Network security data tracing method and device, medium and program product

Abstract

The embodiment of the invention provides a network security data tracing method and device, a medium and a program product, and relates to the technical field of data tracing. The method comprises the following steps: responding to a traceability request for a target IOC entity; determining a traceability edge set corresponding to the IOC entity to be traced, and constructing a corresponding edge lock based on the traceability edge set; constructing a data pulling task for each traceability edge, and executing each data pulling task based on a preset thread pool to obtain an initial data set corresponding to each traceability edge; and based on the initial data set corresponding to each tracing edge, screening out an effective IOC entity list meeting a preset condition, respectively constructing corresponding entity locks, and taking each effective IOC entity as the IOC entity to be traced in the next round. According to the embodiment of the invention, the cascade father-son lock is designed to perform state transfer and thread control on the multi-level traceability task, so that the waiting problem of the upper-layer thread in the execution process of the lower-layer thread can be avoided, and the efficiency and the resource utilization rate of the whole traceability process are effectively improved.

Description

Technical Field

[0001] The present application relates to the technical field of data tracing, and in particular to a network security data tracing method, device, medium and program product. Background Art

[0002] Cyber ​​attack tracing refers to the use of a series of technical means and analysis methods to track the source of the attack, the identity of the attacker, the attack path and other information after the attack occurs, so as to implement network security management measures such as defense and accountability. However, with the development of technology, the means of cyber attacks are becoming more and more complex, and there are more and more ways to cover up. Attackers use complex multi-level and cross-platform means to hide their whereabouts, making threat tracing face severe challenges.

[0003] In the field of network security, indicators of compromise (IOC) are key elements for identifying and tracking attack behaviors. The entity types corresponding to this indicator include IP addresses, domain names, file hashes, etc. How to find effective associated IOCs in massive amounts of data has become a difficult point in tracing the source. For example, an IP may have been resolved by multiple domain names in history, and each domain name has multiple DNS resolution (Domain Name System Resolution) IPs. Each domain name may have multiple subdomains. At the same time, a domain name may be associated with multiple certificates, registrant information, and filing information. The same registrant may have registered multiple domain names, etc.

[0004] At present, IOC-based tracing analysis technology mainly targets entities directly related to IOC, but usually lacks cross-level extended data tracing. This is because the amount of multi-level data is huge and the data is scattered in different systems (DNS records, threat intelligence platforms, etc.), which makes data integration difficult. In addition, in the cascade tracing process, as the tracing level deepens, the upper-level thread needs to wait until all query tasks in the lower level are completed before releasing the thread resources, resulting in low overall tracing efficiency and low resource utilization. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a network security data tracing method, device, medium and program product, which can improve the efficiency and resource utilization of the overall tracing process in a multi-level data tracing scenario.

[0006] In a first aspect, an embodiment of the present application provides a network security data tracing method, comprising: In response to a traceability request for a target IOC entity, taking the target IOC entity as a current IOC entity to be traced; Create a traceability task for the IOC entity to be traced, determine the traceability edge set corresponding to the IOC entity to be traced, and construct an edge lock corresponding to the IOC entity to be traced based on the traceability edge set; wherein the initial semaphore of the edge lock is equal to the number of edges in the traceability edge set, and the edge lock is used to control whether to release the traceability task corresponding to the IOC entity to be traced according to its own semaphore; Constructing a data pulling task for each traceable edge in the traceable edge set, and calling a traceable thread based on a preset thread pool to execute each data pulling task, so as to obtain an initial data set corresponding to each traceable edge; Based on the initial data set corresponding to each traceability edge, a list of valid IOC entities that meet the preset conditions is screened out respectively, and an entity lock corresponding to each of the valid IOC entity lists is constructed respectively, and the IOC entities in each of the valid IOC entity lists are used as the IOC entities to be traced in the next round; wherein, the parent lock of each of the entity locks is the edge lock constructed in the previous round, the initial semaphore of each of the entity locks is equal to the number of IOC entities in the corresponding valid IOC entity list, and when the semaphore of each of the entity locks decreases to zero, the semaphore of its parent lock is reduced by one.

[0007] In an embodiment of the present application, by designing cascading parent-child locks to perform state transfer and thread control on multi-level traceability tasks, it is possible to avoid the waiting problem of upper-level threads during the execution of lower-level threads, thereby effectively improving the overall efficiency and resource utilization of data traceability.

[0008] In some possible embodiments, determining the set of traceability edges corresponding to the IOC entity to be traced includes: Determine a plurality of traceability paths corresponding to the IOC entity to be traced based on the entity type of the IOC entity to be traced; A combination of the IOC entity to be traced and each of the traceability paths is respectively used as a traceability edge to obtain a set of traceability edges corresponding to the IOC entity to be traced.

[0009] In the embodiment of the present application, different traceability paths are set according to different IOC entity types, thereby further improving the flexibility and comprehensiveness of data traceability.

[0010] In some possible embodiments, the network security data tracing method further includes: When the waiting time of the top-level edge lock exceeds the preset time threshold, a chain release event starting from the top-level edge lock is triggered from top to bottom to end the tracing tasks at each level for the target IOC entity.

[0011] In an embodiment of the present application, by setting a timeout threshold at the top-level edge lock and releasing the traceability tasks at each level when waiting for the timeout, a balance between data integrity and traceability efficiency can be achieved, thereby further improving the flexibility of data traceability.

[0012] In some possible embodiments, the network security data tracing method further includes: Construct a global traceable data list corresponding to the target IOC entity, and record the traceability task information that has been executed in real time; The calling of the tracing thread based on the preset thread pool to execute each of the data pulling tasks also includes: Determine whether the global traceable data list contains traceability task information corresponding to the current data pulling task; If yes, the current data pulling task is terminated and the semaphore of the current edge lock is reduced by one; If not, the tracing thread is called based on the preset thread pool to execute the current data pulling task.

[0013] In an embodiment of the present application, by constructing a global traceable data list and recording the information of completed traceability tasks in real time, repeated execution of the same traceability tasks can be avoided, thereby further improving the overall efficiency of data traceability.

