Methods, devices, electronic equipment and storage media for risk association of security assets

Abstract

This invention provides a method, apparatus, electronic device, and storage medium for security asset risk association, belonging to the technical field of computer science. In this method, each piece of asset data corresponds to at least two asset association IDs, and each piece of risk data corresponds to at least two risk association IDs. When association is performed according to the association IDs, as long as any pair of asset association IDs and risk association IDs can match, the corresponding asset data and risk data can be associated. This achieves multi-angle association through multiple association IDs, with good association accuracy. It supports the access of third-party data sources and realizes the association of assets and risks, i.e., it supports multi-source data. During association, only the first correspondence and the second correspondence of the target within the same segment are associated according to the association ID, which greatly reduces the amount of data associated. Moreover, the association within the same segment is implemented on the same host, thereby greatly improving the association efficiency and meeting the needs of near real-time association analysis.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and storage medium for security asset risk association. Background Technology

[0002] In the current construction of cybersecurity systems, asset operation has become a mainstream trend. Compared with the previous approach of focusing on intrusion attack detection and tracing, the daily and routine operation of security assets is better able to adapt to dynamic and complex business environments.

[0003] Assets are not only the carriers of business operations, but also the points where risks are borne. Deeply linking assets with risk information can build a holistic perspective, helping security personnel quickly locate and efficiently remediate affected assets when faced with alerts, vulnerabilities, and threat intelligence, thereby improving response efficiency.

[0004] By integrating multi-source data (such as CMDB, scanners, logs, intelligence, and other third-party data) to make a comprehensive judgment on affected assets, the assessment will be more accurate and effective. By continuously updating asset information and establishing dynamic mapping relationships, a security operation capability of real-time perception, precise correlation, and closed-loop handling can be achieved.

[0005] Traditional solutions break down vulnerability scanning into multiple rules and calculate the matching degree between feature factors and asset fingerprint information to locate dangerous assets. The disadvantages are that the feature factor binding rules are not universal, have poor accuracy, do not support multi-source data, and have a large amount of computation, making it difficult to guarantee real-time correlation efficiency.

[0006] Currently, there are the following technical challenges in associating assets and risks: asset / risk scanning is a separate process, and the reported data fields have some differences, making it impossible to comprehensively judge asset risks. It is also difficult to use unique IDs for marking and association, and if unique IDs are used for marking and association, the accuracy is poor. Asset risks from multiple sources, especially from different manufacturers and with different collection principles (host-side collection, network-side collection), are difficult to associate efficiently and accurately. The amount of asset / risk data is very large, and each data can generate multiple association IDs, making the association efficiency of the two large tables very low.

[0007] In summary, traditional asset and risk correlation suffers from technical problems such as poor accuracy, lack of support for multi-source data, and low correlation efficiency. Summary of the Invention

[0008] In view of this, the purpose of the present invention is to provide a method, apparatus, electronic device and storage medium for security asset risk association, so as to alleviate the technical problems of poor accuracy, lack of support for multi-source data and low association efficiency of traditional asset and risk association methods.

[0009] In a first aspect, embodiments of the present invention provide a method for associating security asset risks, applied to an association engine, the method comprising:

[0010] Acquire asset data and risk data, wherein the asset data and risk data are obtained by the collection rule detection system, or by cleaning and / or transforming the original asset data and original risk data from a third-party data source according to the configured access transformation rules;

[0011] The association IDs of the asset data and the risk data are calculated using preset association ID calculation rules to obtain asset association IDs and risk association IDs. Among them, an asset or a risk corresponds to at least two association ID calculation rules, each piece of asset data corresponds to at least two asset association IDs, and each piece of risk data corresponds to at least two risk association IDs.

[0012] Each piece of asset data is divided into at least two first correspondences between asset association ID and asset ID according to the corresponding asset association ID, and each piece of risk data is divided into at least two second correspondences between risk association ID and risk ID according to the corresponding risk association ID;

[0013] The first and second correspondence relationships are fragmented based on the asset association ID and the risk association ID;

[0014] The first and second correspondences of targets within the same segment are stored in columnar storage on the same host, and the first and second correspondences of targets within the same segment are associated according to the association ID;

[0015] If the target asset association ID in the first target correspondence matches the target risk association ID in the second target correspondence, then the target asset ID in the first target correspondence is determined to be associated with the target risk ID in the second target correspondence, thereby obtaining the association result between the asset and the risk.

[0016] Furthermore, the association ID calculation rule is a calculation rule for multiple calculation factors, including: host ID + software version + software path, host ID + image ID + software version + software path, host ID + software version + software type, host ID + image ID + software version + software type, host ID + dependency package version + dependency package name, and host ID + image ID + dependency package version + dependency package name.

[0017] Furthermore, the first and second correspondences are fragmented based on the asset association ID and the risk association ID, including:

[0018] Calculate the hash values ​​of the asset-associated ID and the risk-associated ID, and take the modulo of the hash values ​​of the asset-associated ID and the risk-associated ID to obtain the hash modulo value of the asset-associated ID and the hash modulo value of the risk-associated ID;

[0019] The first and second correspondences of the same asset association ID hash modulus and risk association ID hash modulus are treated as the same shard.

