure 7 It is a flowchart of the steps of the key data reading procedure of the embodiment of the present disclosure.

[0027] Figure 8 It is a flowchart of the steps of the judgment chain procedure of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] The following is an explanation of the implementation methods of the present disclosure through specific specific embodiments. Those skilled in the art can understand the advantages and effects of the present disclosure from the content provided in this specification. The present disclosure can be implemented or applied through other different specific embodiments, and the details in this specification can also be modified and changed in various ways based on different viewpoints and applications without deviating from the concept of the present disclosure. In addition, the drawings of the present disclosure are only simple schematic illustrations and are not depicted according to actual dimensions. It is stated in advance. The following implementation methods will further explain the relevant technical content of the present disclosure in detail, but the content provided is not intended to limit the scope of protection of the present disclosure.

[0029] See also Figure 1 and Figure 2 , Figure 1 is a functional block diagram of the information security threat judgment device of the embodiment of the present disclosure, and Figure 2 1 is a flowchart of the steps of the information security threat judgment method of the disclosed embodiment. Figure 1 As shown, the information security threat judgment device 10 of this embodiment is suitable for a network system 12 including a terminal 120, a core network 122 and a server 124 (that is, the information security threat judgment device 10 can be coupled to the network system 12), and the information security threat judgment device 10 includes a storage 100 and a processor 102.

[0030] The storage 100 is configured to store information of abnormal events occurring in the network system 12 (i.e., contents reflecting the abnormal events, but Figure 1 The processor 102 is electrically connected to the storage 100 and can be implemented by hardware (eg, a central processing unit and a memory) in combination with software and / or firmware. However, the present disclosure does not limit the specific implementation of the storage 100 and the processor 102.

[0031] like Figure 2 As shown, the information security threat judgment method of this embodiment can be executed by the information security threat judgment device 10 and includes the following steps.

[0032] Step S111: receiving information about abnormal events occurring in the network system.

[0033] Specifically, the information security threat judgment device 10 can be configured to receive information about abnormal events occurring in the network system 12, and store the information about the abnormal events in the storage 100. In the present embodiment, the network system 12 may be a system of a 5G network, and the information about the abnormal events may be generated by an external system of the 5G network. The terminal 120, the core network 122, and the server 124 may be user equipment (UE), a core network, and a data network (DN) of the 5G network, respectively, and the core network 122 is coupled between the terminal 120 and the server 124. In addition, the aforementioned external system may include an operation and maintenance (OAM) system of the 5G network, an information security detection system, and a network segment traffic monitoring system, etc., but the present disclosure is not limited thereto.

[0034] Generally speaking, the core network of a 5G network may include access and mobility functions (AMF), session management functions (SMF) and user plane functions (UPF), and the OAM system is capable of detecting events in which the network functions (NF) of the core network operate abnormally. In addition, the information security detection system is capable of detecting events such as abnormal UE login, and the network segment traffic monitoring system is capable of detecting events in which the network segment (e.g., N2 interface, N3 interface or N6 interface) traffic is abnormal. In other words, the aforementioned external system is capable of effectively detecting the abnormal state of the overall 5G network from different perspectives, and the information security threat judgment device 10 may be the information of abnormal events received through the aforementioned external system.

[0035] According to the foregoing, different systems (i.e., OAM system, information security detection system, and network segment traffic monitoring system, etc.) can detect abnormal events from different sources. In addition, different abnormal events detected by different systems at the same time have a high probability of originating from the same information security threat. Therefore, in other embodiments, if the information security threat judgment device 10 receives information about multiple abnormal events detected by the aforementioned external system at the same time, the information security threat judgment device 10 can also be configured to select one of the multiple abnormal events as the primary target of source analysis.

[0036] Step S112: Execute the causal tree verification program to generate multiple tracing causes according to the abnormal event and deploy virtual terminals and virtual servers to communicate through the core network to verify whether each tracing cause will cause the abnormal event, thereby generating a verification result.

