Network security abnormal event detection method and device, and electronic equipment

Abstract

The invention discloses a network security abnormal event detection method and device and electronic equipment, and relates to the technical field of network security or other related fields, and the method comprises the steps: continuously collecting system data streams in the real-time operation process of a target system, and inputting the system data streams into a rule matching engine with preset N progressive preset association rules, n is a positive integer; under the condition that the first target association rule is matched, generating a network security abnormal event and an event mark; when the rule matching engine matches a second target association rule having a logic progressive relationship with the first target association rule, querying an event mark in a system cache; and under the condition of confirming that the event mark is in the validity period, upgrading the generated network security abnormal event, and updating the event mark. According to the method and the device, the technical problem that the network security alarm is not timely due to the fact that response delay is easy to occur when a progressively associated complex network security event is processed in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a method and device for detecting abnormal network security events, and electronic equipment. Background Art

[0002] Network security abnormal events refer to system operation abnormalities or failures caused by user operation errors, virus programs or hacker attacks. They will not only affect the normal operation of the system, but also cause the leakage of user information and even data loss, causing economic losses to users. Detecting network security abnormal events and accurately judging the severity of the events are key issues in the field of network security.

[0003] In the prior art, network security abnormal events are mainly discovered by detecting the characteristics and abnormal behaviors of specific events. For example, hacker intrusion events or virus events are discovered by detecting the characteristics of hacker intrusion or virus characteristics. However, the detection methods in the prior art have problems such as single detection method, inaccurate detection, and low detection efficiency. They face significant limitations when processing progressive event associations: on the one hand, although the association analysis method based on the state machine can achieve orderly matching of rules, it cannot complete the phased result output in the intermediate process, and it is also insufficient in resource occupation, and cannot meet the accuracy and efficiency requirements under high-frequency and large-volume data processing conditions; on the other hand, although the technical solution with a fixed time window can simplify the rule matching process, it sacrifices the real-time nature of events, resulting in delays and misjudgments in security responses.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a method and device for detecting abnormal network security events, and an electronic device, so as to at least solve the technical problem that the prior art is prone to response delays when processing complex network security events with progressive associations, resulting in untimely network security alarms.

[0006] According to one aspect of an embodiment of the present application, a method for detecting network security abnormal events is provided, comprising: continuously collecting system data streams during real-time operation of a target system, and inputting the system data streams into a rule matching engine, wherein the multiple rules preset in the rule matching engine include N preset association rules, and N is a positive integer; when the rule matching engine matches the system data stream to a first target association rule, generating a network security abnormal event and an event flag corresponding to the first target association rule, wherein the event flag is at least used to characterize the validity period of the abnormal event; when the rule matching engine matches a second target association rule that has a logically progressive relationship with the first target association rule, querying the event flag in a system cache; when it is confirmed that the event flag is within the validity period, upgrading the generated network security abnormal event, and updating the event flag based on the upgraded network security abnormal event.

[0007] Optionally, after receiving the system data stream, the rule matching engine performs the following steps: sorting the received system data stream according to the time sequence and data timestamp to obtain the data stream to be analyzed; calling at least one progressive rule group formed by N preset association rules one by one, and using the association sub-rules of the preset association rules in the progressive rule group to match the data stream to be analyzed, wherein the multiple association sub-rules corresponding to the same progressive rule group have a time sequence progressive relationship; when the data stream to be analyzed hits T association sub-rules according to the time sequence progressive relationship, determining that the preset association rule to which the T association sub-rules belong is the first target association rule, wherein T is a positive integer.

[0008] Optionally, before inputting the system data stream into the rule matching engine, it also includes: analyzing the N preset association rules preset in the rule matching engine to obtain M progressive rule groups, where M is a positive integer less than or equal to N; analyzing all the preset association rules in each of the progressive rule groups to determine R association sub-rules corresponding to each of the progressive rule groups, where R is a positive integer.

[0009] Optionally, generating a network security anomaly event corresponding to the first target association rule includes: determining detailed data of the network security anomaly event based on the first target association rule and system data that hits the first target association rule, wherein the detailed data includes: specific data that triggers the association sub-rule, the triggering event, and the event category and event level of the triggering event; creating an event record of the network security anomaly event based on the detailed data, and storing the event record in a system memory database of the target system.

[0010] Optionally, after storing the event record in the system memory database of the target system, generating an event flag includes: determining the validity period of the network security anomaly event based on the first target association rule, and creating the event flag based on the validity period, wherein the event flag includes at least a generation timestamp, the validity period, and a data index of the network security anomaly event in the system memory database; and storing the event flag in the system cache of the target system.

[0011] Optionally, the steps performed by the rule matching engine after the system data flow matches the first target association rule also include: after the data flow to be analyzed hits T association sub-rules in the progressive rule group, continuing to match the data flow to be analyzed with the remaining association sub-rules in the progressive rule group according to the time sequence progressive relationship within a preset time window; when the data flow to be analyzed matches a newly added association sub-rule, determining the second target association rule based on the T association sub-rules that have been hit and the newly added association sub-rule; or, when the preset time window is exceeded and no newly added association sub-rule is matched, stopping the matching operation between the progressive rule group and the data flow to be analyzed in the current matching process, and deleting the event flag in the system cache.

[0012] Optionally, the generated network security anomaly event is upgraded, and an event flag is updated based on the upgraded network security anomaly event, including: determining the upgraded supplementary data of the network security anomaly event based on the second target association rule and the system data that hits the second target association rule, wherein the upgraded supplementary data includes: the specific data that triggers the newly added association sub-rule, the triggering event, and the event category and event level of the triggering event; searching for the event record of the network security anomaly event in the system memory database, and supplementing the event record with the upgraded supplementary data to obtain the upgraded network security anomaly event; determining the updated validity period of the upgraded network security anomaly event based on the second target association rule, and creating an updated event flag based on the updated validity period, wherein the updated event flag includes at least: an updated timestamp, the updated validity period, and a data index of the upgraded network security anomaly event in the system memory database; and replacing the event flag in the system cache of the target system with the updated event flag.

[0013] According to another aspect of an embodiment of the present application, a device for detecting network abnormal events is also provided, including: an input module, used to continuously collect system data streams during the real-time operation of a target system, and input the system data streams into a rule matching engine, wherein the multiple rules preset in the rule matching engine include N preset association rules, and N is a positive integer; a generation module, used to generate a network security abnormal event and an event flag corresponding to a first target association rule when the rule matching engine matches the system data stream to a first target association rule, wherein the event flag is at least used to characterize the validity period of the abnormal event; a query module, used to query the event flag in a system cache when the rule matching engine matches a second target association rule having a logically progressive relationship with the first target association rule; an upgrade module, used to upgrade the generated network security abnormal event when confirming that the event flag is within the validity period, and update the event flag based on the upgraded network security abnormal event.

[0014] According to another aspect of an embodiment of the present application, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for detecting abnormal network security events.

[0015] According to another aspect of an embodiment of the present application, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-described methods for detecting abnormal network security events.

[0016] In the present application, a real-time monitoring and intelligent matching method is adopted. First, the system data stream is continuously collected during the real-time operation of the target system, and the system data stream is input into a rule matching engine that has preset multiple preset association rules. Then, when the rule matching engine detects and matches the first target association rule in chronological order, the corresponding network security anomaly event and an event flag for identifying the validity period of the event are immediately generated. Finally, when the subsequent data stream matches the second target association rule that has a logical progressive relationship with the first target association rule, the present application will query the event flag in the system cache, and after confirming that it is within the validity period, the generated network security anomaly event will be upgraded and the event flag will be updated.

[0017] From the above content, it can be seen that this application realizes the instant detection and dynamic upgrade of network security abnormal events by real-time data stream collection and intelligent matching of progressive association rules. On this basis, compared with the prior art, this application can significantly reduce the event response time through the query and instant upgrade mechanism within the validity period of the event mark, thereby improving the real-time and accuracy of network security event detection and ensuring the timely warning and processing of security events.