[0020] Furthermore, the association ID calculation rules include: asset association ID calculation rules and risk association ID calculation rules;

[0021] When the asset is a running application, the asset association ID calculation rules include: agent_id+md5(version+path), agent_id+md5(version+app_name), or agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+app_name);

[0022] When the asset is a database, the asset association ID calculation rules include: agent_id+md5(version+path), agent_id+md5(version+db_type), or agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+db_type);

[0023] When the asset is a web service, the asset association ID calculation rules include: agent_id+md5(version+server_type), agent_id+md5(version+install_path), or agent_id+md5(image_id+version+server_type), agent_id+md5(image_id+version+install_path);

[0024] When the asset is a Java framework, the asset association ID calculation rule includes: agent_id+md5(version+jar_path), or agent_id+md5(image_id+version+jar_path);

[0025] When the asset is an installation package, the asset association ID calculation rule includes: agent_id+md5(version+pkg_name), or agent_id+md5(image_id+version+pkg_name);

[0026] When the asset is a dependency package, the asset association ID calculation rule includes: agent_id+md5(version+path), or agent_id+md5(image_id+version+pkg_name);

[0027] When the risk is a host vulnerability, the risk association ID calculation rules include: agent_id+md5(version+path), agent_id+md5(version+app_name), agent_id+md5(version+pkg_name);

[0028] When the risk is a container vulnerability, the risk association ID calculation rules include: agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+app_name), agent_id+md5(image_id+version+pkg_name).

[0029] Furthermore, the third-party data sources include: CMDB, scanners, logs, and intelligence.

[0030] Furthermore, the method also includes:

[0031] In the results of the association between assets and risks, supplement the corresponding asset data and risk data.

[0032] Secondly, embodiments of the present invention also provide a device for associating security asset risks, applied to an association engine, the device comprising:

[0033] The acquisition unit is used to acquire asset data and risk data, wherein the asset data and the risk data are acquired by the acquisition rule detection system, or the original asset data and original risk data from a third-party data source are cleaned and / or converted according to the configured access conversion rules;

[0034] The calculation unit is used to calculate the association ID of the asset data and the risk data using a preset association ID calculation rule to obtain the asset association ID and the risk association ID. The asset or the risk corresponds to at least two association ID calculation rules, each piece of asset data corresponds to at least two asset association IDs, and each piece of risk data corresponds to at least two risk association IDs.

[0035] The splitting unit is used to divide each piece of asset data into at least two first correspondences between asset association ID and asset ID according to the corresponding asset association ID, and to divide each piece of risk data into at least two second correspondences between risk association ID and risk ID according to the corresponding risk association ID;

[0036] The sharding unit is used to shard the first correspondence and the second correspondence based on the asset association ID and the risk association ID;

[0037] The columnar storage and association unit is used to store the first correspondence and the second correspondence of targets within the same segment in columnar storage on the same host, and to associate the first correspondence and the second correspondence of targets within the same segment according to the association ID;

[0038] The determining unit is configured to determine that if the target asset association ID in the first target correspondence matches the target risk association ID in the second target correspondence, then determine that the target asset ID in the first target correspondence matches the target risk association ID in the second target correspondence, thereby obtaining the association result between the asset and the risk.

[0039] Furthermore, the association ID calculation rule is a calculation rule for multiple calculation factors, including: host ID + software version + software path, host ID + image ID + software version + software path, host ID + software version + software type, host ID + image ID + software version + software type, host ID + dependency package version + dependency package name, and host ID + image ID + dependency package version + dependency package name.

[0040] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in any of the first aspects above.

[0041] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing machine-executable instructions, which, when invoked and executed by a processor, cause the processor to perform the method described in any of the first aspects above.

[0042] In this embodiment of the invention, a method for associating security asset risks is provided, applied to an association engine. The method includes: acquiring asset data and risk data, wherein the asset data and risk data are collected by a collection rule detection system, or obtained by cleaning and / or transforming raw asset data and raw risk data from a third-party data source according to configured access transformation rules; calculating association IDs for the asset data and risk data using preset association ID calculation rules to obtain asset association IDs and risk association IDs, wherein each asset or risk corresponds to at least two association ID calculation rules, each piece of asset data corresponds to at least two asset association IDs, and each piece of risk data corresponds to at least two risk association IDs; and dividing each piece of asset data into at least two asset association IDs according to the corresponding asset association ID. The system establishes a first correspondence between the associated ID and the asset ID, and divides each risk data into at least two second correspondences between the associated ID and the risk ID according to the corresponding risk association ID. It then segments the first and second correspondences based on the asset association ID and the risk association ID. The system stores the target first and second correspondences within the same segment on the same host and associates them according to the association ID. If the target asset association ID in the target first correspondence matches the target risk association ID in the target second correspondence, then the target asset ID in the target first correspondence is associated with the target risk ID in the target second correspondence, thus obtaining the association result between the asset and the risk. As described above, in the secure asset risk association method of the present invention, each asset data corresponds to at least two asset association IDs, and each risk data corresponds to at least two risk association IDs. When association is performed according to the association IDs, as long as any pair of asset association IDs and risk association IDs can match, the corresponding asset data and risk data can be associated. This achieves multi-angle association through multiple association IDs, with good association accuracy. In addition, it supports the access of third-party data sources and realizes the association of assets and risks, that is, it supports multi-source data. Furthermore, it will segment the first correspondence and the second correspondence according to the asset association ID and the risk association ID. When associating, only the target first correspondence and the target second correspondence within the same segment are associated according to the association ID. The correspondences within different segments are not associated, which greatly reduces the amount of data associated. Moreover, the associations within the same segment are all implemented on the same host, thereby greatly improving the association efficiency. It can meet the needs of near real-time association analysis and alleviate the technical problems of poor accuracy, lack of support for multi-source data, and low association efficiency of traditional asset and risk association. Attached Figure Description

