Security risk detection method and device and storage medium

Abstract

The invention provides a security risk detection method and device and a storage medium, relates to the technical field of network security, and can improve the security risk detection and evaluation capability of network infrastructures. The method comprises the steps of obtaining a risk detection result of a target object, wherein the risk detection result is used for indicating whether the target object has a security risk; under the condition that the risk detection result indicates that the target object has the security risk, determining whether an attack behavior aiming at the security risk exists based on log information of the target object; and under the condition that the attack behavior aiming at the security risk exists, determining attack information of the attack behavior.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular, to a security risk detection method, device, and storage medium. Background Art

[0002] As the fulcrum of the network and the physical world, network infrastructure has become a key node for the stable operation of all walks of life, and its security is becoming increasingly important. To ensure the secure and stable operation of network infrastructure, in addition to deploying defensive forces, it is also necessary to establish a security detection and evaluation system.

[0003] Currently, the detection means of security detection and evaluation methods in general technology are single, and the analysis of detection results is insufficient, resulting in a low ability to detect and evaluate the security of network infrastructure. Summary of the Invention

[0004] This application provides a security risk detection method, device, and storage medium, which can improve the ability to detect and evaluate the security risks of network infrastructure.

[0005] To achieve the above object, this application adopts the following technical solutions:

[0006] In a first aspect, this application provides a security risk detection method, which includes: obtaining a risk detection result of a target object; the risk detection result is used to indicate whether there is a security risk in the target object; in the case where the risk detection result indicates that there is a security risk in the target object, based on the log information of the target object, determining whether there is an attack behavior against the security risk; in the case where there is an attack behavior against the security risk, determining the attack information of the attack behavior.

[0007] In a possible implementation, the security risk includes at least one of the following: non-compliance with baseline configuration; existence of security vulnerabilities; existence of malware; existence of risk components.

[0008] In a possible implementation, determining the attack information of the attack behavior includes: determining the attack content related to the security risk according to the type of the security risk; based on the abnormal information of the target object and the attack content related to the security risk, determining the attack information of the attack behavior.

[0009] In a possible implementation, obtaining the risk detection result of the target object includes: obtaining a target detection task; the target detection task includes multiple detection indicators; based on the detection tool matched with the target detection task, detecting the target object to obtain the risk detection result of the target object.

[0010] In a possible implementation, the detection tool includes at least one of the following: a baseline check tool; a vulnerability check tool; a malware check tool; a software composition analysis tool; a static application security testing tool; an interactive application security testing tool; a dynamic application security testing tool.

[0011] In a possible implementation, the security risk includes non-compliance with the baseline configuration. Based on the detection tool matched with the target detection task, the target object is detected to obtain the risk detection result of the target object, including: using the baseline check tool to detect the configuration information of the target object to determine whether the baseline configuration of the target object is compliant, where the configuration information includes one or more of an operating system, middleware, and a database; wherein, in the case that the configuration information of the target object does not meet the preset security conditions, it is determined that the baseline configuration of the target object is non-compliant.

[0012] In a possible implementation, the preset security conditions include at least one of the following: no default account exists; no default password exists; high-risk ports are not opened; default shares are not opened; unknown services are not opened; a security access control policy has been configured.

[0013] In a second aspect, the present application provides a security risk detection device, which includes: a communication unit and a processing unit; the communication unit is used to obtain the risk detection result of the target object; the risk detection result is used to indicate whether there is a security risk for the target object; the processing unit is used to determine whether there is an attack behavior against the security risk based on the log information of the target object in the case that the risk detection result indicates that the target object has a security risk; the processing unit is further used to determine the attack information of the attack behavior in the case that there is an attack behavior against the security risk.

[0014] In a possible implementation, the security risk includes at least one of the following: non-compliance with the baseline configuration; existence of security vulnerabilities; existence of malware; existence of risk components.

[0015] In a possible implementation, the processing unit is further used to determine the attack content related to the security risk according to the type of the security risk; the processing unit is further used to determine the attack information of the attack behavior based on the abnormal information of the target object and the attack content related to the security risk.

[0016] In a possible implementation, the communication unit is further used to obtain the target detection task; the target detection task includes multiple detection indicators; the processing unit is further used to detect the target object based on the detection tool matched with the target detection task to obtain the risk detection result of the target object.

[0017] In a possible implementation, the detection tool includes at least one of the following: a baseline check tool; a vulnerability check tool; a malware check tool; a software composition analysis tool; a static application security testing tool; an interactive application security testing tool; a dynamic application security testing tool.

[0018] In a possible implementation, the processing unit is further configured to use the baseline check tool to detect the configuration information of the target object and determine whether the baseline configuration of the target object is compliant, where the configuration information includes one or more of an operating system, middleware, and a database; wherein, when the configuration information of the target object does not meet the preset security conditions, it is determined that the baseline configuration of the target object is non-compliant.

[0019] In a possible implementation, the preset security conditions include at least one of the following: no default account exists; no default password exists; high-risk ports are not enabled; default shares are not enabled; unknown services are not enabled; a security access control policy has been configured.

[0020] In a third aspect, the present application provides a security risk detection device, which includes: a processor and a communication interface; the communication interface is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the security risk detection method described in the first aspect and any possible implementation manner of the first aspect.

[0021] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions are stored, and when the instructions are run on a terminal, the terminal is caused to execute the security risk detection method described in the first aspect and any possible implementation manner of the first aspect.