[0018] It can be seen that the technical method of this application achieves the purpose of instant identification and intelligent upgrading of network security threats, thereby achieving efficient and accurate detection and response effects for progressively associated complex events, and thus solving the technical problem that the prior art is prone to response delays when dealing with progressively associated complex network security events, resulting in untimely network security alarms. It can not only quickly capture the slight signs of security threats, but also automatically adjust the alarm level as the threat situation changes, greatly enhancing the flexibility and effectiveness of the network security defense system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a flow chart of an optional method for detecting abnormal network security events according to an embodiment of the present application;

[0021] Figure 2 is a flowchart of an optional event escalation method based on progressive association rules according to an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of an optional escalation process of a threat event according to an embodiment of the present application;

[0023] Figure 4 is a schematic diagram of an optional threat event detection process according to an embodiment of the present application;

[0024] Figure 5 It is a schematic diagram of an optional device for detecting abnormal network security events according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0028] The embodiments or examples of the present application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection of the present application. In the absence of contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0029] The following embodiments of this application can be applied to various systems / applications / devices that require threat event detection and security warning upgrades, and can achieve real-time monitoring and dynamic response to network security anomalies. This application uses a rule matching engine to perform real-time analysis of system data streams, and then generates event flags and instant upgrades for detected threat events based on progressive association rules, which can better adapt to the rapid changes in the network environment and improve the timeliness and accuracy of security event processing.

[0030] Specifically, the application continuously collects system data streams during the operation of the target system and inputs them into the rule matching engine. The engine presets multiple association rules with progressive relationships. When the first association rule is matched, a network security anomaly event and event flag are immediately generated to ensure the timeliness of the alarm. In the subsequent data stream, when an event with a progressive relationship with the first association rule is detected, the generated event is immediately upgraded by querying the validity of the event flag, avoiding the risk of threat spread caused by delayed event processing and significantly enhancing the system's security defense capabilities.

[0031] By adopting the dynamic event upgrade and flag management technology of the present application, the alarm level and response strategy can be quickly adjusted according to the evolution path of the network attack, which not only improves the real-time performance of security event detection, but also reduces resource consumption and avoids unnecessary false alarms, providing a more efficient and intelligent solution for network security defense.

[0032] The present application is described in detail below in conjunction with various embodiments.

[0033] Embodiment 1

[0034] According to an embodiment of the present application, an embodiment of a method for detecting abnormal network security events is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] The implementation subject of this embodiment can be a security information and event management system, threat detection platform, firewall and intrusion detection system, automated response and security orchestration system, etc. held by the network security department or team responsible for network security monitoring and defense of the enterprise or organization, which is responsible for monitoring, analyzing and responding to network security threats. The use of association rule analysis can enhance its threat identification ability and response speed, especially in the face of complex and multi-stage attacks, it can more effectively capture and evaluate threats and take timely defense measures. The above implementation subject can be implemented by software, or by hardware equipment or a combination of software and hardware, depending on its business needs and resource conditions.

[0036] Figure 1 is a flow chart of an optional method for detecting abnormal network security events according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0037] Step S101, continuously collecting system data streams during the real-time operation of the target system, and inputting the system data streams into a rule matching engine, wherein the multiple rules preset in the rule matching engine include N preset association rules, where N is a positive integer.

[0038] In step S101, the target system refers to the specific environment or platform to which the method of the present application is applied, which may be a network system within an enterprise or organization, a data center, a cloud service platform, or any other IT infrastructure that requires real-time monitoring of network security threats, including but not limited to: firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), security information and event management (SIEM) platforms, etc.

[0039] In addition, the real-time operation process refers to the continuous state in which the target system continuously generates and processes data in actual operation; the system data stream refers to the continuous data record generated by the target system, including but not limited to: network traffic data, system logs, application logs, user activity records, etc. In this embodiment, the system data stream can come from multiple data sources, such as network devices, server ports, user terminals, etc.

[0040] In the field of information security / network security, the target system continuously monitors the system data flow during real-time operation, and promptly processes the high-frequency, large-volume system data flow through the rule matching engine to ensure a rapid response to attack behaviors, so as to quickly handle threats and then block them in time.

[0041] The continuous collection of system data streams in step S101 is the starting point of the entire detection method. Continuous monitoring of all key network nodes and system logs can ensure the integrity and real-time nature of the data.

[0042] Optionally, after continuously collecting system data streams and before inputting the system data streams into the rule matching engine, a data preprocessing step may be performed, for example, cleaning the data to remove irrelevant or duplicate information, standardizing the data so that it can be effectively identified and processed by the rule matching engine, etc. Specifically, data format conversion, outlier filtering, and preliminary screening based on predefined patterns may be performed. Data preprocessing may improve the efficiency and accuracy of subsequent analysis and reduce unnecessary consumption of computing resources.

[0043] It needs to be further explained that the rule matching engine is an automated component in this embodiment that is responsible for analyzing the system data flow and comparing it with the preset association rules. It can understand and execute complex logical judgments, including but not limited to: timing analysis and pattern recognition. The rule matching engine in this embodiment uses efficient data processing algorithms and optimization strategies (such as timing-based event matching algorithms, event cache management mechanisms, etc.) to improve the accuracy and response speed of threat detection, and can process multiple progressive association rules to achieve dynamic upgrades from low-level threat warnings to high-level threat responses.

[0044] Furthermore, the progressive preset association rules are a series of ordered rules preset in the rule matching engine, which are used to identify threat events of different levels. There is an inclusion and progressive relationship between the rules, that is, the higher-level rules include the lower-level rules and add additional event matching conditions on this basis.

[0045] Figure 2 is a flowchart of an optional event escalation method based on progressive association rules according to an embodiment of the present application, such as Figure 2 As shown, for multiple association rules ( Figure 2 In the example, Rule1, Rule2, and Rule3 are represented by their sub-rules ( Figure 2 A, B, C, D, E, and F represent sub-rules for single event or log matching) and there is an inclusion and progressive relationship. For example, if the rule content is that events A and B (A→B) are detected in sequence, alarm 1 is generated (i.e. Figure 2Threat event 1 in Rule 2 is detected in sequence, and alarm 2 is generated (i.e. Figure 2 Threat event 2 in Rule 3 is detected in the order of events A, B, C, D, E and F (A→B→C→D→E→F), and alarm 3 is generated (i.e. Figure 2 ), then, in the received data stream, if sub-rules A and B are matched in sequence in time, it is considered to match association rule 1, that is, threat event 1 is generated; if sub-rules A, B, C, and D are matched in sequence in time, it is considered to match association rule 2, that is, threat event 2 is generated; if sub-rules A, B, C, D, E, and F are matched in sequence in time, it is considered to match association rule 3, that is, threat event 3 is generated, and so on. Among them, the sub-rule can be a field in the data source that meets the preset logical conditions or a match of a specific string in the log.

[0046] In this embodiment, the progressive preset association rules are intended to capture the complete path from preliminary anomalies to complex attacks. For example, Rule 1 detects abnormal network access behavior, while Rule 2 detects frequent attempts to access specific ports after detecting abnormal network access behavior. Rule 3 further detects attempts to call a known attack tool or method after detecting abnormal network access behavior and frequent attempts to access specific ports. The above progressive relationship can gradually and accurately identify the severity and type of threat events, providing the security team with more specific and immediate warning information.

[0047] In general, step S101 achieves efficient resource utilization and timely event response and upgrade through real-time data collection and analysis and intelligent threat identification. It can not only detect the anomaly of a single event, but also identify more covert multi-stage attacks through the association between events, thereby improving the accuracy and depth of threat detection. Even in the early stages of the threat, immediate alarm information can be obtained. When subsequent more serious related events are detected, the alarm can be quickly upgraded based on the event flag, providing more accurate threat assessment and response strategies.