[0014] In some possible embodiments, respectively constructing entity locks corresponding to each valid IOC entity list, and using the IOC entities in each valid IOC entity list as the IOC entities to be traced in the next round, includes: Determine whether the current traceability level has reached the preset level upper limit; If yes, then the tracing task for the valid IOC entity list is terminated, and the parent lock semaphore corresponding to the valid IOC entity is reduced by one; If not, then construct entity locks corresponding to each of the valid IOC entity lists respectively, and use the IOC entities in each of the valid IOC entity lists as the IOC entities to be traced in the next round.

[0015] In an embodiment of the present application, the maximum traceability level is set to limit the infinite splitting of traceability tasks, thereby further improving the overall efficiency and flexibility of data traceability.

[0016] In some possible embodiments, constructing a data pulling task for each source tracing edge in the source tracing edge set includes: Determine a data pulling rule corresponding to each source tracing edge based on the type of each source tracing edge in the source tracing edge set, and construct a data pulling task for each source tracing edge according to the corresponding data pulling rule; Based on the initial data set corresponding to each traceability edge, a valid IOC entity list that meets the preset conditions is screened out, including: The entity screening rules corresponding to each tracing edge are determined according to the type of each tracing edge, and based on the initial data set corresponding to each tracing edge, a list of valid IOC entities that meet the preset conditions is screened out according to the corresponding entity screening rules.

[0017] In an embodiment of the present application, by configuring different data pulling rules and entity screening rules for different tracing edges, it is possible to obtain valid IOC entities under different tracing paths according to needs, which is conducive to further improving the efficiency and flexibility of data tracing.

[0018] In some possible embodiments, the network security data tracing method further includes: Record the basic information of source tracing for all entity data in the initial data set corresponding to each source tracing edge; wherein the basic information of source tracing includes the source tracing path information and parent entity information to which each entity data belongs; When the waiting time of the top-level edge lock exceeds the preset time threshold, or when all traceability tasks are completed, the final traceability result corresponding to the traceability request is generated based on the valid IOC entities in the list of all valid IOC entities and their corresponding traceability basic information.

[0019] In an embodiment of the present application, by recording basic information of entity data obtained through tracing at different levels, the final data tracing result can be generated based on the identified valid IOC entities and their corresponding tracing basic information, thereby further improving the efficiency and flexibility of data tracing.

[0020] In some possible embodiments, the network security data tracing method further includes: After creating the tracing task for the next round of IOC entities to be traced, the tracing thread corresponding to the tracing task at the current level is released to the thread pool.

[0021] In an embodiment of the present application, the resource utilization rate of the data tracing process is further improved by releasing the tracing thread of the previous round in time after creating the next round of tracing tasks.

[0022] In some possible embodiments, the entity type of the IOC entity to be traced includes at least one of an IP address, a domain name, a sample hash, an email, a digital certificate, a subdomain, filing information, and a registrant.

[0023] In the embodiment of the present application, by providing a variety of traceability IOC entity types, the richness of the traceability path can be effectively improved, thereby further improving the comprehensiveness of data traceability.

[0024] In a second aspect, an embodiment of the present application provides a network security data tracing device, including: A request response module, used to respond to a traceability request for a target IOC entity and use the target IOC entity as the current IOC entity to be traced; An edge lock construction module is used to create a traceability task for the IOC entity to be traced, determine the traceability edge set corresponding to the IOC entity to be traced, and construct an edge lock corresponding to the IOC entity to be traced based on the traceability edge set; wherein the initial semaphore of the edge lock is equal to the number of edges in the traceability edge set, and the edge lock is used to control whether to release the traceability task corresponding to the IOC entity to be traced according to its own semaphore; A data pulling module is used to construct a data pulling task for each traceability edge in the traceability edge set, and call the traceability thread based on a preset thread pool to execute each data pulling task to obtain an initial data set corresponding to each traceability edge; An entity screening module is used to screen out valid IOC entity lists that meet preset conditions based on the initial data sets corresponding to each traceability edge, respectively construct entity locks corresponding to each of the valid IOC entity lists, and use the IOC entities in each of the valid IOC entity lists as the IOC entities to be traced in the next round; wherein the parent lock of each of the entity locks is the edge lock constructed in the previous round, the initial semaphore of each of the entity locks is equal to the number of IOC entities in the corresponding valid IOC entity list, and when the semaphore of each of the entity locks decreases to zero, the semaphore of its parent lock is reduced by one.

[0025] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the method described in any embodiment of the first aspect when executing the program.

[0026] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented.

[0027] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a computer program, wherein when the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0029] Figure 1 A schematic diagram of a process for tracing network security data provided in an embodiment of the present application; Figure 2 An overall flow chart of a network security data tracing method provided in an embodiment of the present application; Figure 3 A schematic diagram of the architecture of the parent-child lock mechanism provided in an embodiment of the present application; Figure 4 A schematic diagram of the structure of a network security data tracing device provided in an embodiment of the present application; Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0031] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0032] It should be noted that, at present, in the process of cross-level traceability query, a serial layer-by-layer analysis process is adopted (first check the IP-associated domain name, then check the domain name-associated certificate, and so on). The data expanded at each layer increases exponentially, and the query time of each layer also increases exponentially. In this real-time traceability scenario, the same-level query mostly adopts thread pool concurrent query technology. In order to obtain the signal that the query is completed, the upper-level traceability query thread needs to wait for the completion of the lower-level traceability task before releasing the thread resources. During this process, the upper-level thread is always in a waiting state. As the traceability level deepens, the number of threads in a waiting state will increase, resulting in a large amount of resource waste.

[0033] In view of the problems existing in the above-mentioned prior art, an embodiment of the present application provides a network security data tracing method, which integrates IOC-related resources allocated in different systems by designing an engineering architecture solution for cascade tracing, and retains the tracing path in the tracing process; in addition, the cascaded parent-child lock is redesigned through CountDownLatch (lock, a synchronization tool class in Java concurrent programming, mainly used to coordinate synchronization between multiple threads) based on the Java language, and the signal transmission of the parent-child lock is used to avoid the waiting problem of the upper-level thread during the query process of the lower-level thread, thereby improving resource utilization, and at the same time, the signal notification of the end of tracing can be obtained in time.

[0034] like Figure 1 As shown, the embodiment of the present application provides a network security data tracing method, which may include the steps of: S1. In response to a traceability request for a target IOC entity, the target IOC entity is used as the current IOC entity to be traced.

