Unauthorized business asset discovery method and system based on multi-source log

Abstract

The invention discloses an unauthorized business asset discovery method and system based on a multi-source log. The method comprises the following steps: determining a first network entity based on heterogeneous security logs of different data sources; when it is determined that the first network entity does not exist in the configuration management database CMDB, determining that the first network entity is a suspicious network entity; and when it is determined that the suspicious network entity appears in at least two independent data sources, the activity in a preset time window meets a preset persistence condition, and a service port exists, determining that the suspicious network entity is a persistent unauthorized service asset. Therefore, through multiple independent data source conditions, activity persistence conditions and service port conditions, suspicious target entities related to transient temporary connection are excluded, and persistent unauthorized business assets are accurately identified.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a method and system for discovering unauthorized business assets based on multi-source logs. BACKGROUND

[0002] With the continuous expansion of enterprise network scale and the dynamic changes of cloud environment, the number and types of network assets are growing explosively. The traditional asset management system, such as a configuration management database (CMDB), is difficult to reflect the real state of network assets due to the delay in updating and the dependence on manual input, resulting in a large number of unknown assets existing in the network, which constitutes a serious security threat.

[0003] The existing asset discovery technology can infer the existence of unknown assets by a passive flow analysis method based on mirroring, copying or collecting data packets flowing in the network. However, this method is difficult to effectively distinguish between temporary connections and substantive assets that need to be managed persistently. This leads to a large amount of noise in the existing asset discovery results, which misjudges temporary and insignificant network endpoints as assets that need to be managed, while the real persistent shadow assets that pose a threat may be ignored due to their hidden behavior.

[0004] Therefore, how to provide a technical solution capable of improving the identification accuracy of persistent unauthorized business assets is a subject of focus for those skilled in the art. SUMMARY

[0005] In a first aspect, the present application provides a method for discovering unauthorized business assets based on multi-source logs, which comprises: determining a first network entity based on heterogeneous security logs of different data sources, the first network entity being a logical subject commonly pointed to by one or more network identifiers; determining the first network entity as a suspicious network entity in a case where it is determined that the first network entity does not exist in a configuration management database (CMDB), the CMDB being used to record known network entity assets that have been confirmed and governed by business; and determining the suspicious network entity as a persistent unauthorized business asset in a case where it is determined that the activities of the suspicious network entity in at least N independent data sources within a preset time window satisfy a preset persistence condition, and there is a service port, the N being greater than or equal to 2.

[0006] The method for discovering unauthorized business assets based on multi-source logs provided in the application can accurately identify persistent unauthorized business assets by comparing the asset behavior knowledge graph with the CMDB to find suspicious targets, and then by using the conditions of multiple independent data sources (to ensure that the suspicious network entity exists in multiple independent data sources), activity persistence (to ensure that the asset is persistent and is excluded), and service port (to exclude clients such as employee personal mobile phones connected to company wifi), to exclude suspicious target entities related to temporary connections (such as temporary IP), reduce the false positive rate of the result of unauthorized business asset discovery, and improve the identification accuracy.

[0007] In some possible implementation manners, after determining that the first network entity is a suspicious network entity, the method further includes: determining a comprehensive risk value of the suspicious network entity based on a connection closeness of the suspicious network entity to a preset core asset, an abnormality degree of an authentication behavior of the suspicious network entity, an exposure risk of a service related to the suspicious network entity, and whether the suspicious network entity belongs to a malicious network entity indicated in a threat intelligence source; and determining whether the suspicious network entity belongs to a malicious asset based on the comprehensive risk value of the suspicious network entity and a preset risk threshold, wherein the malicious asset and the unauthorized business asset are the same or different suspicious network entities.

[0008] In this way, the business attribute and the security attribute of the same suspicious network entity can be determined in parallel. On one hand, the discovered unauthorized business asset can be evaluated for potential threats in a timely manner.

[0009] On the other hand, the method can not only discover unauthorized business assets from suspicious network entities, but also identify malicious entities that do not meet the activity persistence condition and are not part of the business assets, that is, pure malicious attack nodes, from the suspicious network entities. Therefore, the threat detection range of the system is greatly expanded, and the system is no longer limited to discovering business assets in the management blind area, but can discover pure malicious software, and realizes the fusion of unknown asset management discovery and attack detection.

[0010] On the other hand, a comprehensive threat evaluation framework is formed from four core evaluation dimensions of core asset connection closeness, authentication behavior abnormality, service exposure risk, and threat intelligence source matching, which avoids one-sidedness of single-dimension judgment, and makes the risk evaluation result more objective, accurate, and persuasive.

[0011] In some possible implementation manners, after the determining whether the suspicious network entity belongs to a malicious asset based on the comprehensive risk value of the suspicious network entity, the method further includes: in a case where it is determined that the suspicious network entity belongs to an unauthorized business asset and does not belong to a malicious asset, determining that the suspicious network entity belongs to a non-malicious shadow asset; in a case where it is determined that the suspicious network entity belongs to an unauthorized business asset and belongs to a malicious asset, determining that the suspicious network entity belongs to a hacked malicious shadow asset; in a case where it is determined that the suspicious network entity does not belong to an unauthorized business asset and belongs to a malicious asset, determining that the suspicious network entity belongs to a malicious attack node irrelevant to business; and in a case where it is determined that the suspicious network entity does not belong to an unauthorized business asset and does not belong to a malicious asset, determining that the suspicious network entity belongs to a non-malicious temporary node.

[0012] In this way, on the one hand, by using the two judgments of "whether to belong to an unauthorized business asset" and "whether to belong to a malicious asset", a 2x2 matrix is constructed, all possible classification results are covered, the ambiguous zone in judgment is completely eliminated, and each discovered suspicious network entity can be clearly classified into one of the four categories, thereby providing a unique and clear input for subsequent differentiated response.

[0013] On the other hand, the "hacked malicious shadow asset" is accurately defined, the traditional scheme regards it as an ordinary shadow IT (underestimates its risk) or can only regard it as a malicious node (but does not know its source). The present scheme clearly distinguishes the asset inside the source but non-malicious (non-malicious shadow asset) and the asset inside the source but intended to be malicious (hacked malicious shadow asset), so that the security team can know the dual risk nature of the hacked malicious shadow asset and take the most urgent disposal measures.