[0043] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0044] Figure 1 A flowchart illustrating a method for associating security asset risks provided in an embodiment of the present invention;

[0045] Figure 2 A schematic diagram illustrating asset risk association provided for embodiments of the present invention;

[0046] Figure 3 A schematic diagram illustrating asset data splitting provided in an embodiment of the present invention;

[0047] Figure 4 This is a schematic diagram of risk data splitting provided in an embodiment of the present invention;

[0048] Figure 5 An optimized schematic diagram of asset risk association provided for an embodiment of the present invention;

[0049] Figure 6 An unoptimized schematic diagram of asset risk association provided in an embodiment of the present invention;

[0050] Figure 7 A schematic diagram of a security asset risk association device provided in an embodiment of the present invention;

[0051] Figure 8 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0052] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Traditional methods of linking assets and risks suffer from poor accuracy, lack support for multi-source data, and low efficiency.

[0054] Based on this, in the secure asset risk association method of the present invention, each asset data corresponds to at least two asset association IDs, and each risk data corresponds to at least two risk association IDs. When association is performed according to the association IDs, as long as any pair of asset association IDs and risk association IDs can match, the corresponding asset data and risk data can be associated. This achieves multi-angle association through multiple association IDs, with good association accuracy. In addition, it supports the access of third-party data sources and realizes the association of assets and risks, that is, it supports multi-source data. Furthermore, it will shard the first correspondence and the second correspondence according to the asset association ID and the risk association ID. When associating, only the target first correspondence and the target second correspondence within the same shard are associated according to the association ID. Correspondences within different shards are not associated, which greatly reduces the amount of data associated. Moreover, the associations within the same shard are all implemented on the same host, thereby greatly improving the association efficiency and meeting the needs of near real-time association analysis.

[0055] To facilitate understanding of this embodiment, a method for associating security asset risks disclosed in this embodiment of the invention will first be described in detail.

[0056] Example 1:

[0057] According to an embodiment of the present invention, an embodiment of a method for associating security asset risks is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0058] Figure 1 This is a flowchart of a method for associating security asset risks according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0059] Step S102: Obtain asset data and risk data, wherein the asset data and risk data are obtained by the collection rule detection system, or by cleaning and / or transforming the original asset data and original risk data from a third-party data source according to the configured access transformation rules;

[0060] In this embodiment of the invention, the above-described method for associating security asset risks can be applied to an association engine, such as... Figure 2As shown, after the asset and risk data collected by the collection rule detection system are reported to the association engine, the association engine stores the asset and risk data in the corresponding queues for processing. Then, it consumes the data (asset and risk data) in the queues. Specifically, it calculates the association IDs of the asset and risk data using preset association ID calculation rules to obtain asset association IDs and risk association IDs. Alternatively, raw asset and risk data from third-party data sources can be reported to the association engine. The association engine then cleans and / or transforms (i.e., standardizes) the raw asset and risk data according to the configured access conversion rules to obtain standard asset and risk data. This data is then stored in the corresponding queues for processing, and the association engine consumes the data (asset and risk data) in the queues. Specifically, it calculates the association IDs of the asset and risk data using preset association ID calculation rules to obtain asset association IDs and risk association IDs.

[0061] Specifically, security assets (i.e., asset data) are various valuable software resources discovered using the asset collection rules in the collection rule detection system, including databases, running applications, installation packages, development frameworks, etc.; security risks (i.e., risk data) refer to vulnerabilities in systems and applications discovered using the risk collection rules in the collection rule detection system, which may be exploited by attackers.

[0062] Step S104: Calculate the association IDs of asset data and risk data using preset association ID calculation rules to obtain asset association IDs and risk association IDs. Among them, an asset or a risk corresponds to at least two association ID calculation rules, each piece of asset data corresponds to at least two asset association IDs, and each piece of risk data corresponds to at least two risk association IDs.

[0063] Specifically, the core of generating association IDs (including asset association IDs and risk association IDs) is how to find the characteristic fields that identify a certain asset and a certain risk in asset data and risk data. Since there are differences between different categories and versions of data (referring to asset data or risk data), it is necessary to generate association IDs from different perspectives (i.e., different association ID calculation rules) to associate as much related data (asset data and risk data) as possible. Therefore, the association ID calculation algorithm can generate association IDs from multiple perspectives based on the actual data characteristics. The following text will introduce these multiple perspectives in detail, and will not be repeated here.