[0048] Step S102, when the rule matching engine matches the system data flow to the first target association rule, generates a network security abnormal event and an event flag corresponding to the first target association rule, wherein the event flag is at least used to characterize the validity period of the abnormal event.

[0049] In step S102, the first target association rule refers to the first rule that satisfies the progressive association rule sequence identified by the rule matching engine. It is the basic level in the progressive association rule system and the threat event represented is a preliminary sign of a more complex threat.

[0050] In addition, network security anomaly events refer to threat events that match preset association rules and are identified by the rule matching engine in the system data flow, pointing to potential network attacks or security vulnerabilities. The generation of network security anomaly events not only includes metadata describing the threat event itself (including but not limited to: the time, location, possible attack source, etc. of the event), but also includes the severity of the event, the scope of the event, and suggestions for handling measures. The generated network security anomaly events will be recorded and used as the basis for subsequent event upgrades.

[0051] Furthermore, the event flag is a special identifier created by the rule matching engine when a network security anomaly event is detected, which can be used to track and associate subsequent events related to the same threat. The event flag contains at least: the event index that triggers the first target association rule, and the validity period used to determine whether the event flag is still valid. In this embodiment, the event flag is created to ensure the accuracy of event upgrades. Each flag is associated with one or more network security anomaly events, contains key information of the event (such as timestamp, event type, matching rule number, etc.) and is assigned a validity period. After the expiration, the flag will be automatically deleted to avoid waste of resources and mismatching.

[0052] Furthermore, the validity period of an abnormal event is used to limit the maximum time that the event flag remains valid in the system. It is set based on the understanding of the development rhythm of threat events and the consideration of rational use of resources. After the validity period expires, higher-level threat actions matched are deemed to have no connection with the previous threat event.

[0053] As an example, the validity period of a rapidly developing attack event can be set shorter (e.g., 10 minutes) to facilitate rapid response and adjustment; while for long-term latent threats, the validity period can be set longer (e.g., 24 hours) to ensure that no subsequent activities related to early events are missed.

[0054] An optional embodiment, in modern enterprise network environments, attackers often adopt a multi-stage strategy, from initial reconnaissance activities to final malicious behavior, which may include multiple associated events. Although existing technologies (such as state machine-based association analysis systems) can identify these events, they are insufficient in terms of instant response to events and resource management, especially when processing progressive association rules, it may take a long time window to generate a complete threat event alert, which is disadvantageous in rapidly changing network attack scenarios.

[0055] In response to the above-mentioned problem, the present embodiment proposes a method for instantly generating abnormal events and event flags through step S102, which can generate an alarm immediately when a threat is initially detected, and realize rapid escalation of subsequent events through flag management. When an event in the data stream meets the first target association rule for the first time, a low-level abnormal event is immediately generated, and an event flag is created and stored in the cache. As more data flows in, the event level is automatically upgraded, the old flag is deleted and a flag pointing to the new event is created, without waiting for a fixed time window, thereby greatly improving the response speed and the accuracy of the alarm.

[0056] Step S103: when the rule matching engine matches a second target association rule having a logically progressive relationship with the first target association rule, query the event flag in the system cache.

[0057] In step S103, the logical progressive relationship refers to the inclusion and extension relationship between the second target association rule and the first target association rule, that is, the second target association rule not only includes all the sub-rules of the first target association rule, but also introduces new sub-rules to identify more complex or more serious threat events, which are at a higher level in the rule sequence. Designing logical progressive relationship detection enables the implementation system to detect threats in stages, from initial signs to complex attacks, layer by layer, improving the accuracy and timeliness of threat detection.

[0058] Furthermore, when a match of the second target association rule is identified, the event flag stored in the cache is queried to determine whether there is a flag of the first target association rule that has a logical progressive relationship with the current matching rule, and to quickly determine whether the first target association rule has been triggered and is within the validity period. Optionally, a prefix matching or timestamp comparison technique can be used to efficiently locate the event flag that matches the current rule. Once the corresponding flag is found, the existing low-level abnormal event is updated to a higher-level threat event based on the event index stored in the flag, thereby achieving instant escalation of the event.

[0059] In the scenario of dealing with network threats, the rule design of logical progressive relationship can better adapt to the gradually deepening and complex attack patterns. Through phased rule matching, the severity and specific type of threats can be gradually identified, so as to make more accurate warnings and responses. For example, an attack starts with a preliminary external scan (first target association rule), followed by a successful login attempt (second target association rule), and finally data leakage or system destruction (higher-level association rule). By generating event markers at each stage and querying the markers in subsequent stages, the evolution of threats can be quickly identified, and the accuracy and timeliness of warning information can be ensured even if the threats change rapidly.

[0060] In addition, in order to improve query efficiency, the event flags cached by the system are designed to contain key information such as timestamps and validity periods, allowing effective flags to be quickly located within a specific time window, ensuring that event upgrade decisions can be made instantly even in high-frequency data streams, while avoiding false alarms or missed alarms due to expired or invalid flags. Therefore, step S103 ensures the system's flexibility, response speed, and resource efficiency when dealing with complex network attacks.

[0061] Step S104: when confirming that the event flag is within the validity period, the generated network security abnormality event is upgraded, and the event flag is updated based on the upgraded network security abnormality event.

[0062] In step S104, once the event flag is confirmed to be valid, the event upgrade process is executed to upgrade the generated low-level network security anomaly event to reflect a more serious or complex threat situation, which at least involves adjusting the event level and updating the event information. For example, if the initial event is the detection of a suspicious network login attempt, and further signs of data leakage are detected during the validity period of the event flag, it will be upgraded to a data leakage event.

[0063] After the event is upgraded, the event flags in the cache are updated to reflect the new threat event status, including at least modifying the validity period, updating the metadata related to the event, and directly generating new flags to replace the old ones. For example, if the event is upgraded from preliminary suspicious behavior to a specific malware infection, the event flags are updated to include information such as the specific type of infection or the depth of infection, providing richer context for subsequent correlation rules.

[0064] Step S104 of this embodiment solves the problem of lack of flexibility and timeliness in event response in the prior art by introducing the concept of the validity period of the event flag and the event escalation process based on this concept. It can quickly respond and dynamically adjust the severity assessment of the event after the initial signs of the network threat are detected, take more precise defense measures, and effectively respond to the evolving network attacks. It is particularly suitable for network security scenarios that require rapid decision-making and response, and can significantly improve the security defense capabilities and efficiency of the enterprise.

[0065] Figure 3 is a schematic diagram of an optional threat event upgrade process according to an embodiment of the present application, such as Figure 3As shown, in the input data stream (the data source can be a threat log, a network log or user behavior data), the association engine matches the association rule 1, generates a threat event 1, and generates a flag 1 with a valid duration; then the data in the data stream matches the association rule 2 in time sequence, if the flag 1 with a time less than the earliest event of rule 2 is found, the generated threat event 1 is updated to threat event 2, and the flag 1 is deleted to generate a flag 2 with a valid duration; the subsequent rules are analogous.

[0066] Specifically, in the association rule matching stage, the rule matching engine performs association analysis on the data stream generated by the data source within the specified time window. If the association rules are matched in the data stream in time sequence, such as a piece of data A hits sub-rule A of the association rule, and then another piece of data B hits sub-rule B of the association rule, then it is confirmed that the association rules are met and the corresponding conversion output can be made.

[0067] In the threat event storage link, after the data source matches the phased association rules, the threat events corresponding to the association rules are generated or updated and persisted in the database. The threat event fields include unique indexes, regular fields such as threat event name, event level, evidence information, i.e. the original data A and B that hit the rules, and other additional fields.

[0068] In the event flag generation phase, when the threat event is generated or updated according to the preceding rules, the threat event flag corresponding to the association rule is generated and the flag is set with an effective time and stored in the cache. If the effective time is exceeded, the flag is deleted. The event flag is cached so that the corresponding preceding event can be found quickly and efficiently when the subsequent rules are hit, which meets the requirements of real-time computing in data stream processing.