[0014] In some possible implementations, determining the comprehensive risk value of a suspicious network entity based on the degree of connection between the suspicious network entity and preset core assets, the degree of abnormality of the authentication behavior of the suspicious network entity, the exposure risk of services related to the suspicious network entity, and whether the suspicious network entity belongs to a malicious network entity indicated in the threat intelligence source, includes: calculating the degree of connection between the suspicious network entity and known core assets based on graph algorithms, and determining a first risk value based on the degree of connection; assessing the deviation of the login behavior of the suspicious network entity in terms of time, location, and frequency based on historical login behavior baselines or group login behavior baselines, and determining a second risk value based on the deviation; determining a third risk value based on whether there is known vulnerability information on the service ports opened by the suspicious network entity; determining a fourth risk value based on whether the suspicious network entity exists in internal or external threat intelligence sources; and determining the comprehensive risk value of the suspicious network entity based on the first, second, third, and fourth risk values.

[0015] This approach, by introducing specific risk values ​​from four dimensions (connectivity criticality, authentication anomalies, service exposure, and threat intelligence) and integrating them, makes the risk assessment results more objective, comprehensive, and persuasive.

[0016] In some possible implementations, the method further includes: determining a first confidence score based on the number of pieces of evidence corresponding to the suspicious network entity, wherein the number of pieces of evidence is the number of categories of independent data sources in which the unauthorized business asset appears in the heterogeneous security log; determining a second confidence score based on the frequency and regularity of the suspicious network entity's activities within a preset time window; determining a third confidence score based on the persistence of the service ports opened by the suspicious network entity; and determining a comprehensive confidence score that the suspicious network entity belongs to an unauthorized business asset based on the first confidence score, the second confidence score, and the third confidence score.

[0017] This approach transforms the system's output from a simple yes or no to a judgment with a confidence level. This significantly enhances the practicality and operability of the system's output, allowing security personnel to prioritize high-confidence alarms and optimize resource allocation.

[0018] In some possible implementations, determining the first network entity based on heterogeneous security logs from different data sources includes: collecting various heterogeneous security logs from a Security Information and Event Management (SIEM) platform, including authentication logs, host connectivity logs, network session logs, and application service logs, wherein security logs of the same category originate from one or more independent data sources; identifying heterogeneous identifiers from different data sources belonging to the same reference network entity in the various heterogeneous security logs, and associating different heterogeneous identifiers of the reference network entity; assigning a unique identifier to the reference network entity, wherein the reference network entity is any one of the network entities in the various heterogeneous security logs; constructing an asset behavior knowledge graph with network entities as nodes and communication relationships, authentication relationships, or access relationships between network entities as edges, wherein nodes in the asset behavior knowledge graph represent network entities and edges represent interaction relationships between network entities, and the first network entity is any one of the nodes in the asset behavior knowledge graph.

[0019] This approach, which uses data sources covering multiple key logs from different data domains and heterogeneous identifiers associated with the same entity, ensures the breadth of the reasoning basis and the rigor of the logic.

[0020] In some possible implementations, identifying heterogeneous identifiers from different data sources belonging to the same reference network entity in the various heterogeneous security logs, associating different heterogeneous identifiers of the reference network entity, and assigning a unique identifier to the reference network entity includes: when it is determined that the reference IP address in the security log belongs to an IP address in the company's NAT address pool, resolving the internal real IP corresponding to the reference IP address to determine the set of IP address aliases for the same network entity, wherein the reference IP address is any IP address in any security log that has not been included in the standardized processing; converting all hostnames in the security log to a uniform uppercase and lowercase letter format, removing suffixes, and then comparing them to identify the hostnames of the same network entity. The system includes a set of aliases, where the unified letter case format is either lowercase or uppercase English. All MAC addresses in the security log are converted to a unified letter case format, delimiters are removed, and then compared to identify the MAC address aliases of the same network entity. Based on the stable mapping relationship in the security log and asset management system, the system obtains the pairwise associations between IP addresses, hostnames, and MAC addresses. Identifiers with associations are merged into the identification information of the same reference network entity, and a unique identifier is created for the reference network entity. The system also determines the heterogeneous identifier set of the reference network entity, which includes the IP address alias set, hostname alias set, and MAC address alias set of the reference network entity.

[0021] This approach significantly improves the accuracy of data fusion for the same network entity by addressing real-world scenarios such as NAT, hostname, and MAC address format standardization. It avoids the erroneous splitting of the same asset into multiple entities or the erroneous merging of multiple assets, fundamentally enhancing the accuracy of all subsequent steps.

[0022] In some possible implementations, the method further includes: for the malicious shadow assets and the malicious attack nodes, triggering immediate blocking and isolation operations through the Security Orchestration Automation and Response (SOAR) platform; for the non-malicious shadow assets, notifying the asset manager through a work order system for standardized processing.

[0023] Secondly, this application also provides an unauthorized business asset discovery system based on multi-source logs. The system includes: an entity determination module, used to determine a first network entity based on heterogeneous security logs from different data sources, wherein the first network entity is a logical entity commonly pointed to by one or more network identifiers; a suspicious asset determination module, used to determine the first network entity as a suspicious network entity when it is determined that the first network entity does not exist in the configuration management database (CMDB), wherein the CMDB is used to record known network entity assets that have undergone business confirmation and governance; and an unauthorized business asset determination module, used to determine the suspicious network entity as an unauthorized business asset not included in management when it is determined that the suspicious network entity appears in at least N independent data sources, its activity within a preset time window meets preset persistence conditions, and a service port exists, wherein N is greater than or equal to 2.

[0024] Thirdly, this application also provides an apparatus for discovering unauthorized business assets based on multi-source logs, including a unit for performing any of the unauthorized business asset discovery methods based on multi-source logs in the first aspect.

[0025] Fourthly, this application also provides a computer storage medium that can store multiple instructions, which are adapted to be loaded and executed by a processor using any of the unauthorized business asset discovery methods based on multi-source logs in the first aspect.

[0026] Fifthly, embodiments of this application also provide a computer program product containing instructions that, when the computer program product is run on an electronic device, cause the electronic device to execute any one of the unauthorized business asset discovery methods based on multi-source logs in the first aspect.

[0027] In a sixth aspect, embodiments of this application also provide a chip module, including a transceiver component and a chip, wherein the chip is used to execute any of the unauthorized business asset discovery methods based on multi-source logs in the first aspect.