[0037] Furthermore, the processor 102 may be configured to execute a cause-effect tree checking program to generate multiple tracing causes ( Figure 1 Not shown) and deploy virtual terminals and virtual servers ( Figure 1 (not shown) communicates through the core network 122 to verify whether each traced cause will cause an abnormal event. Figure 3 , Figure 3 is a flowchart of the steps of the causal tree checking procedure of the embodiment of the present disclosure. Figure 3 As shown, the causal tree checking procedure may include the following steps.

[0038] Step S121: Execute an analysis program for the abnormal event to generate multiple tracing causes according to the inspection rule set.

[0039] Step S122: executing a verification procedure for each tracing cause to verify whether the tracing cause will cause an abnormal event.

[0040] Please also refer to Figure 4 , Figure 4 FIG. 1 is a schematic diagram of a processor of the information security threat judgment device according to an embodiment of the present disclosure being configured to execute a causal tree checking program. Figure 4 As shown, during the time period T11 of executing the analysis program for the abnormal event 400, the processor 102 may check the rule set ( Figure 4 (not shown) generates multiple tracing reasons corresponding to the abnormal event 400. For the convenience of the following description, this embodiment takes the processor 102 generating five tracing reasons 501-505 corresponding to the abnormal event 400 as an example, but the present disclosure is not limited thereto.

[0041] Specifically, the inspection rule set may include multiple inspection rules. In addition to being pre-set, these inspection rules can also be added through the judgment chain program, and these inspection rules define the tracing reasons corresponding to different abnormal events. For example, these inspection rules may define the tracing reasons corresponding to the abnormal event of "UE (i.e., terminal 120) has a slow network speed after logging into the 5G network", including: "NF's central processor is full", "NF's memory is full", "NF's storage is full", "N3 interface data flow is blocked" and "UE's registration configuration has been maliciously tampered with", but the present disclosure is not limited to this. Therefore, when abnormal event 400 is the above-mentioned abnormal event, processor 102 can generate the above-mentioned tracing reasons.

[0042] Next, during the time period T12 for executing the verification procedure for each tracing cause, the processor 102 may deploy a virtual terminal and a virtual server to communicate through the core network 122 to verify whether each tracing cause will cause the abnormal event 400. For ease of understanding, for the tracing causes that are verified not to cause the abnormal event 400, this embodiment will mark a cross at the back end to indicate exclusion. In addition, the verification procedure executed for each tracing cause may include an end-to-end probing procedure. Please refer to Figure 5 , Figure 5 FIG. 1 is a flowchart of the steps of the end-to-end detection procedure of the embodiment of the present disclosure. Figure 5 As shown, the end-to-end probing procedure may include the following steps.

[0043] Step S131: configuring the probe management module to register the virtual terminal with the core network.

[0044] Step S132: configuring the probe management module to deploy virtual terminals and virtual servers to communicate through the core network according to abnormal events and cause tracing.

[0045] Step S133: configure the virtual terminal to send uplink data.

[0046] Step S134: configure the virtual server to analyze the uplink data and report the first probe data to the probe management module.

[0047] Step S135: configure the virtual server to send downlink data.

[0048] Step S136: configure the virtual terminal to analyze the downlink data and report the second probe data to the probe management module.

[0049] Step S137: configuring the probe management module to report the first detection data and the second detection data to the processor, and the processor verifies whether the tracing cause will cause an abnormal event according to the first detection data and the second detection data.

[0050] Specifically, the probe management module can also be implemented by hardware with software and / or firmware. However, the present disclosure does not limit the specific implementation of the probe management module. Please refer to 6, Figure 6 1 is a schematic diagram of the processor of the information security threat judgment device according to the embodiment of the disclosure being configured to execute an end-to-end detection program. For the convenience of the following description, this embodiment takes the processor 102 executing the end-to-end detection program for tracing the cause 501 as an example. Figure 6 As shown, the processor 102 can configure the probe management module 104 to register the virtual terminal 220 with the core network 122 , and configure the probe management module 104 to deploy the virtual terminal 220 and the virtual server 224 to communicate through the core network 122 according to the abnormal event 400 and the cause tracing 501 .