[0035] Specifically, when a suspicious IOC entity is discovered and a traceability query is required for further analysis, the network security detection system can initiate a traceability request based on the currently identified suspicious IOC entity (target IOC entity). The present application scheme can serve as a deep traceability system associated with the network security detection system, responding to the traceability request for the target IOC entity and returning the final data traceability result to the network security detection system, so that the network security detection system can conduct further attack traceability analysis based on the data traceability result.

[0036] Exemplarily, step S1 starts the tracing task corresponding to the tracing request based on the target IOC entity as the current IOC entity to be traced. The IOC entity can be a specific entity information such as an IP address, domain name, etc., and the IOC entity is used as the starting point to efficiently mine its associated cross-level entities (IP, domain name, sample hash, email, digital certificate, subdomain, filing information, registrant, etc.) through concurrent technology.

[0037] S2. Create a traceability task for the IOC entity to be traced, determine the traceability edge set corresponding to the IOC entity to be traced, and construct an edge lock corresponding to the IOC entity to be traced based on the traceability edge set; wherein the initial semaphore of the edge lock is equal to the number of edges in the traceability edge set, and the edge lock is used to control whether to release the traceability task corresponding to the IOC entity to be traced according to its own semaphore.

[0038] Specifically, first, a tracing task is created for the current IOC entity to be traced. According to preset rules, the tracing edge set corresponding to the current IOC entity to be traced can be determined. Each tracing edge in the tracing edge set represents a tracing path. For example, if the IOC entity to be traced is an IP address, its corresponding tracing edges may include: IP->domain name, IP->certificate, etc.

[0039] At the same time, a side lock corresponding to the IOC entity to be traced is constructed, that is, a side lock used to control whether to release the traceability task corresponding to the current IOC entity to be traced. Among them, the initial semaphore of the side lock is equal to the number of traceability edges in the traceability edge set. When the data pulling task of a traceability edge is completed, the semaphore of the side lock is reduced by one, and so on until the semaphore of the side lock is reduced to zero. When the semaphore of the side lock is reduced to zero, the traceability task corresponding to the IOC entity to be traced is released. If the side lock is the top-level side lock, then when the semaphore of the side lock is reduced to zero, it indicates that all traceability tasks of the target IOC entity have been completed, and the final data traceability result is returned.

[0040] S3. Construct a data pulling task for each traceability edge in the traceability edge set, and call the traceability thread based on the preset thread pool to execute each data pulling task to obtain the initial data set corresponding to each traceability edge.

[0041] Specifically, for the set of traceability edges corresponding to the IOC entity to be traced, a data pulling task is constructed for each of the traceability edges (one traceability edge corresponds to one data pulling task). Then, the constructed data pulling task is submitted to the queue to be processed, and the preset thread pool calls the traceability thread to execute the data pulling tasks in the queue in turn. When a data pulling task is completed, its corresponding traceability thread is recycled to the thread pool and called to process other data pulling tasks waiting in the queue. Every time a data pulling task is completed, the edge lock semaphore corresponding to the traceability edge set is reduced by one until the data pulling tasks of all traceability edges corresponding to the traceability edge set are completed.

[0042] It should be noted that different data pulling tasks may need to build requests through the adaptation layer to pull the data of the corresponding traceability edge from different systems (DNS records, threat intelligence platforms, etc.), and the data pulled by different data pulling tasks may have inconsistent formats. Therefore, the data adaptation layer can be used to normalize the data pulled by each system into a unified data structure. At this point, when each data pulling task is completed, the initial data set corresponding to the corresponding traceability edge will be obtained. The data in the initial data set can retain the detailed information of the current traceability edge and its parent traceability entity.

[0043] S4. Based on the initial data set corresponding to each traceability edge, the valid IOC entity lists that meet the preset conditions are screened out respectively, and the entity locks corresponding to each valid IOC entity list are constructed respectively, and the IOC entities in each valid IOC entity list are used as the IOC entities to be traced in the next round; wherein, the parent lock of each entity lock is the edge lock constructed in the previous round, and the initial semaphore of each entity lock is equal to the number of IOC entities in the corresponding valid IOC entity list. When the semaphore of each entity lock decreases to zero, the semaphore of its parent lock is reduced by one.

[0044] Specifically, the same initial data set contains different entity data under the same traceability edge. For example, for the data pulling task of the "IP->domain name" traceability edge, its initial data set contains different domain name entity data. For each initial data set, data can be filtered according to preset conditions to obtain a valid IOC entity list (a collection of valid IOC entities). Exemplarily, for the initial data set of the "IP->domain name" traceability edge, IOC entities that do not need to be processed can be filtered by setting preset conditions such as a whitelist, thereby filtering out a valid IOC entity list.

[0045] Then, an entity lock is constructed for each valid IOC entity list respectively. For each valid IOC entity list, each IOC entity therein is used as the IOC entity to be traced in the next round. The tracing process for these IOC entities to be traced is the same as the process of steps S2 to S4, and so on.

[0046] Specifically, the initial semaphore of the entity lock is equal to the number of valid IOC entities in the valid IOC entity list, and each valid IOC entity will serve as the IOC entity to be traced in the next round, that is, the valid IOC entity will build the edge lock of the next level based on its traceability edge set. When the edge lock semaphore is reduced to zero, the current entity lock semaphore is reduced by one until the current entity lock semaphore is reduced to zero. At this time, it means that all IOC entities in the current valid IOC entity list have completed the next round of data pulling tasks, and the semaphore of its parent lock (the parent lock of the entity lock is the edge lock of the previous level) is reduced by one, and so on.

[0047] In an embodiment of the present application, cascading parent-child locks are designed to transfer states and control threads of multi-level traceability tasks. Multi-level traceability is performed through concurrent cascading scheduling from an IOC entity as the entry, and finally a valid IOC is output and the traceability paths of each level are retained. This can avoid the waiting problem of the upper-level thread during the execution of the lower-level thread, thereby effectively improving the overall efficiency and resource utilization of data traceability.