[0022] In a fifth aspect, the present application provides a computer program product containing instructions, and when the computer program product runs on a security risk detection device, the security risk detection device is caused to execute the security risk detection method described in the first aspect and any possible implementation manner of the first aspect.

[0023] In a sixth aspect, the present application provides a chip, which includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is configured to run a computer program or instruction to implement the security risk detection method described in the first aspect and any possible implementation manner of the first aspect.

[0024] Specifically, the chip provided in the present application further includes a memory for storing a computer program or instruction.

[0025] The above technical solution has at least the following beneficial effects: obtaining the risk detection result of the target object, and when the risk detection result indicates that the target object has a security risk, determining whether there is an attack behavior against the security risk based on the log information of the target object, and when there is an attack behavior against the security risk, determining the attack information of the attack behavior. That is to say, the security risk detection method provided by the embodiments of the present application not only determines whether the target object has a security risk, but also determines whether there is an attack behavior of the target object and the attack information of the attack behavior, so as to comprehensively analyze the detection result and improve the security risk detection and evaluation ability. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a schematic diagram of the composition of a security risk detection device provided by an embodiment of the present application;

[0027] Figure 2 It is a flowchart of a security risk detection method provided by an embodiment of the present application;

[0028] Figure 3 It is a flowchart of another security risk detection method provided by an embodiment of the present application;

[0029] Figure 4 It is a flowchart of another security risk detection method provided by an embodiment of the present application;

[0030] Figure 5 It is a module diagram of a security risk detection device provided by an embodiment of the present application;

[0031] Figure 6 It is a flowchart of an equal protection evaluation method provided by an embodiment of the present application;

[0032] Figure 7 It is a schematic diagram of the display of the equal protection evaluation result provided by an embodiment of the present application;

[0033] Figure 8 It is a flowchart of a supply chain security evaluation method provided by an embodiment of the present application;

[0034] Figure 9 It is a schematic diagram of the display of the supply chain security evaluation result provided by an embodiment of the present application;

[0035] Figure 10 It is a flowchart of an evaluation result correlation analysis method provided by an embodiment of the present application;

[0036] Figure 11 It is a structural diagram of a security risk detection device provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0037] The following will describe in detail the security risk detection method, device, and storage medium provided by the embodiments of the present application in conjunction with the accompanying drawings.

[0038] The term "and / or" in this article is merely a description of the association relationship between associated objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0039] Terms such as "first" and "second" in the specification and drawings of the present application are used to distinguish different objects or different processes for the same object, rather than to describe the specific order of the objects.

[0040] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally further include other steps or units not listed, or may optionally further include other steps or units inherent to these processes, methods, products, or devices.

[0041] It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to represent examples, illustrations, or explanations. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of the present application should not be construed as being more preferred or having more advantages than other embodiments or design solutions. Rather, the use of words such as "exemplary" or "for example" is intended to present relevant concepts in a specific manner.

[0042] In the description of the present application, unless otherwise specified, the meaning of "a plurality" refers to two or more.

[0043] As described in the foregoing background art, the security of network infrastructure is very important. However, attacks on network infrastructure by network attackers are becoming increasingly frequent, posing a serious threat to network infrastructure. To ensure the safe and stable operation of network infrastructure, in addition to deploying defense forces, it is also necessary to establish a security detection and evaluation system.

[0044] Currently, the security detection and evaluation methods in the general technology are difficult to comprehensively cover dynamic threat scenarios, lack the comprehensive analysis ability of multi-dimensional detection results, and do not perform full-process statistics on the detection and evaluation work, resulting in a low security detection and evaluation ability for network infrastructure and making it difficult to meet the high-level network security protection requirements of network infrastructure.

[0045] In view of this, an embodiment of the present application provides a security risk detection method, which includes: obtaining a risk detection result of a target object; in the case that the risk detection result indicates that the target object has a security risk, determining whether there is an attack behavior against the security risk based on the log information of the target object; and in the case that there is an attack behavior against the security risk, determining the attack information of the attack behavior. That is to say, the security risk detection method provided by the embodiment of the present application not only determines whether the target object has a security risk, but also determines whether there is an attack behavior of the target object and the attack information of the attack behavior, so as to comprehensively analyze the detection result and improve the security risk detection and evaluation ability.

[0046] In addition, the risk assessment method in the prior art forms a hierarchical rule base model by constructing a rule base of first-level index attributes and second-level rule attributes. Secondly, the non-technical source data is further classified and analyzed, and a belief rule base model is used to evaluate the non-technical source rule indicators and security of the critical information infrastructure system. Finally, aiming at the security risk status of critical information infrastructure units, the technical source information and non-technical source information are fused and analyzed to give a more accurate risk assessment result. Based on the critical information infrastructure security guarantee system, the rules are divided into different levels to improve the detection efficiency and accurate evaluation of the rule base.

[0047] Exemplarily, Figure 1 is a schematic diagram of the composition of a security risk detection device 10 provided by an embodiment of the present application. As Figure 1 shown, the security risk detection device 10 may include a processor 101 and a bus 102.

[0048] Further, the security risk detection device 10 may further include a communication interface 103 and a memory 104. Among them, the processor 101, the memory 104, and the communication interface 103 may be connected through the bus 102.

[0049] Among them, the processor 101 is a central processing unit (CPU), a general-purpose processor, a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 101 may also be other devices with processing functions, such as circuits, devices, or software modules, without limitation.