[0051] In other words, the present disclosure may use the virtual terminal 220 to simulate the operation of a specific UE, and the virtual server 224 is a virtual data network. Then, the probe management module 104 may configure the virtual terminal 220 to send the uplink data TD1. The uplink data TD1 sent by the virtual terminal 220 will be transmitted to the virtual server 224 through the core network 122. In addition, the virtual server 224 may be configured to analyze the received uplink data TD1 and report the first probe data PD1 to the probe management module 104.

[0052] In contrast, the probe management module 104 can configure the virtual server 224 to send downlink data TD2, and the downlink data TD2 sent by the virtual server 224 will be transmitted to the virtual terminal 220 through the core network 122. In addition, the virtual terminal 220 can be configured to analyze the received downlink data TD2, and report the second probe data PD2 to the probe management module 104. The present disclosure does not limit the specific content of the uplink data TD1 sent by the virtual terminal 220 and the downlink data TD2 sent by the virtual server 224. Furthermore, the probe management module 104 can be configured to report the first probe data PD1 and the second probe data PD2 to the processor 102, and the processor 102 verifies whether the tracing cause 501 will cause the abnormal event 400 based on the first probe data PD1 and the second probe data PD2.

[0053] Furthermore, the present embodiment uses the end-to-end detection procedure to achieve the following goals: "check whether the data transmitted by the UE / DN has been tampered with", "check whether the system has been attacked by DoS", "check whether the N2 / N3 / N6 interface connection is stable", and "check whether the relevant operation records of the UE / base station (e.g., gNB) have been tampered with", etc., but the present disclosure is not limited to this. In the case of using the end-to-end detection procedure to "check whether the data transmitted by the UE has been tampered with", the uplink data TD1 sent by the virtual terminal 220 may be information security sensitive data (e.g., medical images, financial data, industry certificates and political pictures, etc.), and the virtual server 224 may generate the first detection data PD1 by comparing the received uplink data TD1 with the information security sensitive data.

[0054] Since the details of using the end-to-end detection program to "check whether the data transmitted by the DN end has been tampered with" are as mentioned above, they will not be repeated here. In addition, the verification program executed for each cause of tracing may also include a key data reading program. Figure 7 , Figure 7 1 is a flowchart of the steps of the key data reading procedure of the embodiment of the present disclosure. Figure 7 As shown, the procedure for reading key data may include the following steps.

[0055] Step S141: Obtain configuration data and real-time operation data of the core network. Step S142: Verify whether the cause of the investigation will cause an abnormal event based on the configuration data and the real-time operation data.

[0056] Specifically, the configuration data of the core network 122 may be the configuration data of the NF, which may be used to verify whether the current cause of investigation will cause the abnormal event 400. In addition, the real-time operation data of the core network 122 may include the health of each component of the core network, the utilization rate of operating resources, the network transmission performance, and various logs of the NF.

[0057] Taking the above content as an example, when the end-to-end probing program is used to "check whether the N2 / N3 / N6 interface connection is stable", if the processor 102 determines that the N2 / N3 / N6 interface connection is unstable, the processor 102 can also confirm whether the N2 / N3 / N6 interface connection is unstable due to malicious operation by obtaining the configuration data and real-time operation data of the core network 122. In addition, the processor 102 can also perform specific operations to obtain the configuration data and real-time operation data of the core network 122 to verify whether the NF of the core network 122 is normal.