[0069] Using redis as a cache component can set the lease of the flag key to a preset validity period. The key is the flag name + current timestamp, and the value is the unique index of the corresponding threat event in the persistent storage. The flag name is convenient for finding the threat flag corresponding to the previous rule, and the timestamp is convenient for finding the earliest flag within the valid time. Since redis supports searching by key prefix, you can first retrieve all the flags you are looking for by prefix flag, find the key with the smallest timestamp among all the keys in the filtered flags, and use the threat event in the earliest generated flag as the pre-rule of the current association rule. The value of the key can quickly and easily retrieve the threat event in the persistent storage for further processing.

[0070] Specifically, the rule matching engine consumes data streams and sets a fixed time window, such as 10 minutes. During this time, threat event 1 is generated after matching the A and B sub-rules of association rule 1 in chronological order. The generated threat event 1 is stored in a persistent database, which facilitates the visualization of threat event data for analysis and processing by relevant personnel and is also convenient for tracing. At the same time, the threat event 1 flag is stored in the cache, and the flag validity period is set, assuming it is also 10 minutes. The flag 1 and the current timestamp are stored in the key, and the value stores the index of threat event 1 in the database.

[0071] After the rule matching engine matches the last two sub-rules C and D of association rule 2 in chronological order within the time window, it searches the cache for threat event 1 flag, finds all flags 1 by searching for keys prefixed with flag 1, and filters out flags whose timestamps are less than the timestamp of the data corresponding to sub-rule C, that is, the event generated by the flag must be earlier than the time of the data corresponding to sub-rule C, that is, the order of occurrence of sub-rules A, B, C, and D in rule 2 is met, and B must be before C.

[0072] After filtering the above flag 1, take the one with the earliest timestamp as the preceding sub-rule that matches the current rule 2, use the flag key corresponding to the value to find the threat event 1 in the database, update the threat event 1 to the threat event 2, and finally delete the flag 1. If the threat event 1 flag is not found, no processing is performed.

[0073] Similar to the detection process of association rule 2, after the correlation engine matches the last two sub-rules E and F of association rule 3, it searches for the threat event 2 flag in the cache and performs corresponding processing.

[0074] Figure 4 is a schematic diagram of an optional threat event detection process according to an embodiment of the present application, such as Figure 4 As shown in FIG. 1 , in an example of detecting and upgrading threat events in a specific case where multiple association rules exist and are included and progressive, the detailed conditions of sub-rules A, B, C, and D are: sub-rule A = suspicious Microsoft Office sub-process detected, sub-rule B = file download detected through command and script interpreter, sub-rule C = suspicious suffix file released by CMD or PowerShell detected, sub-rule D = Cobalt Strike default named pipe detected, then, if Figure 4As shown in , association rule 1 is: if A and B occur successively, threat event 1 is generated (potential Office phishing activity is detected), if A, B and C occur successively, threat event 2 is generated (potential Office phishing activity is detected and malicious files are stored on the disk), and if A, B, C and D occur successively, threat event 3 is generated (Office phishing behavior using Cobalt Strike is detected).

[0075] The above monitoring process can achieve the following clear beneficial effects for the generation of threat events based on association rules: 1. After matching a rule, the corresponding alarm event is generated immediately, which can generate alarms in time, help security operation and maintenance personnel to quickly handle relevant alarms, do preventive work for possible subsequent threats, or trigger equipment automation to do some advance blocking work to prevent the generation of subsequent threats; 2. Multiple association rules with progressive relationships are segmented and matched according to sub-rules. When the first rule is met, an event is generated immediately. Subsequent segmented rules only need to find the previous rule flag, and there is no need to wait for the detection of whether all sub-rules are met. Only the flag is cached, instead of increasing the entire time window and the number of matched sub-rules, reducing memory usage; 3. When receiving subsequent sub-rules and matching the previously stored event flag, the low-level event generated by the previous rule is upgraded to a higher-level event, and the alarm event can be adjusted immediately according to the actual input situation, and the system displays more accurate matching events. At the same time, after receiving data that meets the subsequent rules, the event generated by the previous rule is updated instead of adding an event, reducing the number of output events and avoiding the display of redundant events.

[0076] From the above content, it can be seen that this application realizes the instant detection and dynamic upgrade of network security abnormal events by real-time data stream collection and intelligent matching of progressive association rules. On this basis, compared with the prior art, this application can significantly reduce the event response time through the query and instant upgrade mechanism within the validity period of the event mark, thereby improving the real-time and accuracy of network security event detection and ensuring the timely warning and processing of security events.

[0077] In an optional embodiment, after receiving the system data stream, the rule matching engine performs the following steps: sorting the received system data stream according to the time sequence and data timestamp to obtain the data stream to be analyzed; calling at least one progressive rule group formed by N preset association rules one by one, and using the association sub-rules of the preset association rules in the progressive rule group to match the data stream to be analyzed, wherein multiple association sub-rules corresponding to the same progressive rule group have a time sequence progressive relationship; when the data stream to be analyzed hits T association sub-rules according to the time sequence progressive relationship, determining the preset association rule to which the T association sub-rules belong is the first target association rule, wherein T is a positive integer.

[0078] In some implementation scenarios, after receiving the system data stream, the rule matching engine of the implementation system takes a series of strategic steps to efficiently analyze and identify threat events, especially when processing association rules with a time-sequential progressive relationship. First, the data is sorted according to the timestamp to ensure that the data stream can be processed in the actual time order of the events. For example, if the formation of a threat chain needs to follow a specific event sequence: first an abnormal login attempt, followed by an internal network scan, and finally a data leakage behavior, then the time sequence sorting of the data stream can ensure that the engine detects these events in the correct order, thereby accurately identifying the progress of the threat chain. The sorted data stream is the data stream to be analyzed, ready for the next step of rule matching analysis.

[0079] After obtaining the data stream to be analyzed, the rule matching engine begins to call the identified progressive rule groups one by one. For each progressive rule group, the rule matching engine uses the associated sub-rules therein to analyze the data stream according to the preset time-series progressive relationship, that is, to detect and track potential threat behaviors based on the sub-rules in the progressive rule group. For example, for a progressive rule group, if the sequence of the associated sub-rules in the time-series progressive relationship is abnormal login attempt, internal network scan, and data leakage behavior, then the rule matching engine will first try to detect the abnormal login attempt event. If successful, it will continue to detect the internal network scan event, and so on, until all events in the data stream have been analyzed.

[0080] Furthermore, the step of determining the first target association rule is the key to identifying and upgrading threat events. When the events in the data stream to be analyzed successfully hit T associated sub-rules in the progressive rule group according to the time-sequential progressive relationship (assuming R is the total number of sub-rules in the progressive rule group, then T is less than or equal to R), the rule matching engine determines that the preset association rules corresponding to these hit sub-rules are the first target association rules. In other words, if events of sub-rules such as abnormal login and internal network scanning are detected in sequence in the data stream, then these events meet the definition of the first target association rule and represent a specific, developing threat situation.

[0081] For example, in a progressive rule group, if the associated sub-rules are abnormal login attempts, internal network scanning, and data leakage, and the data flow successfully hits the two sub-rules of abnormal login attempts and internal network scanning in a time-sequential progressive relationship, then the preset association rules corresponding to these two sub-rules are determined as the first target association rules, representing a preliminary but developing security threat. At this time, the implementation system generates or upgrades the corresponding threat event according to the preset process, and triggers the analysis method and response measures corresponding to the threat event or threat level, such as the generation of event flags and the preparation of event upgrades.

[0082] Through the above steps, the rule matching engine can effectively identify and track threat behaviors with a time-sequential relationship when processing system data streams, thereby providing the network security team with more accurate and timely threat intelligence, which is particularly suitable for environments that require continuous monitoring and response to complex threat scenarios, such as enterprise internal networks, cloud infrastructures, or IoT device networks. This embodiment can more intelligently respond to changing network threats and improve overall security protection capabilities by dynamically adjusting event identification and response strategies.