[0048] In some possible embodiments, in step S2, determining the traceability edge set corresponding to the IOC entity to be traced may include: S201, determining a number of traceability paths corresponding to the IOC entity to be traced based on the entity type of the IOC entity to be traced; S202: Take the combination of the IOC entity to be traced and each traceability path as a traceability edge, and obtain a traceability edge set corresponding to the IOC entity to be traced.

[0049] It should be noted that different traceability path sets can be set for different entity types, so that the corresponding traceability paths can be determined according to the entity type of the current IOC entity to be traced. Then, the current IOC entity to be traced is combined with these traceability paths into a traceability edge to obtain the traceability edge set corresponding to the IOC entity to be traced.

[0050] Exemplarily, the IOC entity to be traced that currently needs to be processed is an IP address. For the entity type of IP address, its preset traceability path includes the domain name and certificate. Then the traceability edge set corresponding to the IOC entity to be traced is {IP->domain name, IP->certificate}.

[0051] Based on this, by setting different traceability paths according to different IOC entity types, massive data can be selectively traced according to needs, thereby further improving the flexibility and comprehensiveness of data traceability.

[0052] In some possible embodiments, the network security data tracing method may further include: When the waiting time of the top-level edge lock exceeds the preset time threshold, a lock chain release event starting from the top-level edge lock is triggered from top to bottom to end the tracing tasks at each level for the target IOC entity.

[0053] It should be noted that in addition to waiting for all traceability tasks to be completed to obtain the final data traceability results, you can also set a maximum waiting time limit to control the timeout of external traceability requests.

[0054] Specifically, the timing starts when a traceability task is created for the target IOC entity, that is, when the top-level side lock is created. When the cumulative waiting time of the top-level side lock exceeds the preset time threshold, the traceability tasks of each level are immediately terminated. At the same time, the chain release is triggered from the top-level side lock to the sub-locks of the lower levels in sequence, thereby recovering all traceability threads that are executing tasks.

[0055] It is understandable that before the timeout recovery event is triggered, each level has completed a certain number of data traceability tasks. At this time, the traceability results can be generated based on the entity data that has completed traceability and its corresponding traceability basic information (paths at each level, entity details, etc.) as the result of feedback to the external traceability request.

[0056] Based on this, by setting a timeout threshold at the top-level edge lock and releasing the traceability tasks at each level when waiting for the timeout, when the traceability level is deep or the data is massive, there is no need to wait for all traceability tasks to be completed. The traceability results can be generated based on the appropriate amount of traceability data, thereby achieving a balance between data integrity and traceability efficiency, and further improving the flexibility of data traceability.

[0057] In some possible embodiments, the network security data tracing method may further include: Build a global traceable data list corresponding to the target IOC entity, and record the traceability task information that has been executed in real time; In step S3, the tracing thread is called based on a preset thread pool to execute each data pulling task, which may also include: Determine whether the global traceable data list contains traceability task information corresponding to the current data pulling task; If yes, the current data pulling task is terminated and the semaphore of the current edge lock is reduced by one; If not, the tracing thread is called based on the preset thread pool to execute the current data pulling task.

[0058] It should be noted that during the traceability process, the same or different traceability edges may generate the same valid IOC entity at the same level or different levels (for example, the resolution IP of the domain name is the same as an IP associated with the certificate).

[0059] In order to avoid loop tracing or repeated tracing, you can keep a global list of traced entities (you can use IOC entity + traceability edge as the unique query primary key). Before the traceability tasks at each level pull specific data, first determine whether the corresponding traceability task information (current IOC entity + traceability edge) already exists in the global list (global traced data list).

[0060] If it exists, it means that the same valid IOC entity has been expanded in the traceability tasks of other levels or other traceability edges at the same level, and the corresponding traceability tasks have been created. In this case, there is no need to continue the current task. The current traceability task (data pulling task) can be ended and the edge lock semaphore is notified to decrease by one (one data pulling task corresponds to one semaphore of the edge lock).

[0061] On the contrary, if there is no tracing task information corresponding to the current data pulling task in the global list (global traced data list), the thread is called to process the data pulling task according to the normal process.

[0062] Based on this, by building a global traceable data list to record the information of completed traceability tasks in real time, and judging whether to end the traceability task based on the traced situation before executing the data pulling task, unnecessary task duplication can be avoided, thereby further improving the overall efficiency of data traceability.

[0063] In some possible embodiments, in step S4, constructing entity locks corresponding to each valid IOC entity list respectively, and using the IOC entities in each valid IOC entity list as the IOC entities to be traced in the next round, may include: Determine whether the current traceability level has reached the preset level upper limit; If yes, the traceability task for the valid IOC entity list is terminated, and the parent lock semaphore corresponding to the valid IOC entity is reduced by one; If not, construct entity locks corresponding to each valid IOC entity list respectively, and use the IOC entities in each valid IOC entity list as the IOC entities to be traced in the next round.

[0064] It should be noted that the number of traceability tasks will increase exponentially with the increase of traceability levels, and since the types of entities are limited, the types of traceability edges (tracing paths) are also limited. Therefore, when the number of data traceability levels exceeds a certain number, the probability of repeated traceability tasks (the same traceability path for the same entity) will increase greatly. Therefore, a suitable maximum traceability level can be set according to needs to control the overall traceability level depth.

[0065] Based on the preset level limit, before filtering out the valid IOC entity list and building the corresponding entity lock each time, first determine whether the current traceability level has reached the upper limit. If so, the traceability task will not be expanded, and the traceability task of the current level will be considered completed, and the parent lock semaphore will be reduced by one. Otherwise, the entity lock corresponding to each valid IOC entity list will be created normally, and the next round of data pulling tasks will continue to be created, and so on, until the traceability level reaches the preset level upper limit.

[0066] Based on this, by setting the maximum traceability level to limit the infinite splitting of traceability tasks, the overall traceability task can be executed within the appropriate level range, thereby further improving the overall efficiency and flexibility of data traceability.

[0067] In some possible embodiments, in step S3, constructing a data pulling task for each traceability edge in the traceability edge set may include: Determine the data pulling rule corresponding to each traceability edge based on the type of each traceability edge in the traceability edge set, and construct the data pulling task of each traceability edge according to the corresponding data pulling rule; In step S4, based on the initial data set corresponding to each traceability edge, a list of valid IOC entities that meet the preset conditions is screened out, which may include: The entity screening rules corresponding to each tracing edge are determined according to the type of each tracing edge, and based on the initial data set corresponding to each tracing edge, a list of valid IOC entities that meet the preset conditions is screened out according to the corresponding entity screening rules.