[0058] Furthermore, after the analysis procedure and the verification procedure, the processor 102 may exclude some of the causes of the investigation, but in order to obtain better inspection results, the processor 102 may execute multiple rounds of analysis procedures and verification procedures. In other words, this embodiment uses the principle of causal tree analysis to find the cause of the abnormal event 400. The advantage of the causal tree analysis used in this embodiment is that the inspection scope can be gradually narrowed to more accurately identify information security threats. Therefore, if Figure 3 As shown, the causal tree checking procedure may also include the following steps.

[0059] Step S123: obtaining a set of tracing causes that are verified to cause abnormal events, and deriving at least one tracing event according to the set of tracing causes.

[0060] Step S124: Execute an analysis procedure for the at least one tracing event to regenerate a plurality of tracing causes according to a set of checking rules.

[0061] Step S125: executing the verification procedure again for each tracing cause to verify whether the tracing cause will cause an abnormal event.

[0062] like Figure 4As shown, in response to obtaining a set of tracing causes that are verified to cause abnormal events, including tracing causes 502 and tracing causes 503, the processor 102 may derive tracing events 411 and tracing events 412 based on tracing causes 502 and tracing causes 503, but the present disclosure is not limited to this. It should be noted that the inspection rule set may also include rules for deriving tracing events based on tracing causes. In addition, within the time period T21 in which the analysis program is executed for tracing events 411 and tracing events 412, the processor 102 may regenerate multiple tracing causes corresponding to tracing events 411 and tracing events 412 according to the inspection rule set. In other words, the aforementioned inspection rules may also define tracing causes corresponding to different tracing events. For the convenience of the following description, this embodiment takes the example that the processor 102 regenerates two tracing causes 511 and 512 corresponding to tracing event 411 and one tracing cause 513 corresponding to tracing event 412, but the present disclosure is not limited to this.

[0063] It can be seen that the analysis program executed in the time period T11 may be the analysis program of the first round, and the analysis program executed in the time period T21 may be the analysis program of the second round. Similarly, the verification program executed in the time period T12 may be the verification program of the first round, and the verification program executed in the time period T22 may be the verification program of the second round. In the second round of the verification program, the processor 102 may verify whether each of the tracing reasons 511 to 513 will cause the abnormal event 400. For the convenience of the following description, this embodiment only takes the execution of two rounds of analysis programs and verification programs as an example. Therefore, after executing the second round of the verification program, the processor 102 can generate a verification result 600.

[0064] In other words, since this embodiment only takes the execution of two rounds of analysis and verification procedures as an example, Figure 3 After step S125, the causal tree verification procedure may further include step S126: generating a verification result. It should be noted that the content of the verification result 600 may indicate "no information security threat", "a single information security threat" or "multiple information security threats at the same time", but the present disclosure is not limited to this. In this embodiment, since the tracing cause 512 that is verified to cause the abnormal event 400 is only related to the information security threat of "malicious network blocking attack", the processor 102 may generate a verification result 600 indicating "a single information security threat".

[0065] In other embodiments, if it is verified that there are still many causes that may cause the abnormal event and it is impossible to accurately identify the information security threat, the processor 102 may execute the next round of analysis and verification procedures. That is, before entering step S126 of the causal tree verification procedure, the processor 102 may also repeatedly execute steps S123 to S125 until the verification range can be narrowed to more accurately identify the information security threat. Since the relevant details are the same as the above content, they will not be repeated here.

[0066] On the other hand, Figure 2 As shown, the information security threat judgment method of this embodiment can enter step S113: execute the judgment chain program to judge the abnormal event as a non-information security threat event or an information security threat event according to the inspection result.

[0067] In other words, the processor 102 may be configured to execute the judgment chain program to judge the abnormal event 400 as a non-information security threat event or an information security threat event according to the inspection result 600. Figure 8 , Figure 8 is a flowchart of the steps of the judgment chain procedure of the embodiment of the present disclosure. Figure 8 As shown, the judgment chain procedure may include the following steps.

[0068] Step S151: Execute a marking procedure to determine and mark abnormal events as non-information security threat events or information security threat events based on the inspection results.