[0083] In an optional embodiment, before the system data stream is input into the rule matching engine, it also includes: analyzing N preset association rules preset in the rule matching engine to obtain M progressive rule groups, where M is a positive integer less than or equal to N; analyzing all preset association rules in each progressive rule group to determine R association sub-rules corresponding to each progressive rule group, where R is a positive integer.

[0084] In some implementation scenarios, the implementation system performs the preliminary work of rule matching and event escalation mechanism, aiming to optimize the operating efficiency of the rule matching engine and the accuracy of event identification. Specifically, before inputting the data stream into the rule matching engine, the preset N preset association rules are first analyzed to identify M rule groups with progressive relationships.

[0085] The preset association rules cover a variety of threat scenarios, such as abnormal access behavior, malware activities, signs of data leakage, etc. The preset association rules are classified and analyzed to identify rules with inclusion and progressive relationships, that is, one rule is a subset of another rule. When a higher-level rule is triggered, it means that the threat situation is more serious or complex.

[0086] After analyzing the preset association rules, the rules with inclusion and progressive relationships are organized into M progressive rule groups. The rules in each rule group have a progressive relationship. When an event in the data stream matches a lower-level rule in a group in chronological order, if subsequent events continue to meet the conditions of higher-level rules in the same group, the severity assessment of the event is gradually upgraded.

[0087] Furthermore, for each progressive rule group, it is also possible to analyze and determine R associated sub-rules arranged in a specific time-series progressive relationship. For example, in a progressive rule group, the sub-rules are, in sequence, detecting abnormal logins, detecting internal network scans, and detecting data exfiltration attempts. Each step of detection is based on the results of the previous step and indicates more serious threat behaviors. By setting a time-series progressive relationship, the development of threats can be detected and evaluated step by step, ensuring timely responses at each critical stage of the threat chain.

[0088] Alternatively, assuming that the rule matching engine has preset association rules, including detection rules for abnormal logins, internal network activities, and signs of data leakage, in this implementation scenario, the implementation system first analyzes these rules to identify rule groups with inclusion and progressive relationships. For example, rule group 1 contains the following progressive rules: 1. Abnormal login detection: Identify abnormal login attempts from external sources; 2. Internal network scanning: Detect scanning behavior of the internal network after abnormal login; 3. Data leakage attempt: Identify potential behaviors of data leakage after scanning the internal network. The formation of rule groups is based on a deep understanding of the threat behavior chain to ensure that the rules in the rule groups can reflect the evolution of threats.

[0089] Subsequently, the implementation system analyzes all preset association rules in each progressive rule group, determines the corresponding association sub-rules, and sorts them in a time-sequential progressive relationship. For example, for rule group 1, the association sub-rules can be: 1, abnormal login attempts (Sub-rule 1); 2, access activities to specific internal servers (Sub-rule 2); 3, large data transmission behaviors from internal servers to external suspicious IPs (Sub-rule 3). The identification and sorting of these sub-rules provide a clear detection path for the rule matching engine, enabling the engine to start from the initial abnormal login attempt, gradually detect subsequent potential threat behaviors, and generate and upgrade threat events based on the detected sub-rule sequence to reflect the severity and scope of the threat.

[0090] The above steps can not only more efficiently handle multiple types of threat detection, but also dynamically adapt to the complexity and changes of threat behavior, providing more accurate and timely security responses. In addition, the definition and management of progressive rule groups and associated sub-rules also help optimize the use of system resources, reduce unnecessary computing and storage burdens, and ensure performance and stability when processing large-scale data streams.

[0091] In an optional embodiment, a network security anomaly event corresponding to a first target association rule is generated, including: determining detailed data of the network security anomaly event based on the first target association rule and system data that hits the first target association rule, wherein the detailed data includes: specific data that triggers the association sub-rule, the triggering event, and the event category and event level of the triggering event; creating an event record of the network security anomaly event based on the detailed data, and storing the event record in a system memory database of the target system.

[0092] In some implementation scenarios, when the rule matching engine determines that an event in the system data stream meets the definition of the first target association rule, the real-time system will generate a detailed network security anomaly event record and store it in the system memory database for quick access and subsequent processing.

[0093] Specifically, the rule matching engine will generate detailed data of network security anomaly events based on the specific data and timestamps of the T associated sub-rules hit by the system data flow and the definition of the first target association rule. These detailed data include but are not limited to: 1. Specific data that triggers the associated sub-rules, such as the source IP, target IP, login time, and protocol used of the abnormal login attempt; 2. Event category of the triggered event, such as "abnormal login", "internal scan", "data leakage", etc.; 3. Event level, that is, the severity level of the event is determined according to the number and type of hit sub-rules, such as "low", "medium", "high", etc.; 4. Other related attributes, such as the scope of impact of the event, recommended response measures, associated device or user information, etc.

[0094] Furthermore, an event record of the network security anomaly event is created based on the detailed data. It should be noted that creating an event record is a key step in the event generation process, which involves integrating the above detailed data into a structured event record, which is usually stored in JSON, XML or other standard formats to facilitate the transmission, storage and subsequent processing of the event.

[0095] The event record contains the following fields: event ID, rule ID, specific data of the triggering event, event category and level, timestamp, and other metadata. Specifically, the event ID is a unique identifier used to track and manage events; the rule ID refers to the identifier of the first target association rule that triggers the event, which can help understand the context of the event; the specific data of the triggering event includes all detailed information related to the event; the event category and level are used to preliminarily assess the nature and severity of the event; the timestamp is the specific time when the event is generated or detected, which can help sort and respond to events; other metadata include but are not limited to: the source of the event, the affected system components, and the recommended response strategies.

[0096] In order to achieve fast access and low-latency processing of events, system memory databases (such as Redis, Memcached, etc.) have become the first choice for storing network security anomaly event records. These databases usually have high read and write speeds and can support high-concurrency event query and update operations. Storing threat event records in the system memory database can ensure that the latest event status can be accessed instantly in subsequent event upgrades or real-time response strategies, thereby achieving faster and more accurate threat responses.

[0097] In an optional embodiment, it is assumed that a series of events are detected by the rule matching engine in a certain monitoring environment, and the associated sub-rule sequence of "abnormal login attempt" → "internal network scanning" → "data leakage behavior" in the progressive rule group is met. When only abnormal login attempts and internal network scanning are detected, the implementation system determines that the abnormal event meets the definition of the first target association rule, that is, "potential internal network manipulation activity".

[0098] Next, the implementation system generates event records containing the following fields based on the specific data of these events and the definition of the first target association rule, for example, event ID: 1234567890; rule ID: 001; specific data of the triggering event: including the source IP (192.168.1.2) of the abnormal login, the target IP (10.0.0.1), the login time (2023-04-0714:30), and the source IP (10.0.0.1) of the internal network scan, the scan start time (2023-04-0714:35), etc.; event category: internal network manipulation activity; event level: medium; timestamp: 2023-04-0714:35; recommended response strategy: immediately block the network access rights of 10.0.0.1 and initiate an internal network scan to check for potential lateral movement behavior.

[0099] After that, this event record will be stored in the system memory database so that the subsequent event escalation process (as described in step S104) or the real-time security response strategy can quickly access and process this data. By storing event records in the memory database, the system can achieve real-time monitoring and response to network security threats in a low-latency environment, thereby improving the overall security protection efficiency and effectiveness.

[0100] In an optional embodiment, after storing the event record in the system memory database of the target system, generating an event flag includes: determining the validity period of the network security anomaly event based on the first target association rule, and creating an event flag based on the validity period, wherein the event flag includes at least a generation timestamp, a validity period, and a data index of the network security anomaly event in the system memory database; and storing the event flag in the system cache of the target system.

[0101] In some implementation scenarios, when the rule matching engine determines that an event in the system data stream meets the first target association rule, in addition to generating and storing event records in the system memory database, it is necessary to further create event flags to support subsequent event escalation processes. The determination of the validity period is a very critical step in the event flag generation process, which is directly related to the accuracy and timeliness of subsequent event escalation strategies.