[0064] Step S106: Divide each piece of asset data into at least two first correspondences between asset association ID and asset ID according to the corresponding asset association ID, and divide each piece of risk data into at least two second correspondences between risk association ID and risk ID according to the corresponding risk association ID;

[0065] Specifically, such as Figure 3 As shown, for a piece of asset data about asset A, its asset ID is asset A, and the corresponding asset association IDs are A1, A2, and A3. Therefore, the asset data for asset A can be divided into three first-level correspondences according to the corresponding asset association IDs (A1, A2, and A3): A1-Asset A, A2-Asset A, and A3-Asset A. Similarly, each piece of risk data can be divided into at least two second-level correspondences of risk association ID and risk ID according to the corresponding risk association ID, such as... Figure 4 As shown (the details are omitted here; please refer to the process for obtaining the first correspondence). Simultaneously, an index is created for the asset-related IDs (A1, A2, and A3), resulting in asset-related ID indexes (A1, A2, A3). For example... Figure 4 An index is created using the risk association IDs (A1, A2, and A3) to obtain the risk association ID index (A1, A2, and A3). In subsequent association processes, the association IDs are used for single-column association to improve association efficiency.

[0066] Step S108: Segment the first and second correspondences based on the asset association ID and risk association ID;

[0067] Step S110: Store the first correspondence and the second correspondence of the target within the same segment in columnar storage on the same host, and associate the first correspondence and the second correspondence of the target within the same segment according to the association ID;

[0068] Step S112: If the target asset association ID in the first target correspondence matches the target risk association ID in the second target correspondence, then the target asset ID in the first target correspondence is determined to be associated with the target risk ID in the second target correspondence, thereby obtaining the association result between assets and risks.

[0069] Specifically, such as Figure 5As shown, for the target first correspondence relationships ID1-A1, ID2-A2 and the target second correspondence relationships ID1-V1, ID2-V2 within shard 1, they are associated according to the association ID. That is, the target first correspondence relationship ID1-A1 is associated with ID1-V1 and ID2-V2 respectively according to the association ID, and the target first correspondence relationship ID2-A2 is associated with ID1-V1 and ID2-V2 respectively according to the association ID. This results in a match between the association IDs (i.e., association ID1) of ID1-A1 and ID1-V1, thus determining that A1 is associated with V1. Similarly, A2 is associated with V2. Here, A1 and A2 represent asset IDs, and V1 and V2 represent risk IDs. Correspondence relationships within other shards are also associated according to the association ID, which will not be elaborated here; please refer to [reference needed]. Figure 5 The fragments 2 and 3 in the data.

[0070] As can be seen, in the method of the present invention, when associating, it is only necessary to associate the data within the same segment, output the association result of each segment, and finally summarize the association results of each segment to obtain the final association result.

[0071] Traditional association processes such as Figure 6 As shown, Figure 6 In the asset association data, association ID1, association ID2, association ID3, and association ID4 are asset association IDs, and A1, A2, A3, and A4 are asset IDs; in the risk association data, association ID1, association ID2, association ID3, and association ID4 are risk association IDs, and V1, V2, V3, and V4 are risk IDs. During association, each first correspondence relationship and each second correspondence relationship will be matched once according to the association ID to finally obtain the association result.

[0072] pass Figure 5 and Figure 6 The comparison shows that, under the condition of uniform data distribution, if there are m asset data, n risk data, and k shards, the computational cost of the traditional solution can be represented by m*n, while the computational cost of the present invention can be represented by (m*n) / k. Obviously, this will greatly reduce the computational cost of the association. At the same time, the association algorithm of the present invention can ensure that the shard association is performed on the local machine (because the data in the same shard is stored in columnar storage on the same host), which can avoid the performance problems caused by cross-machine association (in the traditional association algorithm, the asset association data and the risk association data may be on different hosts, so cross-machine association will occur during association).

[0073] In this embodiment of the invention, a method for associating security asset risks is provided, applied to an association engine. The method includes: acquiring asset data and risk data, wherein the asset data and risk data are collected by a collection rule detection system, or obtained by cleaning and / or transforming raw asset data and raw risk data from a third-party data source according to configured access transformation rules; calculating association IDs for the asset data and risk data using preset association ID calculation rules to obtain asset association IDs and risk association IDs, wherein each asset or risk corresponds to at least two association ID calculation rules, each piece of asset data corresponds to at least two asset association IDs, and each piece of risk data corresponds to at least two risk association IDs; and dividing each piece of asset data into at least two asset association IDs according to the corresponding asset association ID. The system establishes a first correspondence between the associated ID and the asset ID, and divides each risk data into at least two second correspondences between the associated ID and the risk ID according to the corresponding risk association ID. It then segments the first and second correspondences based on the asset association ID and the risk association ID. The system stores the target first and second correspondences within the same segment on the same host and associates them according to the association ID. If the target asset association ID in the target first correspondence matches the target risk association ID in the target second correspondence, then the target asset ID in the target first correspondence is associated with the target risk ID in the target second correspondence, thus obtaining the association result between the asset and the risk. As described above, in the secure asset risk association method of the present invention, each asset data corresponds to at least two asset association IDs, and each risk data corresponds to at least two risk association IDs. When association is performed according to the association IDs, as long as any pair of asset association IDs and risk association IDs can match, the corresponding asset data and risk data can be associated. This achieves multi-angle association through multiple association IDs, with good association accuracy. In addition, it supports the access of third-party data sources and realizes the association of assets and risks, that is, it supports multi-source data. Furthermore, it will segment the first correspondence and the second correspondence according to the asset association ID and the risk association ID. When associating, only the target first correspondence and the target second correspondence within the same segment are associated according to the association ID. The correspondences within different segments are not associated, which greatly reduces the amount of data associated. Moreover, the associations within the same segment are all implemented on the same host, thereby greatly improving the association efficiency. It can meet the needs of near real-time association analysis and alleviate the technical problems of poor accuracy, lack of support for multi-source data, and low association efficiency of traditional asset and risk association.