[0069] Step S152: Execute a training program to train a machine learning model by using information security threat events as labels and the overall operation data of the network system during abnormal events as training data.

[0070] Step S153: Execute a feedback procedure to update the verification rule set in the analysis procedure according to the machine learning model.

[0071] Specifically, in response to the verification that one of the traceable causes that may cause the abnormal event 400 is associated with an information security threat, the processor 102 may determine and mark the abnormal event 400 as an information security threat event according to the inspection result 600. Taking the aforementioned content as an example, since the traceable cause 512 is associated with the information security threat of "malicious network blocking attack", the processor 102 may generate the inspection result 600 indicating that "there is a single information security threat", and may also determine and mark the abnormal event 400 as an information security threat event according to the inspection result 600.

[0072] In contrast, if it is verified that the cause 512 that causes the abnormal event 400 is not related to the information security threat, the processor 102 can not only generate the verification result 600 indicating that "there is no information security threat", but also judge and mark the abnormal event 400 as a non-information security threat event based on the verification result 600. In addition, taking the aforementioned content as an example, in order to allow the processor 102 to generate the cause 512 earlier, another focus of the judgment chain program is to update the verification rule set in the analysis program. In other words, it is hoped that when the information of the same abnormal event is received next time, the processor 102 can generate the cause 512 according to the updated verification rule set in the first round of the analysis program, so as to save the time and cost of the processor 102 executing the causal tree verification program.

[0073] In order to update the set of verification rules in the analysis program, the processor 102 may use the information security threat event as a label and the overall operation data of the network system 12 at the time of the abnormal event 400 as training data to train the machine learning model. Then, the processor 102 may update the set of verification rules in the analysis program according to the machine learning model. For example, a new verification rule is added to the current set of verification rules, or an existing verification rule is removed. Taking the aforementioned content as an example, the cause of the investigation 501 may be confirmed to be not closely related to the abnormal event 400. In order to avoid increasing the probability of misjudgment, the processor 102 may remove the verification rule that defines the cause of the investigation 501 as being associated with the abnormal event 400 according to the machine learning model. It should be understood that updating the set of verification rules may also be adjusting the rules that derive the tracing event.

[0074] Furthermore, the processor 102 may collect the overall operation data of the network system 12 during the abnormal event 400, and use the overall operation data of the network system 12 as a feature for model training. In addition, the machine learning model may identify what type of information security threat has occurred based on the overall operation data of the network system 12 during the abnormal event 400. For example, the information security threat determination device 10 may also include a database (not shown in the drawings), and the database is used to store the overall operation data of the network system 12 when different information security threats occur.

[0075] Therefore, the machine learning model can compare the overall operation data of the network system 12 at the time of the abnormal event 400 with the overall operation data stored in the database, and generate threat scores corresponding to different information security threats through comparison. The higher the threat score, the more likely it is that the corresponding information security threat will occur. After each identification, the processor 102 can compare the identification result with the actual result confirmed manually. For samples with an incorrect identification result (i.e., the identification result is different from the actual result), the processor 102 can also add it to the training data and use it to train the machine learning model again.

[0076] In other words, the processor 102 can use an incremental learning method to allow the machine learning model to dynamically receive new data and use the new data for learning. Therefore, the machine learning model of the present embodiment can continuously self-learn and correct errors. In this case, the present embodiment does not need to retrain the entire model. In addition, after the machine learning model has undergone multiple rounds of training, in addition to gradually correcting the tracing causes generated by the analysis program, it will also gradually enhance the accuracy of self-identification of information security threats. If the usage scenario of the network system 12 changes in the future, the machine learning model can also self-learn and correct errors to maintain a high degree of accuracy.