[0050] The bus 102 is used to transmit information between the components included in the security risk detection device 10.

[0051] A communication interface 103 is used to communicate with other devices or other communication networks. The other communication network can be an Ethernet, a radio access network (RAN), a wireless local area network (WLAN), etc. The communication interface 103 can be a module, a circuit, a communication interface, or any device capable of implementing communication.

[0052] A memory 104 is used to store instructions. Among them, the instructions can be computer programs.

[0053] Among them, the memory 104 can be a read-only memory (ROM) or other types of static storage devices that can store static information and / or instructions, can also be a random access memory (RAM) or other types of dynamic storage devices that can store information and / or instructions, and can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM), or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, without limitation.

[0054] It should be noted that the memory 104 can exist independently of the processor 101 or can be integrated with the processor 101. The memory 104 can be used to store instructions, program codes, or some data, etc. The memory 104 can be located inside the security risk detection device 10 or outside the security risk detection device 10, without limitation. The processor 101 is used to execute the instructions stored in the memory 104 to implement the security risk detection method provided in the following embodiments of this application.

[0055] In one example, the processor 101 can include one or more CPUs. For example, CPU0 and CPU1 (not shown in the figure).

[0056] As an optional implementation manner, the security risk detection device 10 includes multiple processors.

[0057] As an optional implementation manner, the security risk detection device 10 further includes an output device and an input device. Exemplarily, the input device is a device such as a keyboard, a mouse, a microphone, or a joystick, and the output device is a device such as a display screen and a speaker.

[0058] It should be noted that the security risk detection device 10 can be a desktop computer, a laptop computer, a network server, a mobile phone, a tablet computer, a wireless terminal, an embedded device, a chip system, or a device with a similar structure in Figure 1 . In addition, Figure 1 The component structures shown in Figure 1 do not constitute limitations on the respective devices in Figure 1 . Except for the components shown in Figure 1 , the respective devices in

[0059] may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0060] In addition, actions, terms, etc. involved between the embodiments of the present application can be referred to each other without limitation. The message names or parameter names in the messages for interaction between the respective devices in the embodiments of the present application are only examples, and other names can also be used in specific implementations without limitation.

[0061] The security risk detection method provided by the embodiments of the present application will be described below with reference to the accompanying drawings. Among them, actions, terms, etc. involved between the embodiments of the present application can be referred to each other without limitation. The message names or parameter names in the messages for interaction between the respective devices in the embodiments of the present application are only examples, and other names can also be used in specific implementations without limitation. The actions involved in the embodiments of the present application are only examples, and other names can also be used in specific implementations, such as: "included in" in the embodiments of the present application can also be replaced by "carried on" or "carried in", etc.

[0062] As Figure 2 shown, the embodiments of the present application propose a security risk detection method, which includes:

[0063] S201. Obtain the risk detection result of the target object.

[0064] Among them, the risk detection result is used to indicate whether there is a security risk for the target object.

[0065] In a possible implementation, obtain a target detection task, send the target detection task to the terminal of the evaluator, and receive the risk detection result of the target business system from the terminal of the evaluator.

[0066] Exemplarily, the above-mentioned target object may include various devices and business systems in the network infrastructure. For example, basic software and hardware facilities, key business systems, network devices, security devices, and management and operation and maintenance systems, etc.

[0067] Exemplarily, the above security risks may include at least one of the following: non-compliance with baseline configuration, presence of security vulnerabilities, presence of malware, and presence of risky components. Among them, malware may include viruses, Trojans, and malicious code.

[0068] S202. When the risk detection result indicates that the target object has a security risk, based on the log information of the target object, determine whether there is an attack behavior against the security risk.

[0069] In a possible implementation, analyze the risk detection result of the target object to determine whether the target object has a security risk. When it is determined that the target object has a security risk, obtain the log information of the target object. Identify the attack behavior based on this log information to determine whether there is an attack behavior against the security risk of the target object.

[0070] Exemplarily, the above log information may include operation log information, application log information, database log information, or business traffic information.

[0071] S203. When there is an attack behavior against the security risk, determine the attack information of the attack behavior.

[0072] In a possible implementation, when there is an attack behavior against the security risk, according to the type of the security risk, determine the attack content related to the security risk. Obtain the abnormal information of the target object, and based on this abnormal information and the attack content related to the security risk, obtain the attack information of the attack behavior.

[0073] Exemplarily, the types of the above security risks may include at least one of the following: network intrusion, data leakage, identity theft, or physical threat.

[0074] For example, when the type of the security risk is network intrusion, the attack content related to network intrusion may include: scanning the ports of the target object to find vulnerabilities, attacking using known vulnerabilities, and using brute-force cracking methods to crack passwords, etc.

[0075] Again, for example, when the type of the security risk is data leakage, the attack content related to data leakage may include: sensitive data being accessed by unauthorized users, stealing sensitive data stored in the system, and monitoring network communications to obtain sensitive data, etc.

[0076] Again, for example, when the type of the security risk is identity theft, the attack content related to identity theft may include: forging login credentials, using session hijacking techniques to steal user sessions, etc.

[0077] For another example, when the type of security risk is a physical threat, the attack content related to the physical threat may include: stealing hardware devices, damaging system components, intercepting physically transmitted data, etc.

[0078] Exemplarily, the abnormal information of the above target object may include at least one of the following: abnormal behavior, abnormal process, abnormal port, or abnormal script.