[0074] The above provides a brief overview of the method for associating security asset risks according to the present invention. The specific details involved are described in detail below.

[0075] In an optional embodiment of the present invention, the association ID calculation rule is a calculation rule of multiple calculation factors, wherein the multiple calculation factors include: host ID + software version + software path, host ID + image ID + software version + software path, host ID + software version + software type, host ID + image ID + software version + software type, host ID + dependency package version + dependency package name, and host ID + image ID + dependency package version + dependency package name.

[0076] Specifically, the specific angles from which the associated ID is generated in the above text are as follows:

[0077]

[0078] In an optional embodiment of the present invention, the first correspondence and the second correspondence are fragmented according to the asset association ID and the risk association ID, specifically including the following steps:

[0079] (1) Calculate the hash values ​​of the asset-related ID and the risk-related ID, and take the modulo of the hash values ​​of the asset-related ID and the risk-related ID to obtain the hash modulo value of the asset-related ID and the hash modulo value of the risk-related ID;

[0080] (2) The first and second correspondences of the same asset association ID hash modulus and risk association ID hash modulus are treated as the same fragment.

[0081] Specifically, the above-mentioned target first correspondence and target second correspondence corresponding to the same asset association ID hash modulus and risk association ID hash modulus are treated as the same shard. This can ensure that asset data and risk data with the same association ID (i.e. the same asset association ID and risk association ID) are in the same shard. When associating, only the data within the same shard needs to be associated, which greatly reduces the amount of data to be associated.

[0082] In an optional embodiment of the present invention, the association ID calculation rule includes: asset association ID calculation rule and risk association ID calculation rule;

[0083] When the asset is a running application, the asset association ID calculation rules include: agent_id+md5(version+path), agent_id+md5(version+app_name), or agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+app_name);

[0084] When the asset is a database, the asset association ID calculation rules include: agent_id+md5(version+path), agent_id+md5(version+db_type), or agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+db_type);

[0085] When the asset is a web service, the asset association ID calculation rules include: agent_id+md5(version+server_type), agent_id+md5(version+install_path), or agent_id+md5(image_id+version+server_type), agent_id+md5(image_id+version+install_path);

[0086] When the asset is a Java framework, the asset association ID calculation rules include: agent_id+md5(version+jar_path), or agent_id+md5(image_id+version+jar_path);

[0087] When the asset is an installation package, the asset association ID calculation rules include: agent_id+md5(version+pkg_name), or agent_id+md5(image_id+version+pkg_name);

[0088] When the asset is a dependency package, the asset association ID calculation rules include: agent_id+md5(version+path), or agent_id+md5(image_id+version+pkg_name);

[0089] When the risk is a host vulnerability, the risk association ID calculation rules include: agent_id+md5(version+path), agent_id+md5(version+app_name), agent_id+md5(version+pkg_name);

[0090] When the risk is a container vulnerability, the risk association ID calculation rules include: agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+app_name), and agent_id+md5(image_id+version+pkg_name).

[0091] Specifically, the rules for calculating asset association IDs are shown in the table below (multiple asset association IDs can be generated for each asset data item):

[0092]

[0093] The rules for calculating risk association IDs are shown in the table below (multiple risk association IDs can be generated for each piece of risk data):

[0094]

[0095] In an optional embodiment of the present invention, the third-party data source includes: CMDB, scanner, logs, and intelligence.

[0096] In an optional embodiment of the present invention, the method further includes the following steps:

[0097] In the results of the correlation between assets and risks, supplement the corresponding asset data and risk data.

[0098] The method of the present invention solves the following technical problems:

[0099] Unified association of multi-source security asset risks: There are certain differences in the asset data and risk data fields provided by various vendors. How to integrate heterogeneous data into a standard association process and quickly respond to changes in multi-source data structures requires that asset risks from various vendors be identified and associated using a unified association ID.

[0100] Efficient and accurate association of security asset risks: Scanning and reporting assets and risks are two independent processes, and the two types of data have no direct correlation. Furthermore, the data from different vendors vary. Therefore, each asset / risk needs to have multiple association IDs calculated according to different characteristics (i.e., association ID calculation rules). Flexible and accurate association is achieved through the flexible calculation of association IDs. In real-world scenarios, the amount of asset risk data for customers may be very large. The computational workload for calculating and associating multiple asset association IDs and multiple risk association IDs is very large and needs to be completed in near real-time.