[0068] It should be noted that different data pulling rules can be configured for different tracing edges. For example, for the IP->domain name tracing edge, it can be set to pull the domain name data resolved within a preset historical period (such as the past 30 days).

[0069] In addition, for the initial data set pulled by each tracing edge, different entity filtering rules can be configured for different tracing edges. For example, for the IP->domain name tracing edge, the corresponding domain name whitelist and blacklist can be configured, where the whitelist domain name is a filtering rule, and the whitelist domain name is not included in the valid IOC entity list; the blacklist is a filtering rule, and the blacklist domain name is included in the valid IOC entity list; or it can be configured to filter and retain static type domain names and filter out dynamic type domain names.

[0070] Based on this, by configuring different data pulling rules and entity screening rules for different traceability edges, it is possible to obtain valid IOC entities under different traceability paths according to needs, which is conducive to further improving the efficiency and flexibility of data traceability.

[0071] In some possible embodiments, the network security data tracing method further includes: Record the basic information of all entity data in the initial data set corresponding to each traceability edge; the basic information includes the traceability path information and parent entity information to which each entity data belongs; When the waiting time of the top-level edge lock exceeds the preset time threshold, or when all traceability tasks are completed, the final traceability result corresponding to the traceability request is generated based on the valid IOC entities in the list of all valid IOC entities and their corresponding traceability basic information.

[0072] It should be noted that when each traceability edge pulls the corresponding data through the data pulling task, the relevant traceability basic information can be saved for these data, and the traceability basic information includes the traceability path information and parent entity information to which the entity itself belongs. For example, for the domain name data pulled by the IP->domain name traceability edge, the corresponding traceability path information (IP->domain name) and the detailed information of its parent entity (specific IP address) are saved for each domain name data.

[0073] When all traceability tasks are completed or reach a timeout, based on the recorded basic traceability information, a reverse search can be performed from the last node of the traceability chain according to the parent traceability entity and the traceability edge to find the complete traceability link of the corresponding entity, and finally generate the traceability results corresponding to all valid IOC entities.

[0074] Based on this, by recording the basic information of entity data obtained through traceability at different levels, the final data traceability results can be generated based on the identified valid IOC entities and their corresponding traceability basic information, thereby further improving the efficiency and flexibility of data traceability.

[0075] In some possible embodiments, the network security data tracing method may further include: After creating the tracing task for the next round of IOC entities to be traced, the tracing thread corresponding to the tracing task at the current level is released to the thread pool.

[0076] It should be noted that after the parent class traceability task is completed, you only need to build the next level of traceability task and submit the task to the thread pool. The thread of the current task can end and return to the thread pool, thereby avoiding the waste of thread resources to the greatest extent. At the same time, the status of each traceability task can be obtained in time through the semaphore of the edge lock / entity lock.

[0077] In an embodiment of the present application, the resource utilization rate of the data tracing process is further improved by releasing the tracing thread of the previous round in time after creating the next round of tracing tasks.

[0078] In some possible embodiments, the entity type of the IOC entity to be traced includes at least one of an IP address, a domain name, a sample hash, an email, a digital certificate, a subdomain, filing information, and a registrant.

[0079] It should be noted that the entity types of IOC entities (including IOC entities to be traced and valid IOC entities, etc.) in the embodiments of the present application can include one or more of IP addresses, domain names, sample hashes, emails, digital certificates, subdomains, filing information, and registrants. Different traceability paths, data pulling rules, and entity screening rules can be configured according to the entity types of different entities, thereby further improving the flexibility and comprehensiveness of data traceability.

[0080] See also Figure 2 The main steps of the embodiment of the present application are described below: 1. Starting from an IOC entity (target IOC entity), enter the entity adaptation layer and determine the tracing edge set of the current entity according to the entity type (IP address, domain name, certificate, etc.) and the tracing path of the IOC entity (for example, if the type is IP, the tracing edge may include IP->domain name, IP->certificate, etc.).

[0081] 2. Build an edge lock based on the traceability edge set. If the traceability edge set has N edges, the edge lock semaphore is N, that is, the edge lock can only be unlocked and released when all N edges are completed. The parent lock of the top-level edge lock is null, and the business thread of the external request waits on the edge lock to obtain the completion status of the overall traceability task.

[0082] 3. Each edge builds a request through the data pull adaptation layer and sends it to each system to pull the data of the corresponding traceability edge. Each edge can set its own data pull rules; the data pull tasks of each edge are submitted to the pending queue after construction, and the data is pulled concurrently through the thread pool; the outer layer call side can control the request timeout through the first layer edge lock or wait for all the layer extension tasks to complete to obtain the final traceability result. The traceability level at this time is 1.

[0083] 4. The data pulled from each system is normalized into a unified data structure through the data adaptation layer. The data set pulled corresponding to each traceability edge may be different. The normalized data can retain information such as the current traceability relationship edge and the parent traceability entity details as the data basis for generating the final traceability result.

[0084] 5. The initial data set pulled by each traceability edge is filtered through the data filtering layer. Different entity filtering rules can be set for each traceability edge to filter out qualified entities and enter the valid IOC entity list; according to the parent entity and edge relationship retained in the entity, the traceability path and the details of the entities on each level of the path can be found in a reverse loop; it should be noted that the top-level IOC entity traced back from any traced entity is the target IOC entity that first enters the traceability process, and the traceability path of any IOC entity can be found through a reverse loop search.

[0085] 6. The data pulled by each traceability edge enters the traceability filtering layer to determine whether there are IOC entities that meet the conditions for entering the next round of traceability (i.e., the valid IOC entity list). If none of the conditions are met, the traceability task of this edge ends, and the parent lock semaphore is notified to decrease by one. When the parent lock semaphore decreases to 0, the parent lock is released. If the parent lock still has a parent lock, then when the parent lock semaphore decreases to 0, the parent lock semaphore of the parent lock decreases by one.