[0079] Exemplarily, the attack information of the above attack behavior may include: the identity or characteristics of the attacker, the source and path of the attack, the start time and duration of the attack, the target and result of the attack.

[0080] In the security risk detection method provided by this application, the risk detection result of the target business system is obtained. When the risk detection result indicates that the target business system has a security risk, it is determined whether there is an attack behavior against the security risk based on the log information of the target business system, and when there is an attack behavior against the security risk, the attack information of the attack behavior is determined. That is to say, the security risk detection method provided by the embodiments of this application not only determines whether the target business system has a security risk, but also determines whether there is an attack behavior in the target business system and the attack information of the attack behavior. In this way, a comprehensive analysis of the detection result can improve the security risk detection and evaluation ability.

[0081] In one embodiment, as Figure 3 shown, the above S201 can be specifically determined by the following S301 to S302.

[0082] S301. Obtain the target detection task.

[0083] Among them, the target detection task includes multiple detection indicators.

[0084] In a possible implementation manner, in response to user input, obtain the evaluation scenario, and determine the corresponding multiple detection indicators according to the evaluation scenario. According to the evaluation scenario and the multiple detection indicators, obtain the target detection task.

[0085] Exemplarily, the above evaluation scenario may be equal protection evaluation, commercial cryptography evaluation, or critical information infrastructure protection evaluation.

[0086] The detection indicators of the above evaluation scenarios are described below respectively:

[0087] 1-1. Equal protection evaluation

[0088] The detection indicators corresponding to the equal protection evaluation may include physical environment security, communication network security, computing environment security, management center security, and configuration security.

[0089] Among them, physical environment security includes: computer room environment security, physical access control security, device security, and electromagnetic protection.

[0090] Communication network security includes: reasonable network architecture, communication encryption, access control security, real-time network monitoring, regular backup and recovery.

[0091] Computing environment security includes: hardware device security, basic software security, application program security, data encryption protection.

[0092] Management center security includes: perfect security operation and maintenance process, strict security management strategy, personnel privilege management.

[0093] Configuration security includes: security configuration baseline, security audit and monitoring, unified configuration management.

[0094] 1-2. Commercial cipher evaluation

[0095] The detection indicators corresponding to commercial cipher evaluation can include key management security, cryptographic algorithm and protocol security, application and data security, and device and computing security.

[0096] Among them, key management security includes: secure key generation, secure key storage, key usage, regular key update, timely key destruction.

[0097] Cryptographic algorithm and protocol security includes: compliance of cryptographic algorithms, secure implementation of cryptographic algorithms, strong interoperability of cryptographic protocols, secure authentication of cryptographic protocols, encryption of cryptographic protocols.

[0098] Application and data security includes: application program security, data security, regular backup and recovery.

[0099] Device and computing security includes: having physical protection measures, secure remote management, access control and privilege management.

[0100] 1-3. Critical information infrastructure security evaluation

[0101] The detection indicators corresponding to critical information infrastructure security evaluation can include overall architecture security, protection measure security, security policies, and emergency response capabilities.

[0102] Among them, overall architecture security includes: reasonable system architecture, reasonable network topology, compliance of hardware and software configuration.

[0103] Protection measure security includes: access control authentication, deployment of intrusion prevention systems, deployment of security audit systems.

[0104] Security policies include: formulation of security management systems, personnel privilege management, third-party security management.

[0105] Emergency response capabilities include: formulation of emergency response plans, security incident monitoring and reporting, disaster recovery and backup.

[0106] S302. Use the detection tool matched with the target detection task to detect the target object and obtain the risk detection result of the target object.

[0107] Exemplarily, the above detection tool may include at least one of the following: baseline check tool, vulnerability check tool, malware check tool, software composition analysis (SCA) tool, static application security testing (SAST) tool, interactive application security testing (IAST) tool, dynamic application security testing (DAST) tool. Among them, the malware check tool may include virus check tool, Trojan check tool, and malicious code scanning tool.

[0108] Taking the example that the security risk of the target object includes non-compliance with the baseline configuration, the implementation process of the above S302 may be as follows: Use the baseline check tool to detect the configuration information of the target object to determine whether the baseline configuration of the target object is compliant. Specifically, when the configuration information of the target object does not meet the preset security conditions, it is determined that the baseline configuration of the target object is non-compliant. Among them, the configuration information includes one or more of the operating system, middleware, and database.

[0109] Exemplarily, the above preset security conditions may include at least one of the following: no default account exists, no default password exists, high-risk ports are not opened, default shares are not opened, unknown services are not opened, and a security access control policy has been configured.

[0110] The above preset security conditions are described separately below:

[0111] 2-1. No default account exists

[0112] A default account is an account preset by the system or device at the time of factory for initial login or management. Since these accounts usually have known usernames and are equipped with default passwords, the risk of being easily exploited is increased. Therefore, a secure system or device should ensure that all default accounts are deleted or disabled during deployment.

[0113] 2-2. No default password exists

[0114] Similar to the default account, the default password is also preset by the system or device at the time of factory shipment for initial login or management. Since these passwords are usually easy to guess and can be easily exploited by malicious users. Therefore, to ensure security, all default passwords should be changed during deployment, and the new passwords should comply with the strong password policy.