[0101] To address the above problems or difficulties, the method of this invention proposes the following targeted solutions:

[0102] Based on the characteristics of business scenarios and reported data, when accessing data (including asset data and risk data), multiple sets of association ID calculation rules are used to generate multiple association IDs (i.e., asset association IDs and risk association IDs). Each association ID can define the uniqueness of assets / risks to a certain extent. As long as any pair of association IDs generated from asset data and any pair of association IDs generated from risk data can be matched, they can be associated. In this way, association can be flexible and accurate.

[0103] During the access process, external source data (i.e., third-party data sources) will first be cleaned according to the access transformation rules, then standardized according to the fields defined by the platform, and finally the standardized data (i.e., asset data and risk data) will be used to generate associated IDs using a unified calculation method. Data that cannot meet the conditions for generating associated IDs will not generate associated IDs. In subsequent business use, the differences in external source data can be ignored, and external source data can be integrated into the system.

[0104] The volume of asset risk data can be substantial, requiring many-to-many comparisons for correlation analysis, which is inefficient and cannot meet near real-time correlation analysis needs. Based on business characteristics, the following methods can be used to optimize correlation:

[0105] The associated ID row is converted to column, and the asset / risk data is split into multiple data (i.e., the first correspondence and the second correspondence) according to the associated ID and stored. The column storage method is adopted, and the column storage prefix index is used for fast matching.

[0106] Both the first and second correspondences use associated ID sharding to ensure that the number of shards is consistent. In a distributed scenario, this ensures that data in the same shard resides on the same host. When associating, only data in the same local shard needs to be associated, which greatly reduces the amount of data associated, avoids performance loss caused by network transmission, and meets the requirements of near real-time association analysis.

[0107] The present invention has the following advantages:

[0108] Accuracy: By combining business characteristics, generate multi-related IDs and associate them from multiple perspectives;

[0109] Scalability: Integration of multiple sources, including third-party data sources;

[0110] High performance: Near real-time computation matching.

[0111] Example 2:

[0112] This invention also provides a device for security asset risk association, which is mainly used to execute the security asset risk association method provided in Embodiment 1 of this invention. The following is a detailed description of the security asset risk association device provided in this invention.

[0113] Figure 7 This is a schematic diagram of a security asset risk association device according to an embodiment of the present invention, as shown below. Figure 7 As shown, the device mainly includes: an acquisition unit 10, a calculation unit 20, a splitting unit 30, a sharding unit 40, a columnar storage and association unit 50, and a determination unit 60, wherein:

[0114] The acquisition unit is used to acquire asset data and risk data, wherein the asset data and risk data are acquired by the acquisition rule detection system, or the original asset data and original risk data from a third-party data source are cleaned and / or transformed according to the configured access transformation rules;

[0115] The calculation unit is used to calculate the association ID of asset data and risk data using a preset association ID calculation rule to obtain asset association ID and risk association ID. Among them, an asset or a risk corresponds to at least two association ID calculation rules, each piece of asset data corresponds to at least two asset association IDs, and each piece of risk data corresponds to at least two risk association IDs.

[0116] The splitting unit is used to divide each piece of asset data into at least two first correspondences between asset association ID and asset ID according to the corresponding asset association ID, and to divide each piece of risk data into at least two second correspondences between risk association ID and risk ID according to the corresponding risk association ID;

[0117] The sharding unit is used to shard the first correspondence and the second correspondence based on the asset association ID and the risk association ID;

[0118] The columnar storage and association unit is used to store the first correspondence and the second correspondence of targets within the same segment in columnar storage on the same host, and to associate the first correspondence and the second correspondence of targets within the same segment according to the association ID;

[0119] The determining unit is used to determine the association between the target asset ID in the first correspondence and the target risk ID in the second correspondence if the target asset association ID in the first correspondence matches the target risk association ID in the second correspondence, thereby obtaining the association result between the asset and the risk.

[0120] In this embodiment of the invention, a device for associating security asset risks is provided, applied to an association engine. The device includes: acquiring asset data and risk data, wherein the asset data and risk data are collected by a collection rule detection system, or obtained by cleaning and / or transforming raw asset data and raw risk data from a third-party data source according to configured access transformation rules; calculating association IDs for the asset data and risk data using preset association ID calculation rules to obtain asset association IDs and risk association IDs, wherein one asset or one risk corresponds to at least two association ID calculation rules, each piece of asset data corresponds to at least two asset association IDs, and each piece of risk data corresponds to at least two risk association IDs; and dividing each piece of asset data into at least two asset association IDs according to the corresponding asset association ID. The system establishes a first correspondence between the associated ID and the asset ID, and divides each risk data into at least two second correspondences between the associated ID and the risk ID according to the corresponding risk association ID. It then segments the first and second correspondences based on the asset association ID and the risk association ID. The system stores the target first and second correspondences within the same segment on the same host and associates them according to the association ID. If the target asset association ID in the target first correspondence matches the target risk association ID in the target second correspondence, then the target asset ID in the target first correspondence is associated with the target risk ID in the target second correspondence, thus obtaining the association result between the asset and the risk. As described above, in the security asset risk association device of the present invention, each asset data corresponds to at least two asset association IDs, and each risk data corresponds to at least two risk association IDs. When association is performed according to the association IDs, as long as any pair of asset association IDs and risk association IDs can match, the corresponding asset data and risk data can be associated, realizing multi-angle association through multiple association IDs. The association accuracy is good. In addition, it supports the access of third-party data sources and realizes the association of assets and risks, that is, it supports multi-source data. Furthermore, it will segment the first correspondence and the second correspondence according to the asset association ID and the risk association ID. When associating, only the target first correspondence and the target second correspondence within the same segment are associated according to the association ID. The correspondence within different segments is not associated, which greatly reduces the amount of data associated. Moreover, the association within the same segment is implemented on the same host, thereby greatly improving the association efficiency. It can meet the needs of near real-time association analysis and alleviate the technical problems of poor accuracy, lack of support for multi-source data, and low association efficiency of traditional asset and risk association.