[0086] 7. If there are IOC entities that meet the conditions for the next round of tracing, an entity lock is built for the valid IOC entity list corresponding to the current edge that enters the next round of tracing. The semaphore is the number of valid IOC entities in each valid IOC entity list, and the parent lock is the edge lock built in the previous round; then, a tracing task is built for each valid IOC entity and submitted to the thread pool. At this time, the level of the task is the parent level + 1. Each tracing task retains the entity details and upper-level tracing edges of the upper level; after the task is submitted, the tracing thread of the current task returns to the thread pool and can be used by other tracing tasks.

[0087] 8. For each valid IOC entity traceability task in step 7, the process will go back to step 1 to obtain the traceability edge set, and then build an edge lock based on the traceability edge set. The parent lock of this layer of edge lock is the entity lock built in step 7, and so on.

[0088] 9. If the maximum level of traceability is set in the business thread, when the traceability level gradually increases and reaches the maximum level, the traceability task will no longer be expanded, and the parent lock will be notified in cascade that the current task has ended.

[0089] It is understandable that in the entire process of in-depth expansion layer by layer, if there is no parent-child lock mechanism, in order to obtain the completion status of the overall task at the top level, the thread at the top level must wait; for example, the IOC entity at the Nth layer needs to expand three edges, and the thread needs to wait for the completion of three tracing tasks. Each tracing task may expand m IOC entities, and these IOC entities will enter the next level of tracing tasks, that is, the N+1 layer tracing tasks. Then the edge tracing thread at the Nth layer needs to wait for the completion of all tracing tasks at the N+1 layer, and so on. The overall tracing process will cause a lot of thread resource waste.

[0090] The embodiment of the present application uses a cascaded parent-child lock mechanism such as "edge lock->entity lock->edge lock". Only the top-level business thread needs to wait on the top-level edge lock to obtain the completion of the overall traceability task or reach a timeout. In addition, no parent thread needs to wait for the child thread task to complete before obtaining the completion signal. After the parent class traceability task is completed, it only needs to build the traceability task of the next level and then submit the task to the thread pool. The traceability thread of the current traceability task ends and can return to the thread pool, thereby avoiding the waste of thread resources to the greatest extent. At the same time, based on the cascaded parent-child lock mechanism, the top-level traceability thread can obtain the status of tasks at each level in time; when the deep-level traceability task is completed, the semaphore of the parent lock is reduced by one, and when the semaphore of the parent lock is 0, the parent lock is released. At the same time, if the parent lock still has a parent lock, the parent lock semaphore of the parent lock is reduced by one, and so on, until the top-level edge lock is released. In addition, since the parent lock retains the reference of the child lock, when the overall task times out, the child lock can be notified from top to bottom to release the current task.

[0091] The following specific examples are given to explain in detail the scheme of the embodiment of the present application: Step A1: The target IOC entity (the current IOC entity to be traced) enters the entity adaptation layer and obtains the traceability edge set according to the type and context of the target IOC entity.

[0092] This step obtains the traceability edge of the IOC entity through the entity type. For example, if the entity type is IP, the traceability edge may include the above-mentioned IP->domain name, IP->certificate and other traceability edges. The following steps assume that starting from the IP entity vertex1, m traceability edges are obtained.

[0093] Step A2, build the traceability task (data pulling task) of each edge in a loop according to the traceability edge set, and build the traceability edge lock latch1 according to the number of traceability edges; query whether there is a unique primary key composed of the current entity and the traceability edge in the global traceability entity set. If it already exists, it means that the current entity and the current edge have entered or completed the traceability, and the current edge task ends. If not, add it to the global traceability entity set and submit the traceability task of the traceability edge to the traceability thread pool.

[0094] Step A3: Normalize the data pulled corresponding to the traceability edge, filter out valid IOC entities and filter out the traceability entities to enter the next round (all valid IOC entities can be directly used as the entities to be traced to enter the next round, or the entities to enter the next round of traceability can be further filtered out from the valid IOC entities).

[0095] This step consists of three sub-steps: Step A31: Normalize the pulled data. The normalized data includes extended entities, entity types, and specific data for subsequent screening of valid ioc entities and construction of the next round of traceability tasks.

[0096] Step A32: Filter out valid IOC entities based on the initial data set pulled from each traceability edge. Each traceability edge can customize different entity filtering rules. For example, the domain name resolution IP edge can be filtered based on the resolution time, IP intelligence, etc. If a valid IOC entity is filtered out, it will enter the valid ioc entity list corresponding to the traceability edge.

[0097] Step A33: Based on the valid IOC entity list traced, build the next round of traceability entity set, each entity can contain information such as entity, entity type, data details and parent class traceability entity. In the process of screening the next round of traceability entity set, each edge and each type of entity can customize different entity screening conditions. For example, it is not meaningful to continue tracing the dynamic domain name, and it will not enter the next round.

[0098] It should be noted that according to the field definition of the traceability entity, from the last node of the traceability chain, a reverse search can be performed based on the parent class traceability entity and the traceability edge to find the complete traceability link of this entity. The top-level entity of the traceability chain is entity vertex1.

[0099] Step A4: Judge the traceability entity set (valid IOC entity list) that is selected by each edge and enters the next round. If the set is empty, it means that the traceability task of this edge is completed, and the edge lock Latch1 is notified, and the Latch1 semaphore is reduced by one. If the set is not empty, then build the entity lock Latch2 of this edge. The semaphore of the entity lock is the number of valid IOC entity sets corresponding to the traceability edge. The parent lock of the entity lock Latch2 is the edge lock Latch1, and Latch2 is added to the child lock set of Latch1.

[0100] Step A5: Construct a traceability task (data pulling task) for each entity in the current valid IOC entity list. The level of the traceability task is increased by 1 and submitted to the traceability thread pool. Each task repeats step A1 for the next round of traceability.

[0101] It should be noted that the overall traceability process is an exponential task expansion process. Starting from the first few edge tasks, as the traceability level goes deeper, the number of expanded entities increases, and the number of tasks expands rapidly. If the common thread pool usage method is used, the upper-level task needs to wait for all lower-level tasks to be completed before the task status can be obtained. There will be a problem of chain thread waiting. For example, the task execution thread of the IP->domain name edge is thread1, and thread1 expands N domain names. These N domain names enter the next round of traceability process. Thread1 needs to wait for the traceability of these N domain names to be completed before the task can be returned to the thread pool. Assuming that each domain name has three traceability edges, 3N threads are required to perform the traceability task. These 3N threads need to wait for the next round of subtasks to be completed. By analogy, a large number of threads cannot be immediately recycled to the thread pool to perform new tasks after completing their own traceability tasks, but are in waiting. The embodiment of the present application effectively solves the problem of resource waste caused by thread waiting through the mechanism of cascading parent-child locks.