[0115] 2-3. High-risk ports are not enabled

[0116] High-risk ports refer to network ports that may be exploited by malicious users to initiate attacks or spread malware. These ports may become insecure due to vulnerabilities in the system or application. Therefore, a secure system should ensure that only secure ports are enabled and all unnecessary or high-risk ports are closed.

[0117] 2-4. Default shares are not enabled

[0118] Default shares refer to functions for file or resource sharing automatically created by the system or device at the time of factory shipment. Since these shares may contain sensitive information or be exploited by malicious users to initiate attacks. Therefore, a secure system or device should ensure that all default shares are closed during deployment.

[0119] 2-5. Unknown services are not enabled

[0120] Unknown services refer to services that run without authorization or sufficient testing. Since these services may contain security vulnerabilities. Therefore, a secure system should ensure that only authorized and fully tested services are run and all unknown or unnecessary services are closed.

[0121] 2-6. A secure access control policy has been configured

[0122] A secure access control policy refers to the rules and mechanisms used to control access to the system or device. These policies can include aspects such as authentication, authorization, access control, and auditing. A secure system should ensure that a comprehensive secure access control policy has been configured and implemented to restrict unauthorized access and operations.

[0123] Exemplarily, Figure 4 is the overall flowchart of a secure risk detection method provided by an embodiment of this application. As Figure 4 shown, the secure risk detection method may include the following steps.

[0124] S401. The secure risk detection device determines the evaluation scenario and evaluation metrics.

[0125] Optionally, the user can select or define the evaluation scenario in the secure risk detection device according to the evaluation requirements, and the secure risk detection device matches the corresponding evaluation metrics according to different evaluation scenarios or receives the evaluation metrics defined by the user.

[0126] Exemplarily, the above evaluation scenarios may be compliance evaluations, such as equal protection evaluations, commercial secret evaluations, or critical information infrastructure protection evaluations. The above evaluation scenarios may also be special evaluations, such as supply chain security evaluations or data security evaluations.

[0127] S402. The security risk detection device establishes an evaluation task according to the evaluation scenario and evaluation indicators, and matches an evaluation tool according to the evaluation task.

[0128] Optionally, the security risk detection device analyzes the evaluation scenario and evaluation indicators, determines the evaluation requirements, and formulates an evaluation plan. The security risk detection device refines the evaluation plan into specific evaluation tasks, and selects a suitable evaluation tool according to the specific requirements of the evaluation tasks.

[0129] Optionally, the above evaluation tasks may include task basic information and task evaluators.

[0130] S403. The security risk detection device receives the evaluation results.

[0131] It should be noted that the above evaluation results may be the results obtained by evaluators automatically completing the evaluation tasks through evaluation tools and / or manually completing the evaluation tasks. Among them, the risk level corresponding to the evaluation indicators can be directly obtained by detecting through evaluation tools. Detecting manually requires analyzing and evaluating the risk level corresponding to the evaluation indicators.

[0132] S404. The security risk detection device analyzes the evaluation results to obtain existing security risks.

[0133] Optionally, the security risk detection device compares the evaluation results with preset security standards, industry norms, or normal data to identify security risk points that do not meet the standards or are abnormal.

[0134] S405. The security risk detection device performs correlation analysis on the evaluation results, log information, and abnormal information of the evaluation object to determine attack information.

[0135] S406. The security risk detection device displays the detection effect.

[0136] Optionally, if there are security risks in the evaluation object, specific security risk information is displayed. If there are attack behaviors against the evaluation object, specific attack information is displayed.

[0137] S407. The security risk detection device stores the evaluation-related data in the detection knowledge base.

[0138] Among them, the evaluation-related data includes evaluation scenarios, evaluation cases, and security risks.

[0139] It is understandable that by establishing a detection knowledge base, relevant security personnel can understand the status of assessment tasks and the risk situations of assessment objects, comprehensively grasp the security risks existing in network infrastructure, supervise the risk handling situations, and accumulate and improve the ability to handle security risks through the detection knowledge base.

[0140] Exemplarily, Figure 5 is a module schematic diagram of a security risk detection device provided by an embodiment of the present application. As Figure 5 shown, the security risk detection device includes a comprehensive analysis module, a centralized management module, and an assessment object detection module.

[0141] The comprehensive analysis module includes a comprehensive analysis module for assessment reports, a centralized presentation module for detection effects, and a detection knowledge base construction module. The comprehensive analysis module is used to automatically analyze and extract key information from the assessment reports generated by assessment tasks, analyze the security risks found in detection and evaluation, and present them centrally, enabling security personnel to intuitively discover existing security risk hidden dangers and make rectifications in a timely manner. Moreover, the comprehensive analysis module can store the analysis results of the assessment reports in the detection knowledge base in a normalized format.

[0142] The centralized management module includes an assessment task management module, an assessment scenario management module, an assessment index management module, an assessment document management module, an assessment tool management module, and an assessment personnel management module.

[0143] Among them, the assessment task management module is used to create, distribute, and delete tasks according to assessment scenarios.

[0144] The assessment scenario management module is used to define detection and evaluation scenarios according to user requirements.

[0145] The assessment index management module is used to define assessment indexes for corresponding scenarios according to user requirements or match corresponding assessment indexes for different assessment scenarios. For example, define equal protection assessment indexes, commercial secret assessment indexes, critical information infrastructure protection assessment indexes, and special assessment indexes, etc.

[0146] The assessment document management module is used to store assessment reports.