[0102] Specifically, the validity period is usually determined by the characteristics of the first target association rule. For example, if the threat behavior involved in the rule has a specific time window (10 minutes), the validity period of the event flag is set to match the time window (set to 10 minutes). The setting of the validity period ensures that when subsequent threat events occur, the relevant event flags that have not expired can be found in time, so as to upgrade the event or confirm the new threat link.

[0103] In addition, event flags are records used by the implementation system to identify and track specific network security anomaly events, including key information such as generation timestamp, validity period, and data index of network security anomaly events in the system memory database. Event flags are created mainly to support subsequent event escalation processes and ensure that the implementation system can quickly locate the generated low-level event records related to the current threat event.

[0104] Specifically, the event flag includes at least the following information: a generation timestamp, which indicates the specific time when the event flag was created, and is used to correctly determine the sequence of events in the timing matching link of events; a validity period, which is used to define the time range in which the event flag can be used for subsequent event upgrades to avoid mismatching caused by expired flags; a data index, which is a unique identifier pointing to the network security anomaly event record stored in the system memory database, which facilitates rapid retrieval and updating of event records.

[0105] In order to achieve low latency and high efficiency event escalation, event markers are stored in the system cache (key-value storage in memory, such as Redis, Memcached, etc.). The use of system cache enables the implementation system to retrieve event markers at a very fast speed, avoiding event escalation delays that may be caused by database query delays. Storing event markers in the cache also facilitates the rapid determination of whether there are preceding events that meet the timing and progressive relationships when performing subsequent association rule matching. When subsequent sub-rules are matched, the relevant event records can be quickly located based on the data index in the event marker and updated according to the event escalation logic.

[0106] In an optional implementation, when scanning the internal network after detecting an abnormal login attempt, it is assumed that the rule matching engine determines that the validity period of the event is 10 minutes based on the first target association rule, that is, within 10 minutes after the abnormal login attempt event occurs, subsequent network behavior will be regarded by the system as threatening behavior that may be associated with the event.

[0107] In the above implementation, after the event record is created and stored in the system memory database, the rule matching engine will create an event flag based on the event record, which includes the following information: generation timestamp: 2023-04-0714:35 (i.e., the detection time of the internal network scanning event); validity period: within 10 minutes from the generation timestamp; data index: Index1234567890, pointing to the network security anomaly event record stored in the memory database.

[0108] Subsequently, the event flag will be stored in the system cache of the target system for quick retrieval and utilization in the subsequent sub-rule matching process. For example, if a data leak is detected within the validity period of the event flag, the rule matching engine can quickly retrieve the event flag from the cache to confirm whether there is a preceding network anomaly event associated with the data leak, and then upgrade the event, such as upgrading from "potential internal network manipulation activities" to "high-risk data leak event."

[0109] By storing event flags in the system cache, the rule matching engine can achieve rapid response and accurate upgrades to network security threats, improving the efficiency and accuracy of threat event identification and response. It is of great significance for building an efficient and intelligent security defense system. It is particularly suitable for environments that require real-time or near real-time processing of large amounts of event data, such as network security monitoring of large enterprises, security event management of cloud platforms, and other scenarios. It can significantly improve the efficiency and response speed of security operations and maintenance.

[0110] In an optional embodiment, the steps performed by the rule matching engine after the system data stream matches the first target association rule also include: after the data stream to be analyzed hits T association sub-rules in the progressive rule group, continuing to match the data stream to be analyzed with the remaining association sub-rules in the progressive rule group in a time-series progressive relationship within a preset time window; when the data stream to be analyzed matches a newly added association sub-rule, determining the second target association rule based on the T association sub-rules that have been hit and the newly added association sub-rule; or, when the preset time window is exceeded and no newly added association sub-rules are matched, stopping the matching operation between the progressive rule group and the data stream to be analyzed in the current matching process, and deleting the event flag in the system cache.

[0111] In one implementation scenario, the rule matching engine not only processes the currently detected event, but also continuously monitors the subsequent data stream to evaluate whether it meets the conditions of the higher-level associated sub-rules, thereby achieving event escalation or confirmation. When the event in the data stream to be analyzed matches the first T associated sub-rules in the progressive rule group in time sequence, the rule matching engine will not stop the matching process immediately. Instead, it will continue to monitor the subsequent data within the preset time window, trying to match the remaining associated sub-rules. The setting of this time window needs to take into account the real-time and continuity of the threat event to ensure that the system does not terminate the matching process prematurely, thereby missing possible threat behaviors.

[0112] For example, if the first T associated sub-rules are "abnormal login" → "internal network scan", and the subsequent sub-rule of the progressive rule group is "data leakage", then within the preset time window, the engine will continue to search for events related to "data leakage" in the data stream.

[0113] If within the preset time window, the event in the data stream to be analyzed successfully matches the newly added associated sub-rule in the progressive rule group, it means that the construction of the entire threat chain may be more complex or serious. At this time, the rule matching engine will re-evaluate the current threat situation based on the T associated sub-rules that have been hit and the newly added associated sub-rules, determine the second target associated rule, and determine a higher level threat event. For example, if a "data leakage" event occurs in the data stream, then based on the time sequence relationship of "abnormal login" → "internal network scanning" → "data leakage", the rule matching engine determines the second target association rule as a "high-risk data leakage event" and triggers the corresponding security response measures.

[0114] Alternatively, when the preset time window is exceeded and no newly added associated sub-rule is matched, the matching operation between the progressive rule group in the current matching process and the data flow to be analyzed is stopped, and the event flag in the system cache is deleted:

[0115] If the data stream to be analyzed does not match any newly added associated sub-rules within the preset time window, it means that the current threat link has not developed further or the threat behavior has stopped. In this case, in order to prevent resource waste and false alarms, the rule matching engine will stop the matching operation of the current progressive rule group and the data stream and delete the event flag in the system cache to ensure the effective use of system resources, avoid unnecessary calculations and storage, reduce the risk of false alarms, and improve the efficiency and accuracy of security event management.

[0116] Assume that in a certain network security monitoring scenario, the rule matching engine first detects the two events of "abnormal login" and "internal network scanning", matches the first two associated sub-rules in the progressive rule group in chronological order, determines the first target association rule as "potential internal network manipulation activities", and generates corresponding event records and event flags. Subsequently, the rule matching engine continues to monitor the data flow within a preset time window (for example, 10 minutes), trying to match the newly added associated sub-rule of "data leakage".

[0117] If a "data leakage" event is successfully detected within the time window, the rule matching engine will determine the second target association rule as "high-risk data leakage event" based on the hit "abnormal login" → "internal network scanning" sub-rule and the newly added "data leakage" sub-rule. At this time, take immediate action to disconnect the network connection of the affected device, start the incident response process, etc., to reduce potential data loss.

[0118] However, if the rule matching engine fails to detect a "data leakage" event within the 10-minute time window, the matching operation between the current progressive rule group and the data stream will be stopped, and the event flag in the system cache (i.e., the flag of "potential internal network manipulation activity") will be deleted to avoid the misuse of expired flags in subsequent matching processes, thereby ensuring the accuracy of event management and the effective use of resources.

[0119] Through the above steps, the rule matching engine can flexibly identify and evaluate the development of threat events in a complex and changeable network security environment, and realize timely escalation or confirmation of events. At the same time, through reasonable time windows and cache management strategies, it optimizes the overall performance and security of the system. It is extremely important for enterprise-level network security monitoring systems, cloud security service providers or any scenarios that require real-time analysis and response to network threats, and can significantly improve the accuracy of threat detection and the timeliness of response.