[0028] It is understood that the aforementioned unauthorized business asset discovery system, apparatus, computer storage medium, computer program, computer program product, and chip system based on multi-source logs are all used to execute the method shown in any implementation of the first aspect of the embodiments of this application. Therefore, the beneficial effects that can be achieved can be referred to the beneficial effects in the corresponding methods, and will not be repeated here. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating a method for discovering unauthorized business assets based on multi-source logs, as provided in an embodiment of this application. Figure 2 This is a flowchart illustrating a method for determining a first network entity based on heterogeneous security logs from different data sources, as provided in an embodiment of this application. Figure 3 This is a flowchart illustrating another method for discovering unauthorized business assets based on multi-source logs provided in this application embodiment; Figure 4 This is a flowchart illustrating a method for classifying suspicious network entities provided in an embodiment of this application. Figure 5 This is a schematic diagram of an unauthorized business asset discovery system based on multi-source logs provided in an embodiment of this application; Figure 6 This is a schematic diagram of another unauthorized business asset discovery system based on multi-source logs provided in the embodiments of this application; Figure 7 This is a schematic diagram of an unauthorized business asset discovery device based on multi-source logs provided in an embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described below in conjunction with the accompanying drawings.

[0031] It is understood that the embodiments of this application use an electronic device as an example to illustrate the execution subject of the method for discovering unauthorized business assets based on multi-source logs provided in this application. This electronic device can also be understood as the device for discovering unauthorized business assets based on multi-source logs shown in the embodiments of this application. In the embodiments of this application, the electronic device can be a microprocessor or computer for executing program code, etc. Any electronic device that can be used to execute the method provided in the embodiments of this application falls within the protection scope of the embodiments of this application, and this application does not impose any limitations. For example, the electronic device can be a desktop computer, a laptop, a mobile terminal, a 32-bit microprocessor, or a 64-bit microprocessor, etc., and the embodiments of this application do not limit this.

[0032] Please see Figure 1, Figure 1 This document provides a flowchart of a method for discovering unauthorized business assets based on multi-source logs, as illustrated in an embodiment of this application. Figure 1 As shown, this method for discovering unauthorized business assets based on multi-source logs includes the following steps: S101, the electronic device determines the first network entity based on heterogeneous security logs from different data sources.

[0033] In this application embodiment, an independent data source refers to a data source that is independent of each other in terms of technical architecture, generation logic, and observation perspective, and does not derive from each other. The security logs generated by different independent data sources have different data structures and exhibit heterogeneity. For example, different independent data sources may include, but are not limited to, at least two of the following: bastion hosts, domain controllers, command-line tool network statistics (Netstat) output, endpoint detection and response (EDR) platforms, firewalls, network address translation (NAT) devices, web servers, and databases.

[0034] In some possible implementations, such as Figure 2 As shown, step S101 specifically includes: S1011 collects various heterogeneous security logs from different data sources on the Security Information and Event Management (SIEM) platform.

[0035] In this embodiment, the various heterogeneous security logs include, but are not limited to, authentication logs, host connectivity logs, network session logs, and application service logs. The data sources cover the identity, network, host, and application layers, ensuring multi-dimensional observation and avoiding blind spots from a single data source.

[0036] In this embodiment, the identity authentication log is used to record user login information, the host connectivity log is used to record the host's network connection information and service port, the network session log is used to record the details of communication sessions between IPs, and the application service log is used to record service access behavior.

[0037] Within this category, security logs originate from one or more independent data sources. For example, authentication logs may originate from, but are not limited to, bastion hosts and domain controllers; host connectivity logs may originate from, but are not limited to, Netstat echoes and EDR network events; network session logs may originate from, but are not limited to, firewalls and NAT devices; and application service logs may originate from, but are not limited to, web servers and databases.

[0038] S1012, identify heterogeneous identifiers from different data sources that belong to the same reference network entity in the above-mentioned multiple heterogeneous security logs, associate different heterogeneous identifiers of the reference network entity, and assign a unique identifier to the reference network entity.

[0039] In this embodiment, a logical entity that is jointly pointed to by one or more unique network identifiers and possesses persistent and observable behavioral characteristics is a network entity (persistent and observable behavioral characteristics can be understood as the number of observable log data it generates being greater than or equal to a preset number, such as 5). For example, a network entity can be, but is not limited to, a physical server, virtual machine, container, network device (such as a switch or router), or user terminal (such as a laptop). The aforementioned reference network entity can be any one of the various heterogeneous security logs mentioned above.

[0040] In some possible implementations, step S1012 specifically includes: 1) If it is determined that the reference IP address in the security log belongs to the IP address in the company's NAT address pool, the internal real IP corresponding to the reference IP address is resolved to determine the set of IP address aliases of the same network entity. The reference IP address is any IP address in any security log that has not been included in the standardized processing.

[0041] Specifically, if the IP address in the log belongs to the company's NAT address pool, the electronic device queries the NAT device's record at the same time to resolve the corresponding internal real IP. In this way, internal and external network addresses are uniformly mapped to internal entities, avoiding the misidentification of the same server after NAT translation as two different assets.

[0042] 2) Convert all hostnames in the security log to a uniform uppercase and lowercase letter format, remove suffixes, and then compare them to identify the set of host aliases of the same network entity. The uniform uppercase and lowercase letter format is either lowercase or uppercase English.

[0043] For example, 'WEB-SRV-01', 'web-srv-01.internal.com', and 'web-srv-01' will be recognized as pointing to the same hostname 'web-srv-01'.

[0044] 3) Convert all MAC addresses in the security log to a uniform uppercase and lowercase letter format, remove delimiters, and then compare them to identify the set of MAC address aliases of the same network entity.

[0045] For example, 'aa:bb:cc:11:22:33' and 'AA-BB-CC-11-22-33' will be recognized as pointing to the same MAC device.

[0046] 4) Based on the stable mapping relationship in the security log and asset management system, obtain the pairwise association relationship between IP address, hostname and MAC address.

[0047] For example, the pairwise relationships between IP addresses, hostnames, and MAC addresses can be obtained by utilizing dynamic host configuration protocol (DHCP) logs, address resolution protocol (ARP) tables, or stable mapping relationships in an asset management system.

[0048] As another example, raw, unprocessed data collected from various data sources includes, but is not limited to: firewall logs: {raw_ip: '203.0.113.5', ...}, domain controller logs: {raw_hostname: 'WEB-SRV-01', ...}, and Netstat logs from internal hosts: {raw_ip: '192.168.1.10', raw_hostname: 'web-srv-01.internal.com', raw_mac: '00:1B:44:11:3A:B7', ...}. The logs from internal hosts contain the relationships between IP addresses, hostnames, and MAC addresses.

[0049] 5) Merge related identifiers into the same identifier information of the reference network entity, create a unique identifier for the reference network entity, and determine the heterogeneous identifier set of the reference network entity, which includes the IP address alias set, hostname alias set, and MAC address alias set of the reference network entity.