[0147] The assessment tool management module integrates and docks with third-party detection tools, including tools such as baseline configuration verification, vulnerability scanning, code analysis, traffic analysis, log analysis, virus detection, and trojan detection, to form a proprietary test tool set for detection and evaluation, which is used to match corresponding tool sets for different assessment scenarios and assessment tasks and centrally manage and schedule assessment tools.

[0148] The evaluation personnel management module is used to establish different evaluation roles according to different evaluation tasks, implement permission control for different evaluation roles, and audit and record the operation behaviors of evaluation personnel.

[0149] The evaluation object detection module is used to detect various devices, services or systems existing in the network infrastructure. For example, basic software and hardware facilities, key business systems, network devices, security devices, and management and operation and maintenance systems, etc.

[0150] In one embodiment, taking the equal protection evaluation of the target business system as an example, Figure 6 This is a flowchart of an equal protection evaluation method provided by an embodiment of the present application. As Figure 6 shown, the equal protection evaluation method may include the following steps.

[0151] S601. Obtain an equal protection evaluation task according to the equal protection evaluation scenario and equal protection evaluation indicators.

[0152] S602. Determine the evaluation tools matching the equal protection evaluation task.

[0153] Exemplarily, the evaluation tools matching the above equal protection evaluation task may include: baseline inspection tools, vulnerability inspection tools, virus inspection tools, Trojan inspection tools, malicious code scanning tools, and weak password inspection tools.

[0154] S603. Detect the target business system according to the evaluation tools to obtain an evaluation result.

[0155] Specifically, use the baseline inspection tool to check the operating system, middleware and database of the target business system, and check whether there are default accounts, default configurations, default passwords, whether high-risk ports, default shares, unknown system services are enabled, and whether a security access control policy is configured, etc.

[0156] Use the vulnerability inspection tool to perform system vulnerability scanning and network (web) vulnerability scanning on the target business system to check whether there are high-risk vulnerabilities.

[0157] Use the virus inspection tool, Trojan inspection tool and malicious code scanning tool to check whether the target business system has known viruses, Trojans or malicious codes.

[0158] Use the weak password inspection tool to check whether the length and complexity of the passwords stored in the target business system meet the security standards.

[0159] S604. Automatically analyze and correlate analyze the evaluation results.

[0160] Specifically, based on the evaluation results, identify the security risks existing in the target business system. For example, the target business system has non-compliant baseline configurations, known vulnerabilities, malicious code, or viruses. Conduct correlation analysis on the operation logs, application logs, database logs, and business traffic of the target business system to confirm whether there are attack behaviors targeting known vulnerabilities and security configuration defects in the logs. If there are attack behaviors, obtain the attack path based on the correlation analysis.

[0161] S605. Display the security risks and attack behaviors existing in the target business system.

[0162] Optionally, if the target business system has no security risks, display security compliance. If the target business system has security risks, display information such as the existing vulnerabilities and non-compliant security configurations, and display the results of the correlation analysis. For example, if the correlation analysis result shows that there are attack behaviors, display the attack behaviors and the attack path.

[0163] Furthermore, based on the display results, conduct risk investigation on the target business system to repair security vulnerabilities and configuration defects.

[0164] S606. Enter the evaluation-related data into the detection knowledge base.

[0165] Among them, the evaluation-related data includes evaluation scenarios, evaluation cases, and security risks.

[0166] Exemplarily, Figure 7 is a schematic diagram of the display of the equal protection evaluation results provided by an embodiment of the present application. As Figure 7 shown, the target business system has security risks, including security vulnerabilities and baseline non-compliance. Among them, the security vulnerability is the existence of a high-risk structured query language (SQL) injection vulnerability. The baseline non-compliance is that the access control is not enabled in the operating system. The log audit result of the target business system is the existence of attack behavior logs, and the traffic audit result is the existence of attack behavior traffic. Conduct correlation analysis on the security vulnerabilities, baseline non-compliance, log audit, and traffic audit to obtain attack behaviors and the attack path. Among them, the attack behavior is: the SOL injection attack behavior using the known vulnerability has been successfully implemented. The attack path is: information collection → vulnerability and defect exploitation → malicious code upload → attack behavior implementation.

[0167] In one embodiment, taking the supply chain security evaluation of the target business system as an example, Figure 8 is a flowchart of a supply chain security evaluation method provided by an embodiment of the present application. As Figure 8 shown, the supply chain security evaluation method may include the following steps.

[0168] S801. Obtain a supply chain security assessment task according to the supply chain security assessment scenario and supply chain security assessment indicators.

[0169] S802. Determine the assessment tool that matches the supply chain security assessment task.

[0170] Exemplarily, the assessment tools that match the above supply chain security assessment task may include: SCA tool, SAST tool, IAST tool, and DAST tool.

[0171] S803. Detect the target business system according to the assessment tool to obtain an assessment result.

[0172] Specifically, use the SCA tool to perform component analysis on the target business system, comprehensively analyze the components of the target business system, and detect whether the target business system uses risk components and whether there are security vulnerabilities.

[0173] Use the SAST tool to analyze the code of the target business system, and confirm the reachability of risk components and the exploitable nature of security vulnerabilities through static analysis.

[0174] Use the IAST tool to confirm the reachability, authenticity of risk component vulnerabilities, and verify the link for exploiting vulnerabilities through dynamic interaction, and confirm the specific location of the vulnerabilities.