[0120] In an optional embodiment, the generated network security anomaly event is upgraded, and the event flag is updated based on the upgraded network security anomaly event, including: determining the upgraded supplementary data of the network security anomaly event based on the second target association rule and the system data that hits the second target association rule, wherein the upgraded supplementary data includes: the specific data that triggers the newly added association sub-rule, the triggering event, and the event category and event level of the triggering event; searching for the event record of the network security anomaly event in the system memory database, and supplementing the event record with the upgraded supplementary data to obtain the upgraded network security anomaly event; determining the updated validity period of the upgraded network security anomaly event based on the second target association rule, and creating an updated event flag based on the updated validity period, wherein the updated event flag includes at least: the updated timestamp, the updated validity period, and the data index of the upgraded network security anomaly event in the system memory database; and replacing the event flag in the system cache of the target system with the updated event flag.

[0121] In some implementation scenarios, the rule matching engine can also identify more serious threats in subsequent behaviors, realize the upgrade of events and update the corresponding event flags to support higher-level threat responses. Under the condition that the event meets the first target association rule, if the subsequent data of the data stream to be analyzed hits the newly added association sub-rule in the progressive rule group according to the time sequence progressive relationship, the upgraded supplementary data of the network security abnormal event is determined based on these newly added data and the second target association rule. The upgraded supplementary data will include the specific data details that trigger the newly added association sub-rule, such as source IP, target IP, timestamp, protocol type, etc., as well as the category and level of the triggering event.

[0122] When an event that meets the second target association rule is detected, the rule matching engine searches for the generated network security anomaly event record in the system memory database based on the data index stored in the event flag, integrates the upgraded supplementary data, and adds it to the original event record to reflect the upgraded status of the event, including updating the event name, level, scope of impact, recommended response measures, etc., to generate a more comprehensive and accurate upgraded network security anomaly event, providing more precise guidance for subsequent security responses.

[0123] In order to ensure that the upgraded network security anomaly events can be used in a timely manner by the subsequent threat monitoring and response process, an updated validity period can be determined for the upgraded events based on the characteristics of the second target association rule. An updated event flag is created based on the updated validity period, including the updated timestamp, the updated validity period, and the data index of the upgraded network security anomaly events in the system memory database, ensuring that subsequent threat events can quickly locate and process the upgraded event information.

[0124] Finally, in order to ensure that the event flags stored in the system cache are always the latest state, the original event flags can be replaced with the created updated event flags to ensure low latency and efficient event flag management and subsequent event upgrade process execution. The storage of updated event flags provides continuous support for subsequent threat event monitoring and upgrades, ensuring that the system can respond to and handle the development of threat events in a timely manner and improve overall security protection capabilities.

[0125] From the above content, it can be seen that the present application can quickly adjust the alarm level and response strategy according to the evolution path of network attacks through dynamic event upgrade and sign management technology, which not only improves the real-time detection of security incidents, but also reduces resource consumption and avoids unnecessary false alarms. It provides a more efficient and intelligent solution for network security defense, achieves the purpose of instant identification and intelligent upgrade of network security threats, and thus realizes efficient and accurate detection and response effects for progressively related complex events.

[0126] The present application is described below in conjunction with another optional embodiment.

[0127] Embodiment 2

[0128] Based on the method for detecting abnormal network security events provided in the above-mentioned embodiment, the embodiment of the present application also provides a device for detecting abnormal network security events, which includes multiple implementation units, each implementation unit corresponds to each implementation step in the above-mentioned embodiment one.

[0129] Figure 5 is a schematic diagram of an optional network security abnormal event detection device according to an embodiment of the present application, such as Figure 5 As shown, the device may include: an input module 501, a generation module 502, a query module 503, and an upgrade module 504.

[0130] Optionally, the input module 501 is used to continuously collect system data streams during the real-time operation of the target system, and input the system data streams into the rule matching engine, wherein the multiple rules preset in the rule matching engine include N preset association rules, where N is a positive integer.

[0131] Optionally, generation module 502 is a generation module used to generate a network security abnormal event and an event flag corresponding to the first target association rule when the rule matching engine matches the system data flow to the first target association rule, wherein the event flag is at least used to characterize the validity period of the abnormal event.

[0132] Optionally, the query module 503 is used to query the event flag in the system cache when the rule matching engine matches a second target association rule that has a logical progressive relationship with the first target association rule.

[0133] Optionally, the upgrading module 504 is used to upgrade the generated network security abnormality event when confirming that the event flag is within the validity period, and update the event flag based on the upgraded network security abnormality event.

[0134] From the above content, it can be seen that this application realizes the instant detection and dynamic upgrade of network security abnormal events by real-time data stream collection and intelligent matching of progressive association rules. On this basis, compared with the prior art, this application can significantly reduce the event response time through the query and instant upgrade mechanism within the validity period of the event mark, thereby improving the real-time and accuracy of network security event detection and ensuring the timely warning and processing of security events.

[0135] It can be seen that the technical method of this application achieves the purpose of instant identification and intelligent upgrading of network security threats, thereby achieving efficient and accurate detection and response effects for progressively associated complex events, and thus solving the technical problem that the prior art is prone to response delays when dealing with progressively associated complex network security events, resulting in untimely network security alarms. It can not only quickly capture the slight signs of security threats, but also automatically adjust the alarm level as the threat situation changes, greatly enhancing the flexibility and effectiveness of the network security defense system.

[0136] Optionally, the detection device for abnormal network security events also includes: a sorting module, a first matching module and a first determination module. The sorting module is used to sort the received system data stream according to the time sequence and data timestamp after the rule matching engine receives the system data stream, so as to obtain the data stream to be analyzed; the first matching module is used to call at least one progressive rule group formed by N preset association rules one by one, and use the association sub-rules of the preset association rules in the progressive rule group to match the data stream to be analyzed, wherein the multiple association sub-rules corresponding to the same progressive rule group have a time sequence progressive relationship; the first determination module is used to determine that the preset association rule to which the T association sub-rules belong is the first target association rule when the data stream to be analyzed hits T association sub-rules according to the time sequence progressive relationship, wherein T is a positive integer.

[0137] Optionally, the detection device for abnormal network security events further includes: an analysis module and a second determination module. The analysis module is used to analyze N preset association rules preset in the rule matching engine before inputting the system data stream into the rule matching engine to obtain M progressive rule groups, where M is a positive integer less than or equal to N; the second determination module is used to analyze all preset association rules in each progressive rule group to determine R association sub-rules corresponding to each progressive rule group, where the R association sub-rules have a time-series progressive relationship, and R is a positive integer.

[0138] Optionally, the generation module further includes: a first determination unit and a first storage unit. The first determination unit is used to determine the detail data of the network security abnormality event based on the first target association rule and the system data that hits the first target association rule, wherein the detail data includes: the specific data of the triggering association sub-rule, the triggering event, and the event category and event level of the triggering event; the first creation unit is used to create an event record of the network security abnormality event based on the detail data, and store the event record in the system memory database of the target system.

[0139] Optionally, the generation module further includes: a second determination unit and a second storage unit. The second determination unit is used to determine the validity period of the network security anomaly event based on the first target association rule after storing the event record in the system memory database of the target system, and to create an event flag based on the validity period, wherein the event flag at least includes a generation timestamp, a validity period, and a data index of the network security anomaly event in the system memory database; the second storage unit is used to store the event flag in the system cache of the target system.

[0140] Optionally, the detection device for abnormal network security events also includes: a second matching module, a third determination module, and a deletion module. Among them, the second matching module is used to continue matching the data stream to be analyzed with the remaining association sub-rules in the progressive rule group in a time-sequential progressive relationship within a preset time window after the rule matching engine matches the system data stream to the first target association rule and after the data stream to be analyzed hits T association sub-rules in the progressive rule group; the third determination module is used to determine the second target association rule based on the hit T association sub-rules and the newly added association sub-rule when the data stream to be analyzed matches the newly added association sub-rule; the deletion module is used to stop the matching operation between the progressive rule group and the data stream to be analyzed in the current matching process when the preset time window is exceeded and no newly added association sub-rule is matched, and delete the event flag in the system cache.