[0102] See also Figure 3 , the locking mechanism of the embodiment of the present application is briefly described below: 1. The ioc entity that enters the traceability process obtains m traceability edges through the entity adaptation layer, and the semaphore of the edge lock is m, that is, this edge lock will be released only after m subtasks are completed and notified.

[0103] 2. Build m tracing subtasks and submit them to the tracing thread pool. The top-level tracing business thread (external business request) waits on the edge lock.

[0104] 3. Take one of the traceability edges as an example. The traceability edge expands N valid ioc entities to enter the next round of traceability, and builds an entity lock. The semaphore of the entity lock is the number of valid ioc entities N, and the parent-child relationship between the edge lock and the entity lock is associated; 4. Build the traceability task for each valid IOC entity, jump to step 1, obtain the edge lock corresponding to each valid IOC entity, build the parent-child relationship between the entity lock in step 3 and the edge lock of this round, and finally form a parent-child lock chain of cascade edge lock -> entity lock -> edge lock.

[0105] 5. When the deepest task is completed, the parent lock is notified and the parent lock semaphore is reduced by one. When its own semaphore is 0, the lock is released and the semaphore of the parent lock held is notified to decrease by one, and so on until the top-level side lock is released.

[0106] The following specific examples are given to explain the locking mechanism of the embodiment of the present application in detail: Step L1: When the traceability ioc entity enters the traceability process, assuming there are three traceability edges, edge lock latch1 is created, and the edge lock semaphore is 3. The traceability business thread can wait on edge lock latch1 to obtain the traceability status in time.

[0107] Step L2: Construct the traceability task of each traceability edge and concurrently request to pull data. The threads used are T1, T2 and T3 respectively. If there are N1, N2 and N3 valid ioc entities entering the next round, then construct entity locks Latch11, Latch12 and Latch13 in threads T1, T2 and T3 respectively, and the semaphores are N1, N2 and N3 respectively. The parent locks of the three entity locks are all edge locks Latch1. At the same time, add three entity locks Latch11, Latch12 and Latch13 to the child lock set of Latch1.

[0108] Step L3: Construct N1, N2 and N3 entity tracing tasks in threads T1, T2 and T3 in a concurrent loop respectively, and submit them to the thread pool.

[0109] It should be noted that after step L3 is completed (after submitting the entity tracing task), threads T1, T2 and T3 can be returned to the thread pool without waiting for the completion of the next round of subtasks.

[0110] In step L4, after the N1 entity traceability tasks constructed in thread T1 enter the next round of traceability, each entity traceability task will construct a side lock, namely latch111, latch112, ... latch11n. The parent lock of these n side locks is latch11.

[0111] It should be noted that the subsequent deeper-level traceability locks cycle the above steps, based on which a multi-tree lock chain can be constructed. When the deepest-level traceability task is completed, the corresponding lock semaphore will be notified to decrease by 1. For example, each time a traceability task corresponding to Latch111 is completed, the semaphore of Latch111 will be notified to decrease by one. When the semaphore of Latch111 is 0, Latch111 is released, and the semaphore of Latch111's parent lock Latch11 is notified to decrease by one. When latch112 to Latch11n complete the traceability task and notify the parent lock Latch11 to decrease by one, the semaphore of the parent lock Latch11 is 0, and the Latch11 lock is released, so the semaphore of Latch11's parent lock Latch1 is notified to decrease by 1, until the traceability tasks corresponding to Latch12 and Latch13 complete the lock release, and notify Latch1 to decrease by one respectively, until the semaphore of Latch1 is zero, then Latch1 is finally released, and the external business thread obtains the most total traceability status and results.

[0112] It should also be noted that when the traceability level is deep and the top edge lock wait times out, it triggers the release notification of the lock chain from top to bottom, that is, Latch1 notifies Latch11, Latch12, and Latch13 to release, Latch11 notifies Latch111, Latch112...Latch11n to release, and so on. In the process logic, before submitting a task, it will determine whether the lock corresponding to the current task has been released. If it has been released, the task will not be submitted again.

[0113] It should be noted that the embodiment of the present application, by constructing a set of concurrent cascade traceability methods, can obtain corresponding related data from different systems starting from one entity, complete a multi-level automated traceability process, and greatly improve the traceability efficiency; at the same time, through the cascading parent-child lock mechanism, the resource utilization of the overall traceability process is greatly improved, and it can facilitate threads at all levels to obtain the status of traceability tasks in a timely manner.

[0114] Please refer to Figure 4 , Figure 4 The following is a block diagram showing the composition of the network security data tracing device provided by some embodiments of the present application. Figure 1 Corresponding to the method embodiment, it is able to execute each step involved in the above method embodiment. The specific functions of the network security data tracing device can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0115] Figure 4 The network security data tracing device includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the network security data tracing device, and the network security data tracing device includes: The request response module 410 is used to respond to the traceability request for the target IOC entity and use the target IOC entity as the current IOC entity to be traced; The edge lock construction module 420 is used to create a traceability task for the IOC entity to be traced, determine the traceability edge set corresponding to the IOC entity to be traced, and construct an edge lock corresponding to the IOC entity to be traced based on the traceability edge set; wherein the initial semaphore of the edge lock is equal to the number of edges in the traceability edge set, and the edge lock is used to control whether to release the traceability task corresponding to the IOC entity to be traced according to its own semaphore; The data pulling module 430 is used to construct a data pulling task for each traceable edge in the traceable edge set, and call the traceable thread based on a preset thread pool to execute each data pulling task to obtain an initial data set corresponding to each traceable edge; The entity screening module 440 is used to screen out valid IOC entity lists that meet preset conditions based on the initial data sets corresponding to each traceability edge, respectively construct entity locks corresponding to each valid IOC entity list, and use the IOC entities in each valid IOC entity list as the IOC entities to be traced in the next round; wherein the parent lock of each entity lock is the edge lock constructed in the previous round, the initial semaphore of each entity lock is equal to the number of IOC entities in the corresponding valid IOC entity list, and when the semaphore of each entity lock decreases to zero, the semaphore of its parent lock is reduced by one.