[0175] Use the DAST tool to perform system vulnerability scanning and Web vulnerability scanning on the target business system, check whether there are high-risk vulnerabilities in the target business system, and confirm whether there is an association with risk component vulnerabilities.

[0176] S804. Perform automated analysis and correlation analysis on the assessment result.

[0177] Specifically, according to the assessment result, obtain the security risks existing in the target business system. For example, the target business system has known vulnerabilities and risk components. Perform correlation analysis on the operation logs, application logs, database logs, and business traffic of the target business system to confirm whether there are attack behaviors against the known vulnerabilities and risk components in the logs. If there are attack behaviors, obtain the attack path according to the correlation analysis.

[0178] S805. Display the security risks and attack behaviors existing in the target business system.

[0179] Optionally, if there are no security risks in the target business system, display security compliance. If there are security risks in the target business system, display the existing supply chain vulnerabilities and display the result of the correlation analysis. For example, if the correlation analysis result is that there are attack behaviors, display the attack behaviors and attack paths.

[0180] Furthermore, risk investigation can be carried out on the target business system according to the display results, and components with risks can be upgraded.

[0181] S806. Enter the evaluation-related data into the detection knowledge base.

[0182] Among them, the evaluation-related data includes evaluation scenarios, evaluation cases, and security risks.

[0183] Exemplarily, Figure 9 is a schematic diagram of the display of supply chain security evaluation results provided by an embodiment of the present application. As Figure 9 shown, the target business system has security risks, including security vulnerabilities and the reachability of components and vulnerabilities. Among them, the security vulnerability is the existence of a Log4j component vulnerability. The reachability of components and vulnerabilities means that both the components and the vulnerabilities are reachable. The log audit result of the target business system is the existence of attack behavior logs, and the traffic audit result is the existence of attack behavior traffic. Correlation analysis of security vulnerabilities, component and vulnerability reachability, log audit, and traffic audit yields attack behaviors and attack paths. Among them, the attack behavior is that the attack behavior using the risk component has been successfully implemented. The attack path is: information collection → risk component utilization → RCE code upload → attack behavior implementation.

[0184] In one embodiment, as Figure 10 shown, the correlation analysis of the evaluation results can be determined through the following S1001 to S1007.

[0185] S1001. According to the vulnerability detection report of the target business system, determine whether the target business system has configuration defects or security vulnerabilities.

[0186] Among them, the vulnerability detection report of the target business system is equivalent to the evaluation result obtained after detecting the target business system as described above.

[0187] If the target business system does not have configuration defects and security vulnerabilities, then execute step S1002.

[0188] S1002. Conduct continuous security operation on the target business system.

[0189] If the target business system has configuration defects or security vulnerabilities, then execute step S1003.

[0190] S1003. According to the attack behavior analysis report of the target business system, determine whether the target business system has been attacked.

[0191] Among them, the attack behavior analysis report of the target business system is obtained by analyzing the logs and traffic of the target business system.

[0192] If the target business system has not been attacked, then execute step S1004.

[0193] S1004. Repair configuration defects and security vulnerabilities in the target business system.

[0194] If the target business system is attacked, execute step S1005.

[0195] S1005. Determine whether the attack behavior against the target business system is successful based on the abnormal behavior analysis report of the target business system.

[0196] Among them, the abnormal behavior analysis report of the target business system is obtained by sorting out the abnormal information of the target business system.

[0197] If the attack behavior against the target business system is not successful, execute step S1006.

[0198] S1006. Repair configuration defects and security vulnerabilities in the target business system and strengthen the security protection measures against attack behavior.

[0199] If the attack behavior against the target business system is successful, execute step S1007.

[0200] S1007. Complete the correlation analysis to obtain the attack information of the attack behavior.

[0201] In summary, the security risk detection method provided by the embodiments of the present application has an integrated security detection and evaluation ability of multiple scenarios, multiple dimensions, and multiple modes, making the security detection and evaluation work more standardized, systematic, and automated. Security evaluation personnel only need to define the evaluation scenarios and indicators, and they can use the corresponding tool set of the system to carry out risk evaluation. At the same time, they can more accurately locate the risk problems of the evaluation object, helping security operators to more comprehensively understand the security risk status of the network infrastructure. In addition, through the established detection knowledge base, security personnel can overall master the security hidden dangers of the network infrastructure, clearly and intuitively understand the status of the evaluation task and the overall risk situation of the evaluation object, and can also supervise the risk handling situation, and accumulate and improve the risk handling ability through the detection knowledge base.

[0202] It can be understood that the above-mentioned security risk detection method can be implemented by a security risk detection device. In order to implement the above functions, the security risk detection device includes the corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should easily realize that, in combination with the modules and algorithm steps of each example described in the embodiments disclosed in this article, the disclosed embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the manner of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the disclosed embodiments of the present application.

[0203] The disclosed embodiments of the present application can perform functional module division according to the security risk detection device generated by the above method examples. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of a software function module. It should be noted that the division of modules in the disclosed embodiments of the present application is illustrative, only a logical function division, and there may be other division methods in actual implementation.

[0204] Figure 11 It is a schematic structural diagram of a security risk detection device provided by an embodiment of the present application. As Figure 11 shown, the security risk detection device 110 can be used to execute Figures 2 - 4 、 Figure 6 、 Figure 8 and Figure 10 the security risk detection methods shown. The security risk detection device 110 includes: a communication unit 1101 and a processing unit 1102.