[0121] Optionally, the association ID calculation rule is a calculation rule with multiple calculation factors, including: host ID + software version + software path, host ID + image ID + software version + software path, host ID + software version + software type, host ID + image ID + software version + software type, host ID + dependency package version + dependency package name, and host ID + image ID + dependency package version + dependency package name.

[0122] Optionally, the sharding unit is also used to: calculate the hash values ​​of the asset-related ID and the risk-related ID, and take the modulo of the hash values ​​of the asset-related ID and the risk-related ID to obtain the hash modulo value of the asset-related ID and the hash modulo value of the risk-related ID; and take the target first correspondence and target second correspondence corresponding to the same asset-related ID hash modulo value and risk-related ID hash modulo value as the same shard.

[0123] Optionally, the association ID calculation rules include: asset association ID calculation rules and risk association ID calculation rules; when the asset is a running application, the asset association ID calculation rules include: agent_id+md5(version+path), agent_id+md5(version+app_name), or agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+app_name); when the asset is a database, the asset association ID calculation rules include: agent_id+md5(version+path), agent_id+md5(version+db_type), or agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+db_type); when the asset is a web service, the asset association ID calculation rules include: agent_id+md5(version+server_type), agent_id+md5(version+install_path), or agent_id+md5(image_id+version+db_type). The asset association ID calculation rules are as follows: `agent_id + version + server_type` and `agent_id + md5(image_id + version + install_path)`. When the asset is a Java framework, the asset association ID calculation rules include: `agent_id + md5(version + jar_path)` or `agent_id + md5(image_id + version + jar_path)`. When the asset is an installation package, the asset association ID calculation rules include: `agent_id + md5(version + pkg_name)` or `agent_id + md5(image_id + version + install_path)`. d5(image_id+version+pkg_name); When the asset is a dependency package, the asset association ID calculation rules include: agent_id+md5(version+path), or agent_id+md5(image_id+version+pkg_name); When the risk is a host vulnerability, the risk association ID calculation rules include: agent_id+md5(version+path), agent_id+md5(version+app_name), agent_id+md5(version+pkg_name);When the risk is a container vulnerability, the risk-associated ID calculation rules include: agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+app_name), and agent_id+md5(image_id+version+pkg_name).

[0124] Optionally, third-party data sources include: CMDB, scanners, logs, and intelligence.

[0125] Optionally, the method further includes supplementing the asset and risk data in the correlation results between assets and risks.

[0126] The device provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned method embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned method embodiment.

[0127] like Figure 8 As shown in the embodiment of this application, an electronic device 600 includes a processor 601, a memory 602, and a bus. The memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 via the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the security asset risk association method described above.

[0128] Specifically, the memory 602 and processor 601 mentioned above can be general-purpose memory and processor, without any specific limitations. When the processor 601 runs the computer program stored in the memory 602, it can execute the above-mentioned method for associating security asset risks.

[0129] The processor 601 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 601 or by instructions in software form. The processor 601 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 602, and processor 601 reads the information from memory 602 and, in conjunction with its hardware, completes the steps of the above method.

[0130] Corresponding to the above-described method for associating security asset risks, this application also provides a computer-readable storage medium storing machine-executable instructions. When these machine-executable instructions are invoked and executed by a processor, they cause the processor to perform the steps of the above-described method for associating security asset risks.

[0131] The security asset risk association device provided in this application embodiment can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in this application embodiment are the same as those in the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0132] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0133] For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0134] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0135] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0136] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the security asset risk association method described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0137] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0138] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for associating security asset risks, characterized in that, The method is applied to an association engine and comprises the following steps: obtaining asset data and risk data, wherein the asset data and the risk data are obtained by a collection rule detection system, or the original asset data and the original risk data of a third-party data source are cleaned and / or converted according to configured access conversion rules; calculating association IDs of the asset data and the risk data by using preset association ID calculation rules, to obtain asset association IDs and risk association IDs, wherein one asset or one risk corresponds to at least two association ID calculation rules, each piece of asset data corresponds to at least two asset association IDs, and each piece of risk data corresponds to at least two risk association IDs; dividing each piece of asset data into at least two first corresponding relationships between asset association IDs and asset IDs according to the corresponding asset association IDs, and dividing each piece of risk data into at least two second corresponding relationships between risk association IDs and risk IDs according to the corresponding risk association IDs; sharding the first corresponding relationships and the second corresponding relationships according to the asset association IDs and the risk association IDs; column-storing target first corresponding relationships and target second corresponding relationships in the same shard on the same host, and associating the target first corresponding relationships and the target second corresponding relationships in the same shard according to the association IDs; if a target asset association ID in the target first corresponding relationship matches a target risk association ID in the target second corresponding relationship, determining that a target asset ID in the target first corresponding relationship is associated with a target risk ID in the target second corresponding relationship, and further obtaining an association result of assets and risks; wherein sharding the first corresponding relationships and the second corresponding relationships according to the asset association IDs and the risk association IDs comprises: calculating hash values of the asset association IDs and the risk association IDs, and taking modulo of the asset association ID hash values and the risk association ID hash values to obtain asset association ID hash modulus values and risk association ID hash modulus values; taking target first corresponding relationships and target second corresponding relationships corresponding to the same asset association ID hash modulus value and risk association ID hash modulus value as the same shard.