[0141] Optionally, the upgrade module includes: a third determination unit, a search unit, a second creation unit, and a replacement unit. The third determination unit is used to determine the upgrade supplementary data of the network security anomaly event based on the second target association rule and the system data that hits the second target association rule, wherein the upgrade supplementary data includes: specific data that triggers the newly added association sub-rule, the triggering event, and the event category and event level of the triggering event; the search unit is used to search for the event record of the network security anomaly event in the system memory database, and use the upgrade supplementary data to supplement the event record to obtain the upgraded network security anomaly event; the second creation unit is used to determine the update validity period of the upgraded network security anomaly event based on the second target association rule, and create an update event flag based on the update validity period, wherein the update event flag at least includes: update timestamp, update validity period, and data index of the upgraded network security anomaly event in the system memory database; the replacement unit is used to replace the event flag in the system cache of the target system with the update event flag.

[0142] From the above content, it can be seen that the present application can quickly adjust the alarm level and response strategy according to the evolution path of network attacks through dynamic event upgrade and sign management technology, which not only improves the real-time detection of security incidents, but also reduces resource consumption and avoids unnecessary false alarms. It provides a more efficient and intelligent solution for network security defense, achieves the purpose of instant identification and intelligent upgrade of network security threats, and thus realizes efficient and accurate detection and response effects for progressively related complex events. It can not only quickly capture the subtle signs of security threats, but also automatically adjust the alarm level as the threat situation changes, greatly enhancing the flexibility and effectiveness of the network security defense system.

[0143] The above-mentioned network security anomaly event detection device may also include a processor and a memory. The above-mentioned input module 501, generation module 502, query module 503, upgrade module 504, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0144] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels may be provided, and specific program steps may be executed by adjusting kernel parameters; the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0145] Embodiment 3

[0146] According to an embodiment of the present application, a computer program product is also provided. When executed on a data processing device, the computer program product is suitable for executing a program that is initialized with the following method steps: continuously collecting system data streams during the real-time operation of the target system, and inputting the system data streams into a rule matching engine, wherein the multiple rules preset in the rule matching engine include N preset association rules, and N is a positive integer; when the rule matching engine matches the system data stream to a first target association rule, a network security anomaly event and an event flag corresponding to the first target association rule are generated, wherein the event flag is at least used to characterize the validity period of the anomaly event; when the rule matching engine matches a second target association rule that has a logically progressive relationship with the first target association rule, the event flag in the system cache is queried; when it is confirmed that the event flag is within the validity period, the generated network security anomaly event is upgraded, and the event flag is updated based on the upgraded network security anomaly event.

[0147] Embodiment 4

[0148] According to an embodiment of the present application, a computer-readable storage medium is also provided, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method for detecting network security abnormal events of any one of the above-mentioned embodiments one.

[0149] Embodiment 5

[0150] According to an embodiment of the present application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the method for detecting abnormal network security events of any one of the above-mentioned embodiments one.

[0151] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0152] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0153] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0154] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0155] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0156] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0157] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting abnormal network security events, characterized in that: include: Continuously collecting system data streams during the real-time operation of the target system, and inputting the system data streams into a rule matching engine, wherein the multiple rules preset in the rule matching engine include N preset association rules, where N is a positive integer; When the rule matching engine matches the system data flow to a first target association rule, generating a network security abnormal event and an event flag corresponding to the first target association rule, wherein the event flag is at least used to characterize the validity period of the abnormal event; In the case where the rule matching engine matches a second target association rule having a logically progressive relationship with the first target association rule, querying the event flag in the system cache; When it is confirmed that the event flag is within the validity period, the generated network security abnormality event is upgraded, and the event flag is updated based on the upgraded network security abnormality event.

2. The method for detecting abnormal network security events according to claim 1, characterized in that: After receiving the system data stream, the rule matching engine performs the following steps: Sorting the received system data stream according to the time sequence and data timestamp to obtain the data stream to be analyzed; Calling at least one progressive rule group formed by the N preset association rules one by one, and matching the data stream to be analyzed using the association sub-rules of the preset association rules in the progressive rule group, wherein the multiple association sub-rules corresponding to the same progressive rule group have a time-series progressive relationship; In the case that the data flow to be analyzed hits T association sub-rules according to the time sequence progressive relationship, the preset association rule to which the T association sub-rules belong is determined to be the first target association rule, where T is a positive integer.

3. The method for detecting abnormal network security events according to claim 2, characterized in that: Before inputting the system data flow into the rule matching engine, it also includes: Analyze the N preset association rules preset in the rule matching engine to obtain M progressive rule groups, where M is a positive integer less than or equal to N; All preset association rules in each of the progressive rule groups are analyzed to determine R association sub-rules corresponding to each of the progressive rule groups, where R is a positive integer.

4. The method for detecting abnormal network security events according to claim 2, characterized in that: Generating a network security anomaly event corresponding to the first target association rule includes: Determine the detailed data of the network security abnormal event based on the first target association rule and the system data that hits the first target association rule, wherein the detailed data includes: specific data triggering the association sub-rule, the triggering event, and the event category and event level of the triggering event; An event record of the network security anomaly event is created based on the detailed data, and the event record is stored in a system memory database of the target system.

5. The method for detecting abnormal network security events according to claim 4, characterized in that: After storing the event record in the system memory database of the target system, generating an event flag includes: Determine the validity period of the network security abnormal event based on the first target association rule, and create the event flag based on the validity period, wherein the event flag at least includes a generation timestamp, the validity period, and a data index of the network security abnormal event in the system memory database; The event flag is stored in a system cache of the target system.

6. The method for detecting abnormal network security events according to claim 2, characterized in that: The rule matching engine performs steps after the system data flow matches the first target association rule, further comprising: After the data flow to be analyzed hits T associated sub-rules in the progressive rule group, continue to match the data flow to be analyzed with the remaining associated sub-rules in the progressive rule group according to the time sequence progressive relationship within a preset time window; In the case where the data flow to be analyzed matches the newly added association sub-rule, determining the second target association rule based on the T association sub-rules that have been matched and the newly added association sub-rule; or When the preset time window is exceeded and no newly added associated sub-rule is matched, the matching operation between the progressive rule group and the data stream to be analyzed in the current matching process is stopped, and the event flag in the system cache is deleted.

7. The method for detecting abnormal network security events according to claim 6, characterized in that: Upgrading the generated network security abnormal event, and updating the event flag based on the upgraded network security abnormal event, including: Determine the upgraded supplementary data of the network security abnormality event based on the second target association rule and the system data that hits the second target association rule, wherein the upgraded supplementary data includes: specific data triggering the newly added association sub-rule, the triggering event, and the event category and event level of the triggering event; Searching for an event record of the network security abnormal event in a system memory database, and supplementing the event record with the upgraded supplementary data to obtain the upgraded network security abnormal event; Determine an updated validity period of the upgraded network security anomaly event based on the second target association rule, and create an updated event flag based on the updated validity period, wherein the updated event flag at least includes: an updated timestamp, the updated validity period, and a data index of the upgraded network security anomaly event in the system memory database; The event flag in the system cache of the target system is replaced with the updated event flag.

8. A device for detecting abnormal network security events, characterized in that: include: An input module, used for continuously collecting system data streams during the real-time operation of the target system, and inputting the system data streams into a rule matching engine, wherein the multiple rules preset in the rule matching engine include N preset association rules, where N is a positive integer; A generating module, configured to generate a network security abnormal event and an event flag corresponding to the first target association rule when the rule matching engine matches the system data flow to the first target association rule, wherein the event flag is at least used to characterize the validity period of the abnormal event; A query module, configured to query the event flag in the system cache when the rule matching engine matches a second target association rule having a logically progressive relationship with the first target association rule; The upgrade module is used to upgrade the generated network security abnormal event when confirming that the event flag is within the validity period, and update the event flag based on the upgraded network security abnormal event.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the method for detecting abnormal network security events according to any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for detecting abnormal network security events as described in any one of claims 1 to 7.

Images