[0205] The communication unit 1101 is used to obtain the risk detection result of the target object; the risk detection result is used to indicate whether there is a security risk for the target object; the processing unit 1102 is used to determine whether there is an attack behavior against the security risk based on the log information of the target object when the risk detection result indicates that the target object has a security risk; the processing unit 1102 is further used to determine the attack information of the attack behavior when there is an attack behavior against the security risk.

[0206] In a possible implementation manner, the security risk includes at least one of the following: non-compliance with baseline configuration; existence of security vulnerabilities; existence of malware; existence of risk components.

[0207] In a possible implementation, the processing unit 1102 is further configured to determine attack content related to the security risk according to the type of the security risk; the processing unit 1102 is further configured to determine attack information of the attack behavior based on the abnormal information of the target object and the attack content related to the security risk.

[0208] In a possible implementation, the communication unit 1101 is further configured to obtain a target detection task; the target detection task includes multiple detection metrics; the processing unit 1102 is further configured to detect the target object based on the detection tool matched with the target detection task to obtain a risk detection result of the target object.

[0209] In a possible implementation, the detection tool includes at least one of the following: a baseline check tool; a vulnerability check tool; a malware check tool; a software composition analysis tool; a static application security testing tool; an interactive application security testing tool; a dynamic application security testing tool.

[0210] In a possible implementation, the processing unit 1102 is further configured to use the baseline check tool to detect the configuration information of the target object to determine whether the baseline configuration of the target object is compliant. The configuration information includes one or more of an operating system, middleware, and a database. Wherein, when the configuration information of the target object does not meet the preset security conditions, it is determined that the baseline configuration of the target object is non-compliant.

[0211] In a possible implementation, the preset security conditions include at least one of the following: there is no default account; there is no default password; high-risk ports are not enabled; default shares are not enabled; unknown services are not enabled; a security access control policy has been configured.

[0212] Through the description of the above embodiments, those skilled in the art can clearly understand that for the convenience and conciseness of description, only the above division of each functional module is used as an example for illustration. In actual applications, the above functions can be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0213] The present disclosure also provides a computer-readable storage medium, on which instructions are stored. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the security risk detection method provided in the embodiments of the present disclosure above.

[0214] Embodiments of the present disclosure also provide a computer program product containing instructions, which, when running on an electronic device, causes the electronic device to execute the security risk detection method provided in the above embodiments of the present disclosure.

[0215] Among them, a computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a register, a hard disk, an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above, or any other form of computer-readable storage medium well-known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). In the embodiments of the present application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0216] The above are only the specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A security risk detection method, characterized in that: The method comprises: Obtaining a risk detection result of a target object; the risk detection result is used to indicate whether the target object has a security risk; When the risk detection result indicates that the target object has a security risk, determining whether there is an attack behavior against the security risk based on the log information of the target object; In the case that the attack behavior against the security risk exists, attack information of the attack behavior is determined.

2. The method according to claim 1, characterized in that The security risks include at least one of the following: The baseline configuration is not compliant; There are security vulnerabilities; The presence of malware; There are risky components.

3. The method according to claim 1, characterized in that The attack information for determining the attack behavior includes: Determining, according to the type of the security risk, attack content related to the security risk; Attack information of the attack behavior is determined based on the abnormal information of the target object and the attack content related to the security risk.

4. The method according to any one of claims 1 to 3, characterized in that The step of obtaining the risk detection result of the target object includes: Obtaining a target detection task; the target detection task includes multiple detection indicators; Based on the detection tool matched with the target detection task, the target object is detected to obtain a risk detection result of the target object.

5. The method according to claim 4, characterized in that The detection tool comprises at least one of the following: Baseline screening tools; Vulnerability checking tools; Malware checking tools; Software component analysis tools; Static application security testing tools; Interactive application security testing tool; Dynamic application security testing tool.

6. The method according to claim 5, characterized in that The security risk includes non-compliance of the baseline configuration. The detection tool based on the target detection task matching detects the target object to obtain the risk detection result of the target object, including: Using a baseline checking tool, checking the configuration information of the target object to determine whether the baseline configuration of the target object is compliant, wherein the configuration information includes one or more of an operating system, middleware, and a database; Wherein, when the configuration information of the target object does not meet the preset security condition, it is determined that the baseline configuration of the target object is non-compliant.

7. The method according to claim 6, characterized in that The preset safety condition includes at least one of the following: There is no default account; There is no default password; High-risk ports are not opened; Default sharing is not enabled; Unknown services are not enabled; The security access control policy has been configured.

8. A security risk detection device, characterized in that: The device comprises: a communication unit and a processing unit; The communication unit is used to obtain a risk detection result of the target object; the risk detection result is used to indicate whether the target object has a security risk; The processing unit is configured to determine, when the risk detection result indicates that the target object has a security risk, whether there is an attack behavior against the security risk based on the log information of the target object; The processing unit is further configured to determine attack information of the attack behavior when there is the attack behavior against the security risk.

9. A security risk detection device, characterized in that: include: Memory and processor; The memory is coupled to the processor; The memory is used to store instructions executable by the processor; When the processor executes the instruction, the security risk detection method according to any one of claims 1 to 7 is performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is enabled to execute the security risk detection method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The computer program product comprises computer program instructions, and when the computer program instructions are executed by a processor, the security risk detection method according to any one of claims 1 to 7 is implemented.

Images