[0077] In summary, one of the beneficial effects of the present disclosure is that the information security threat judgment method and information security threat judgment device provided by the present disclosure can judge abnormal events as non-information security threat events or information security threat events through the technical means of "generating multiple tracing causes based on abnormal events and deploying virtual terminals and virtual service terminals to communicate through the core network to verify whether each tracing cause will cause abnormal events". In addition, the information security threat judgment method and information security threat judgment device provided by the present disclosure can gradually narrow the scope of inspection through multiple rounds of analysis procedures and verification procedures to more accurately confirm information security threats.

[0078] Furthermore, the information security threat judgment method and information security threat judgment device provided by the present disclosure can verify whether the tracing cause will cause abnormal events through an end-to-end probing program. In addition, the information security threat judgment method and information security threat judgment device provided by the present disclosure can gradually correct the tracing cause generated by the analysis program through a judgment chain program.

[0079] The content provided above is only a preferred feasible embodiment of the present disclosure, and does not limit the scope of the patent application of the present disclosure. Therefore, all equivalent technical changes made using the contents of the present disclosure specification and drawings are included in the scope of the patent application of the present disclosure.

[0080]

Explanation of symbols

[0081] 10: Information security threat judgment device

[0082] 100: Storage

[0083] 102: Processor

[0084] 104: Probe management module

[0085] 220: Virtual Terminal

[0086] 224: Virtual Server

[0087] 12: Network system

[0088] 120: Terminal

[0089] 122: Core Network

[0090] 124: Server

[0091] 400: Abnormal event

[0092] 501~505,511~513: Investigating the cause

[0093] 411,412: Tracking incident

[0094] 600: Check result

[0095] T11, T12, T21, T22: time period

[0096] TD1: Uplink data

[0097] TD2: Downlink data

[0098] PD1, PD2: Exploration Data

[0099] S111~S113, S121~S126, S131~S137, S141~S142, S151~S153: process steps.

Claims

1. A method for determining information security threats, applicable to a network system including a terminal, a core network and a server, characterized in that: The information security threat judgment method comprises configuring an information security threat judgment device to perform the following steps: Receiving information about an abnormal event occurring in the network system; Execute a cause-effect tree checking procedure to generate multiple tracing causes according to the abnormal event and deploy a virtual terminal and a virtual server to communicate through the core network to verify whether each of the tracing causes will cause the abnormal event, thereby generating a checking result; as well as A judgment chain procedure is executed to judge the abnormal event as a non-information security threat event or an information security threat event according to the inspection result.

2. The information security threat determination method according to claim 1, characterized in that: The causal tree checking procedure includes: executing an analysis procedure for the abnormal event to generate a plurality of the tracing causes according to a set of checking rules; and A verification procedure is executed for each of the tracing causes to verify whether the tracing cause causes the abnormal event.

3. The information security threat determination method according to claim 2, characterized in that: The verification procedure performed for each of the tracing reasons includes an end-to-end probing procedure, and the end-to-end probing procedure includes: configuring a probe management module to register the virtual terminal with the core network; Configuring the probe management module to deploy the virtual terminal and the virtual service end to communicate through the core network according to the abnormal event and the cause of the investigation; Configuring the virtual terminal to send uplink data; Configuring the virtual server to analyze the uplink data and report the first probe data to the probe management module; Configuring the virtual server to send downlink data; configuring the virtual terminal to analyze the downlink data and report second probe data to the probe management module; and The probe management module is configured to report the first probe data and the second probe data to a processor, and the processor verifies whether the tracing cause causes the abnormal event according to the first probe data and the second probe data.

4. The information security threat determination method according to claim 2, characterized in that: The causal tree checking procedure also includes: Obtaining a set of tracing causes that are verified to cause the abnormal event, and deriving at least one tracing event according to the set of tracing causes; executing the analysis procedure for the at least one tracing event to regenerate a plurality of the tracing causes according to the inspection rule set; and The verification procedure is executed again for each of the tracing causes to verify whether the tracing cause causes the abnormal event.

5. The information security threat determination method according to claim 3, characterized in that: The verification procedure executed for each of the tracing reasons further includes a key data reading procedure, and the key data reading procedure includes: Obtaining configuration data and real-time operation data of the core network; and Verify whether the tracing cause will cause the abnormal event according to the configuration data and the real-time operation data.