[0050] As an example, the standardized identifier for a reference network entity is “Entity_ID: {ip_set, hostname_set, mac_set}”, where Entity_ID is the unique identifier of the reference network entity, and ip_set, hostname_set, and mac_set are the sets of IP address aliases, hostname aliases, and MAC address aliases of the reference network entity, respectively.

[0051] Based on this, a rules engine is used to handle complex scenarios, ensuring the uniqueness and accuracy of entities and laying the foundation for subsequent association analysis.

[0052] S1013 constructs an asset behavior knowledge graph using network entities as nodes and communication, authentication, or access relationships between network entities as edges.

[0053] For example, electronic devices extract relationship edges (such as communication, authentication, and access) from logs and attach metadata (metadata may include, but is not limited to, time windows, frequency, protocols, ports, etc., where time windows are used to record the timestamps of the first and last observed interactions between two entities, reflecting continuous communication). For instance, by combining firewall logs (src_ip accessing dst_ip) and authentication logs (user login hostname), the association chain [User]→[Login]→[Hostname]→[Running]→[Service]→[Accessed]→[src_ip] can be inferred.

[0054] In some possible implementations, the first network entity is any node in the asset behavior knowledge graph. Alternatively, in other possible implementations, the electronic device may directly determine the first network entity based on the extracted reference network entity and store the relevant information of the extracted reference network entity (including the entity's identifier set, the interaction relationships between entities, and the metadata of the interaction relationships), without drawing the asset behavior knowledge graph. This paper does not limit this approach.

[0055] S102, the electronic device determines whether a first network entity exists in the configuration management database CMDB.

[0056] If not, continue with step S103. If yes, it means that the first network entity is a legitimate entity, and the relevant operations on the current first network entity are terminated. Alternatively, it can be understood as skipping the relevant operations on the current first network entity and continuing to execute step S103 and subsequent operations on another first network entity.

[0057] S103, if the electronic device determines that the first network entity does not exist in the CMDB, the first network entity is determined to be a suspicious network entity.

[0058] In this embodiment, the CMDB is used to record known network entity assets that have been verified and governed by business processes. Suspicious network entities that are not present in the CMDB can also be understood as unknown network entities or unknown assets.

[0059] S104, the electronic device determines whether the suspicious network entity appears in at least N independent data sources, whether its activity within a preset time window meets a preset persistence condition, and whether a service port exists, where N is greater than or equal to 2.

[0060] If yes, then execute S105; otherwise, execute S106.

[0061] S105, if the electronic device determines that the suspicious network entity is a persistent unauthorized business asset when it is determined that the suspicious network entity appears in at least N independent data sources, its activity within a preset time window meets a preset continuity condition, and a service port exists.

[0062] As an example, each independent data source has a unique identifier. During the network entity resolution process (step S1012), when a log entry is parsed into an Entity_ID, the data source identifier of that log entry is recorded. Based on this, the set of independent data sources where each network entity appears (i.e., the number of different data source identifiers) can be counted. As an example, behavioral analysis is performed on network entity nodes in the electronic device asset behavior knowledge graph. This involves obtaining the node's own service port set using Netstat, extracting the node's active time periods based on edge attributes and log data, and extracting its stable communication counterparts based on edge connections. For instance, the preset time window is 7 days, and the preset persistence conditions include, but are not limited to: the suspicious network entity remaining active within the preset time window (e.g., the set of all values ​​for the time attribute in the edge attributes, spanning the preset time window, and log data showing communication, login, or authentication behaviors for 5 out of the 7 days).

[0063] S106, if the electronic device determines that the suspicious network entity does not appear in at least N independent data sources, or its activity within a preset time window does not meet the preset continuity condition, or there is no service port, the suspicious network entity does not belong to the continuous unauthorized business assets.

[0064] The unauthorized business asset discovery method based on multi-source logs provided in this application identifies suspicious targets by comparing asset behavior knowledge graphs with CMDB. Then, by using multiple independent data source conditions (ensuring that suspicious network entities exist in multiple independent data sources, are seen by multiple data sources, indicating a high probability of their actual existence, and avoiding circular arguments from different logs from the same data source), activity persistence conditions (ensuring that assets are persistent), and service port conditions (providing effective services), suspicious target entities related to short-lived temporary connections (such as temporary IPs) are excluded, accurately identifying persistent unauthorized business assets, reducing the false positive rate of unauthorized business asset discovery results, and improving identification accuracy.

[0065] In some possible implementations, after step S102 above, the method further includes: the electronic device calculating a comprehensive confidence score that the suspicious network entity belongs to an unauthorized asset.

[0066] For example, an electronic device calculates a comprehensive confidence score for a suspicious network entity, including: 1) Determine the first confidence score based on the amount of evidence corresponding to the unauthorized business assets.

[0067] The evidence count is the number of distinct data source categories in which unauthorized business assets appear in heterogeneous security logs.

[0068] For example, a piece of evidence with 1 piece of evidence corresponds to a confidence score of 0, which may be a false positive or a temporary connection. A piece of evidence with 2 pieces of evidence corresponds to a confidence score of basically credible (e.g., 0.6 points), which requires verification from other dimensions. A piece of evidence with 3 pieces of evidence corresponds to a confidence score of highly credible (e.g., 0.8 points), which is strong evidence support. A piece of evidence with 4 or more pieces of evidence corresponds to a confidence score of very credible (e.g., 1.0 points), which is confirmed from multiple dimensions.

[0069] 2) Determine the second confidence score based on the frequency and regularity of unauthorized business assets' activities within a preset time window.

[0070] For example, the second confidence score is equal to the weighted sum of the active days ratio and the active regularity ratio. The active regularity ratio can be the ratio of the longest consecutive active days to the total number of days, and the total number of days is the aforementioned preset time window.

[0071] 3) Determine the third confidence score based on the continuity of the service ports opened by unauthorized business assets.

[0072] For example, a confidence table for common service ports is defined, and port confidence scores are determined based on this table. Specifically, high confidence scores (e.g., 0.9 to 1.0) are configured for critical business service ports (e.g., common HTTP port 80, common HTTPS port 443, common MySQL ports 3306 and 1433), while medium-high confidence scores (e.g., 0.6 to 0.8) are configured for common application service ports (e.g., common FTP port 21, common telnet port 23, common DNS port 25). Other ports are configured with low confidence scores (representing temporary ports or client ports). Furthermore, service port stability is considered; for example, a stability confidence score bonus is determined based on the service port's listening duration. Finally, the third confidence score is determined by a weighted sum of the port confidence score and the port stability confidence score.