[0116] It can be understood that the above-mentioned device item embodiment corresponds to the method item embodiment of the present invention. A network security data tracing device provided by the embodiment of the present invention can implement the network security data tracing method provided by any method item embodiment of the present invention.

[0117] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0118] like Figure 5 As shown, some embodiments of the present application provide an electronic device 500, which includes: a memory 510, a processor 520, and a computer program stored in the memory 510 and executable on the processor 520, wherein the processor 520 reads the program from the memory 510 through a bus 530 and executes the program to implement a method such as any embodiment of the above-mentioned network security data tracing method.

[0119] Processor 520 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 520 can be a microprocessor.

[0120] The memory 510 may be used to store instructions executed by the processor 520 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 520 of the disclosed embodiment may be used to execute instructions in the memory 510 to implement the method shown above. The memory 510 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0121] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon. The computer program is executed by a processor to execute the method described in the method embodiment.

[0122] Some embodiments of the present application further provide a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0123] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0124] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0125] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0126] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0127] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0128] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0129] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A network security data tracing method, characterized in that: include: In response to a traceability request for a target IOC entity, taking the target IOC entity as a current IOC entity to be traced; Create a traceability task for the IOC entity to be traced, determine the traceability edge set corresponding to the IOC entity to be traced, and construct an edge lock corresponding to the IOC entity to be traced based on the traceability edge set; wherein the initial semaphore of the edge lock is equal to the number of edges in the traceability edge set, and the edge lock is used to control whether to release the traceability task corresponding to the IOC entity to be traced according to its own semaphore; Constructing a data pulling task for each traceable edge in the traceable edge set, and calling a traceable thread based on a preset thread pool to execute each data pulling task, so as to obtain an initial data set corresponding to each traceable edge; Based on the initial data set corresponding to each traceability edge, a list of valid IOC entities that meet the preset conditions is screened out respectively, and an entity lock corresponding to each of the valid IOC entity lists is constructed respectively, and the IOC entities in each of the valid IOC entity lists are used as the IOC entities to be traced in the next round; wherein, the parent lock of each of the entity locks is the edge lock constructed in the previous round, the initial semaphore of each of the entity locks is equal to the number of IOC entities in the corresponding valid IOC entity list, and when the semaphore of each of the entity locks decreases to zero, the semaphore of its parent lock is reduced by one.

2. The network security data tracing method according to claim 1, characterized in that: The determining of the traceability edge set corresponding to the IOC entity to be traced includes: Determine a plurality of traceability paths corresponding to the IOC entity to be traced based on the entity type of the IOC entity to be traced; A combination of the IOC entity to be traced and each of the traceability paths is respectively used as a traceability edge to obtain a set of traceability edges corresponding to the IOC entity to be traced.

3. The network security data tracing method according to claim 1, characterized in that: Also includes: When the waiting time of the top-level edge lock exceeds the preset time threshold, a chain release event starting from the top-level edge lock is triggered from top to bottom to end the tracing tasks at each level for the target IOC entity.

4. The network security data tracing method according to claim 1, characterized in that: Also includes: Construct a global traceable data list corresponding to the target IOC entity, and record the traceability task information that has been executed in real time; The calling of the tracing thread based on the preset thread pool to execute each of the data pulling tasks also includes: Determine whether the global traceable data list contains traceability task information corresponding to the current data pulling task; If yes, the current data pulling task is terminated and the semaphore of the current edge lock is reduced by one; If not, the tracing thread is called based on the preset thread pool to execute the current data pulling task.

5. The network security data tracing method according to claim 1, characterized in that: The step of respectively constructing an entity lock corresponding to each of the valid IOC entity lists, and taking the IOC entities in each of the valid IOC entity lists as the IOC entities to be traced in the next round, includes: Determine whether the current traceability level has reached the preset level upper limit; If yes, then the tracing task for the valid IOC entity list is terminated, and the parent lock semaphore corresponding to the valid IOC entity is reduced by one; If not, then construct entity locks corresponding to each of the valid IOC entity lists respectively, and use the IOC entities in each of the valid IOC entity lists as the IOC entities to be traced in the next round.

6. The network security data tracing method according to claim 1, characterized in that: The step of constructing a data pulling task for each source tracing edge in the source tracing edge set includes: Determine a data pulling rule corresponding to each tracing edge based on the type of each tracing edge in the tracing edge set, and construct a data pulling task for each tracing edge according to the corresponding data pulling rule; Based on the initial data set corresponding to each traceability edge, a valid IOC entity list that meets the preset conditions is screened out, including: The entity screening rules corresponding to each tracing edge are determined according to the type of each tracing edge, and based on the initial data set corresponding to each tracing edge, a list of valid IOC entities that meet the preset conditions is screened out according to the corresponding entity screening rules.

7. The network security data tracing method according to claim 1, characterized in that: Also includes: Record the basic information of source tracing for all entity data in the initial data set corresponding to each source tracing edge; wherein the basic information of source tracing includes the source tracing path information and parent entity information to which each entity data belongs; When the waiting time of the top-level edge lock exceeds the preset time threshold, or when all traceability tasks are completed, the final traceability result corresponding to the traceability request is generated based on the valid IOC entities in the list of all valid IOC entities and their corresponding traceability basic information.

8. The network security data tracing method according to claim 1, characterized in that: Also includes: After creating the tracing task for the next round of IOC entities to be traced, the tracing thread corresponding to the tracing task at the current level is released to the thread pool.

9. The network security data tracing method according to any one of claims 1 to 8, characterized in that: The entity type of the IOC entity to be traced includes at least one of an IP address, a domain name, a sample hash, an email, a digital certificate, a subdomain, filing information, and a registrant.

10. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the network security data tracing method described in any one of claims 1 to 9 when executing the program.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the network security data tracing method according to any one of claims 1 to 9 is executed.

12. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the network security data tracing method according to any one of claims 1 to 9 is implemented.

Images