6. The information security threat determination method according to claim 2, characterized in that: The judgment chain procedure includes: Executing a marking procedure to judge and mark the abnormal event as the non-information security threat event or the information security threat event according to the inspection result; executing a training procedure to train a machine learning model by using the information security threat event as a label and the overall operation data of the network system during the abnormal event as training data; and A feedback process is performed to update the verification rule set in the analysis process based on the machine learning model.

7. The information security threat determination method according to claim 6, characterized in that: In response to one of the traced causes that causes the abnormal event being verified to be associated with an information security threat, the marking program determines and marks the abnormal event as the information security threat event based on the inspection result.

8. An information security threat judgment device, applicable to a network system including a terminal, a core network and a server, characterized in that: The information security threat judgment device comprises: a storage device configured to store information of an abnormal event occurring in the network system; and A processor is electrically connected to the memory and configured to perform the following steps: executing a cause-effect tree checking procedure to generate a plurality of tracing causes according to the abnormal event and deploying a virtual terminal and a virtual server to communicate through the core network to verify whether each of the tracing causes will cause the abnormal event, thereby generating a checking result; and A judgment chain procedure is executed to judge the abnormal event as a non-information security threat event or an information security threat event according to the inspection result.

9. The information security threat judgment device according to claim 8, characterized in that: The processor executes the causal tree checking program including the following steps: executing an analysis procedure for the abnormal event to generate a plurality of the tracing causes according to a set of checking rules; and A verification procedure is executed for each of the tracing causes to verify whether the tracing cause causes the abnormal event.

10. The information security threat judgment device according to claim 9, characterized in that: The verification procedure executed by the processor for each of the tracing reasons includes an end-to-end probing procedure, and the end-to-end probing procedure includes: configuring a probe management module to register the virtual terminal with the core network; Configuring the probe management module to deploy the virtual terminal and the virtual service end to communicate through the core network according to the abnormal event and the cause of the investigation; Configuring the virtual terminal to send uplink data; Configuring the virtual server to analyze the uplink data and report the first probe data to the probe management module; Configuring the virtual server to send downlink data; configuring the virtual terminal to analyze the downlink data and report second probe data to the probe management module; and The probe management module is configured to report the first probe data and the second probe data to the processor, and the processor verifies whether the tracing cause causes the abnormal event according to the first probe data and the second probe data.

11. The information security threat judgment device according to claim 9, characterized in that: The processor executing the causal tree checking program further comprises the following steps: Obtaining a set of tracing causes that are verified to cause the abnormal event, and deriving at least one tracing event according to the set of tracing causes; executing the analysis procedure for the at least one tracing event to regenerate a plurality of the tracing causes according to the inspection rule set; and The verification procedure is executed again for each of the tracing causes to verify whether the tracing cause causes the abnormal event.

12. The information security threat judgment device according to claim 10, characterized in that: The verification procedure executed by the processor for each of the tracing reasons further includes a key data reading procedure, and the key data reading procedure includes: Obtaining configuration data and real-time operation data of the core network; and Verify whether the tracing cause will cause the abnormal event according to the configuration data and the real-time operation data.

13. The information security threat judgment device according to claim 9, characterized in that: The processor executes the judgment chain program including the following steps: Executing a marking procedure to judge and mark the abnormal event as the non-information security threat event or the information security threat event according to the inspection result; executing a training procedure to train a machine learning model by using the information security threat event as a label and the overall operation data of the network system during the abnormal event as training data; and A feedback process is performed to update the verification rule set in the analysis process based on the machine learning model.

14. The information security threat judgment device according to claim 13, characterized in that: In response to one of the traced causes that may cause the abnormal event being verified to be associated with an information security threat, the processor determines and marks the abnormal event as the information security threat event based on the verification result.

Images