[0073] In this embodiment, the confidence level reflects not only the credibility of being considered an unauthorized business asset, but also the potential harm to the organization should the suspicious network entity encounter problems (such as intrusion or vulnerabilities). Based on this, this solution distinguishes between critical business service ports and commonly used application server ports, defining different confidence levels for each based on their level of business impact. The greater the business impact, the higher the confidence level, as protecting service ports with the greatest business impact yields the highest return on security investment. Critical business services, as the core of the business, processing highly sensitive data, and affecting the entire organization or multiple departments, are given higher confidence levels. Common application services, as business support, processing less sensitive data, and affecting specific teams or individual workflows, are given medium to high confidence levels. This ensures that the security team's limited resources can be prioritized for the most important and dangerous assets, improving the detection sensitivity of high-value targets while reducing false positives against low-risk targets.

[0074] 4) Determine the overall confidence score of the suspicious network entity based on the first confidence score, the second confidence score, and the third confidence score.

[0075] For example, the overall confidence score of a suspicious network entity is determined by a weighted sum of the first confidence score, the second confidence score, and the third confidence score. For instance, the weights for the first confidence score, the second confidence score, and the third confidence score are 0.4, 0.35, and 0.25, respectively.

[0076] When issuing a work order to the asset manager to standardize the corresponding unauthorized business assets, the electronic device can carry the comprehensive confidence score of the unauthorized business assets.

[0077] It should be noted that the step of determining the overall confidence score of a suspicious network entity as an unauthorized business asset can be performed after step S103 (to save unnecessary calculations) or in parallel with step S103. This article does not limit this step.

[0078] In some possible implementations, such as Figure 3 As shown, after step S103 above, the electronic device also performs the following operations: S107, Electronic devices determine the comprehensive risk value of a suspicious network entity based on the degree of connection between the suspicious network entity and the preset core assets, the degree of abnormality of the authentication behavior of the suspicious network entity, the exposure risk of the services related to the suspicious network entity, and whether the suspicious network entity belongs to the malicious network entity indicated in the threat intelligence source.

[0079] As an example, step S107 specifically includes: 1) Calculate the degree of connection between suspicious network entities and known core assets based on graph algorithms, and determine the first risk value based on the degree of connection.

[0080] Among them, the known core assets are the preset core assets.

[0081] For example, a graph algorithm is used to determine the shortest path from the target entity to each core asset. If there is no connected path, the distance is infinite and the density score is 0. If a connected path exists, the shortest distance is converted into a density score (the closer the distance, the higher the density). For example, an exponential decay function is used to convert the shortest distance into a density score, such as a distance of 1 → density score of 1.0, a distance of 2 → density score of 0.5, and a distance of 3 → density score of 0.25.

[0082] For example, the first risk value of a suspicious network entity can be determined by weighted summation of the density scores of each reachable core asset among the core assets reachable by the suspicious network entity. For instance, the top-ranked (or tied for first) reachable core asset in descending density score is assigned a first weight; the top three reachable core assets with the largest density scores among the remaining assets are assigned a second weight; and the remaining reachable core assets are assigned a third weight, with the first weight being greater than the second weight, and the second weight being greater than the third weight. For example, the first, second, and third weights could be 0.6, 0.3, and 0.1, respectively.

[0083] 2) Based on the baseline of individual historical login behavior or the baseline of group login behavior, assess the deviation of the login behavior of suspicious network entities in terms of time, location and frequency, and determine the second risk value based on the deviation.

[0084] For example, behavioral baselines include login time pattern baselines, geographic location baselines, and frequency pattern baselines. For instance, deviations from the time pattern baseline may include hourly distribution deviations (e.g., based on historical or group data statistics to obtain the hourly login probability distribution within a 24-hour period; the lower the probability of the current login hour, the higher the deviation), and / or weekday / non-weekday pattern deviations. Geographic location baseline deviations may include location distance deviations and / or VPN usage pattern deviations. Frequency pattern baseline deviations may include daily login frequency deviations and / or login failure count deviations. Finally, the second risk value is determined based on a weighted sum of the time, location, and frequency anomalies.

[0085] 3) Determine the third risk value based on whether there is known vulnerability information on the service ports opened by the suspicious network entity.

[0086] For example, electronic devices collect service information such as service types (e.g., web services, databases, remote services) and software versions provided by suspicious network entities based on edge attributes (protocols, ports), host connectivity logs, etc., in an asset behavior knowledge graph. This service information is then compared with vulnerability information published in public vulnerability databases (e.g., NVD, CVE), commercial vulnerability intelligence sources, and industry-specific vulnerability announcements to determine whether the services exposed by the suspicious network entity contain known high-risk vulnerabilities (e.g., unpatched vulnerabilities). The specific risk value settings can be determined based on the specific design; this document does not impose any limitations on them.

[0087] 4) Determine the fourth risk value based on whether the suspicious network entity exists in an internal or external threat intelligence source.

[0088] For example, this fourth risk value is determined by checking whether the IP address, domain name, or other identifiers of suspicious network entities appear in threat intelligence sources. The specific risk value settings can be determined based on the specific design, and this article does not impose any limitations on them.

[0089] 5) Based on the first risk value, the second risk value, the third risk value, and the fourth risk value, determine the comprehensive risk value of the suspicious network entity.

[0090] S108, the electronic device determines whether the overall risk value of the suspicious network entity is greater than or equal to a preset risk threshold.

[0091] In this embodiment of the application, the malicious asset and the unauthorized business asset determined in step S105 may be the same or different suspicious network entities.

[0092] If yes, then execute S109; otherwise, execute S110.

[0093] S109, Electronic devices determine that a suspicious network entity is a malicious asset.

[0094] For example, the highest risk value is 100, and the preset risk threshold is 80.

[0095] S110, Electronic devices determine that the suspicious network entity is not a malicious asset.

[0096] It should be noted that steps S104-S106 and steps S107-S110 can be executed simultaneously or sequentially, and the order is not limited. This article does not impose any restrictions on this.

[0097] This approach allows for the simultaneous determination of both business and security attributes of the same unknown asset. On one hand, it enables timely potential threat assessment of discovered "unauthorized business assets."

[0098] On the other hand, this method not only identifies suspicious network entities belonging to "unauthorized business assets," but also malicious entities that are not actually business assets—that is, purely "malicious attack nodes." For example, C2 servers, Trojans, lateral movement tools, etc., deployed by attackers on the internal network after successful intrusion are not deployed for business purposes and therefore do not meet the conditions for continuous activity and service port stability (i.e., they are not unauthorized business assets). However, they exhibit obvious malicious behavior characteristics and are therefore malicious attack nodes. This greatly expands the system's threat detection scope, no longer limited to discovering business assets in management blind spots, but enabling the discovery of "pure malware," thus achieving a fusion of asset management and attack detection.