2. The method of claim 1, wherein, The association ID calculation rules are calculation rules of multiple calculation factors, wherein the multiple calculation factors include: host ID + software version + software path, host ID + image ID + software version + software path, host ID + software version + software type, host ID + image ID + software version + software type, host ID + dependent package version + dependent package name, and host ID + image ID + dependent package version + dependent package name.

3. The method of claim 1, wherein, The association ID calculation rules include asset association ID calculation rules and risk association ID calculation rules. When the asset is a running application, the asset-associated ID calculation rule comprises: agent_id+md5(version+path), agent_id+md5(version+app_name), or agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+app_name); When the asset is a database, the asset-associated ID calculation rule comprises: agent_id+md5(version+path), agent_id+md5(version+db_type), or agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+db_type); When the asset is a Web service, the asset-associated ID calculation rule comprises: agent_id+md5(version+server_type), agent_id+md5(version+install_path), or agent_id+md5(image_id+version+server_type), agent_id+md5(image_id+version+install_path); When the asset is a Java framework, the asset-associated ID calculation rule comprises: agent_id+md5(version+jar_path), or agent_id+md5(image_id+version+jar_path); When the asset is an installation package, the asset-associated ID calculation rule comprises: agent_id+md5(version+pkg_name), or agent_id+md5(image_id+version+pkg_name); When the asset is a dependent package, the asset-associated ID calculation rule comprises: agent_id+md5(version+path), or agent_id+md5(image_id+version+pkg_name); When the risk is a host vulnerability, the risk-associated ID calculation rule comprises: agent_id+md5(version+path), agent_id+md5(version+app_name), agent_id+md5(version+pkg_name). When the risk is a container vulnerability, the risk association ID calculation rule comprises: agent_id+md5(image_id+version+path), agent_id+md5(image_id+version+app_name), agent_id+md5(image_id+version+pkg_name).

4. The method of claim 1, wherein, The third-party data source comprises: a CMDB, a scanner, logs and intelligence.

5. The method of claim 1, wherein, The method further comprises: In the association result of the asset and the risk, the corresponding asset data and risk data are supplemented.

6. An apparatus for security asset risk correlation, the apparatus comprising: The device is applied to an association engine and comprises: An acquisition unit is configured to acquire asset data and risk data, wherein the asset data and the risk data are obtained by a collection rule detection system, or the original asset data and the original risk data of a third-party data source are cleaned and / or converted according to configured access conversion rules; A calculation unit is configured to calculate the association ID of the asset data and the risk data by using a preset association ID calculation rule, to obtain asset association ID and risk association ID, wherein one asset or one risk corresponds to at least two association ID calculation rules, each piece of asset data corresponds to at least two asset association IDs, and each piece of risk data corresponds to at least two risk association IDs; A splitting unit is configured to split each piece of asset data into at least two first corresponding relationships of asset association ID and asset ID according to the corresponding asset association ID, and split each piece of risk data into at least two second corresponding relationships of risk association ID and risk ID according to the corresponding risk association ID; A sharding unit is configured to shard the first corresponding relationship and the second corresponding relationship according to the asset association ID and the risk association ID; A column storage and association unit is configured to perform column storage of target first corresponding relationships and target second corresponding relationships in the same shard on the same host, and associate the target first corresponding relationships and the target second corresponding relationships in the same shard according to the association ID; A determination unit is configured to determine that a target asset ID in the target first corresponding relationship is associated with a target risk ID in the target second corresponding relationship if a target asset association ID in the target first corresponding relationship matches a target risk association ID in the target second corresponding relationship, to obtain an association result of an asset and a risk. The sharding unit is further configured to: calculate the hash value of the asset association ID and the risk association ID, and take the asset association ID hash value and the risk association ID hash value modulo to obtain an asset association ID hash modulo value and a risk association ID hash modulo value; and take the target first corresponding relationship and the target second corresponding relationship corresponding to the same asset association ID hash modulo value and risk association ID hash modulo value as the same shard.

7. The apparatus of claim 6, wherein, The correlation ID calculation rule is a calculation rule of multiple calculation factors, wherein the multiple calculation factors include: host ID+software version+software path, host ID+image ID+software version+software path, host ID+software version+software type, host ID+image ID+software version+software type, host ID+dependent package version+dependent package name, host ID+image ID+dependent package version+dependent package name.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the steps of the method of any one of claims 1-5 when executing the computer program.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores machine executable instructions, and when the machine executable instructions are called and executed by the processor, the machine executable instructions cause the processor to execute the method of any one of claims 1-5.

Images