[0099] On the other hand, the accurate identification of unauthorized business assets and purely malicious attack nodes indirectly and precisely eliminates transient, temporary connection interference items from suspicious network entities, thereby reducing false alarms and saving security operation resources. For example, an employee's personal mobile phone connecting to the company WiFi, a supplier's laptop for temporary debugging, or a short-lived test container in the cloud. These entities do not exist in the CMDB and may leave records in some logs, but they lack the persistence and service characteristics of business assets, and their behavior does not exhibit malice. After risk assessment proves they are harmless, the system can classify them as low-priority transient nodes and automatically filter them, allowing the security team to focus entirely on truly risky assets (shadow and malicious nodes), significantly improving the efficiency and accuracy of security operations.

[0100] Please refer to Figure 4 In some possible implementations, after steps S106 and S110 described above, the electronic device further performs the following steps: S111, if an electronic device determines that a suspicious network entity is an unauthorized business asset and is not a malicious asset, it determines that the suspicious network entity is a non-malicious shadow asset.

[0101] S112, if an electronic device determines that a suspicious network entity is an unauthorized business asset and is a malicious asset, the electronic device determines that the suspicious network entity is a malicious shadow asset.

[0102] In this application embodiment, malicious shadow assets can be understood as assets originally deployed for business purposes but subsequently compromised.

[0103] Traditional solutions either treat malicious shadow assets as ordinary shadow IT (underestimating their risk) or simply as malicious nodes (but without knowing their origin). This solution clearly distinguishes between assets "originating internally but with malicious intent," enabling security teams to deeply understand their dual-risk nature and take the most urgent remedial measures.

[0104] S113, if an electronic device determines that a suspicious network entity is a malicious attack node when it determines that the suspicious network entity does not belong to unauthorized business assets and belongs to malicious assets.

[0105] In this application embodiment, a malicious attack node can be understood as malware or a C2 server that is directly implanted by the attacker and is unrelated to business operations.

[0106] S114, if an electronic device determines that a suspicious network entity is a non-malicious temporary node, provided that the suspicious network entity is neither an unauthorized business asset nor a malicious asset.

[0107] S115, electronic devices trigger immediate blocking and isolation operations against malicious shadow assets and malicious attack nodes through the Security Orchestration Automation and Response SOAR platform.

[0108] S116. For non-malicious shadow assets, electronic devices shall notify the asset manager through the work order system for standardized processing.

[0109] This approach completely eliminates ambiguity in the judgment, ensuring that every discovered unknown network entity can be clearly classified into one of the four categories, providing a unique and clear input for differentiated responses.

[0110] In this embodiment, for malicious shadow assets and malicious attack nodes, electronic devices can trigger immediate blocking and isolation operations through the Security Orchestration Automation and Response (SOAR) platform; for non-malicious shadow assets, electronic devices can notify the asset manager through the work order system for standardized processing.

[0111] The following are two application examples of this solution: Scenario 1: Discovery of the internal threat attack surface In a compliance audit of a financial institution, the methodology described in this solution was applied to analyze a week's worth of logs within the SIEM. The system discovered that IP address 10.8.5.22 was not registered in the CMDB, and that this IP address appeared in the bastion host login logs, core application server Netstat connection data, and database audit logs. Behavioral profiling showed that it regularly accessed multiple core servers. Upon verification, this asset was found to be an unauthorized automated operations and maintenance node deployed by a team, posing risks of weak credentials and excessive privileges. This enabled the early detection of "shadow IT."

[0112] Scenario 2: Lateral movement detection in attack and defense drills In the red team / blue team exercise, the attacker deployed a C2 server (IP: 172.20.8.15) on the internal network. The defender's SIEM system, using this approach, analyzed in real time the connection strength between suspicious network entities and preset core assets, the anomaly level of the suspicious network entity's authentication behavior, the exposure risk of services related to the suspicious network entity, and whether the suspicious network entity belonged to the malicious network entities indicated in the threat intelligence source. It also correlated and analyzed abnormal outbound connections from the endpoint EDR, abnormal session logs from the firewall, and abnormal authentication events from the domain controller. Within 20 minutes, it identified the communication behavior of the unregistered C2 server with servers in multiple network segments and automatically generated high-risk alerts, effectively blocking the attack chain.

[0113] Verification shows that the accuracy of this method in detecting unauthorized shadow assets and malicious attack nodes is > 98.5% (manually verified), the false positive rate is < 1.5%, and the impact on the basic performance of the SIEM platform is < 5%.

[0114] This application also provides an unauthorized business asset discovery system based on multi-source logs, such as... Figure 5 As shown, the system includes: Entity determination module 501 is used to determine the first network entity based on heterogeneous security logs from different data sources; The suspicious asset determination module 502 is used to determine the first network entity as a suspicious network entity if it is determined that the first network entity does not exist in the configuration management database CMDB. The unauthorized business asset determination module 503 is used to determine that a suspicious network entity is an unauthorized business asset that is not included in management when it is determined that the suspicious network entity appears in at least N independent data sources, its activities within a preset time window meet preset continuity conditions, and a service port exists.

[0115] In some possible implementations, such as Figure 6 As shown, the above system also includes: Risk assessment module 504 is used to determine the comprehensive risk value of a suspicious network entity based on the degree of connection between the suspicious network entity and the preset core assets, the degree of abnormality of the authentication behavior of the suspicious network entity, the exposure risk of the services related to the suspicious network entity, and whether the suspicious network entity belongs to the malicious network entity indicated in the threat intelligence source. The malicious asset assessment module 505 is used to determine whether the suspicious network entity is a malicious asset based on the comprehensive risk value of the suspicious network entity.

[0116] In some possible implementations, the above system also includes: The suspicious entity classification unit 506 is used to determine, when it is determined that the suspicious network entity belongs to an unauthorized business asset and is not a malicious asset, that the suspicious network entity belongs to a non-malicious shadow asset; when it is determined that the suspicious network entity belongs to an unauthorized business asset and is a malicious asset, that the suspicious network entity belongs to a compromised malicious shadow asset; when it is determined that the suspicious network entity does not belong to an unauthorized business asset and is a malicious asset, that the suspicious network entity belongs to a malicious attack node unrelated to business; and when it is determined that the suspicious network entity does not belong to an unauthorized business asset and is not a malicious asset, that the suspicious network entity belongs to a non-malicious temporary node.

[0117] In some possible implementations, the aforementioned risk assessment module 504 is specifically used to calculate the degree of connection between the suspicious network entity and known core assets based on graph algorithms, and determine a first risk value based on the degree of connection; to assess the deviation of the suspicious network entity's login behavior in terms of time, location, and frequency based on historical login behavior baselines or group login behavior baselines, and determine a second risk value based on the deviation; to determine a third risk value based on whether there is known vulnerability information on the service ports opened by the suspicious network entity; to determine a fourth risk value based on whether the suspicious network entity exists in internal or external threat intelligence sources; and to determine a comprehensive risk value for the suspicious network entity based on the first, second, third, and fourth risk values.

[0118] In some possible implementations, the above system also includes: The unauthorized business asset confidence scoring module 507 is used to determine a first confidence score based on the number of pieces of evidence corresponding to the suspicious network entity, wherein the number of pieces of evidence is the number of categories of independent data sources in which the unauthorized business asset appears in the heterogeneous security log; determine a second confidence score based on the frequency and regularity of the suspicious network entity's activities within a preset time window; determine a third confidence score based on the persistence of the service ports opened by the suspicious network entity; and determine a comprehensive confidence score that the suspicious network entity belongs to the unauthorized business asset based on the first confidence score, the second confidence score, and the third confidence score.

[0119] In some possible implementations, the entity determination module 501 mentioned above specifically includes: The data aggregation submodule is used to collect various heterogeneous security logs from the Security Information and Event Management (SIEM) platform; The entity parsing submodule is used to identify heterogeneous identifiers from different data sources that belong to the same reference network entity in the various heterogeneous security logs, associate different heterogeneous identifiers of the reference network entity, and assign a unique identifier to the reference network entity. The graph construction submodule is used to construct the asset behavior knowledge graph using network entities as nodes and communication relationships, authentication relationships, or access relationships between network entities as edges.

[0120] In some possible implementations, the aforementioned entity parsing submodule specifically includes: The NAT processing subunit is used to resolve the internal real IP corresponding to the reference IP address when it is determined that the reference IP address in the security log belongs to the IP address in the company's NAT address pool, so as to determine the set of IP address aliases for the same network entity. The alias resolution subunit is used to convert all hostnames in the security log into a uniform uppercase and lowercase letter format, remove suffixes, and then compare them to identify the set of host aliases of the same network entity; and to convert all MAC addresses in the security log into a uniform uppercase and lowercase letter format, remove delimiters, and then compare them to identify the set of MAC address aliases of the same network entity. The association mapping subunit is used to obtain the pairwise associations between IP addresses, hostnames, and MAC addresses based on the stable mapping relationships in the security logs and asset management system. The node fusion subunit is used to merge identifiers with related relationships into the identification information of the same reference network entity, create a unique identifier for the reference network entity, and determine the heterogeneous identifier set of the reference network entity.

[0121] In some possible implementations, the above system also includes: The response triggering unit 508 is used to trigger immediate blocking and isolation operations for the malicious shadow assets and the malicious attack nodes through the Security Orchestration Automation and Response SOAR platform; and to notify the asset manager for standardized processing through the work order system for the non-malicious shadow assets.

[0122] This application also provides an apparatus for discovering unauthorized business assets based on multi-source logs, including a unit for executing any of the above-described methods for discovering unauthorized business assets based on multi-source logs.

[0123] In the embodiments of this application, any implementation method mentioned in the method embodiments is also applicable to the unauthorized business asset discovery system or device based on multi-source logs provided in this application. For specific execution steps, please refer to the description of the foregoing method embodiments, which will not be detailed here.

[0124] This application also provides an apparatus for discovering unauthorized business assets based on multi-source logs, including a processor, which is used to execute any of the above-described methods for discovering unauthorized business assets based on multi-source logs.

[0125] Please refer to Figure 7 This is a schematic diagram of another unauthorized business asset discovery device based on multi-source logs provided in an embodiment of this application, as shown below. Figure 7 As shown, the unauthorized business asset discovery device 700 based on multi-source logs may include: at least one processor 701, such as a CPU, at least one communication interface 703, a memory 704, and at least one communication bus 702. The communication bus 702 is used to enable communication between these components. The communication interface 703 may optionally include a standard wired interface, a wireless interface (such as a Wi-Fi interface or a Bluetooth interface), etc. The memory 704 may be a high-speed RAM memory or a non-volatile memory, such as at least one disk storage device. Optionally, the memory 704 may also be at least one storage device located remotely from the aforementioned processor 701. Figure 7 As shown, the memory 704, which serves as a computer storage medium, may include an operating system, a network communication module, and program instructions.

[0126] exist Figure 7 In the multi-source log-based unauthorized business asset discovery device 700 shown, the processor 701 can be used to load program instructions stored in the memory 704 and specifically execute any of the multi-source log-based unauthorized business asset discovery methods in the above method embodiments.

[0127] It should be noted that the specific execution process can be found in the detailed description of the above method embodiments, and will not be elaborated here.

[0128] For specific execution steps, please refer to the description of the foregoing method embodiments, which will not be detailed here.

[0129] This application also provides a computer storage medium that can store multiple instructions. These instructions are adapted to be loaded and executed by a processor. The method for discovering unauthorized business assets based on multi-source logs provided in this application is described in detail below. For the specific execution process, please refer to the detailed description of the method embodiments shown above.

[0130] This application also provides a computer program product containing instructions that, when run on an electronic device, cause the electronic device to execute the method steps of the method embodiments shown above.

[0131] This application also provides a chip module, including a transceiver component and a chip, wherein the chip is used to execute the method steps of the above-described method embodiments.

[0132] It is understood that the unauthorized business asset discovery system based on multi-source logs, the unauthorized business asset discovery device based on multi-source logs, the computer storage medium, the computer program, the computer program product, and the chip provided above are all used to execute the method shown in any implementation of the corresponding aspect of the embodiments of this application. Therefore, the beneficial effects that can be achieved can be referred to the beneficial effects in the corresponding methods, and will not be detailed here.

[0133] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes the processes of the embodiments of the above methods.

[0134] The term "at least one" in this application refers to one or more items. "More than one item" means two or more items. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. Furthermore, it should be understood that although the terms "first," "second," etc., may be used to describe objects in this application, these objects should not be limited to these terms. These terms are only used to distinguish the objects from each other.

[0135] The terms “including” and “having” mentioned above, and any variations thereof, are intended to cover non-exclusive inclusion.

[0136] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for discovering unauthorized business assets based on multi-source logs, characterized in that, The method includes: The first network entity is determined based on heterogeneous security logs from different data sources. The first network entity is a logical subject that is commonly pointed to by one or more network identifiers. If it is determined that the first network entity does not exist in the configuration management database CMDB, the first network entity is determined to be a suspicious network entity. The CMDB is used to record known network entity assets that have been confirmed and governed by business procedures. If the suspicious network entity appears in at least N independent data sources, its activity within a preset time window meets a preset persistence condition, and a service port exists, the suspicious network entity is determined to be a persistent unauthorized business asset, where N is greater than or equal to 2.

2. The method as described in claim 1, characterized in that, After determining that the first network entity is a suspicious network entity, the method further includes: The comprehensive risk value of the suspicious network entity is determined based on the degree of connection between the suspicious network entity and the preset core assets, the degree of abnormality of the authentication behavior of the suspicious network entity, the exposure risk of the services related to the suspicious network entity, and whether the suspicious network entity belongs to the malicious network entity indicated in the threat intelligence source. Based on the comprehensive risk value and preset risk threshold of the suspicious network entity, it is determined whether the suspicious network entity is a malicious asset, wherein the malicious asset is the same as or different from the unauthorized business asset.

3. The method as described in claim 2, characterized in that, After determining whether a suspicious network entity constitutes a malicious asset based on its comprehensive risk value, the method further includes: If it is determined that the suspicious network entity is an unauthorized business asset and not a malicious asset, then the suspicious network entity is determined to be a non-malicious shadow asset. If it is determined that the suspicious network entity is an unauthorized business asset and a malicious asset, then the suspicious network entity is determined to be a compromised malicious shadow asset. If it is determined that the suspicious network entity does not belong to unauthorized business assets and belongs to malicious assets, then the suspicious network entity is determined to be a malicious attack node unrelated to business. If it is determined that the suspicious network entity is neither an unauthorized business asset nor a malicious asset, then the suspicious network entity is determined to be a non-malicious temporary node.

4. The method as described in claim 2 or 3, characterized in that, The determination of the comprehensive risk value of a suspicious network entity based on the degree of connection between the suspicious network entity and preset core assets, the degree of abnormality in the authentication behavior of the suspicious network entity, the exposure risk of the services related to the suspicious network entity, and whether the suspicious network entity belongs to the malicious network entity indicated in the threat intelligence source, includes: The degree of connection between the suspicious network entity and the known core assets is calculated based on the graph algorithm, and a first risk value is determined based on the degree of connection. Based on historical login behavior baselines or group login behavior baselines, assess the deviation of the login behavior of the suspicious network entity in terms of time, location, and frequency, and determine a second risk value based on the deviation. A third risk value is determined based on whether the service ports opened by the suspected network entity contain known vulnerabilities. A fourth risk value is determined based on whether the suspicious network entity exists in an internal or external threat intelligence source. Based on the first risk value, the second risk value, the third risk value, and the fourth risk value, the comprehensive risk value of the suspicious network entity is determined.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Based on the number of pieces of evidence corresponding to the suspicious network entity, a first confidence score is determined, wherein the number of pieces of evidence is the number of categories of independent data sources in which the unauthorized business asset appears in the heterogeneous security log; A second confidence score is determined based on the frequency and regularity of the activities of the suspicious network entities within a preset time window. A third confidence score is determined based on the persistence of the service ports opened by the suspected network entity. Based on the first confidence score, the second confidence score, and the third confidence score, a comprehensive confidence score is determined to indicate that the suspicious network entity belongs to the unauthorized business asset.

6. The method according to any one of claims 1 to 5, characterized in that, The determination of the first network entity based on heterogeneous security logs from different data sources includes: Collect various heterogeneous security logs from the Security Information and Event Management (SIEM) platform. These heterogeneous security logs include: authentication logs, host connectivity logs, network session logs, and application service logs. Among them, security logs of the same category come from one or more independent data sources. Identify heterogeneous identifiers from different data sources that belong to the same reference network entity in the various heterogeneous security logs, associate different heterogeneous identifiers of the reference network entity, and assign a unique identifier to the reference network entity, wherein the reference network entity is any one of the various heterogeneous security logs; Using network entities as nodes and communication, authentication, or access relationships between network entities as edges, an asset behavior knowledge graph is constructed, where the first network entity is any node in the asset behavior knowledge graph.

7. The method as described in claim 6, characterized in that, The process of identifying heterogeneous identifiers from different data sources belonging to the same reference network entity in the various heterogeneous security logs, associating different heterogeneous identifiers of the reference network entity, and assigning a unique identifier to the reference network entity includes: If it is determined that the reference IP address in the security log belongs to the IP address in the company's NAT address pool, the internal real IP corresponding to the reference IP address is parsed out to determine the set of IP address aliases of the same network entity. The reference IP address is any IP address in any security log that has not been included in the standardized processing. All hostnames in the security log are converted to a uniform uppercase and lowercase letter format, and the suffixes are removed before comparison to identify the set of host aliases of the same network entity. The uniform uppercase and lowercase letter format is either lowercase English or uppercase English. All MAC addresses in the security logs are converted to a uniform uppercase and lowercase letter format and delimiters are removed before comparison to identify the set of MAC address aliases of the same network entity. Based on the stable mapping relationships in the security logs and asset management system, obtain the pairwise associations between IP addresses, hostnames, and MAC addresses; Identifiers with related relationships are merged into the identification information of the same reference network entity, and a unique identifier is created for the reference network entity. The heterogeneous identifier set of the reference network entity is determined, including the IP address alias set, hostname alias set, and MAC address alias set of the reference network entity.

8. The method as described in claim 3, characterized in that, The method further includes: For the malicious shadow assets and malicious attack nodes, immediate blocking and isolation operations are triggered through the Security Orchestration Automation and Response SOAR platform; For the aforementioned non-malicious shadow assets, the asset manager is notified through the work order system to carry out standardized processing.

9. A system for discovering unauthorized business assets based on multi-source logs, characterized in that, The system includes: The entity determination module is used to determine a first network entity based on heterogeneous security logs from different data sources. The first network entity is a logical subject that is commonly pointed to by one or more network identifiers. The suspicious asset determination module is used to determine that the first network entity is a suspicious network entity when it is determined that the first network entity does not exist in the configuration management database CMDB. The CMDB is used to record known network entity assets that have been confirmed and governed by business. The unauthorized business asset determination module determines that the suspicious network entity is an unauthorized business asset not included in management if it is determined that the suspicious network entity appears in at least N independent data sources, its activity within a preset time window meets a preset continuity condition, and a service port exists. The N is greater than or equal to 2.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program, which, when executed, performs the method according to any one of claims 1 to 8.

Images